Sony BMG Music Entertainment

Text (OCR of the scan at left; may contain errors)

IN THE MATTER OF SONY BMG MUSIC ENTERTAINMENT CONSENT ORDER, ETC. , IN REGARD TO ALLEGED VIOLATIONS OF SEC. 5 OF THE FEDERAL TRADE COMMISSION ACT Docket C-4195; File No. 062 3019 Complaint, June 28, 2007 — Decision, June 28, 2007 This consent order addresses software that Sony BMG Music Entertainment embedded on its music CDs that restricted use of the audio files and also caused security vulnerabilities on computers. The order, among other things, requires Sony BMG to clearly disclose on its packaging that a CD will install software, has copying limits, and can only be used on certain playback devices. The order bars the respondent from installing content protection software from a CD without consumers’ authorization, and requires clear disclosure on the packaging if a CD can be used only by the installation of such software. The order prohibits the respondent from using any information it had collected through enhanced connectivity CDs prior to this order for any marketing purpose. After the date of the order, the respondent is prohibited from collecting any information using its enhanced connectivity CDs unless it obtains consumers’ consent to do so, and must disclose this condition on the product packaging. The order also prohibits Sony BMG from preventing consumers from readily locating or removing the software from the computer and requires the respondent to provide a reasonable means to uninstall such software. The respondent must provide free uninstall tools and patches for XCP and MediaMax 5.0 on its website, and must notify consumers of the XCP and MediaMax 5.0 vulnerabilities and tell them how to fix their computers. In the case of MediaMax 5.0 CDs, Sony BMG must disclose on the packaging that, if used on a computer, these CDs will create security vulnerabilities that consumers can eliminate with a free patch from the respondent’s website, and that these CDs will establish an Internet connection through which Sony BMG will collect information from, and send back advertising to, the computer. In addition, the order requires that Sony BMG extend the time during which consumers may exchange CDs, and reimburse consumers up to $150 of their costs to repair computer damage resulting from their attempts to remove the XCP content protection software before an uninstall tool was readily available. VOLUME 143 Complaint Participants For the Commission: Matthew Daynard, Stacey Ferguson, and Tracy Shapiro.

For the Respondent: Jeremy Feigelson and Asim Rehman, Debevoise & Plimpton; and corporate counsel Jennifer Pariser. COMPLAINT The Federal Trade Commission, having reason to believe that SONY BMG Music Entertainment, a general partnership, has violated the provisions of the Federal Trade Commission Act, and it appearing to the Commission that this proceeding is in the public interest, alleges:

1. Respondent SONY BMG Music Entertainment (“respondent” or “SONY BMG”) is a Delaware general partnership with its principal office or place of business at 550 Madison Avenue, New York, New York 10022. SONY BMG distributes music CDs in the United States under various labels. 2. The acts and practices of respondent alleged in this complaint have been in or affecting commerce, as “commerce” is defined in Section 4 of the Federal Trade Commission Act. 3. Respondent has licensed, placed on over 100 music CD titles, and installed on consumers’ computers content protection software programs (also known in the music industry as “Digital Rights Management” or “DRM” software). SONY BMG used three types of DRM software on these CDs. SONY BMG first offered for sale CDs containing “XCP” software in April 2005. SONY BMG has sold approximately 3 million XCP CDs. A predecessor to SONY BMG first offered for sale CDs containing “MediaMax version 3.0” software in 2003, and in January 2005 SONY BMG offered for sale CDs containing “MediaMax version SONY BMG MUSIC ENTERTAINMENT 783 Complaint 5.0" software. SONY BMG has sold approximately 8.4 million MediaMax 3.0 CDs and 5.7 million MediaMax 5.0 CDs. Background 4. Unlike CDs that do not contain DRM software, the audio files on SONY BMG content-protected CDs cannot be accessed on a Windows-based computer’s CD drive unless the consumer installs additional software from those CDs, specifically SONY BMG’s DRM software.

5. In addition, in order to initially access the audio files and other digital content, all XCP CDs and MediaMax CDs require the use of a proprietary media player software program that is bundled with the CD (the “bundled media player”). Certain other SONY BMG music CDs contain a bundled proprietary media player, but no DRM software.

6. On the jewel case of respondent’s content-protected CDs, there is no adequate reference to the need to install DRM software before being able to access the CD’s content on a computer. Installation of DRM Software 7. When a user first inserts a content-protected CD into a computer, an End User License Agreement (“EULA”) appears, requiring the user to accept or reject its terms. Users must accept the EULA to access the audio files and other digital content on the CD.

8. If the user rejects the EULA, the CD automatically ejects from the computer and the user cannot access its content. However, in the case of MediaMax 5.0 CDs, certain files of that content protection software will be installed and remain on a user’s computer, even if the user rejects the EULA. VOLUME 143 Complaint 9. If the user accepts the EULA, the software is installed and becomes operational, and the user gains access to the audio files and other digital content on the CD.

Transmission of Information by the Bundled Media Player 10. The bundled media player runs directly from the CD, launches automatically after acceptance of the EULA, and is pre-set to display for the consumer an image of the artist whose work the CD contains. In addition, if the user’s computer is connected to the Internet, the media player on all XCP CDs, certain MediaMax 5.0 CDs, and other CDs that are not content-protected (together, “Enhanced Connectivity CDs”) establishes a connection with Internet servers. Through this connection, the user’s or proxy server’s Internet Protocol (“IP”) address and a numerical key identifying the album being played transmit from the consumer’s computer to the servers. The servers also register the date and time of the transmission. Based on the information received, the bundled media player retrieves updated images of artists and other targeted images, if any, as well as promotional messages and sends them to the user’s computer for display. 11. Respondent does not disclose to consumers, on the jewel case or otherwise prior to purchase, that a proprietary media player contained on the CDs will operate on the user’s computer to transmit information to SONY BMG, if the user’s computer is connected to the Internet, and that this information will be used to retrieve and send updated images of artists and other targeted images, if any, as well as promotional messages to the user’s computer for display.

Effects of the DRM Software and the Bundled Media Player 12. The XCP and MediaMax DRM software limit consumers’ use of the music CDs they have purchased by: (1) limiting to three the number of physical copies of the CD that the consumer can make directly from the CD using the computer; and (2) allowing the SONY BMG MUSIC ENTERTAINMENT 785 Complaint direct transfer of the CD’s audio files only to playback devices that use secure Windows formats and, in some cases, the Sony ATRAC format.

13. The XCP software contains a cloaking technology named “Network Control Manager” that hides the existence of the XCP software from the Windows Operating System. The cloaking technology creates a security vulnerability because malicious software that enters users’ computers can exploit the cloaking technology to conceal itself from the computers’ security software.

14. MediaMax 5.0 also creates a security vulnerability in users’ computers, known as a Aprivilege escalation vulnerability,” that could allow third parties who gain physical access to the computer but who have lower-privilege access to exercise full control over a consumer’s computer running the Windows operating system. The files creating the security vulnerability are installed before the user accepts or declines the EULA.

15. XCP and MediaMax software are difficult to locate on a user’s computer because: (1) neither XCP nor MediaMax software appears in the commonly accessed “Add/Remove Programs” utility in the Windows operating system; (2) XCP software is named “Plug and Play Device Manager” in the services registry key on users’ computers rather than being named “XCP” or ADRM” software; and (3) XCP software’s cloaking technology hides its existence from the Windows operating system and thus from security software. 16. XCP and MediaMax are difficult to remove from a user’s computer because: (1) an uninstall tool was not provided with these programs; and (2) prior to December 2005, to obtain an uninstall tool for either of these programs, users had to visit SONY BMG’s or the software vendor’s website, fill out a form that required the user to disclose her e-mail address, then wait for VOLUME 143 Complaint an e-mail, download additional software, and install a program that was designed to remove the files.

VIOLATIONS OF THE FTC ACT 17. Respondent has advertised, offered for sale, and sold music CDs containing XCP and MediaMax content protection software. Through the advertising, offering for sale, and sale of these music CDs, respondent has represented, expressly or by implication, that consumers will be able to use the CDs as they are commonly used on a computer: to listen to, transfer to playback devices, and copy the audio files contained on the CD for personal use. Respondent has failed to disclose, or has failed to disclose adequately, that the XCP and MediaMax CDs will: (1) install software on consumers’ computers; (2) through the installed software, limit to three the number of physical copies of the CD that the consumer can make directly from the CD using the computer; and (3) through the installed software, allow the direct transfer of the music files only to playback devices that use the secure Windows formats or the Sony ATRAC format. These facts would be material to consumers in their purchase or use of the CDs. Respondent’s failure to disclose these facts, in light of the representation made, was, and is, a deceptive practice.

18. Respondent has advertised, offered for sale, and sold certain music CDs that contain a bundled proprietary media player. Through the advertising, offering for sale, and sale of these music CDs, respondent has represented, expressly or by implication, that consumers will be able to listen to the music on these CDs on their computers. Respondent has failed to disclose, or has failed to disclose adequately, that, if consumers’ computers are connected to the Internet, the CDs’ bundled media player will establish a connection with Internet servers through which the user’s or proxy server’s Internet Protocol (“IP”) address and a numerical key identifying the album being played will be transmitted from the consumer’s computer to the servers, and that this information will be used to display images and/or promotional messages on SONY BMG MUSIC ENTERTAINMENT 787 Complaint consumers’ computers that are retrieved from those servers. These facts would be material to consumers in their purchase or use of the CDs. Respondent’s failure to disclose these facts, in light of the representation made, was, and is, a deceptive practice. 19. Through the means described in Paragraphs 6 through 9, respondent has caused the XCP and MediaMax 5.0 software to be installed on consumers’ computers without adequate notification and consent. As described in Paragraphs 13 and 14, the software has exposed consumers to security risks. Respondent’s practices have caused, or are likely to cause, substantial injury to consumers that is not outweighed by countervailing benefits to consumers or competition and is not reasonably avoidable by consumers. These practices were, and are, unfair acts or practices. 20. Through the means described in Paragraphs 7 through 9, respondent has caused the XCP and MediaMax 3.0 and 5.0 content protection software to be installed on consumers’ computers. As described in Paragraphs 15 and 16, consumers were not able to locate and/or remove this software through the use of reasonable efforts. Consumers have, individually or collectively, incurred substantial costs in locating and removing this software from their computers and in stopping its harmful effects. Among other things, if consumers manually removed the XCP software prior to the time that SONY BMG made an uninstall tool readily available, the software disabled the audio CD drive on the computer, rendering the consumer’s CD-ROM drive inoperable. Respondent’s practices have caused, or are likely to cause, substantial injury to consumers that is not outweighed by countervailing benefits to consumers or competition and is not reasonably avoidable by consumers. These practices were, and are, unfair acts or practices. 21. The acts and practices of respondent as alleged in this complaint constitute unfair or deceptive acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act.

VOLUME 143 Decision and Order THEREFORE, the Federal Trade Commission this twentyeighth day of June, 2007, has issued this complaint against respondent.

By the Commission.

DECISION AND ORDER The Federal Trade Commission having initiated an investigation of certain acts and practices of the Respondent named in the caption hereof, and the Respondent having been furnished thereafter with a copy of a draft of complaint which the Bureau of Consumer Protection proposed to present to the Commission for its consideration and which, if issued by the Commission, would charge the Respondent with violation of the Federal Trade Commission Act; and The Respondent, its attorneys, and counsel for the Commission having thereafter executed an agreement containing a consent order, an admission by the Respondent of all the jurisdictional facts set forth in the aforesaid draft complaint, a statement that the signing of the agreement is for settlement purposes only and does not constitute an admission by the Respondent that the law has been violated as alleged in such complaint, or that any of the facts as alleged in such complaint, other than jurisdictional facts, are true, and waivers and other provisions as required by the Commission’s Rules; and The Commission having thereafter considered the matter and having determined that it had reason to believe that the Respondent has violated the Act, and that complaint should issue stating its charges in that respect, and having thereupon accepted the executed consent agreement and placed such agreement on the SONY BMG MUSIC ENTERTAINMENT 789 Decision and Order public record for a period of thirty (30) days, and having duly considered the comments received from interested persons pursuant to Section 2.34 of its Rules, and having modified the Decision and Order in one respect, now in further conformity with the procedure prescribed in Section 2.34 of its Rules, the Commission hereby issues its complaint, makes the following jurisdictional findings, and enters the following order: 1. Respondent SONY BMG Music Entertainment is a Delaware general partnership with its principal office or place of business at 550 Madison Avenue, New York, New York 10022. 2. The Federal Trade Commission has jurisdiction of the subject matter of this proceeding and of the Respondents, and the proceeding is in the public interest.

ORDER DEFINITIONS For purposes of this order, the following definitions shall apply:

1. Unless otherwise specified, “respondent” shall mean SONY BMG Music Entertainment, its successors and assigns, and its officers, agents, representatives, and employees. 2. “Commerce” shall mean as defined in Section 4 of the Federal Trade Commission Act, 15 U.S.C. § 44.

3. “Clear[ly] and prominent[ly]” shall mean that: A. On or affixed to product packaging, the disclosure shall be in a type size and location sufficiently noticeable for an ordinary consumer to read and comprehend it, in print that contrasts with the background against which it appears. VOLUME 143 Decision and Order B. On the screen of a consumer’s computer, the disclosure shall be unavoidable and shall be presented prior to the consumer installing any content protection software or, if the disclosure is related to Internet connectivity, prior to causing any transmission to respondent about consumers, their computers, or their use of a covered product through Internet servers. The disclosure shall be of a size and shade, and shall appear on the screen for a duration, sufficient for an ordinary consumer to read and comprehend it. The disclosure shall be in understandable language and syntax.

Nothing contrary to, inconsistent with, or in mitigation of the disclosure shall be used on any advertising, product packaging, or computer screen.

4. “Content protection software” shall mean “XCP,” “MediaMax,” and any other software residing on a CD that acts to limit a consumer’s ability to copy or distribute the CD’s audio files or other digital content.

5. “Covered product” shall mean any audio compact disc (CD) intended for commercial release for which SONY BMG controls the master files used to produce the CD. 6. “Enhanced connectivity” shall mean a software feature on a covered product (usually contained in a media player) that permits or causes a computer playing the product while connected to the Internet to communicate information over the Internet about the consumer, the consumer’s computer, or his/her use of the covered product.

7. “Operating system” means the computer system software responsible for managing and controlling the computer’s hardware and computer resources and its basic operations, including providing a platform on which to download, install, and run any software program.

SONY BMG MUSIC ENTERTAINMENT 791 Decision and Order 8. “Product packaging” means the physical container in which the covered product is delivered to a consumer, such as a jewel case or digipak, or material attached to or surrounding the physical container, such as shrinkwrap. 9. “Uninstall” means: (a) removing a software program from a computer; (b) removing all files, registry keys, and components that were added to the computer when such software program was initially installed; (c) removing all files, registry keys, and components that were subsequently generated by such software program; and (d) restoring all files, registry keys, and components that such software program caused to be altered. I.

IT IS ORDERED that respondent, directly or through any corporation, subsidiary, division, or other device, in connection with the manufacturing, labeling, advertising, promotion, offering for sale, sale, or distribution of any covered product that contains content protection software, in or affecting commerce, shall clearly and prominently disclose:

A. On the front of the product packaging, that important consumer information regarding limits on copying and use can be found on the rear of the product packaging, if that is the case; and B. On the product packaging, that the software: (1) will install on consumers’ computers, if that is the case; (2) will limit the number of physical copies that can be made from the product, if that is the case, and the number of permitted copies; and (3) allows the direct transfer of the product’s audio files or other digital content only to playback devices that use secure Windows formats or the Sony ATRAC format, if that is the case. VOLUME 143 Decision and Order II.

IT IS FURTHER ORDERED that respondent, directly or through any corporation, subsidiary, division, or other device, in connection with the manufacturing, labeling, advertising, promotion, offering for sale, sale, or distribution of any covered product that contains content protection software, in or affecting commerce, shall not install or cause to be installed any such software on the hard disc drive of a consumer’s computer unless respondent clearly and prominently discloses on his/her computer screen the information required to be disclosed under Part I of this order, and the consumer indicates his/her assent to install such software by clicking on a button or link that is clearly labeled or otherwise clearly represented to convey that it will activate the installation, or by taking a substantially similar action. III.

IT IS FURTHER ORDERED that respondent, directly or through any corporation, subsidiary, division, or other device, in connection with the manufacturing, labeling, advertising, promotion, offering for sale, sale, or distribution of any covered product that contains content protection software, in or affecting commerce, shall:

A. Clearly and prominently disclose on the product packaging that the software will prevent consumers who decline to install the content protection software from listening to or accessing the product’s audio files via computer, if that is the case; and B. Clearly and prominently disclose on the computer screen that the software will prevent consumers who decline to install the content protection software from listening to or accessing the product’s audio files via computer, if that is the case; and obtain the consumer’s assent to install such software by clicking on a button or link that is clearly SONY BMG MUSIC ENTERTAINMENT 793 Decision and Order labeled or otherwise clearly represented to convey that it will activate the installation, or by taking a substantially similar action.

IV.

IT IS FURTHER ORDERED that respondent, directly or through any corporation, subsidiary, division, or other device, in connection with the manufacturing, labeling, advertising, promotion, offering for sale, sale, or distribution of any covered product with enhanced connectivity manufactured prior to the date that this order becomes final, in or affecting commerce, shall not:

A. Use any information about consumers, their computers, or their use of the covered product collected over the Internet for any marketing purpose, and respondent shall destroy such data within three days of its receipt; and B. Use any information about consumers, their computers, or their use of the covered product collected over the Internet to deliver any marketing messages.

V.

IT IS FURTHER ORDERED that respondent, directly or through any corporation, subsidiary, division, or other device, in connection with the manufacturing, labeling, advertising, promotion, offering for sale, sale, or distribution of any covered product with enhanced connectivity, in or affecting commerce, shall:

A. Clearly and prominently disclose on the product packaging that the software will prevent consumers who decline to permit transmission of information over the Internet about them, their computers, or their use of the product from listening to or accessing the product’s audio files via computer, if that is the case; and VOLUME 143 Decision and Order B. Prior to causing transmission via the Internet of information about consumers, their computers, or their use of the product:

1. Clearly and prominently disclose on their computer screen that such information will be transmitted to respondent and/or that images or promotional messages will be transmitted to their computers; and 2. Obtain the consumer’s assent to its transmission by clicking on a button or link that is clearly labeled or otherwise clearly represented to convey such assent, or by taking a substantially similar action. VI.

IT IS FURTHER ORDERED that respondent, directly or through any corporation, subsidiary, division, or other device, in connection with the manufacturing, labeling, advertising, promotion, offering for sale, sale, or distribution of any covered product, in or affecting commerce, shall not install or cause to be installed on a consumer’s computer any content protection software that prevents the consumer from readily locating or removing the software, including but not limited to by: (1) hiding or cloaking files, folders, or directories; (2) using random or misleading names for files, folders, or directories; or (3) misrepresenting the purpose or effect of files, directory folders, formats, or registry entries.

VII.

IT IS FURTHER ORDERED that respondent, directly or through any corporation, subsidiary, division, or other device, in connection with the manufacturing, labeling, advertising, promotion, offering for sale, sale, or distribution of any covered product, in or affecting commerce, shall: SONY BMG MUSIC ENTERTAINMENT 795 Decision and Order A. Not install or cause to be installed on a consumer’s computer any content protection software unless respondent provides a reasonable and effective means for consumers to uninstall the software;

B. For a period of two years after the date that this order becomes final, continue to provide free of charge to consumers a program and a patch that uninstalls XCP and MediaMax content protection software and removes the Aprivilege escalation vulnerability” associated with any covered product that contains MediaMax 5.0 content protection software, respectively; and C. For a period of two years after the date that this order becomes final, post a notice on its website with information for consumers about the uninstall programs and security patch referred to in Part VII.B. of this order. This notice shall be of a size and shade, and shall appear on the screen for a duration, sufficient for an ordinary consumer to read and comprehend it. This notice shall be in understandable language and syntax.

D. For a period of 12 months after the date that this order becomes final, continue its current program of purchasing Internet browser premium keywords (“keyword buys”) to give consumers notice of the security vulnerability associated with any covered product that contains XCP or MediaMax 5.0 software and of the steps that they should take to protect their property.

Provided, that, the means that respondent provides to consumers to uninstall software pursuant to this Part need not erase information or data stored on the computer regarding whether the consumer has reached the limit of permitted copies of the covered product, or other comparable content protection data, so long as: (1) prior to installing the software, the respondent has clearly and prominently disclosed on the consumer’s computer VOLUME 143 Decision and Order screen that uninstalling the software will not erase information or data stored on the computer regarding whether the user has reached the limit of permitted copies of the product, or other comparable content protection data, if that is the case; and (2) the information or data that is not erased does not impair, hinder, or otherwise adversely affect the operation or performance of the computer or its operating system.

VIII.

IT IS FURTHER ORDERED that, to provide redress to consumers, respondent shall:

A. Fully comply with the XCP and MediaMax exchange and compensation program terms contained in the class action settlement approved by the court in In re SONY BMG CD Technologies Litigation, No. 05 CV 9575 (NRB) (S.D.N.Y.) (May 24, 2006);

B. 1. For a period of 180 days after December 31, 2006, continue to accept claims and provide exchange and compensation benefits in a manner that is substantially similar to the program referred to in Part VIII.A. of this order.

2. For a period of 180 days after December 31, 2006, post a notice on its website with information for consumers about the exchange and compensation benefits described in Part VIII.B.1 of this order. This notice shall be of a size and shade, and shall appear on the screen for a duration, sufficient for an ordinary consumer to read and comprehend it. This notice shall be in understandable language and syntax. C. Continue to provide the exchange and compensation benefits contained in Sections III.B.1 and 2 and III.C. of the settlement described in Part VIII.A. of this order to consumers who SONY BMG MUSIC ENTERTAINMENT 797 Decision and Order purchased CDs containing the XCP content protection software before December 31, 2006;

D. 1. At the request of any consumer who purchased any covered product that contains XCP content protection software, reimburse the consumer up to $150 spent to repair his or her computer as a result of damage to the computer that was a direct result of that consumer’s efforts to uninstall XCP prior to the issuance of the current version of the SONY BMG uninstaller. Any claim for compensation must be submitted within 180 days after the date that this order becomes final and on a form to be made available on SONY BMG’s website no later than the date that this order becomes final. In considering such claims, respondent may require reasonable proof as to the validity of the claim; and 2. For a period of 180 days after the date that this order becomes final, post a notice on its website with information for consumers about its repair reimbursement program. This notice shall be of a size and shade, and shall appear on the screen for a duration, sufficient for an ordinary consumer to read and comprehend it. This notice shall be in understandable language and syntax. IX.

IT IS FURTHER ORDERED that respondent, directly or through any corporation, subsidiary, division, or other device, in connection with the manufacturing, labeling, advertising, promotion, offering for sale, sale, or distribution of any covered product that contains MediaMax content protection software, in or affecting commerce, shall:

VOLUME 143 Decision and Order A. Prior to the release to retailers of any covered product that contains MediaMax 3.0 or 5.0 content protection software, clearly and prominently disclose on the product packaging that:

1. The software will install on consumers’ computers; 2. The software will limit to three the number of physical copies that can be made from the product; 3. The software allows the direct transfer of the product’s audio files or other digital content only to playback devices that use secure Windows formats or the Sony ATRAC format; and 4. The software will prevent consumers who decline to install the content protection software from listening to or accessing the product’s audio files via computer. B. Prior to the release to retailers of any covered product that contains MediaMax 5.0 content protection software, clearly and prominently disclose on the product packaging that:

1. The CD will establish an Internet connection through which it will transmit to respondent information about consumers, their computers, or their use of the covered product and that respondent will transmit targeted images or promotional messages to consumers, if that is the case; and 2. The CD will create a security vulnerability that consumers can eliminate with a patch that they can download, free of charge, from respondent’s website, and include the website address.

SONY BMG MUSIC ENTERTAINMENT 799 Decision and Order C. For a period of two years after the date that this order becomes final, expand its financial incentives to retailers program pursuant to the class action settlement referred to in Part VIII.A. of this order to include the return of any covered product that contains MediaMax 5.0 software. X.

IT IS FURTHER ORDERED that respondent, and its successors and assigns, shall, for five (5) years after the last date of sale or distribution of any covered product containing content protection software or enhanced connectivity software features, maintain and upon request make available to the Federal Trade Commission for inspection and copying:

A. Copies of all different versions of disclosures on product packaging, End User License Agreements, and associated disclosures for such products required by this order; and B. All tests, reports, studies, surveys, demonstrations, or similar credible evidence in its possession or control that contradict, qualify, or call into question respondent’s representations about the nature, purpose, function, or effects of content protection software included in such product on users’ use of such product or on their computers, including complaints and other communications with consumers or with governmental or consumer protection organizations.

XI.

IT IS FURTHER ORDERED that respondent, and its successors and assigns, shall deliver a copy of this order to all current and future principals, officers, directors, and managers, and to all current and future employees, agents, and representatives having responsibilities with respect to compliance with this order. Respondent shall deliver this order to current personnel within thirty (30) days after the date of service of this VOLUME 143 Decision and Order order, and to future personnel within thirty (30) days after the person assumes such position or responsibilities. XII.

IT IS FURTHER ORDERED that respondent, and its successors and assigns, shall notify the Commission at least thirty (30) days prior to any change in the corporation that may affect compliance obligations arising under this order, including, but not limited to, a dissolution, assignment, sale, merger, or other action that would result in the emergence of a successor corporation; the creation or dissolution of a subsidiary, parent, or affiliate that engages in any acts or practices subject to this order; the proposed filing of a bankruptcy petition; or a change in the corporate name or address. Provided, however, that, with respect to any proposed change in the corporation about which respondent learns less than thirty (30) days prior to the date such action is to take place, respondent shall notify the Commission as soon as is practicable after obtaining such knowledge. All notices required by this Part shall be sent by certified mail to the Associate Director, Division of Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue, N.W., Washington, D.C. 20580.

XIII.

IT IS FURTHER ORDERED that respondent, and its successors and assigns, shall, within sixty (60) days after the date of service of this order, and at such other times as the Federal Trade Commission may require, file with the Commission a report, in writing, setting forth in detail the manner and form in which it has complied with this order.

SONY BMG MUSIC ENTERTAINMENT 801 Decision and Order XIV.

This order will terminate on June 28, 2027, or twenty (20) years from the most recent date that the United States or the Federal Trade Commission files a complaint (with or without an accompanying consent decree) in federal court alleging any violation of the order, whichever comes later; provided, however, that the filing of such a complaint will not affect the duration of: A. Any Part in this order that terminates in less than twenty (20) years;

B. This order’s application to any respondent that is not named as a defendant in such complaint; and C. This order if such complaint is filed after the order has terminated pursuant to this Part.

Provided, further, that if such complaint is dismissed or a federal court rules that the respondent did not violate any provision of the order, and the dismissal or ruling is either not appealed or upheld on appeal, then the order will terminate according to this Part as though the complaint had never been filed, except that the order will not terminate between the date such complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date such dismissal or ruling is upheld on appeal. By the Commission.

VOLUME 143 Analysis to Aid Public Comment ANALYSIS OF CONSENT ORDER TO AID PUBLIC COMMENT The Federal Trade Commission has accepted, subject to final approval, an agreement containing a consent order from Sony BMG Music Entertainment (“Sony BMG” or “respondent”). The proposed consent order has been placed on the public record for thirty (30) days for receipt of comments by interested persons. Comments received during this period will become part of the public record. After thirty (30) days, the Commission will again review the agreement and the comments received, and will decide whether it should withdraw from the agreement or make final the agreement’s proposed order.

This matter involves respondent’s use of content protection software, also known as Digital Rights Management (DRM) software, embedded on its music CDs and the use of a proprietary media player on many of these CDs that must be used to listen to them. When played on a Windows-based computer, Sony BMG’s DRM software is installed on consumers’ computers and restricts the use of the audio files and other digital material on the CDs. In addition, the “XCP” and “MediaMax 5.0" versions of respondent’s DRM software create security vulnerabilities on consumers’ computers, and, when consumers’ computers are connected to the Internet, the media player monitors users’ listening habits and sends back relevant advertisements. According to the FTC complaint, Sony BMG engaged in unfair and deceptive practices in distributing its content-protected CDs. The complaint contains two unfairness charges. The first count alleges that it was unfair for respondent to cause its DRM software, which exposed consumers’ to security risks, to be installed on consumers’ computers without adequate notification and consent. As alleged in the complaint, respondent’s “XCP” DRM software contains cloaking technology that hides the existence of the software from the Windows Operating System. SONY BMG MUSIC ENTERTAINMENT 803 Analysis to Aid Public Comment The cloaking technology creates a security vulnerability because malicious software that enters users’ computers can exploit the cloaking technology to conceal itself from the computers’ security software. In addition, respondent’s “MediaMax 5.0" DRM software creates a Aprivilege escalation vulnerability” that could allow third parties who gain physical access to the computer but who have lower-privilege access to exercise full control over a consumer’s computer running the Windows Operating System. Consumers could not reasonably prevent this injury because they did not know of the DRM software’s existence or its harmful effects. The complaint therefore alleges that respondent’s practices caused, or were likely to cause, substantial consumer injury that consumers could not reasonably avoid and which was not outweighed by countervailing benefits to consumers or competition.

The complaint further alleges as unfair respondent’s practices in causing its DRM software that made computers insecure to be installed without providing a reasonable means to locate and/or remove it. As alleged in the complaint, Sony BMG’s use of cloaking technology and the failure of the “XCP” and “MediaMax 5.0" software to appear in the Windows “Add/Remove” utility hid the existence of the software from consumers and their operating systems. In addition, respondent failed to make an uninstall tool readily available. The complaint alleges that, as a result, consumers incurred substantial costs in locating and removing the DRM software from their computers and in stopping its harmful effects. Thus, the complaint alleges that respondent’s practices in failing to provide a reasonable means to locate and remove its DRM software caused, or were likely to cause, substantial consumer injury that could not be reasonably avoided by consumers and did not provide countervailing benefits to consumers or competition.

In addition, the complaint challenges, as deceptive, Sony BMG’s failure to disclose adequately that its music CDs install onto computers software that materially limits their use by limiting the number of disc-to-disc copies that consumers can VOLUME 143 Analysis to Aid Public Comment make, and by restricting consumers’ ability to transfer to and play music on digital playback devices other than Sony BMG and Microsoft devices. Finally, the proposed complaint alleges as deceptive respondent’s undisclosed inclusion of its media player, which monitors the artists that consumers listen to on their computers and displays advertising.

The proposed consent order contains provisions designed to enhance and expand upon respondent’s programs to provide refunds to consumers and includes injunctive relief to protect against future consumer injury from similar acts and practices. Part I of the proposed order requires Sony BMG to include on the front cover of the packaging for any content-protected CD a clear and prominent disclosure that important consumer information regarding limits on copying and use can be found on the rear of the product packaging. This provision also requires respondent to disclose more fully on the back cover that the CD will install software, if that is the case; has copying limits; and can only be used on certain playback devices. Part II bars Sony BMG from installing content protection software from a CD without consumers’ authorization. Specifically, before such software can be installed, respondent must disclose on the consumer’s computer screen the information required by Part I and the consumer must have signaled her consent by clicking on a properly labeled button or taking a similar action. Further, in cases where Sony BMG conditions consumers’ use of its CDs on their installing content protection software onto their computers, Part III requires that respondent clearly and prominently disclose this requirement on the product packaging. Regarding “enhanced connectivity” CDs (CDs containing respondent’s proprietary media player that transmits nonpersonally identifiable information from consumers’ computers to respondent and displays promotional messages on consumers’ computers), Part IV of the proposed order, which applies to enhanced connectivity CDs that Sony BMG sells prior to the date SONY BMG MUSIC ENTERTAINMENT 805 Analysis to Aid Public Comment that this order becomes final, prohibits respondent from using any information it collects through enhanced connectivity CDs for any marketing purpose and requires respondent to destroy such information within three days of receipt. Part IV also prohibits Sony BMG from using any such information to deliver advertising or marketing messages. Part V, which applies to enhanced connectivity CDs that Sony BMG sells after the order becomes final, requires that if, to use a CD on a computer, consumers must agree to have information collected about them, Sony BMG must disclose this condition clearly and prominently on the product packaging. Further, Part V prohibits Sony BMG from collecting any information using its enhanced connectivity CDs, unless it first discloses that the CD will collect information and/or send back advertising to the computer and obtains consumers’ consent to do so.

In connection with the marketing, advertising, or distributing of any CD, Part VI prohibits Sony BMG from installing content protection software that prevents consumers from readily locating or removing the software from the computer. This prohibition includes, but is not limited to, hiding, cloaking, using misleading or random names for, and misrepresenting the purpose or effects of any file, folder, or directory associated with such software. Part VII requires that respondent provide a reasonable and effective means to uninstall its content protection software. Part VII also provides that Sony BMG is not required to uninstall the “counter” file of its software that determines whether the consumer has exceeded the permitted number of copies on the computer, as long as respondent discloses on consumers’ computer screens, prior to installing the content protection software, that this file will not be removed and the file does not impair, hinder, or otherwise adversely affect the computer’s operation. Part VII further requires that Sony BMG, for a period of two years from the date that the order becomes final, continue to provide free uninstall tools and patches for XCP and MediaMax 5.0 and to disclose the existence of these tools on its website. In addition, Part VII of the order requires that Sony BMG VOLUME 143 Analysis to Aid Public Comment notify consumers of the XCP and MediaMax 5.0 vulnerabilities and how to fix their computers, by extending its existing program of purchasing key words on search engines to one year after the date the order becomes final, and also by publishing a notice through its website.

Part VIII of the proposed order makes clear that all purchasers, prior to December 31, 2006, of XCP and MediaMax CDs are eligible to participate in its ongoing compensation program. Part VIII also requires Sony BMG to extend the period for accepting exchanges to six months after December 31, 2006. Further, Part VIII of the order requires that Sony BMG reimburse consumers up to $150 of their costs to repair computer damage resulting from their attempts to remove the XCP content protection software before respondent made an uninstall tool readily available. Finally, Part VIII requires Sony BMG to publish notices on its website informing consumers about the extended period for exchanging CDs and the “repair reimbursement” program.

Part IX of the proposed order requires that, before selling MediaMax CDs from its inventory, Sony BMG must make applicable disclosures about copying and use restrictions on the product packaging. In the case of MediaMax 5.0 CDs, Sony BMG also must disclose on the packaging that, if used on a computer, these CDs will create security vulnerabilities that consumers can eliminate with a patch that they can download, free of charge, from respondent’s website, and establish an Internet connection through which Sony BMG will collect information from, and send back advertising to, the computer. Also, with respect to MediaMax 5.0 CDs that Sony BMG has sold to retailers, Part IX requires that it offer retailers the same financial incentives to return these CDs as those for XCP CDs. Further, Sony BMG must offer these incentives for two years after the date the order becomes final.

SONY BMG MUSIC ENTERTAINMENT 807 Analysis to Aid Public Comment Parts X through XIII of the proposed order are record-keeping and reporting provisions. Part XIV provides that the order will terminate after twenty (20) years under certain circumstances. The purpose of this analysis is to facilitate public comment on the proposed order, and it is not intended to constitute an official interpretation of the agreement and proposed order or to modify in any way their terms.

INTERLOCUTORY, MODIFYING, VACATING, AND MISCELLANEOUS ORDERS