Understanding Behavioral Marketing/Online Tracking

I'd like to alert people to an excellent (though wish it was longer) interview of UC Berkeley privacy expert Chris Hoofnagle in the San Francisco Chronicle. The topic is online privacy and his recent study that found "Despite widening criticism of online tracking, marketers are going to greater lengths than ever to ensure they can monitor online behavior even when consumers take steps to opt out."

As fights over do-not-track rules are taking place both here in California and in DC (both in Congress and the Federal Trade Commission) I thought this to be of particular use for anyone trying to get a better grasp of just what behavioral marketing is all about.

With that, here are some especially pertinent clips from the article/interview:

A noted 2009 paper that Hoofnagle also supervised found that more than half of the most popular websites were employing what's known as flash cookies. Like the standard cookies in Web browsers, these store information that helps identify a unique user, often for the purpose of matching advertising to online behavior.

But flash cookies are more difficult to delete, more efficient at tracking and, the researchers found, often used to back up and "respawn" the standard cookies that users had deleted to avoid monitoring. In other words: Advertisers were deliberately subverting the clearly stated preferences of consumers.

Privacy advocates cried foul, class-action suits ensued and the industry promised to clean up its act.

Whether it actually did was a key question in the study released late last month, which found that while flash cookie use has declined, marketers are using new tools for essentially the same purpose.

Seven of the top 100 sites appeared to be using what's known as HTML5 local storage to back up standard cookies, and two were found to be respawning cookies....Third-party advertisers on the site were still employing the flash cookies, along with another type that takes advantage of the browser's cache, where online data is stored on the computer so it can be delivered faster. This ETag tracking allows advertisers to monitor users, even when they block all cookies and use a private browsing mode.
...

Hoofnagle: "The problem is that, individually, users never have the motivation or technical skills to circumvent the hundreds of companies that are intent upon unique user tracking. They're just outgunned. Most users are using out-of-the-box browsers, so it's very difficult for people to align their settings with their preferences. So the arms race thing raises the question: What is the role for policy?"

...

Q: What's the right policy approach from your point of view?

A: You'll never find a perfect, clean solution. But I'm a fan of data-retention limits. We know from behavioral economics that most people won't turn on do-not-track features, so if you're serious about protecting privacy, if you think there's a value here, you should protect it by default. It would require no user intervention. You would impair the ability of companies and law enforcement to create long-term profiles about people.

...

Q: The industry argues they've given consumers a choice here, allowing them to opt out if they want. Why isn't that enough?

A: Under self-regulatory programs, they allowed people to opt out of targeted advertising if they wanted. But people figured out that what that meant is these companies could still track you, they just couldn't show you online behavioral advertising.

They could still choose to target you in another channel (like direct-mail marketing or telemarketing.) And if you look at all the tracking they do, they can identify you in a fairly trivial way.

Our study also found over 600 third-party hosts of cookies, most of which are not members of any self-regulatory organization (and thus aren't bound to the rules of opt-out programs). They're not even necessarily advertisers, they could be governments. We really don't know who they are. 

Click here for the entire interview.

For information on the Do-Not-Track legislation that was sponsored by Consumer Watchdog and authored by State Senator Alan Lowenthal here in California that unfortunately died in committee check out the page I created on it at the Consumer Federation of California site (as it was a bill we supported).