Microsoft confirmed this week that there is a spy program built into its latest Windows Media Player that keeps a record of every music CD and DVD movie a computer user plays on his/her computer. The information could end up being used against the user by divorce layers and copyright enforcement agencies looking for people using unlicensed digital content.

The report about the existence of the program that logs all Media Player activity, surfaced in the US media this weekend. Microsoft quickly responded Wednesday saying it will change its privacy statement to notify customers about the technology. But the company is not planning to take out the spy program, even though it appears to conflict with new Microsoft privacy and security policies.

Even David Caulton, Microsoft's lead program manager for Windows Media said users have good reason to be concerned. "If you're watching DVDs you don't want your spouse or parents to know about, you might not want to give them your password."

When a CD or DVD is played, the player downloads the disc name and titles for each song or movie chapter from a Web site licensed by Microsoft. That information is stored on a small file on each computer. As part of downloading the information, the program also transmits an identifier number unique to each user on the computer. That creates the possibility that user habits could be tracked and sold for marketing purposes.

Privacy experts said they feared the log file could be used by investigators, divorce lawyers, snooping family members, marketing companies or others interested in learning about a person's entertainment habits. It also could be used to make sure users have paid for the music or movie, and have not made an illegal copy.

Microsoft defended the feature saying the log file avoids users having to download the same track, album or movie information each time they play. The ID number was created simply to allow Media Players users to have a personal

account on the Web site dealing with the software.

Caulton emphasized that neither the log file or ID numbers are sold or shared with others, and no information is collected on Microsoft's servers that would be personally identifiable. "This is essentially a case where it the ID doesn't serve any purpose and it isn't used."

Ironically, the Media Player program appears in violation of the new security and privacy priority policy Bill Gates has instituted. Gates has ordered all product managers to check for privacy and security concerns before adding new features. "Users should be in control of how their data is used. Policies for information use should be clear to the user. Users should be in control of when and if they receive information to make best use of their time," Gates said in his January memo.