Hotmail sharing subscribers' e-mail addresses

March 5, 2001

Hotmail, the free e-mail service from Microsoft, is divulging subscribers' e-mail addresses, cities and states to a public Internet directory site that combines the information with telephone numbers and home addresses.

Hotmail customers are automatically added to Infospace's Internet White Pages directory unless they remove the check from a box in their registration form and ``opt out,'' company officials said.

Critics say users may be putting themselves at risk of receiving junk e-mail, known as spam, because they overlook the check box. Once their information makes the directory, it is easily obtained by advertisers.

``Once your e-mail addresses get into the spammers' databases, you can't get it out again,'' said Internet activist Bennett Haselton, who made the discovery.

Sarah Lefko, product manager for MSN, Microsoft's Internet service, said Hotmail is complying with the company's privacy policy because consumers can choose whether they want to be in the directory or not. ``We're clearly stating what this is,'' Lefko said. ``It's a consumer benefit.''

Hotmail's privacy policy states that Microsoft will not ``sell, lease or rent'' users' e-mail addresses. Lefko declined comment on Microsoft's business relationship with Infospace, or whether there was money involved in the deal.

Hotmail provides an automatic deletion service which scans incoming messages to find unwanted spam, but it doesn't catch everything.

When people sign up for Hotmail accounts, each is offered an Internet White Pages listing. The site describes the listing by saying the user's ``name, location and Hotmail e-mail address will be automatically listed in one or more Internet e-mail directories.''

The option to have the Hotmail address listed with InfoSpace is prechecked. Lefko defended the default setting.

``Clearly when you're signing up for a new Hotmail account, you have the opportunity to uncheck that,'' Lefko said.

An Infospace representative declined comment. Normally, InfoSpace shields a person's e-mail address. When a listing appears, there is only a ``Send E-mail'' link that leads to a form, which is then sent to the recipient. The sender never sees the recipient's address. The site explains: ``For privacy, we don't show the full email addresses of people listed in our directories.''

However, users and advertisers can easily obtain the addresses using two options: they can enter the search area through a ``backdoor'' page that is easy to find, or they can enter the search area using a Hotmail account. In both cases, e-mail addresses are shown.

With a small adjustment, the site also will display 100 listings per page rather than the default five, which also makes it easier for spammers to collect addresses.

John Mozena, spokesman for Coalition Against Unsolicited Commercial E-mail, said the public lists are a problem. ``Spammers never do anything one-by-one,'' he said.

Hotmail user Chris Livermore of Redmond, Wash., said he keeps one Hotmail address private, given out only to friends. But now he gets almost 20 unwanted e-mails per week. His address is on the White Pages list.

``Within a couple months, the account will be unusable,'' Livermore said. ``To try to wade through about 20 spam messages to get to your own messages, it's horrible.''