Each state will receive $622,000 in civil penalties and $128,000 in legal fees. Sony has agreed to provide refunds of up to $175 to consumers in Texas and California for computer repairs associated with removing the offending digital rights management (DRM) software from their PCs.

Sony BMG also was ordered to stop distributing CDs with antipiracy protections that include any hidden files and to clearly inform consumers if the music CDs they purchase contain features that allow the company's servers to collect IP address and other personal information when the disc is inserted into the computer.

Consumers have 180 days to file a refund claim, which must be submitted on a form available at Sony BMG's Web site and must include documentation of repair expenses.

Suspicions of Spyware

The complaints initially were filed in November 2005 after researcher Mark Russinovich reported that Sony BMG was allegedly using XCP and MediaMix rootkit technology to prevent its CDs from being copied. Such rootkits, which bury themselves deeply within a PC's operating system , are a favorite tool of virus writers, who often use the tactic to plant their code well beneath the radar of security software.

Sony's DRM software was installed automatically, without consumers' consent, when the audio CDs in question were played on PCs. In all, 50 CDs from Sony artists, including Ray Charles, Frank Sinatra, Louis Armstrong, and Celine Dion, contained the DRM software. The technology's virus-like attributes put it in the realm of spyware, the lawsuits alleged.

Gartner analyst John Pescatore noted in a recent interview that use of such software has become a sensitive and prominent concern. "Spyware really is seen in a different way now than it has been in the past," he said. "This isn't the kiddie stuff it used to be, with spyware delivered through pop-up windows. There are much deeper security and privacy issues at play now."

Settlements Applauded

Texas Attorney General Greg Abbott applauded the settlement, saying in a statement, "Texans deserve to be protected from harmful, hidden files that threaten their privacy or the integrity of their computer systems."

The judgments also require Sony BMG to continue encouraging consumers to return XCP- or MediaMax-protected CDs. Those who return their CDs will receive a copy of the same album, without secret DRM code. They also will receive several free MP3 downloads and a few other perks.

"Companies that want to load their CDs with software that limits the ability to copy music should fully inform consumers about it, not hide it, and make sure it doesn't inflict security vulnerabilities on computers," said California Attorney General Bill Lockyer in a statement.

Some 450,000 Californians purchased CDs with the DRM software covered by the restitution provision.