By Wendy Davis
The Federal Trade Commission is considering proposing a do-not-track mechanism that would allow consumers to easily opt out of all behavioral targeting, chairman Jon Leibowitz told lawmakers on Tuesday.
Testifying at a hearing about online privacy, Leibowitz said the FTC is exploring the feasibility of a browser plug-in that would store users' targeting preferences. He added that either the FTC or a private group could run the system.
Leibowitz said that while Web users on a no-tracking list would still receive online ads, those ads wouldn't be targeted based on sites that users had visited in the past.
Three years ago, a coalition of privacy groups including the World Privacy Forum, Center for Digital Democracy and Center for Democracy & Technology proposed that the FTC create a do-not-track registry, similar to the do-not-call registry. At the time, the online ad industry strongly opposed the idea of a government-run no-tracking list.
Currently, many people who want to opt out do so through cookies, either on a company-by-company basis or through the Network Advertising Initiative's opt-out cookie (which allows users to opt out of targeting from many of the largest companies). But those opt-outs aren't stable because they're tied to cookies, which often get deleted.
The Network Advertising Initiative recently rolled out a browser plug-in that enables consumers to opt out of targeted ads by NAI members.
Leibowitz also told lawmakers that he personally favored opt-in consent to behavioral targeting, or receiving ads based on sites visited. "I think opt-in generally protects consumers' privacy better than opt-out, under most circumstances," he said. "I don't think it undermines a company's ability to get the information it needs to advertise back to consumers."
Online ad companies say that behavioral targeting is "anonymous" because they don't collect users' names or other so-called personally identifiable information, but Leibowitz said that it might be possible to piece together users' names from clickstream data. He told lawmakers about AOL's "Data Valdez," which involved AOL releasing three months' of "anonymized" search queries for 650,000 users. Even though the company didn't directly tie the queries to users' names, some were identified based solely on the patterns in their search queries. Several lawmakers expressed concerns with behavioral advertising during Tuesday's hearing. Sen. Claire McCaskill (D-Mo.) said she was "a little spooked out" about online tracking and ad targeting.
McCaskill said that after reading online about foreign SUVs, she noticed that she was receiving ads for such cars. "That's creepy," she said, likening it to someone following her with a camera and recording her moves.
She added that if an "average American" were to learn that someone was trailing him around stores with a camera, "there would be a hue and cry in this country that would be unprecedented."
Sen. Jay Rockefeller (D-W. Va.) and Sen. John Kerry (D-Mass.) both expressed concern that privacy policies weren't giving Web users enough useful information about online ad practices.
Rockefeller proposed that some companies were burying too much information in lengthy documents that consumers don't read. "Some would say the fine print is there and it's not our fault you didn't read it," he said, adding, "I say, that's a 19th-century mentality."
Kerry added that he didn't know that consumers understood how companies use data. "I'm not sure that there's knowledge in the caveat emptor component of this," he said.
Wednesday, July 28, 2010
Privacy Lawsuit Targets Net Giants Over ‘Zombie’ Cookies
A wide swath of the net’s top websites, including MTV, ESPN, MySpace, Hulu, ABC, NBC and Scribd, were sued in federal court Friday on the grounds they violated federal computer intrusion law by secretly using storage in Adobe’s Flash player to re-create cookies deleted by users.
At issue is technology from Quantcast, also targeted in the lawsuit. Quantcast created Flash cookies that track users across the web, and used them to re-create traditional browser cookies that users deleted from their computers. These “zombie” cookies came to light last year, after researchers at UC Berkeley documented deleted browser cookies returning to life. Quantcast quickly fixed the issue, calling it an unintended consequence of trying to measure web traffic accurately.
Flash cookies are used by many of the net’s top websites for a variety of purposes, from setting default volume levels on video players to assigning a unique ID to users that tracks them no matter what browser they use. (Disclosure: The last time we reported on this issue, we found that Wired.com used one to set video preferences.)
The lawsuit (.pdf), filed in U.S. district court in San Francisco, asks the court to find that the practice violated eavesdropping and hacking laws, and that the practice of secretly tracking users also violated state and federal fair trade laws. The lawsuit alleges a “pattern of covert online surveillance” and seeks status as a class action lawsuit. The lawsuit was filed by Joseph Malley, a privacy activist lawyer who also played key roles in other high profile privacy lawsuits, including a $9.5 million settlement earlier this year from Facebook over its ill-fated Beacon program and a settlement with Netflix after the company gave imperfectly anonymized data to contestants in a movie recommendation contest.
“The objective of this scheme was the online harvesting of consumers’ personal information for Defendants’ use in online marketing activities,” wrote Malley, who called the technique “as simple as it was deceptive and devious.”
Unlike traditional browser cookies, Flash cookies are relatively unknown to web users, and they are not controlled through the cookie privacy controls in a browser. That means even if a user thinks they have cleared their computer of tracking objects, they most likely have not.
Adobe’s Flash software is installed on an estimated 98 percent of personal computers, and has been a key component in the explosion of online video, powering video players for sites such as YouTube and Hulu.
Websites can store up to 100 kilobytes of information in the plug-in, 25 times what a browser cookie can hold. Sites like Pandora.com also use Flash’s storage capability to pre-load portions of songs or videos to ensure smooth playback.
QuantCast was using the same user ID in its HTML and Flash cookies, and when a user got rid of the former, Quantcast would reach into the Flash storage bin, retrieve the user’s old number and reapply it so the customer’s browsing history around the net would not be cut off.
Quantcast’s behavior stopped last August, after Wired.com reported on the research from then-grad student Ashkan Soltani.
Quantcast is used by thousands of sites to measure the number of unique visitors and to get information on the kinds of people visiting their site — athletic, older, interested in food, etc.
The lawsuit seeks unspecified damages and a court order requiring the companies to delete data collected, stop the practice in the future and provide an easy way to opt out.
All modern browsers now include fine-grained controls to let users decide what cookies to accept and which to get rid of, but Flash cookies are handled differently. These are fixed through a web page on Adobe’s site, and the controls are not easily understood (There is a panel for Global Privacy Settings and another for Website Privacy Settings — the difference is unclear). In fact, the controls are so odd, the page has to tell you that it actually is the control for your computer, not just a tutorial on how to use the control.
Firefox users can prevent or delete Flash cookies using a free add-on called BetterPrivacy.
Scribd, Hulu, and ESPN both declined to comment, saying they had not yet been served with the lawsuit.
Quantcast and MTV’s parent company, Viacom, did not respond to requests for comment.
The case number is 10-CV-5484, U.S. District Court for the Northern District of California.
By Ryan Singel, wired.com
At issue is technology from Quantcast, also targeted in the lawsuit. Quantcast created Flash cookies that track users across the web, and used them to re-create traditional browser cookies that users deleted from their computers. These “zombie” cookies came to light last year, after researchers at UC Berkeley documented deleted browser cookies returning to life. Quantcast quickly fixed the issue, calling it an unintended consequence of trying to measure web traffic accurately.
Flash cookies are used by many of the net’s top websites for a variety of purposes, from setting default volume levels on video players to assigning a unique ID to users that tracks them no matter what browser they use. (Disclosure: The last time we reported on this issue, we found that Wired.com used one to set video preferences.)
The lawsuit (.pdf), filed in U.S. district court in San Francisco, asks the court to find that the practice violated eavesdropping and hacking laws, and that the practice of secretly tracking users also violated state and federal fair trade laws. The lawsuit alleges a “pattern of covert online surveillance” and seeks status as a class action lawsuit. The lawsuit was filed by Joseph Malley, a privacy activist lawyer who also played key roles in other high profile privacy lawsuits, including a $9.5 million settlement earlier this year from Facebook over its ill-fated Beacon program and a settlement with Netflix after the company gave imperfectly anonymized data to contestants in a movie recommendation contest.
“The objective of this scheme was the online harvesting of consumers’ personal information for Defendants’ use in online marketing activities,” wrote Malley, who called the technique “as simple as it was deceptive and devious.”
Unlike traditional browser cookies, Flash cookies are relatively unknown to web users, and they are not controlled through the cookie privacy controls in a browser. That means even if a user thinks they have cleared their computer of tracking objects, they most likely have not.
Adobe’s Flash software is installed on an estimated 98 percent of personal computers, and has been a key component in the explosion of online video, powering video players for sites such as YouTube and Hulu.
Websites can store up to 100 kilobytes of information in the plug-in, 25 times what a browser cookie can hold. Sites like Pandora.com also use Flash’s storage capability to pre-load portions of songs or videos to ensure smooth playback.
QuantCast was using the same user ID in its HTML and Flash cookies, and when a user got rid of the former, Quantcast would reach into the Flash storage bin, retrieve the user’s old number and reapply it so the customer’s browsing history around the net would not be cut off.
Quantcast’s behavior stopped last August, after Wired.com reported on the research from then-grad student Ashkan Soltani.
Quantcast is used by thousands of sites to measure the number of unique visitors and to get information on the kinds of people visiting their site — athletic, older, interested in food, etc.
The lawsuit seeks unspecified damages and a court order requiring the companies to delete data collected, stop the practice in the future and provide an easy way to opt out.
All modern browsers now include fine-grained controls to let users decide what cookies to accept and which to get rid of, but Flash cookies are handled differently. These are fixed through a web page on Adobe’s site, and the controls are not easily understood (There is a panel for Global Privacy Settings and another for Website Privacy Settings — the difference is unclear). In fact, the controls are so odd, the page has to tell you that it actually is the control for your computer, not just a tutorial on how to use the control.
Firefox users can prevent or delete Flash cookies using a free add-on called BetterPrivacy.
Scribd, Hulu, and ESPN both declined to comment, saying they had not yet been served with the lawsuit.
Quantcast and MTV’s parent company, Viacom, did not respond to requests for comment.
The case number is 10-CV-5484, U.S. District Court for the Northern District of California.
By Ryan Singel, wired.com
Friday, July 23, 2010
IAB, Consumer Advocates Weigh In On Privacy Laws
A senior Republican lawmaker expressed concern on Thursday that a privacy bill introduced by Rep. Bobby Rush (D-Ill.) could impose too many restrictions on businesses.
"We must craft legislation that creates an incentive for businesses to subscribe to the very best practices," Rep. Cliff Stearns (R-Fla.) said at a hearing on Rush's proposal. Stearns criticized several aspects of Rush's bill, including that it would allow consumers to bring lawsuits against companies that violate the law, and that it delegates too much power to the Federal Trade Commission.
Stearns had signed on to an earlier proposal floated in May by Rep. Rick Boucher (D-Va.), which differs in a few key ways from Rush's bill the Best Practices Act (H.R. 5577).
Rush's measure would require Web companies to obtain users' explicit permission before sharing their personal information with third parties, unless those companies participate in a "universal opt-out" program operated by a self-regulatory program and overseen by the Federal Trade Commission. Rush also would allow consumers to sue privately for up to $1,000 per violation, with damages capped at $5 million per incident.
Boucher's slightly different proposal would require ad networks that track people and collect personal information for ad purposes to obtain users' opt-in consent, unless the networks provide prominent notice through an icon and also allow people to view and edit their profiles. Boucher also would ban private lawsuits.
Rush's bill, like Boucher's, doesn't just cover personally identifiable information like names and addresses, but also applies to supposedly anonymous information, including Web users' marketing profiles that are associated with cookies on their computers. But unlike Boucher's proposal, Rush's measure also tasks the FTC with further defining the type of data that is covered by the bill.
At Thursday's hearing, Rep. Ed Whitfield (R-Ky.) asked whether the collection of anonymous browsing activity should "require the same level of consent" as collecting material like names and financial account numbers.
Two privacy advocates on the panel, Ed Mierzwinski, program director of the U.S. Public Interest Research Group, and Leslie Harris, president and CEO of the Center for Democracy & Technology, indicated they believed the answer was yes, because of the possibility that people could be identified based on "anonymous" information.
"We're concerned that de-identified or supposedly anonymous information can be repackaged back together," Mierzwinski said.
But the Interactive Advertising Bureau's Vice President for Public Policy Mike Zaneis said that Congress shouldn't try to legislate about activity that was only theoretical. He said that it isn't the "predominant business model" to connect clickstream data to personally identifiable information.
Whitfield also asked whether requiring users' opt-in consent to data collection would hinder online businesses.
Federal Trade Commission Consumer Protection Chief David Vladeck said that the most important consideration isn't whether companies obtain opt-in or opt-out consent, but whether they are adequately notifying consumers about data collection. "The goal ought to be to keep consumers well-informed," he said. "Clarity and ease of use ought to be the key metrics."
"We must craft legislation that creates an incentive for businesses to subscribe to the very best practices," Rep. Cliff Stearns (R-Fla.) said at a hearing on Rush's proposal. Stearns criticized several aspects of Rush's bill, including that it would allow consumers to bring lawsuits against companies that violate the law, and that it delegates too much power to the Federal Trade Commission.
Stearns had signed on to an earlier proposal floated in May by Rep. Rick Boucher (D-Va.), which differs in a few key ways from Rush's bill the Best Practices Act (H.R. 5577).
Rush's measure would require Web companies to obtain users' explicit permission before sharing their personal information with third parties, unless those companies participate in a "universal opt-out" program operated by a self-regulatory program and overseen by the Federal Trade Commission. Rush also would allow consumers to sue privately for up to $1,000 per violation, with damages capped at $5 million per incident.
Boucher's slightly different proposal would require ad networks that track people and collect personal information for ad purposes to obtain users' opt-in consent, unless the networks provide prominent notice through an icon and also allow people to view and edit their profiles. Boucher also would ban private lawsuits.
Rush's bill, like Boucher's, doesn't just cover personally identifiable information like names and addresses, but also applies to supposedly anonymous information, including Web users' marketing profiles that are associated with cookies on their computers. But unlike Boucher's proposal, Rush's measure also tasks the FTC with further defining the type of data that is covered by the bill.
At Thursday's hearing, Rep. Ed Whitfield (R-Ky.) asked whether the collection of anonymous browsing activity should "require the same level of consent" as collecting material like names and financial account numbers.
Two privacy advocates on the panel, Ed Mierzwinski, program director of the U.S. Public Interest Research Group, and Leslie Harris, president and CEO of the Center for Democracy & Technology, indicated they believed the answer was yes, because of the possibility that people could be identified based on "anonymous" information.
"We're concerned that de-identified or supposedly anonymous information can be repackaged back together," Mierzwinski said.
But the Interactive Advertising Bureau's Vice President for Public Policy Mike Zaneis said that Congress shouldn't try to legislate about activity that was only theoretical. He said that it isn't the "predominant business model" to connect clickstream data to personally identifiable information.
Whitfield also asked whether requiring users' opt-in consent to data collection would hinder online businesses.
Federal Trade Commission Consumer Protection Chief David Vladeck said that the most important consideration isn't whether companies obtain opt-in or opt-out consent, but whether they are adequately notifying consumers about data collection. "The goal ought to be to keep consumers well-informed," he said. "Clarity and ease of use ought to be the key metrics."
Subscribe to:
Posts (Atom)