ISPs May Be Selling Your Web Clicks

Mozzarella writes "Could our ISPs be selling our click data without us even knowing it? It seems like the practice is happening a lot more than we realize, and can be tracked for each user. Complete Incorporated's CTO David Cancel told Ars Technica that his company (an internet research firm) licenses click information from ISPs for 'millions of dollars' to figure out how we use the web. From the article: 'He did not give a specific figure about what this broke down to in terms of dollars per ISP user, although someone in the audience estimated that it was in the range of 40 per user per month — this estimate was erroneously attributed to Cancel himself in some reports on the event. Cancel said that this clickstream data is 'much more comprehensive' than data that is normally gleaned through analyzing search queries.'"

Comments

Is this legal?

[Raul654]

If this is being done without users' consent, then it strikes me as being dangerously close to wiretapping, which is illegal.

Re:Is this legal?

[vandon]

If this is being done without users' consent, then it strikes me as being dangerously close to wiretapping, which is illegal.

Remember that EULA you clicked 'I agree' on without reading?

Re:Is this legal?

[HomelessInLaJolla]

Even if the information isn't immediately personally identifiable it is fairly easy, through analysis of the cross-section of a few related databases, to make it so. It's just math and most cookies have some uniquely identifiable characteristic. Perhaps they can't tie information A with person B, but it isn't too difficult to tie information A to information C to information D and then cut the database down to people who have A, C, and D. Iterate if necessary.

Re:Is this legal?

[Anonymous Coward]

It's a good thing government agencies are only interested in inefficiency, pork-barrel contracts, and bloating their own budgets.

The cheap solution to implementing a surveillance state is to outsource.

Because corporations have no interest in inefficiency, pork-barrel contracts, and budget bloat, right?

Yes

[memeplex]

It is WITH user consent via the 99.9%-unread EULA. Compete could license data from say, NetZero, also funded by Charles River. Or maybe from Alexa toolbar-collected data, since the Alexa Research team all went to Compete around the year 2000. Read the EULA.

Seem reasonable. Almost

[value_added]

For his part, David Cancel told Ars that he "strongly supports an increase in the methods and degree to which disclosure is communicated," not only for clickstream data but for any kind of data collected on users' personal surfing habits.

Nicely put. I'd even go so far as to suggest it's even nicer than what we typically hear during White House press conferences.

He stated that "all users should be informed explicitly when their data can be sold to a third party."

The tricky part. A nice sounding pronouncement, but it sidesteps the issue of whether they are, and if so, to what extent, etc. And it overlooks what we should expect, which is typically a progression starting with a scandal, followed by a Mistakes Were Made apology, followed by calls to action and the scattered efforts of those affected but who otherwise have little say in the matter, and if we're lucky, a legislator giving a There Oughta Be a Law speech before some subcomittee.

I've often wondered what the cable companies are doing with respect to TV watching. On the one hand, it seems perfectly reasonable that they could devise a system whereby they could collect statistics on my viewing habits and sell them to Nielsen's. On the other, I'm not aware of whether they can, have plans to, or already do. Maybe someone more knowledgable can clue me in.

Re:So, who's going to be the first to...

[Dunbal]

With all due respect, their business is not evil.

    If they're really not evil then where is the harm in obtaining my consent first? Well?

Re:EULA doesn't always prevail

[DragonWriter]

If the EULA enforces things that a reasonable person wouldn't expect to find in a contract of this type, the unreasonable elements of the EULA may be found unenforceable by the courts.

Whether the right to sell data relating to your Internet use to third parties something a reasonable person would expect is debatable. Someone could challenge those portions of the EULA covering click info, on the basis that they are not to be reasonably expected in an end user license covering a contract for Internet access.

Since most of the time there is a separate "privacy policy" containing such provisions, and you have to separately acknowledge the privacy policy, and since it would be very hard to make the case that a reasonable person would not expect to find agreements as to what information would be protected as private and what information would be shared in a "privacy policy", I don't expect that that's going to be effective against most agreements.

Re:Who gives a rats ass?

[Jherek Carnelian]

It isn't just about your personal privacy. The way that society protects other people's privacy can affect your personal well-being.

The simplest example is when a group attains political dominance and is able to breach the privacy of anyone who challenges the status quo. If they can cause sufficient embarrassment or publicly humiliate anyone enough to make them unelectable, they can still appear to run open and fully democratic elections without risk of losing their grip on power.

Society as whole will stagnate and suffer under such conditions, and even if you personally have nothing to hide, chances are that you'll end up suffering too. Although you may not realize it since most people tend to accept that life is the way it is, never wondering if a better life could ever have been an option.