Real Networks Inc. Monday is finding itself in the hot seat following a report that company's RealJukebox software surreptitiously monitors the listening habits of users and sends that information to the company.

A security expert who intercepted and examined data generated by the program told The New York Times Real Jukebox monitors the listening habits and certain other activities of people who use it and continually reports this information, along with the user's identity, to RealNetworks.

Dave Richards, RealNetworks' (RNWK) vice president for consumer products, concedes the company has gathered the information, but says it is only used to customize services for individual users.

He and other company officials insisted that the practice did not violate consumer privacy because the information was not being stored by RealNetworks nor distributed to other companies.

But privacy advocates and security experts interviewed by the Times last week condemned the practice as a violation of the privacy of the 13.5 million registered users of RealJukebox, almost all of whom have given the company their names and e-mail addresses. The experts said the practice is unacceptable because of the secrecy: RealNetworks, one of the largest distributors of audio software on the Internet, does not inform consumers that they are being identified and monitored by the company.

Richard M. Smith is an independent Internet security consultant from Brookline, Mass. who discovered RealJukebox's monitoring functions. He said that each time the program is started on a computer connected to the Internet, it sends in the following information to the company:

• the number of songs stored on the user's hard drive
• the kind of file formats -- RealAudio or MP3 -- the songs are stored in
• the quality level of the recordings
• the user's preferred music genre
• the type of portable music player, if any, that the user has connected to the computer.

Officials at RealNetworks said most of this information is used to offer music selections to users based on their preferences.

Allegedly, a host of personal and preference information is combined with a personal serial number known as a globally unique identifier, or GUID, which is assigned to each user when he or she registers the software. And, with RealJukebox on its default settings, it automatically loads each time a CD is inserted in the CD-ROM drive -- if the computer is connected to the Internet, the title of the CD is sent, together with the GUID, to RealNetworks.

Some other CD player programs also assign GUID's to each copy of the software. The difference lies in what they do with it. Microsoft Corp. (MSFT), for example, said the unique identifier in its Windows Media Player is used for such things as purchasing multimedia from a Web site. A company spokesman said it is not routed through Microsoft, nor does Microsoft require users to register and it does not gather information through Media Player.

David Banisar, a lawyer in Washington who specializes in Internet law, told The Times RealNetworks' surveillance practices could violate various state and federal statutes, including the Computer Fraud and Abuse Act.

"It's a new type of case that hasn't been brought before," he said. "But I think it's a pretty good case." Banisar argued that RealJukebox could be considered a "trojan horse," a legitimate program that contains hidden instructions to perform illegitimate functions.