Cookies harmless but often purged

Got cookies?

Spend any time surfing the Web, and it's easy to collect a bunch of them - the digital kind, that is. You might have hundreds of these tiny files sitting on your computer.

Go to Google, you get a cookie. The same goes for Yahoo.com, CNN.com and northjersey.com, the Web site of The Record.

But growing numbers of people are purging cookies from their computers or blocking new ones from getting planted. In the process, they are jeopardizing the basic economics of the Internet.

How can something so small and so ubiquitous - and with such a cute name - get such a bad reputation?

Cookies are identification tags. They allow a Web site to distinguish one visitor from another. Cookies will reveal if you've been to the site before, what other sites you have visited, and what information and products you have sought - without necessarily knowing your name or other personal information.

You might prefer to keep this information to yourself. But keep this in mind: Most information on the Web is underwritten by advertising. And advertisers - along with their clients - desperately want to know about your online behavior.

So don't be surprised if sites start forcing you to accept cookies before checking stock prices, sports scores and the latest headlines, according to Young-Bean Song, director of analytics for Atlas, a major cookie-maker. It will be a trade-off, he says, akin to supermarket loyalty cards: In return for some kind of benefit, the company gets to learn more about you.

That trade-off has actually been going on for a decade. But something happened in the past year that is forcing it into the open: the proliferation of malicious programs called spyware.

People get infected with spyware because someone using the computer downloaded free music or visited an unscrupulous Web site. The programs track a user's movements on the Internet, sometimes extracting personal information. They also can slow down a computer's performance.

Consumers are striking back with special anti-spyware programs. And many of these products also target cookies.

"Now you can be a little more safe that your sexual preferences, your buying habits, your political stuff isn't being tracked by somebody who can ultimately use that information to foist stuff on you," says Richard Stiennon, the vice president for threat research at Webroot, an anti-spyware company.

Cookie-makers, not surprisingly, say their little files - which don't cause any harm to people's computers - are being unfairly stigmatized.

"There's a smoke of fear being perpetuated by the anti-spyware companies," Song says. "And at the end of the day, that's not going to be good for the Internet."

Cookie deletion gained attention this spring when JupiterResearch, a technology consulting firm, issued a report questioning the reliability of cookies for measuring the number of return visitors to Web sites. In a survey of 2,300 Internet users, 39 percent said they delete their cookies at least once a month, and 25 percent said they block cookies from being placed on their computers.

Eric Peterson, the Jupiter analyst who wrote the report, illustrates the problems facing cookies. He is a tech-savvy guy who considers cookies "pretty harmless." He says his credit card company knows far more about his spending habits, and his Internet provider knows far more about his online habits, than anyone will learn about him from cookies. And yet he regularly deletes some cookies from his computer.

"Am I afraid? Am I paranoid? No," he said. "Do I think I'm improving the performance of my computer? No. I don't really have a good reason for doing it. But I do it. ... And I think this is a fairly common consumer behavior."

Anthony Gesimondo is one of those cookie-busters. A Pompton Lakes resident who builds computers as a side job, he became aware of cookies from reading computer magazines. And he is convinced cookies allow companies to sell information about you to other companies, eventually leading to pop-up ads.

"You don't really know what kind of information is being left on your computer from anywhere," he said.

Some consumers - for now, a much-outnumbered minority - appreciate cookies, because it means that online ads will be tailored to their interests.

"Personally, I embrace it," said Tom Mokrzecki of Lyndhurst, who stopped deleting cookies five years ago. "I want to be targeted. I want all the advertisers to serve me only the most relevant ads. I want them to have the most current statistics on me."

But as more people learn about cookies, usually by running anti-spyware programs, they err on the side of deleting them. It doesn't help cookies' cause that most Web sites don't adequately explain what they are. Most sites don't even make clear that they're using them.

"Nobody is being asked," said Peterson, the Jupiter analyst.

Well, some sites do extend the courtesy. Amazingpregnancy.com, a Web site that includes articles and merchandise for expectant mothers, gives users two choices: "Use cookies" and "Do not use cookies." The site also includes a prominent link that explains what its cookie does.

"We didn't want to lose potential visitors who thought we were doing something underhanded," said the Web site's owner, Vickie Barnes, a former Elmwood Park resident now living in North Carolina. "If we're putting something on their system, we want them to know about it."

Then there's the opposite approach: sneakiness.

Using another tasty-sounding technology called PIE (for Persistent Identification Element), advertisers can make cookies resistant to deletion. If you delete it, PIE just recreates it.

PIE's owner, Mookie Tenenbaum, says it's a reasonable response to the anti-spyware programs that "demonize" cookies. Most people, he says, delete cookies through these programs, without really knowing what cookies are. If they did know, he says, they probably wouldn't mind having them.

But Peterson, the Jupiter analyst, thinks PIE will make things worse for online retailers by flouting the wish of some Internet users to remain completely anonymous. Instead, he advises Web sites to be more forthright.

"Don't try to sneak around consumer preferences," he said. "That's how we got where we are today - by being sneaky and not telling people we're setting cookies."


* * *
What are cookies?

Cookies are small text files placed on your computer by Web sites you visit. They allow a Web site to distinguish you from other visitors - not by name, but by a unique combination of letters and numbers.

Can cookies reveal my personal information?

Cookies contain only information that you provided. Some cookies, called first-party cookies, are read only by the Web site that put them there. Others, known as third-party cookies, can be read by several other Web sites, allowing advertisers and merchants to build a profile of your online activities (but not your name, e-mail address or other personally identifiable information).

Also, anyone looking at the cookies on your computer - such as another member of your household - will know what sites you've visited.

Cookies won't allow people to steal sensitive information from your computer. Other malicious programs are capable of doing that, but not cookies.

Do cookies slow down my computer?

Not likely. They're too small.

Does the user get any benefit from having cookies?

First-party cookies save you the step of logging in to a Web site. First-party and third-party cookies also enable Web sites to customize the offers and ads they show, based on your previous online activity.

Can I delete my cookies?

Yes. In Windows XP, click on "My Computer," go to your "C:" drive and find "Documents and Settings." Open the file with your user name, and find the "Cookies" folder. Open it, highlight the cookies you don't want and delete them. Be warned, however, that if you delete all of your cookies, you might have to manually log in to some sites that previously didn't require it.

Also, anti-spyware programs often search for third-party tracking cookies on your computer and give you the option of deleting them. Some anti-spyware programs are available for free downloading; others are available by subscription.

Can I block future cookies?

Yes, but they are so pervasive that your Web surfing will frequently be interrupted or even limited. In Internet Explorer, go to the Tools drop-down bar, choose Internet Options, then click on the Security tab. Choose the kind of blocking you want.

- Brian Kladko

WebTrends update addresses ‘cookie’ conundrum

May 26, 2005
BY KAREN J. BANNAN

Analytics provider WebTrends Inc. this week announced a new version of its WebTrends 7 product, WebTrends 7.5, that is designed to address, among other issues, a recent Jupiter Research report about the accuracy of third-party cookies.

In March, Jupiter Research released a report that said in 2004 more than 58% of online users deleted cookies, the markers that help marketers track the effectiveness of online campaigns. As many as 39% of users are deleting cookies on a monthly basis, according to the report. Even more significant for b-to-b marketers, many corporations block cookies automatically. Third-party cookies are a common target, said Eric T. Peterson, site operations and technology analyst at Jupiter Research. Peterson authored the study on cookies.

This week’s announcement is WebTrend’s first major news since becoming a privately held company once again. Francisco Partners, a Menlo Park, Calif. private equity firm, finalized its acquisition of Portland, Ore.-based WebTrends on May 3.

WebTrends 7.5 includes first-party cookie support. In addition, WebTrends has announced it will implement first-party cookies for its customers. "If a customer can’t deploy its own [first-party cookie], we can help them do it and still keep ownership of their SSL certificate," said Jeff Seacrist, the company’s director-product marketing. Jupiter Research’s Peterson agreed the announcement is good news for customers looking to thwart cookie blocking and anti-spyware software.

"It’s good that one of the better-known vendors is actively looking at the problem and doing so using the guidance [using first-party cookies] that we suggested when we released our report," Peterson said. "The analytics vendors didn’t have to like our report but they had an obligation to their customers. WebTrends’ upgrade provides more actionable and accurate information to their customers based on what we know."

WebTrends competitor WebSideStory is testing similar functionality, while CoreMetrics, another analytics provider, is already implementing its own first-party cookie solution, said Peterson. But while these improvements may solve the issue of cookie blocking, they can’t fix cookie deletion. Even if a browser accepts a first-party cookie, once it’s deleted, it’s deleted, Peterson added.

Analytic providers such as WebTrends are looking at cookie alternatives such as so-called "sessionization," using IP addresses plus agents to create a "unique" visit to track. In some cases, software is relying solely on IP address, a method that can be off as much as 50%, said WebTrend’s Seacrist. Still, this is better than the alternative, said Peterson.

"Cookies are being deleted quite frequently. If 30% of your audience is unidentifiable, using IP plus Agent you can get 75% of those 30%," he said. "But nothing out there provides an absolute picture."

Web Analytics Industry Confronts Cookie-Deletion Trend

By Keith Regan
E-Commerce Times
05/25/05 5:00 AM PT

The tempest caused by the Jupiter Research report showing widespread deletion of cookies was not surprising considering how important cookies are to tracking Web users. Without them, data on how many unique visitors a site was getting could be called into question, which in turn casts doubt on marketing moves and other decisions based on that data.

Few analyst reports hit home as squarely as the recent Jupiter Research study on cookie deletion struck at the heart of the Web analytics industry.

Released in March, the report said 39 percent of Web users acknowledged deleting cookies -- code stored on a user's hard drive so that a site they click to in the future will recognize them as return visitors -- at least once a month, with smaller but still significant numbers eliminating them from their computers daily or weekly.

The rise of spyware -- which often identifies third-party cookies as problematic code -- new browsers that alert users to attempts to place cookies and increased awareness of how to manually delete cookies had given rise to the trend, Jupiter said. "Consumers tell us they are concerned about cookies and actually doing something about it," Jupiter Research analyst Eric Petersen, who wrote the report, said.


Ensuing Debate
The ink had barely dried on Jupiter's report when the ripple effects began to be felt around the Web analytics industry and a debate ensued about how serious the problem really is.

The Atlas Institute released a counter study suggesting that Web users exaggerated how often they actually removed cookies, saying that survey respondents might have been giving what they thought was the right answer rather than the honest one. However, Nielsen//NetRatings released data showing the rate of deletion could be even higher than Jupiter estimated.

The tempest was not surprising considering how important cookies are to tracking Web users. Without them, data on how many unique visitors a site was getting could be called into question, which in turn casts doubt on marketing moves and other decisions based on that data.

Since then, experts have stepped forward with still more data to suggest that Web-tracking is probably suffering less than originally thought. The analytics industry, recognizing that the issue of cookie deletion needs to be addressed, has begun to roll out new solutions.

In a report released Monday, analytics firm WebTrends focuses attention on the issue of cookie rejection, in which users refuse to ever accept cookies when they first visit a site.

The rise of alternative browsers, notably Mozilla's Firefox, as well as more robust firewalls and enhanced security settings in Windows XP SP2, have given users more options when it comes to cookies, with pop up windows asking users if they want to allow the code to be placed on their machines.

Cookie Rejection
WebTrends said that the percentage of users saying no to third-party cookies has risen four-fold in the past 18 months, from 2.8 percent in January of 2004 to 12.4 percent in April of this year. However, the firm also said that growth seems to have peaked. Some industries are being hit harder than others, with a nearly 17 percent refusal rate in retail, more than 15 percent in telecommunications and 12 percent among media firms.

"Cookie rejection is a more serious issue" than after-the-fact deletion, Jeff Seacrist, vice president of product marketing for WebTrends, told the E-Commerce Times. "If users are blocking cookies altogether, you are missing out on insight about that visit from the start."

Seacrist said the true impact of cookie denial or deletion is hard to judge and likely varies based on how the analytics in question are being done. Some vendors offer a backup system that uses IP addresses and browser information to categorize users, which preserves some data.

However, Seacrist said WebTrends was working on ways to solve the cookie-deletion issue before the Jupiter report hit. The firm rolled out version 7.5 of its hosted and software program Monday, with an upgrade that enables companies to use so-called first-party cookies instead of those installed by the analytics firm.

First-party cookies are not as likely to be tagged as spyware and are therefore far less likely to be removed or denied by the user. Seacrist said the WebTrends products will provide the same level of analytical data -- and in fact include a number of upgrades of its user interface designed to make it easier to sort, store and share key data.

In its report, the Atlas Institute said cookie-based measurement will "continue to provide reliable metrics and optimize online campaigns." Young-Bean Song, director of analytics, said many transactions are completed so quickly by Web shoppers that sites can gain a full spectrum of information on where they came from, how they navigate a site and so on, before the user ever has a chance to delete a cookie.

Solutions Aplenty
Still, he acknowledged that "technologies and methodologies need to continually evolve in order to keep pace with industry dynamics."

It's clear that firms are eager to offer alternatives. In addition to the latest WebTrends release, Affiliatetracking.com quickly followed the Jupiter Research report by "reintroducing" its "cookie-less" affiliate tracking software option, which monitors, without using third-party cookies, how traffic is directed to a site.

Another alternative being eyed is the use of Flash to work around cookie deletion with a process called Local Shared Objects.

However, Seacrist believes that anti-spyware tools will soon be updated to detect and remove that code as well. He said other solutions that disguise a third-party cookie as those installed by the primary site also come close to or even cross an ethical line in the industry.

Jupiter's Petersen said the solution shows that the Web industry is seeking creative alternatives to the cookie dilemma. For his part, the analyst believes the best long-term solutions will be those that are "user-friendly" and "describe to the consumer what the site is trying to do and why."

Third-Party Cookie Blocking Grows

By Brian Morrissey

More consumers are rejecting third-party cookies, according to a new study, making it more difficult for Web analytics providers and ad networks to track Web users.

WebTrends analytics firm found blocking of third-party cookies --the tracking files used by entities other than the site a user is visiting-- increased from 2.4 percent in January 2004 to 12.4 percent in April 2005. WebTrends attributed the rise to the adoption of Firefox and updated Internet Explorer service products that reject third-party cookies as a default.

"We're starting to see a trend," said Jeff Seacrist, director of product marketing at WebTrends, a Portland, Ore.-based Web data provider. "We may see these numbers continue to increase."

The study examined data from WebTrends customers over a 15-month period, including more than 5 billion visitor sessions.

The WebTrends report follows survey data that showed over 40 percent of Internet users say they delete their cookies regularly. A report by aQuantive's Atlas Solutions unit found third-party cookies bearing the brunt of deletion: 32 percent of consumers deleted them weekly and 48 percent monthly. While deleted cookies skew tracking, they can always be reset, unlike cookies blocked outright.

"This rejection issue is more serious than cookie deletion," Seacrist said.

WebTrends is addressing the issue by trying to avoid using third-party cookies altogether. Since users are less likely to block cookies from sites they visit, WebTrends is moving its clients to use first-party cookies. While a majority of its clients use third-party cookies today, Seacrist expects most will move to first-party cookies in a year's time.

House O.K.s Two Spyware Bills for Senate to Sort Out

"Let the Senate figure it out" seems to have been the approach of the U.S. House of Representatives on Monday when it approved two anti-spyware bills after a brief debate, reports CNET. The two bills take separate approaches: fines for the creators of malicious code, and imprisonment for those who intentionally impairs a computer's security. The House vote has essentially handed the ball to the Senate, which has been considering spyware legislation in recent months but is not ready to take action yet.


H.R. 29, sponsored by Rep. Mary Bono, R-Calif., would create complex regulations overseen by the FTC, and would punish offenders with fines for browser hijacking, modifying bookmarks, collecting personal information without permission and disabling security mechanisms - up to $3 million per incident.

H.R. 744, sponsored by Rep. Zoe Lofgren, D-Calif., is a one-page bill that outlines prohibitions and attendant felony penalties, including six-digit fines and imprisonment.

Last year, the House approved a spyware bill but the Senate did not act on it. In the meantime, some states and the federal government have sued alleged spyware makers.

Study: Triple the Number of Visitors Rejecting Third-Party Cookies

Users have apparently been adding insult (rejection) to injury (deletion) when it comes to the cookie-deletion controversy. The percentage of website visitors rejecting third-party cookies tripled last year, from roughly 4 percent in January to 12 percent in December and has hovered at that rate up to this month, according to WebTrends, MediaPost writes. The analytics company looked at records of some five billion visitor sessions per month on thousands of its clients' websites.

The WebTrends research showed that third-party rejections occurred most frequently in retail, with 16.7 percent of visitors declining third-party cookies; other high-rejection-rate categories are telecom (15.4 percent), healthcare (14.7 percent), manufacturing (13.3 percent), transportation (13 percent) and media (12 percent).

iMedia writes that WebTrends has launched version 7.5 of its analytics tool, which will better deal with the cookie-deletion controversy. The new features will allow the company, and publishers, to "bypass the third party cookies and leverage the first party cookies that the customers are already setting," according to a WebTrends spokesperson.

Project Apollo: Ready for Lift Off?

BY Jeremy Lockhorn

The face of marketing has changed significantly in the last few years. Though most of the wild predictions of the '90s have yet to materialize (and may never achieve the extremes once assumed to be foregone conclusions), things are decidedly different. Consumers have more control than ever. Media fragmentation is rampant. People consume multiple media simultaneously, fast-forward through ads, block pop-ups and other online ads, and delete cookies. All of this makes tracking ad exposure more difficult.

We've gotten pretty good at tracking online, despite recent uproar over cookies. Continued media convergence creates more digital channels. And as more media become digital, the ability to track those different channels will improve.

VNU, the parent of Arbitron and Nielsen, seems tired of waiting for digital convergence. It's preparing to launch Project Apollo, a pilot program that aims to better track behavior and media consumption across channels, starting with (and heavily focused on) analog.

The system uses the Portable People Meter (PPM), a device similar to a pager, which each panel member must carry at all times. It records the ad messages the wearer is exposed to through a code embedded in the audio track. The pilot program will be made up of 4,000-6,000 U.S. households. It focuses on TV. If it works, it can easily be expanded to radio and conceivably, to any audio-based channel. The idea could even be migrated to print. The developers envision the panel growing to 30,000 U.S. households.

Sounds great, eh? It's certainly talked about, and some big advertisers are throwing their weight behind it. Yet the project seems to be missing key components.

"Another way to think about Project Apollo is that it would aggregate a 'day in the life' of thousands of consumers," says Consumer Insight Magazine, an ACNielsen publication. If the device only tracks audio-based ad exposures (by picking up an inaudible broadcast code), what about print, outdoor, earphone-based audio (podcasting, radio, etc.), mobile phones, PDAs, and, perhaps most important, online?

Any solution that neglects these channels, particularly online, is incomplete and likely not worth the investment for what can only be only incremental gains in understanding media consumption and corresponding behavior. The Internet is an extremely powerful force in the decision-making cycle for many consumer products. For some goods and services, particularly high-consideration categories such as automotive and real estate, the Internet has proven to be the single most important medium.

The Apollo team seems to be considering those channels but inspires no confidence that a solution is coming soon. Vehicles such as TV are going to feel more like the Web (via VOD (define), iTV, etc.) in terms of data types required and skill sets needed to analyze the information.

Methodologies based on PPMs don't appear well suited to measuring with great detail how a user interacts with a Web site (or an interactive ad or, by extension, any interactive marketing channel). Where do the consumer's eyes go? Where do they click? Do they scroll to see content below the fold? How many pages do they consume during a visit? Does that change with more frequent visits? Do they interact with rich media ads? Which expandable panel was most popular? Which panel did consumers spend the most time with, and which was most effective at getting them to take the desired action?

This is the kind of incredibly powerful data key to making important marketing decisions in a world where the consumer's in control. Like it or not, that world (which most marketers appear to dread) is quickly coming. We can't ignore the rich data it affords, not even in the short term.

WebTrends Advises Sites to Move to First-Party Cookies Based on Four-Fold Increase in Third-Party Cookie Rejection Rates

Web analytics leader unveils accuracy best practices on top of industry’s only first-party cookie support for both software and hosted web analytics

PORTLAND, Ore., May 23, 2005 - WebTrends Inc., the global web analytics market share leader, today unveiled results of research it conducted on the increase of Internet users blocking third-party cookies. Commonly used by hosted web analytics services, third-party cookies track a site's unique visitors and their responses to marketing campaigns and web site promotions. In addition to the research, WebTrends has issued best practice recommendations as well as a series of product enhancements with the new version of WebTrends® 7, to deliver the most accurate and actionable analytics in the industry for precise decision-making.

While other recent industry research has focused predominately on rising cookie deletion rates, cookie rejection is a more serious issue. Rejection refers to visitors blocking cookies from ever being set on their machines, as opposed to deletion, which happens at some point after the individual has visited a site. Cookie rejection immediately affects the accuracy of all metrics rather than causing a gradual decline in the accuracy of reports spanning weeks or months.

WebTrends top-level findings indicate that across all industries, average third-party cookie rejection rates have increased more than four-fold in the last 16-months, from 2.84 percent of web site visitors in January 2004 to 12.4 percent in April 2005. The growth in this trend has leveled off since January 2005, and seems to have been primarily fueled by software that blocks third-party cookies, including personal firewalls, proxy servers, and available settings in the Windows XP Service Pack 2 release of Microsoft Internet Explorer.

WebTrends research indicates the following industry verticals are experiencing third-party cookie rejection at the following rates:

* Retail - 16.9%
* Telecom - 15.4%
* Healthcare - 14.7%
* Manufacturing -13.3%
* Transportation - 13.0%
* Technology - 12.4%
* Media - 12.1-%
* Insurance - 12.0%
* Services - 11.8%
* Travel/Hospitality - 11.8%
* Legal/Accounting - 10.6%

Effects of Cookie Rejection and Deletion

Both cookie rejection and cookie deletion result in a loss or distortion of essential metrics. Cookie deletion artificially inflates unique visitor counts and degrades repeat visitor metrics over time, since visitors who delete their cookies are incorrectly recognized as new visitors upon their return. The effects of cookie rejection typically result in the loss of unique and repeat visitor metrics and in some extreme cases, the web analytics system does not track the visit at all. Report distortion from cookie rejection is much greater if the web analytics solution heavily relies on cookies for purchase histories or campaign responses, or, as the solution's only method to sessionize visits.

Attaining Web Analytics Accuracy

A recent consumer survey from independent analyst firm, JupiterResearch, supports the growth in cookie rejection, citing 28 percent of Internet users as claiming they selectively reject third-party cookies (JupiterResearch, "Measuring Unique Visitors," March 10, 2005). Jupiter concludes that "site operators must move toward exclusive use of first-party cookies in data collection efforts."

"The growth in Internet users rejecting third-party cookies is certainly not something that can be ignored by analytics providers or the organizations that rely on those numbers to manage their businesses," said Greg Drew, WebTrends CEO and president. "Customers are counting on their web analytics vendors to adopt best practices for cookie-based measurement, including the use of first-party cookies and backup methods that don't rely on cookies for attaining the critical insights into visitor behavior and the performance of marketing campaigns that have proven to give companies a distinct online advantage."

Leveraging its long-standing 10 years expertise in software and five years with hosted web analytics, WebTrends now offers the most secure and broadest first-party cookie support in the industry for both software and hosted solutions, as well as fallback sessionization methods for unique visitor and visit-tracking that are completely independent of the use of cookies, including authenticated usernames, session IDs and IP+Agent.

Available at no additional charge, WebTrends unique first-party cookie management solution adheres to the best practices in the industry by enabling customers to use their own first-party cookie or automated solutions from WebTrends to add legitimate first-party cookie tracking, which allows them to retain ownership and management of their SSL certificates. Additionally, customers currently using third-party cookies won't lose any existing data as that information is automatically transferred to new first-party cookies. Customers can also opt for low-cost professional services designed specifically to help them implement first-party cookie tracking.

Businesses that are concerned about the accuracy of their web analytics due to the increasing percentage of visitors blocking third-party cookies, can access best practices information and a checklist for evaluating first-party cookie solutions at www.webtrends.com/upload/BB_1st_Party_Cookies_FINAL.pdf.

Methodology for WebTrends Cookie Research

WebTrends analyzed 16-months of data spanning 5 billion visitor sessions from the top trafficked web sites on its hosted On Demand service using third-party cookies, and calculated an average rejection rate for each month. The sites were then grouped according to Standard Industrial Classification (SIC) codes to produce the vertical-specific, third-party cookie rejection rates.

The exact number of visitors that block cookies from being set on their machines cannot be determined, precisely because they are rejecting cookies; for example, a single person visiting a particular website more than once will be recorded as a new visitor each time. However, WebTrends fallback IP+Agent sessionization provides an accurate picture of the trended growth in third-party cookie rejection, and allows site owners to compare the activities of cookied and non-cookied traffic to better estimate the total number of visitors that engage in this behavior.

Cookie Rejection Cited as Next Major Advertiser Problem

By Enid Burns

Users who block cookies are causing problems overlooked in the recent alarm over cookie deletion. A report published by WebTrends details which industries are most affected by users who refuse to accept their Web site cookies.

Over the 16-month period beginning January 2004, and ending in April 2005, overall cookie rejection rate rose from 2.84 percent to 12.4 percent. This sharp increase is credited to software that blocks cookies, as well as the release of Windows XP Service Pack 2 and evolving firewall settings. A recent report published by independent analyst firm, JupiterResearch, supports the growth of cookie deletion; citing 28 percent of users as claiming they selectively reject third-party cookies.

"Rising cookie rejection rates are a factor of consumers' continued misconceptions of what cookies are used for as well as software that makes it easier to block third-party cookies from being set on their machines," said Jeff Seacrist, director of product marketing. "While the scope of this behavior varies between industry verticals, and even site to site, marketers and business managers can easily ensure they have the most accurate information possible by adopting web analytics solutions that use legitimate first-party cookies."

The retail industry is most affected by cookie denial, with a 16.9 percent rejection rate, followed by telecom's 15.4 percent rejection rate. Legal and accounting were on the low end, with a shared 10.6 percent rejection rate. Travel and hospitality sees 11.8 percent of visitors block site cookies.

Third-Party Cookie Rejection Rates by Industry
Industry Rejection Rates (%)
Retail 16.9
Telecom 15.4
Healthcare 14.7
Manufacturing 13.3
Transportation 13.0
Technology 12.4
Media 12.1
Insurance 12.0
Services 11.8
Travel/Hospitality 11.8
Legal/Accounting 10.6
Source: WebTrends, 2005


Users who reject cookies outright affect traffic reporting differently than those who accept, then delete, cookies. Users who reject cookies are never recorded on the site at all, while users who delete cookies are counted as new each time they visit the site in question.

WebTrends calculated rejection rates on top-trafficked Web sites using third-party cookies and its hosted On Demand service.

WebTrends: 12 Percent of Visitors Reject Third-Party Cookies

LAST YEAR, THE PROPORTION OF Web site visitors rejecting third-party cookies increased threefold, from around 4 percent in January to 12 percent by December, according to new research by analytics company WebTrends. The third-party cookie rejection rate remained at around 12 percent through the end of last month, according to the report. For the report, "Accurate and Actionable Web Analytics," WebTrends looked at records of about five billion visitor sessions a month across thousands of clients' Web sites, said Jeff Seacrist, WebTrends director of product marketing.

The report comes at a time when the industry is still reeling from other studies showing that consumers delete their cookies far more frequently than had been imagined. One report issued last month by Jupiter Research showed that 40 percent of consumers deleted cookies at least monthly.

The WebTrends research showed that third-party rejections occurred most frequently rn the retail category, in which 16.7 percent of visitors now decline third-party cookies. Other categories with high rejection rates include telecoms (15.4 percent), health care (14.7 percent), manufacturing (13.3 percent), transportation (13 percent), and media (12 percent).

WebTrends also intends to launch an upgrade to its product at the end of the month. One of the new features is an offering that will allow publishers to do more analytics using their own first-party cookies, rather than third-party cookies placed on the site by an outside company.

Web visitors tossing cookies

More and more often, Web surfers are blocking cookies, preventing companies from measuring what's popular with visitors and improving their efforts to woo them.

Web analysis company WebTrends says that blocking cookies has increased fourfold since January of last year. That may sound like good news for consumers--no more Big Brother watching what you're doing or bothering you with ads you don't care about.

The ironic point is that, when used correctly, cookies can be helpful--they can give companies a better sense of what's important to site visitors and allow them to present visitors with more pertinent information.

The increase in the cookie blocking trend comes partly as a result of new browsers that allow visitors to set blocking as a feature or to delete them more easily.

WebTrends' latest version of its software--version 7.5, to be released in the first part of June and to be announced on Monday--allows companies who want to use cookies to serve up more useful content to prevent these blocking tactics.

It doesn't sound right, but sometimes cookies can be good for you.

Posted by Richard Shim

Online advertising: Myth and reality

Online advertising was a hard sell from the beginning. Advertisers, like anybody who spends money on anything, like to have something they can hold in their hands. Of course advertising has always been hard to put one's finger on, but at least in the days when it was limited to print, the advertiser could at least pick up a copy of the newspaper, flip through the pages to find their ad, and pass it around the office. Online advertising, which is merely a bunch of pixels on a screen, is even more tenuous of a product. Nonetheless, it has found its place, and it has become the currency that makes the Internet continue to grow.

Google is probably the one company that has had the biggest impact on the online advertising market. Early on, the company found its bearings by offering a useful search engine for free, but made its money by creating a massive advertising engine that actually defined online advertising for everyone else. It is because of Google, more than any other company, that online advertising has finally come to be accepted, both by consumers and by advertisers. Forrester reports on Google's new initiative, which holds the promise of making even greater changes to the online ad industry. Forrester's research report highlights Google's entry into the online display advertising market, with the beta launch of a site within its AdSense for Content product.

Forrester accurately predicts that Google will make lots of money from its new venture, but also notes that the new display advertising product will put a strain on existing publisher/advertiser relationships as more advertisers opt for the Google model of ad distribution rather than contracting with individual online publishing companies.

Every ad guy from the pre-Internet days is probably familiar with "Wanamaker's Rule," which states something to the effect that half the money spent on ads is wasted, but nobody ever is sure which half that is. Research and Markets' report proclaims this to now be out of date, since in the world of Internet advertising, everything can be measured. Technology lets advertisers know which reader is looking at which ad, for how long, where they come from, and just about everything they could possibly want to know outside of what color socks each viewer is wearing. Truth be told, they could probably figure that out, too. This report notes that the world of online ad metrics still suffers from many outmoded concepts, but nonetheless holds great promise of accountability. But perhaps we pay too much attention to click-through rates. The report notes that many ad companies measure the view-through rate, which takes into account any action taken by users within 30 days of viewing an ad--and notes that consumers are more likely to respond to an ad slowly than right away. So--low click-throughs doesn't necessarily mean a poor campaign.

But like almost anything else in business, taking online ad metrics is a constantly changing process. Advertisers have always relied on cookies, those handy little files that we place on user's PCs, to keep track of who's who and to personalize the Web browsing experience. Jupiter Research says however, that 40 percent of users delete cookies on a monthly basis. But the crumbling cookies doesn't necessarily mean crumbling metrics, Jupiter predicts that Web analytics vendors will adapt their tools to new methods.

Dan Blacharski has authored several books on technology, business and entrepreneurial concepts. He has been a freelance writer and editorial consultant for over 10 years and currently covers high-tech topics for the trade press. Write him at dan@blacharski.net.

FAQ: Hard facts about Google's Web Accelerator

Google last week unveiled a new application for speeding up the delivery of Web pages. As has become routine with several of the company's recent announcements, including Gmail and desktop search, critics immediately looked for ulterior motives, privacy breaches and security slipups.

Some of it was to be expected; the more successful and powerful you become, the more scrutiny and conspiracy theories you spawn. So what is the truth about Google's latest move beyond search?

What is Web Accelerator, and how can it help me?
If you're surfing the Internet with a broadband connection, and you're hungry for more speed, Web Accelerator could be the ticket. It is free, downloadable software designed to speed access to Web pages by serving up cached, or compressed, copies of sites from Google's servers. For frequent Internet users, the company says the tool could save two to three hours a month in browsing time.

How does Web Accelerator work?
To create the Web Accelerator, Google used research on mouse movements to help develop algorithms that monitor where people, in aggregate, are mousing and clicking on links, according to Marissa Mayer, Google's director of Web products. With that understanding of where people will likely click, Google grabs and stores copies of prospective pages for speedy retrieval.

Google keeps a cached copy of requested Web pages and precaches some other popular pages on the user's computer to load pages faster. And in some cases, it compresses pages to half or a third their size, also speeding their delivery.

"As fast as broadband is, it's still not as fast as it could be," Mayer said. "Think of Google as your proxy. In exchange, we'll try to make the Web faster for you."

Still, aren't Web Accelerators technically best for people using dial-up?
Not necessarily. Technology experts say a good Web accelerator can mitigate packet loss, or latency, as page information is sent from router to router. It also can optimize how a graphics-heavy Web site is compressed and sent to a visitor.

Is there a security flaw in Google's Web Accelerator, and how does it affect me?
Yes, Google acknowledged a vulnerability in the beta software last week, after several online critics spotted the flaw.

The software can serve cached copies of private discussion groups or password-protected pages to people using the software. For example, using the software, a Web surfer might call up a discussion group page and see the name of another group member, making it appear as if the surfer is signed in as that other user.

Google's Mayer said the company is working on a fix and that the problem has affected only small discussion group sites. Google is deactivating the mechanism that caches vulnerable Web pages and is looking at possible mathematical algorithms to prevent the caching from happening in the future.

Are my financial information or any other secure transactions at stake?
No. According to Google, the Web Accelerator does not cache Web sites using the "HTTPS" specification--a variation of HTTP that provides security for online transactions such as banking or credit card pages--so such transactions are not at risk.

Apart from the flaw, is my privacy in jeopardy by using Web Accelerator?
It could be, depending on your comfort level. According to Google's privacy policy, the Web Accelerator retrieves and caches Web pages you've visited, and those page requests can include personal information about you. It also temporarily caches third-party cookies that can contain personal data.

For example, if you've entered information such as e-mail or a physical address into a form on an unencrypted Web page, Google might pick up that data through the Web Accelerator. It also collects "clickstream" data such as URLs you've requested, the date and time of the request, as well as your Internet Protocol address and computer and connection information.

Google says it will never rent or sell a person's personal information to third parties without that user's explicit permission. But privacy advocates say people still don't know enough about what Google does with the personal information. Specifically, they are worried that Google will combine personal and clickstream data with existing search history data contained in Google's own cookie to create a far-reaching profile on Google visitors.

Mayer said Google is not combining search history data with clickstream or personal information collected by the Web Accelerator. However, if people visit Google.com while using the software, the activity will be logged by the Accelerator proxy.

Still, people can dump their cache and delete cookies often, as privacy advocates urge.

What is Google's responsibility toward me when I use this software?
None, really, if you read and agree to Google's terms of service. Like most software disclaimers, the terms of service say Web Accelerator is offered "as is" and provides no warranties regarding security and performance. In other words, use at your own risk.

If the application is free, what's in it for Google?
Google's Mayer said if people are surfing faster and using the Web more, then it will ultimately result in more searches at Google. (The company made more than $1 billion from January to March from text advertisements that appear next to search results.)

Is the beta closed?
Yes, for now, according to Google's information page. The site says it has maxed out on capacity and is "actively working to increase the number of users we can support." Still, the download page is active.

Will Google improve Web Accelerator?
Because the application is in beta, the company wants your feedback and ideas for updates at labs+webaccelerator@google.com

A Modest Cookies Proposal

Assert your property rights. Don't let anybody steal valuable information about your browsing behavior. Make them pay for it, like me.

By David DeJean Desktop Pipeline

So many PC users, fearful of the invasion of their privacy, have begun routinely deleting cookies and spyware that companies that make money from tracking Web users' online behavior are trying to stop it. An ad industry group is being formed to clean up cookies' image, and the story covering the announcement reported that 58 percent of Internet users have deleted cookies, and 39 percent do it on a monthly basis, according to JupiterResearch.

This can seriously undermine website operators' ability to measure consumer behavior on their sites, according to the research firm. And you know what that means: sooner or later the advertising industry will do what the recording and film industries have done: they'll go to Washington and buy favorable legislation, and we'll be forbidden by law to delete cookies.

My thought is, why should all that money go into the pockets of politicians? Why shouldn't I get some, too? So I hereby serve public notice of the following:

Whereas my browsing behavior and any information about it are of obvious value to many individuals and companies, they are therefore declared to be proprietary intellectual property, not only in the future, but all the way back to the first time I used a Web browser. (If J.D. Salinger can use the copyright laws to prohibit publication of letters he wrote years before without notice of restriction, then I can do the same for my Web browsing.) If your Web site places, or has caused to be placed, a cookie on my PC and you or your company uses this cookie, data about its placement, or data subsequently collected about its existence, you are in violation of my property rights.

However, this proprietary information is for sale. If your company desires to place cookies on my PC and track my behavior online, a schedule of fees and related service charges for storage and retrieval of the cookie data is available upon request. (Spyware -- including, but not limited to, home page redirection, "toolbars," keyloggers, and rootkits -- carries substantial additional charges. Please contact me directly to discuss your application and the percentage of your company's assets that would be required as down-payment.)

Because my Web-surfing activity stretches back to 1995, many companies have already incurred substantial liabilities. Companies wishing to know whether they have outstanding balances due to me may determine their status from the indexes of cookies maintained on my various PCs and laptops. I offer part of the "A" listings below as a free sample. The entire index is, of course, proprietary, and information about its contents is available for a fee. I am currently running an introductory special offer on this information and the related outstanding balances, so if you think your company might have planted a cookie on me, you could save substantially if you act now, before you are contacted by my lawyers:

pc@247realmedia[2].txt
pc@a.websponsors[2].txt
pc@acvs.mediaonenetwork[1].txt
pc@ad.reunion[1].txt
pc@ad.yieldmanager[2].txt
pc@adcentriconline[2].txt
pc@adinterax[1].txt
pc@adopt.specificclick[2].txt
pc@adrevolver[2].txt
pc@ads.addynamix[1].txt
pc@ads.as4x.tmcs[2].txt
pc@ads.businessweek[1].txt
pc@ads.monster[2].txt
pc@ads.pointroll[2].txt
pc@ads.vnuemedia[2].txt
pc@adsfac[2].txt
pc@adtech[2].txt
pc@advertising[2].txt
pc@allrecipes[1].txt
pc@alternet[2].txt
pc@amazon.co[2].txt
pc@amazon[2].txt
pc@ancestry[2].txt
pc@apple[1].txt
pc@archiver.rootsweb[1].txt
pc@ardownload.adobe[1].txt
pc@ask[2].txt
pc@atdmt[1].txt
pc@atwola[2].txt
pc@audiencematch[1].txt
pc@austin360[1].txt

Google speed bump draws scorn

Google has raised privacy and security hackles once again, this time by developing an application that accelerates Web surfing but can also delete pages or serve up password-protected content.

The complaints center on the search giant's Web Accelerator, which was released on Wednesday. Downloadable software for broadband users, Web Accelerator is intended to speed access to Web pages by serving up cached or compressed copies of sites from Google's servers.

Though the software can be useful to consumers who are in a hurry--broadband connections already deliver pages quickly--critics were quick to find a potentially damaging glitch. A flaw with Web Accelerator, which Google acknowledges, can serve cached copies of private discussion groups or password-protected pages to people using the software.

For example, using the software, a Web surfer might call up a discussion group page and see the name of another group member, making it appear as if the surfer is signed in as that user. Web Accelerator does not cache secure Web sites in the programming language "HTTPS" such as banking or credit card pages, however, so data such as financial transactions are not at stake.

Marissa Mayer, Google's vice president of Web products, said the company is working on a fix but downplayed the threat. "It looks worse than it is," she said. "We've cached the page with that user name on it. But you are not actually signed in; you couldn't operate as that person," she said, adding it has affected only a small number of sites.

"We're committed to provide users the utmost of integrity in security and privacy, and we're working with urgency to solve this problem," she added.

More broadly, privacy advocates are concerned about the scope of data collected with the Web Accelerator, charging that Google's privacy policy does not address some important consumer issues. Critics say the tool's capabilities to monitor a person's travels across the Web feeds into an overarching worry that Google is becoming a massive market research firm capable of collecting oodles of information on millions of people.

Not a Google first
"The business they're in here with this new product is market research--they'll be looking at what people are doing on the Internet, what they're reading, what they're buying," said Richard Smith, a privacy and security expert who runs the Web site Computerbytesman.org. "There's potentially a lot of information just from the click-stream of the URLs people visit."

Google has run into privacy and security problems before when introducing new services. The company's free e-mail service, Gmail, roiled the privacy community for its practice of scanning the contents of e-mail to deliver related ads. Although the furor eventually subsided. Google's desktop search software, introduced late last year, contained a security glitch that temporarily exposed private data on the Web. And Google's latest toolbar was the subject of criticism for a feature that converted text on third-party Web pages to Google-designated links.

Google's Mayer said the Web Accelerator is not a market research tool. Rather, the company built the application to give people the same fast experience they have at Google--most search pages are returned in a fraction of a second--while surfing the Web at large. If the tool can help someone save two or three hours a month surfing the Web, that person might spend more time searching with Google, Mayer reasoned.

Google states in its privacy policy that it does not collect or share personally identifiable information with use of the software. Still, privacy experts warn that the policy is silent about what click-stream data it collects and what Google does with the information.

"The tool offers a plausible consumer benefit. But it makes me uncomfortable because it's Google collecting yet more information about everyone and doing it in a way that's not necessary," said Ben Edelman, a Harvard University researcher who investigates software applications.

For example, he said, it's unclear whether Google will tie information collected from click-stream data to its cookies. Cookies are tiny tracking tags used by most Web sites to associate a specific computer or user with his or her activity online. Often, cookies are used to remember passwords or log-ins, as well as information such as the user's geographic location or past preferences to better serve Web pages.

"The most important issue they don't address is what click-stream data is tied to the Google cookie," said Computerbytesman.org's Smith. "My recommendation: Purge Google cookies and often."

Mayer said that that click-stream data from Web Accelerator is not associated with the computer's cookie.

"To date, we're not doing anything with this data in terms of market research. We have no plans, but should that change we would aggressively notify our users and give them some escape hatch," Mayer said.

To address the security flaw, Mayer said the company is deactivating the mechanism that caches vulnerable Web pages. Mayer said the problem happens only on a small number of sites, typically discussion groups, because those sites are not passing the proper no-cache header information. She said the company is also contacting Web masters to work with them on that issue. In addition, Google is looking at possible mathematical algorithms to prevent the caching from happening in the future.

Yet another contingent, Web designers, has criticized the application for deleting Javascript commands or pages of their sites within the software environment. That means that people using Web Accelerator may not be able to hit the back button to return to a previous page. Google spokesman Nate Tyler said the company is also looking into that issue.

Web acceleration tools were popular years ago during the dot-com heyday, when most people accessed the Web with dial-up connections. Internet service providers such as America Online have offered them for free to their dial-up customers as a means of improving the surfing experience. Market research firms such as ComScore Networks have also used the tools as a means to entice new subjects for research panels, watching their behavior online to estimate the popularity of Web sites, for example.

But in an era of widespread broadband usage--more than 50 percent of households in the United States have a high-speed connection--the value of such tools has diminished. Peter Christy, co-founder of market research firm Internet Research Group, said that despite that perception, a good Web accelerator can mitigate packet loss, or latency, as information is sent from router to router. It can also optimize how an object-heavy Web site is compressed and sent to a visitor.

Addressing the privacy issues, Cristy said there's always a basic trade-off between getting a service and getting absolute privacy.

"If you look at Google, this fabulously useful company, they make their money by selling people ads," he said. Besides search, "the way Google becomes useful is in building some model of who I am and what I'm interested in and delivering me ads. That's either really useful or very sinister.

We Don't Need No Stinkin' Cookies! (Or Do We?)

Consumers have cookie fever, and they're deleting cookies faster than ever. This has a lot of advertisers very concerned. Many studies have reported on the phenomenon, and all agree users are deleting cookies. What they don't agree on is how many users actually delete them. Most studies say more users are deleting more cookies now, and the trend will accelerate.

Cookie deletion has mostly to do with confusion about what cookies are and how they're used. Anti-spyware applications, such as Lavasoft's Ad-Aware and a few others, are the biggest offenders in the cookie war. They provoke cookie fear to drive product sales.

In light of cookie deletion, what are the best cookies practices? And what common advertising and publishing practices are most likely to be affected when cookies are deleted? Let's review three best practices commonly used by experienced ad agencies. Also, how to discern when cookie deletion is a concern... and when it isn't.

Agencies use third-party ad servers (3PASs) to manage and track ad campaigns, and post-event tracking mechanisms to correlate impressions and clicks to conversions (or site visits driven by ads). 3PAS use is smart and highly recommended. Yet anti-spyware companies typically, if erroneously, target 3PASs for automatic cookie deletion. If you use a 3PAS, be aware some percentage of your users are stripped of their tracking cookies, most either weekly or monthly.

Most agencies configure their ad servers to ignore conversions coming from ad impressions, and clicks over one week old. This is typically viewed as a best practice in and was common well before this controversy erupted. Now, it's even more important given deletion trends, as the vast majority of users don't delete cookies more frequently than weekly. We know approximately 99 percent of conversions for ad campaigns occur within the first week of an impression or click. In fact, the vast majority of conversions take place within hours of an impression or click.

Some more advanced agencies use a 3PAS to track ongoing marketing activity and tie it to the lifetime value of users delivered to a site via ad campaigns. When only a 3PAS is used for tracking, cookie deletion becomes a real issue. Because 3PAS cookies are the ones most likely to be deleted by anti-spyware tools, these results will likely be skewed over time.
Agencies prefer to track lifetime value with their own tools. It helps them demonstrate the value of their work to the advertiser, and they needn't rely on their client to provide this data (which could be a conflict of interest).

Most sophisticated advertisers measure lifetime value themselves, either with internal or Web analytics tools. Both typically use first-party cookies, rather than third, so they are deleted manually -- not by anti-spyware applications.

There's no reason agencies can't use one of these in addition to their 3PASs. But they make life a bit more complicated, and some advertisers don't want their agencies to have that much data on how their sites work.

What does the future hold? Will cookie deletion become a bigger issue? Yes, according to studies on more sophisticated Web users. Though these users understand cookies aren't dangerous, they delete them because they don't want to be tracked. We need a technology to replace cookies within the next few years, or much of the value we've built will crumble alongside the cookie.

A cookie replacement had better be consumer-friendly, not some underhanded method of tracking against users' will. It must be transparent, fair, and honorable -- or we're right back where we started.

If this issue interests you, join the folks at Safecount.org, as I have. Let's work together to solve the problem.

These aren't your Grandma's cookies.

Web cookies getting tougher

Computer tracking programs become more advanced

By Matt Marshall

Knight Ridder Newspapers

These aren't your Grandma's cookies.

And they aren't your traditional electronic cookies that created a file on your computer's hard drive when you visited a Web site. This file, or cookie, would record data about you, perhaps your password and preferences. More than a third of users have learned to delete these cookies from their computers each month.

Now there's a different batch of cookies -- they're newer, they're tougher and they stay around a lot longer. They come with PIE, or Persistent Identification Element, a little-known technology that evades cookie deletion. PIE hides within a little-known corner of your computer. And PIE re-creates itself even after a user deletes a cookie by making a backup copy.

Introduced in early April, PIE is the latest escalation in the cookie wars, and it's already creating a controversy among Web site operators and other industry players. Many are outraged, saying such aggressive tactics will spur users to distrust all cookies, and take drastic measures that will worsen the Web experience.

The furor started in March, when Eric Peterson, an analyst at Jupiter Research, revealed a survey that showed as many as 39 percent of online users may be deleting "cookies" from their primary computer at least monthly. Users aren't just doing it manually.

They're downloading anti-spyware software, which also erases many cookies, bringing the cookie deletion rate as high as 58 percent of users in a year, according to Jupiter.

Web sites use cookies for different things. They can simply assign a user number, or they include lots of things, like shopping cart information, so that you don't have to type it all in again when you return.

Trouble is, the spike in cookie deletions -- and it's a growing trend -- is causing alarm among Web site operators, who depend on the personal information to track crucial business metrics: customer count, number of return-visitors, their habits and preferences, performance by ads and a customer's reaction to them.

The advertising industry is facing some of the biggest impact from cookie deletions. Advertisers depend on "third-party" cookies, or those put on your hard drive by a partner of the Web site you visit -- such as advertisers. Anti-spyware software programs are increasingly deleting these.

"We're trying to get a handle on this," said Kevin Lee, founder of Did-it.com, which helps companies advertise online. He concedes there's a growing deletion trend, but says his company is still studying its magnitude. Still, he argues it's bad for users, who may be duped into thinking cookies are bad, when in fact most of them are good. "If the sky is really falling with cookies, the question is: If not cookies, then what?"

He and others point out that cookies only collect data from use of the site where the cookie was deposited from. But if users volunteer their name, sites can create an individual profiles of the users. Their privacy policies then govern what they do with that information, including information picked up from watching you surf other sites.

Lee's woes may seem irrelevant to users, many of whom couldn't care less about advertisements, and don't want anyone else tracking their behavior either. Most people do trust a few sites, though, including their favorite news site, shopping portal or banking institution. So why not just delete all cookies except for these trusted sites? Well, it isn't that easy.

Enter PIE.

It sounds cute, but PIE is a technology reviled by many, offered by a New York company called United Virtualities. Founder Mookie Tenembaum says he has already signed up "more than 10" customers using it.

Delivered by cookie, PIE hides in the "local shared objects" feature of the Macromedia Flash Player, a technology loaded on more than 98 percent of computers. It protects other cookies by making backup copies even if they are deleted.

PIE can only be shut off if a user decides to reject all cookies at the outset, Tenembaum says. But such a blanket rejection policy, which can be implemented by tinkering with a browser's settings, is a draconian step for most users; it means shutting down cookies for their favorite sites, too.

Which is why many people, including San Francisco's Macromedia, are fuming at United Virtualities' claims. "If they're saying they want to track people that don't want to be tracked, that's outrageous," said David Mendels, Macromedia executive vice president.

Jupiter analyst Peterson said he doesn't want to criticize a specific company, but said: "It tries to pull the wool over the consumers' eyes all over again."

One potential result, Peterson and others say, could be that consumers become so suspicious of all cookies, including the "flash cookies" on Macromedia's player, most of which are benign, that they will demand anti-spyware software programs that erase everything, flash cookies included.

But the local shared objects in Macromedia's Flash are in some ways superior to cookies for storing large amounts of legitimate information -- for example, storing video data of a sweater a user may have looked at while shopping online, so they can pull it up quicker if they go back.

Granted, United Virtualities' technology, announced March 31, is still young, and there is considerable confusion about its capabilities.

For example, Macromedia's Mendels insists the Flash Player gives you the option of rejecting all local shared objects, which presumably would include PIEs, though Macromedia couldn't guarantee that. (This would be the safest option: Once a user chooses it, they then might get prompts from their trusted sites when they visit again, asking for permission to deposit a shared object for that site only.) Tenembaum, meanwhile, declines to comment on whether or not PIEs can withstand Macromedia's blanket rejection setting. A spokesman said such information is "proprietary."

Macromedia also gives users a way of blocking particular sites, but there is no way yet of reliably knowing whether a site uses PIE. Most sites seeking a user's trust presumably wouldn't.

But many of the sites that create cookies or local shared objects have names that are difficult to recognize and researching information about them can be tedious. Few users have the patience to read a Web site's privacy policies, let alone do research on sites hidden in places like the Flash Player.

Still, Macromedia and other players say they're moving quickly to combat the confusion. Macromedia has issued directions to users on how they can control their settings (www.macromedia.com/go/flashprivacy), and has embarked on talks with the major browser developers, Microsoft and Mozilla, to find a way to give users a single place to adjust all their settings.

Did-It's Lee has called upon his colleagues in the online ad industry to urge an informational campaign to help users understand the technology.

Web "analytics" companies, which help corporations analyze their Web traffic, are scrambling, too. Jason Palmer, vice president of marketing and product management for WebTrends, says his company has shifted to a technology that doesn't rely on cookies.

When a cookie is deleted, WebTrends follows a user's behavior for a single session at a site by tracking their browser. It then factors in other things, like the user's so-called Internet Protocol address, and browser version. Together, the data can help a Web site make intelligent estimates of how many unique users they get over a short period -- say, a couple of weeks.

WebTrends has also found a way to shift the third-party cookies it has on clients' sites into first-party cookies by allowing clients to operate the cookies themselves -- thus avoiding the ire of anti-spyware software.

Tenembaum says United Virtualities' technology is doing its part, too. Anti-spyware companies have a financial incentive to hype the danger of cookies, so that they can sell more software -- something he says PIE aims to combat. Without cookies, sites will no longer be able to limit the number of times a user gets shown a particular ad, he argues. "I always celebrate people who disagree, even cursingly, about our technology," he said.

Tenembaum says he screens customers, turning away anyone he thinks would use the technology for dubious or unethical purposes. He has already rejected two ad network companies and one online publisher, he says.

Working to save the endangered cookie

Safecount's mission is to set standards for usage

By Lorraine Sanders

A Jupiter Research report in March found that 39 percent of consumers delete cookies at least once a month, and the effect was to set off alarms in the internet marketplace among both advertisers and those who operate ad-supported web sites। While the findings of the study are hotly debated--is it really as high as 39 percent?--there's no debate on the negative consequences if cookies are indeed endangered, cookies being a key advantage of the internet in terms of providing advertisers critical information on who sees their messages. Cory Treffiletti, managing director of Carat Interactive, and Nick Nyhan, president of research company Dynamic Logic, recently launched Safecount to address the growing concern of cookie deletion and the spyware and spam operators who are behind consumers' fear of cookies. Unless the industry develops standards for legitimate cookie usage, Treffiletti fears consumers will continue to delete them, and digital media will lose a powerful digital measurement tool. Media Life talks to Treffiletti about Safecount, its goals, and the controversy over cookies.


Who is behind Safecount?
Safecount is being launched by myself and Nick Nyhan। The initial idea came up in response to the various reports of users deleting cookies on their systems. Though these reports may be overstating the numbers, the issue is real and could become more significant if left to its own devices.

We developed the idea of putting together a forum for addressing digital counting and measurement methodologies and floated the idea out to a number of industry leaders, representing all of the major agencies and publishers, to see if there would be support. The response was unanimous and was officially launched at AdTech.
The entire industry will need to be behind Safecount in order for it to be effective, and our immediate goal is nothing less.


What are Safecount's top priorities?
Our first priority is to help aggregate the information related to cookie deletion and how it affects consumers and advertisers. Once we have aggregated the information, we will put together a coalition to help develop some recommendations for standards and parameters to be placed on the usage of cookies, or whatever other tool the industry deems to be acceptable, that will also be safe for consumers. We want to put in place a set of definitions, restrictions and parameters that will allow advertisers to effectively manage their inventory and target their consumer with relevant messaging while maintaining a safe and secure environment for the कोन्सुमेर।As we all know, the consumer is the central focus of today's advertising, and their control needs to be recognized. You cannot do things to harm the implicit trust in the consumer/advertiser relationship.
It is also important to note that this is not an issue that is endemic to the internet. As all media becomes digital and all media shifts to a model of accountability, this issue will broaden.
Our ultimate goal is to help establish a precedent that can be applied to other forms of media and still be beneficial to the consumer and the advertisers.


What are the specific digital media trends or industry practices that led you to found Safecount? What's going on in digital media that makes Safecount especially important right now, in spring 2005?


Spyware and spam are the primary elements that are creating an environment where consumers feel it is necessary to protect themselves.
There are a number of stripping technologies and other technologies that enter your system and delete any executable file or other file that was not placed there by the user.
Unfortunately, this includes cookies। If users start to delete their cookies on a large scale, not only will advertisers be unable to target them with messages that will be relevant, but they will have to increase the total number of ads that are on a page to ensure they are casting a wide enough net to reach their core target.

This will increase clutter and either result in a less enjoyable surfing experience or a shift to paid content where the user pays for the rights to see content without ads.
The other downfall of cookie deletion is that sites cannot monitor repeat visitors and will not tailor the experience. Amazon One-Click would no longer work and you would be forced to re-enter your information every time you make a purchase or sign up for information.


How are current digital media measurement, counting and tracking methods flawed?


The actual methods are not flawed but they are exploited by some companies. The methods themselves are working fine, but when the companies extract personally identifiable information, or are not compliant with industry standards and norms, then these issues arise.
There are, unfortunately, a very vocal minority of companies that are exploiting the consumer and making it hard for all those companies who are doing things well.


Why do digital media advertisers, researchers and consumers need Safecount?

They need some forum for aggregating a positive viewpoint and for raising awareness around the topic in a positive light. If left to their own, the media will focus on the fear of the consumer rather than the benefits of the tools.
Safecount, or any other organization, should be able to provide that forum and that opportunity to set standards.


What's the response to Safecount been like so far? How many people have signed the online petition?

The response has been fantastic. There has been a lot of coverage in the press and a few hundred people have come to the site and signed up. We are looking forward to many more people getting involved and wanting to help.


How will Safecount benefit digital media buyers and planners? Or better, how would Safecount's efforts impact a media buyer or planner's role in marketing digital media?

They probably won't affect a media buyer or planner on a regular day-to-day basis. They will affect the performance of the campaigns they are putting forth. They should help keep the measures in place that allow the campaigns to be effective and provide a strong ROI.
They will also affect the consumer by ensuring a positive experience with the web, and potentially with other forms of digital media.


You have an idea called the GoodList. Can you explain what that is and how it might benefit both consumers and advertisers?

The idea here will be to help put together a list of companies that meet the criteria that will be established by the industry, to help put together a list of the companies that are employing methods of safe counting and safe measurement.
This will only be established if the coalition of industry leaders comes to agreement that this is a good idea. If they think another method of addressing this topic would be more fruitful, then we will go in that direction.


What are consumers' major misconceptions about online advertising and, specifically, cookies?

We are going to try and do some research to discover this, but the hypothesis is that many consumers think online advertising is intrusive or that we are using their information to target them specifically. The rest of the consumer audience probably doesn't notice it. It's just like any other form of advertising. The audience is becoming immunized to our messaging due to clutter, and they are becoming more effective at tuning it out. The only way to break through that clutter is become relevant to them. If advertising provides relevant information to the consumer, then it is effective. It's no different for the internet than it is for TV.


It seems like consumers and advertisers are coming from two inherently different points of view. Consumers want an uncluttered online experience that doesn't invade their privacy, but advertisers need to collect information from consumers in order to deliver targeted ads without creating clutter. You're proposing a middle ground that benefits both groups. Can you describe what this middle ground might look like?

That middle ground is simple. It's where many companies are today. We are allowed to gather some basic information, none of which is personally identifiable, and we use it to provide the user with a targeted experience based on what they would like to see. The question is a funny one because in order to have an uncluttered experience, we need to know what they like, and therefore we need to obtain some information. When you go to the supermarket, the market only sells the products that its customers are buying, and they get rid of the things you don't want. It's the same online. We want to show the content that you want to see and get rid of the stuff you don't like. There is a strong amount of privacy in that relationship, and the ethical, compliant advertisers already know that. he consumer has all the strength here. If they don't like what an advertiser or a publisher is doing with their information, they tell the world and that company pays the price.


Are there any legitimate uses for spyware and spam? If so, what are they?

There certainly are, but I would not care to comment on that. That is part of what the coalition will need to address.

Print magazines undergo Audit Bureau of Circulations audits and have advertising pages and revenues reported through the Publisher's Information Bureau. Does Safecount.org intend to eventually become a similar industry body among digital media?

Eventually we hope to set a precedent, but for now we need to focus on what we can handle.

Cookie Issue Research Needs Behavioral Approach

By Tom Hespos

Not to belabor the issue, but my column from two weeks ago centered around a report from Atlas that claimed the sky wasn't falling on cookies, and that report has subsequently been corrected.

Reviewing the data accumulated for the last report, Atlas Director of Analytics Young-Bean Song took a deeper look at cookie lifespan distributions and found that the behavioral data from Atlas' study was in close agreement with earlier reports from Jupiter and others who took a survey-based approach to gauging the extent of the problem. While the sky may not be falling, the data confirmed that people who claim to delete their cookies regularly, generally do so.

This issue is incredibly complex for a number of different reasons:

The difference between what people say they do in a survey and what they actually do is worlds apart in some cases.
There are a number of ways to delete cookies, including erasing the files themselves and relying on a piece of software to do it on behalf of a user.
Computers can have multiple users, one of whom may be deleting cookies while others may not.
Users of anti-spyware applications or other privacy-oriented software may use them to delete cookies. In many cases, users may not actually be aware they're deleting them.
When significant differences can exist between reported behavior and actual behavior, as in cases like this, accuracy is best achieved by observing and reporting on actual behavior. A study based on observed behavior is the key to understanding the extent of the cookie deletion problem, and we need it as soon as we can get it.

While cookie deletion studies seem to be popular these days, with more research firms and analytics companies jumping on the bandwagon every day, I haven't yet seen anything that corrects for all of the problems I've outlined above. If we are to understand the extent of this problem, as well as how it evolves over time, direct observation of behavior is the way to do it.

In addition to understanding the extent of the problem, I'd like to know to what extent consumers are unknowingly erasing their ad server cookies through software packages they've installed to protect themselves from invasions of privacy or from spyware. It's become obvious to me, merely by observing the ways in which many anti-spyware and anti-virus packages handle ad server cookies, that they are often lumped into the same bucket as spyware and consumers may not be aware of what they're doing. My copy of one anti-spyware tool labels ad server cookies as "potential threats" and pre-checks them for removal from the system.

Put yourself in the shoes of the average consumer for a minute. If an anti-spyware tool tells you that you have a potential threat on your system, are you going to un-check it so that it won't be removed? Doubtful.

Now put yourself in the shoes of the anti-spyware software developer. Wouldn't identifying as many potential threats as possible make the consumer think that your software is superior to that of competitors? Perhaps this explains not only why ad server cookies are identified as threats, but also why many anti-spyware utilities call attention to each individual element of a spyware program when one mention will do.

In any case, what we need here is a study that is based on actual behavior. Behavior is the only trustworthy method by which we can gauge the extent of this problem.

'Cookies' Still a Growing Problem

"A lot of cookies are quite beneficial," said Jon Kuhn, a specialist in spyware and cookies in Sunnyvale, Calif. The problem is, like other technologies online that have beneficial uses -- e-mail being the primary example -- cookies can be abused by hackers and computer criminals.

Free Gartner Report: "Three Aspects of Real-Time Collaboration Integration." Find out why real-time collaboration tools, such as IM or videoconferencing, will yield the most value when integrated with asynchronous tools, such as e-mail, and with business processes.

Would anyone willingly download a file from the Internet that can track his or her movements online and provide that private information to advertisers?

Willing or not, experts told UPI's The Web chances are most Internet users already harbor many "cookies," or small data files, on their computer hard drives, giving marketers a glimpse of what they buy online, where they buy it and how much they spend.

"Cookies are a hot issue right now," said Ann Westerheim, president of Ekaru, an IT security consulting firm in the Boston area. "People have heard of cookies, but they are probably not aware of the fact that the files are being written to their hard disk."

Easing Access
Cookies developed innocuously enough back in 1995, when Netscape debuted its Web browser. The small text files -- similar in many respects to a Microsoft (Nasdaq: MSFT) Word document -- enabled customers to visit Internet sites without having to log in repeatedly.

"It can serve like an ID card for a Web site," said Brian Grayek, chief technology officer at Preventsys, an Internet security firm in Carlsbad, Calif. "The idea behind the cookie is incredible."

Without cookies, computer users would have to remember hundreds of passwords for many different sites they visit on a regular basis -- from Opinionjournal.com to Amazon.com -- which could be quite a hassle.

"A lot of cookies are quite beneficial," said Jon Kuhn, a specialist in spyware and cookies in Sunnyvale, Calif. "If you leave the cookie on at Amazon.com, they can remember you and tell you what books you've purchased, like mystery books, and recommend new mystery books to you."

The problem is, like other technologies online that have beneficial uses -- e-mail being the primary example -- cookies can be abused by hackers and computer criminals.

Security Loopholes
"Cookies are now part of the whole issue of Internet security and privacy," Westerheim said.

Some Web sites are retaliating against users who block cookies with their browser or remove them from their hard drive, Grayek said. Developers have created software to determine if a cookie is missing from a computer user's hard drive, and then return it to the user's system. A company called United Virtualities offers software for this purpose, but others have developed custom applications that accomplish the same thing.

"These are security loopholes -- they [represent] a certain level of risk whenever you go out on the Web," Westerheim said. "If you go to safe sites online, there will probably be no problem, but if you are downloading music or games, or worse, things like [reinstalling a deleted cookie] can happen."

Moreover, hackers can write cookies that can list and report all of the files on a user's hard drive. That information can be exploited to locate passwords or tap into money-management software, if it is not secure."Being a text file, cookies are open to abuse," said Grayek. "Hackers are glomming on to that."

To prevent hackers from infiltrating computers, experts advise taking a couple of precautionary steps.

Various Tactics
Kuhn, the cookie expert, said he has installed a program on his computer that encrypts part of the hard drive, where he stores all of his passwords for the programs he uses on the Web.

"That helps," Kuhn said.

Another tactic is not to use the same password for a number of different sites. If a hacker figures out one of them, that makes it easy to figure out others -- maybe accessing a credit card to make online purchases under the user's name and password.

"You need to have good cookie etiquette," said Kuhn. "Don't save the same passwords in critical applications."

Another tactic is to purchase spyware-blocking software that stops cookies sitting on a hard drive from disclosing other personal information. "You can block the outbound communication," Kuhn explained.

The primary tactic to adopt is for users to block most new cookies with their Web browser settings, Grayek said.

In the Microsoft Internet Explorer browser, go to the "tools" menu and select Internet options. Choose the privacy tab, and then press the advanced button, and then select "override automatic cookie handling."

To stop all cookies, select "block," Grayek said. The Firefox browser offers the same option, experts said.

"Most browsers have a 'preferences' area where you can turn cookies off," said Professor Ron Vullo, who teaches information technology at the Rochester Institute of Technology in New York.

Privacy, Security Configuration
Users must constantly upgrade their browsers and operating systems to make sure they can block the latest cookies.

"You have to keep up to date," said Westerheim, who holds a doctorate in engineering from the Massachusetts Institute of Technology .

David K. Mason, host of the radio show "ComputerTalk," said, "when a computer is configured properly for security and privacy, cookies are almost moot."

Experts said about 90 percent of Web sites use cookies but that number is starting to decline. Computer programmers are developing ways of delivering information on the Web to users without cookies.

"It takes a lot more work on the part of the Webmaster, though," Grayek said. "Banks and others like them are moving away from cookies."