Cookies, Ad Banners, and Privacy

Because you're reading Slashdot, you probably know that client-side cookies are perfectly safe. They don't contain any code that gets executed by your computer, and there are limits to keep them from filling up your hard drive. Just as importantly, no server can read another server's data, each site reads only its own cookies, and you don't have to worry about privacy. If you don't want a site to know anything about you, you don't tell that site anything. Simple. Or is it?

When Netscape embraced-and-extended the HTTP spec in 1995, it was really just trying to digitize the shopping cart. Allowing a server to store just a few bits on the client added almost no overhead and it made many applications, such as shopping carts, very convenient.

Maybe it was deliberate; maybe nobody really cared; or maybe it was an engineer's simple distaste for tweaking a spec too much: but they allowed cookies to hang off GIFs as well as HTML, and that changed everything. There were probably ten people in the: world at that point who could have foreseen the explosion in banner ad traffic, yielding a multi-billion-dollar industry in less than five years.

Yes, billion -- the large banner-ad company DoubleClick merged with database firm Abacus Direct last year in a billion-dollar stock swap. How much is a billion dollars worth of advertising revenue on the net? At DoubleClick's current rate, it's about 750 billion banner ads. Think of it as four petabytes of GIFs.

And the vast majority of those GIFs just get ignored. When's the last time you clicked a banner? There aren't any precise figures, but the consensus is that the average click-through rate is dropping. Three percent click-through used to be good. Now a well-targeted ad will be happy to get one or two percent. It's hard work to make money from banners, and getting harder every day.

That's why DoubleClick, and firms like it, need to maximize their efficiency. Their income ends up depending on that click-through rate. The higher they can raise that number, the more they can justify charging their clients. Sending targeted ads becomes critical. And the only way to target you is to learn more about you.

The GIF cookie loophole makes this pretty easy. The first banner ad that your browser requested from a banner-ad company got a user ID cookie sent back with it. And - here's the key - since so many banner GIFs all come from the same company's domain name, your browser sends back the same user ID no matter which website you're viewing the banner on. Your user ID is being tracked all over the web.

In the case of DoubleClick, that's a fair number of sites. They won't talk to you unless you serve a million impressions a month - and their network includes 651 publishers which translates to who-knows how many websites. All told, they deliver a billion ads every two days.

Though the Internet Movie Database can't tell where else you've been on the web today, the company delivering its banners knows. That same company knows if you read National Review, TeenMag, or Dilbert. It knows if you're into professional wrestling or what cruises you were looking at on Travelocity. It even has some of your click history through WebMD.com.

The comforting thing has always been that, while the corporation may be able to follow your footprints around the web, at least they haven't known it's you who's making them. The disconcerting thing is, that's about to change.

Remember that billion-dollar merger between DoubleClick and the database company? This database company doesn't sell software. Abacus Direct uses databases to store names, addresses, and other information about people. In offices across the country, their computers have information on two billion purchases made from 1,100 separate consumer catalogs over the years, "representing virtually all U.S. consumer catalog buying households." Their CEO brags,

"Through the sophisticated use of state-of-the-art technologies and modeling techniques, Abacus' outstanding ability to synthesize vast amounts of data into valuable insights about individual consumer buying behaviors has proven itself to be an important marketing tool for our age."

That's why it's very interesting that DoubleClick's privacy policy changed earlier this month. Its text used to read:

"DoubleClick does not know the name, email address, phone number, or home address of anybody who visits a site in the DoubleClick Network. All users who receive an ad targeted by DoubleClick's technology remain completely anonymous."

That promise is gone without a trace from the new policy. The new policy reads:

"In the course of delivering an ad to you, DoubleClick does not collect any personally-identifiable information about you, such as your name, address, phone number or email address."

Of course not. In delivering the ad, DoubleClick just collects your user ID. It probably already has your name, address, phone number and email address, somewhere in the Abacus database.

A little further down is the portent of things to come. There is "one particular Web publisher" in their network which collects a "log-in name and demographic data about users." Which publisher is that? They don't say.

Whoever it is, you may already have given it your name and address, perhaps to register for a contest, or maybe in exchange for reading its free content. Everyone does it; it's a small price to pay. DoubleClick is already combining their demographic data (your name and address) with its own database (your viewing and clicking habits) in order to deliver more-targeted ads on this one website.

And if their programmers do their jobs right, it'll end up being a simple SQL query to join up your user ID, the name you gave the mysterious web publisher, your Abacus demographic data and catalog purchases, and the footprints you've left all over the net for the past two years, into a single big lump of your online/offline data.

To be fair, their privacy policy promises they won't start doing this without, er, changing their privacy policy:

"...should DoubleClick ever match the non-personally-identifiable information collected by DoubleClick with Abacus database information, DoubleClick will revise this Privacy Statement to accurately reflect its modified data collection and data use policies and ensure that you have adequate notice of any changes and a choice to participate."

Aren't you glad that, when DoubleClick revised its privacy statement on October13,1999, you were given adequate notice of how you were being tracked across the internet? (They've sent out 46 press releases so far this year. Informing you about weakening your privacy wasn't one of them.)

Things aren't as bad as they could be. One fortunate thing is that the banner-ad market isn't a monopoly yet. Not even close. Adbility lists over fifty ad networks, of which DoubleClick is just one of the larger ones (probably the largest).

But, when any rapidly expanding market starts to level off, the smaller and less-efficient companies get eaten. Nobody knows when the internet's growth curve will hit that point, but exponential expansion can't continue forever. At some point, the companies that can't send banner ads targeted to your community will get left behind. We'll end up with two, maybe three, meganetworks that deliver a large majority of the world's banner ads.

What can you do about it? To protect your own personal privacy, opt out of DoubleClick's cookies. Of course, this doesn't affect other banner-ad companies, who may or may not even offer this solution once they get as big as DoubleClick. It also doesn't help novice websurfers like your grandmother, who doesn't understand why she should refuse free cookies. More importantly, it can't ever be a real answer - if more than a tiny percentage of their audience ever opted out, DoubleClick would see the competitive advantage of their billion-dollar merger start to erode, and that'd be the end of that option.

What makes more sense is to close the cookie loophole. DoubleClick isn't the real problem; the HTTP spec is the problem. The browsers should change their implementation of cookies so that, by default, foreign sites can't send me cookies along with their GIFs. Why should cookies be allowed onto my hard drive if they aren't attached to the page I'm viewing?

Since DoubleClick's privacy policy claims that cookies "are not essential for us to continue our leadership," they should have no problem supporting this as the default behavior of every major web browser.

Comments

Advertising in general

[Anonymous Coward]

The biggest problem I have with modern society is this amazing notion that, as an gestalt entity, it seems to have that my desire to own a product is not the result of my own thought processes. It's not that I don't want a subscription to a web-based pornography emailer, it's simply that it hasn't been advertised enough at me. If they could just, just, just tell me about it, just a few more times, I'll suddenly want the damn thing.

I don't want a Ford Escort, no matter how often you tell me it's stylish, I don't believe that Lotus makes "super.human.software" no matter how often I'm told. A deceit is a deceit however often it's repeated.

Banner adverts and targetted marketing are perfect examples of this. The reason I don't click through SlashDot's banner adverts for CodeWarrior is that I don't want the blasted thing. It doesn't matter how often you deliver the image to me, I still don't want the thing.


How long is it going to take before people stop making things people don't want and trying to convince them that they do ever more streneously...

Will we still have a culture left by then? Or will we end up, tired of advertising, and left wondering what we had to fill the world before it?
Or are we already there?

When was the last time salesman spoke truth to customer? Does anyone remember?



I am a person. I will decide if I want your product. The frequency of you telling me about it is not a factor. Learn.

[sillywiz]

IMG SRC cookies needed

[Chemical Serenity]

By removing cookies from IMG SRC tags (or any of the other methods of obtaining a cookie via HTTP), the browser maker would be breaking a LOT of sites, not just the banner ad sites. Cookies are damned convenient, and sometimes the MOST convenient way of implementing them is through a nice, clean self-contained IMG... for example, if you're trying to implement a link exchange or some other similar system where knowing how many times your 'message' has been seen is important, IMG SRC is by far the cleanest way to implement it.

Paranoid direct-marketing reasons shouldn't be used as a reason to break perfectly acceptable behaviour in a browser (especially a behaviour that has generated a multi-billion dollar industry!)... yes, there are people collecting information about you in order to more efficiently sell you things. There's people collecting information about your power consumption, long distance usage and a host of other things too, not to mention the government going through your spending habits for whatever purposes they have (probably tax related ;).

Having done my time in surveillance/counter-surveillance circles, I can honestly say that what most people consider as privacy is the most widely-hyped and catered-to fictional ideal of all time. Anyone can find out anything about anyone else, so long as they have the time, money and talent to do it. What most people consider as privacy would best be described as obscurity... lost in a sea of other dull, obscure people leading a life too dull to be of any concern to anyone (except perhaps ad banner people and spammers ;).

--
rickf@transpect.SPAM-B-GONE.net (remove the SPAM-B-GONE bit)

It's not the advertisers that matter ...

[charlie]

Targeted advertising isn't the real problem with data mining; it's other organisations trying to automate the process of "knowing their customers".

Example: you visit an AIDS awareness web site, then hop over to Amazon.com and buy a book about living with HIV. You do this because your kid sister has a friend who is HIV positive and wants to know more about it and asked you to do her a favour.

Years later, you put in an application for life assurance to cover your endowment mortgage ... and the life assurance company turns you down. Seems their data mining brought up a warning flag: "buys material about living with AIDS, visits AIDS awareness websites". Ergo, their expert system deduces that you may have HIV (a very bad life insurance risk!).

Admittedly, this sort of abuse shouldn't be possible if proper privacy laws are in place. But in the USA, there are no effective consumer privacy laws (hence the current fracas with the EU, which is bringing in reasonable ones). Nothing stops your insurance company from buying the DoubleClick net's database to check against health risks; it's not information subject to medical confidentiality, is it?

This is a relatively mild example of how data mining can go wrong. Much, much worse things can happen to you -- comp.risks is full of examples of people being arrested and dragged off to prison because they share the same name and birthday as a wanted felon, or similar cases of public officials putting their trust blindly in a database that has had information indiscriminately shovelled into it.

If we bring political or governmental issues into it, it gets even worse -- imagine, for example, if your local police force starts looking for people who have looked at web sites with details of how to pick locks and who are not registered locksmiths. Sound outrageous? Of course it is -- until it happens.

Privacy is a fundamental human right; and one that is barely protected by law here in the EU, and utterly inadequately protected in the US.

Re:It's not the advertisers that matter ...

[guardian-ct]

As Sun's CEO, (Scott McNealy?) once said...
"You have no privacy, get over it."

The problem is that most CEOs do not have much in the way of privacy, what with journalists and photographers following them around with tape recorders and cameras, and security personell protecting them from unwanted attentions.

This lack of corporate director privacy encourages them to ignore the feelings of those who do have a small amount of privacy already, and make it truly difficult to remain unknown and still get the services provided by the corporation.

Slashdot itself is somewhat guilty of this. Everybody knows that Rob has an email address. Most who read Slashdot know how to find it, and probably send him enough email that he's swamped. At least occasionally, he's followed by reporters.
So, we end up with a login system that's not only extraordinarily complex and customizable, but also cookie powered and easily trackable. If Rob wants to find out what I read today, he probably can do so fairly easily. He can tell me that he's not, and won't, and that the software system that Slashdot uses is designed to prevent tracking (No, he hasn't told me this.) There's no proof one way or the other, unless there's tracking in the current Slash release.

Oh, and targetted ads... To DoubleClick, the-dma.org, et al, go away. I'm not a target, I'm a human being, and I despise being treated as another datapoint to be aimed at. Sure, I am a statistic. That doesn't mean I like it, or that I want to be treated as one by a bunch of corporations.

A low amount of privacy is no excuse for reducing privacy further.

The real privacy zealots will not be posting to Slashdot, or anywhere else on the net.

Re:Junkbuster is the way to go

[Imperator]

Junkbuster is an HTTP proxy that can filter out ad banenrs, cookies, referers, and other things that you find objctionable.

The original: http://www.junkbuster.com/

The version I use: http://www.waldherr.org/junkbuster/

I prefer the latter because, well, look at the site and you'll see. Regardless, I urge you to install and use it.

Don't like it? Opt out.

[legoboy]

This URL sets a cookie which allows you to opt out of doubleclick.net's tracking. http://ad.doubleclick.net/cgi-bin/optout?

------

Why opt out? Do it hacker-style...

[osolemirnix]

Allow cookies in Netscape. Change the cookies file permissions to read-only. Cookies will live only as long as Netscape/whatever is running, all the shopping carts work fine. When you exit, your cookies will not survive. The next time you get a DoubleClick ad your record is clean and the system gives you a new id since it thinks you are a new user. This will not only prevent them from logging you, it will also make their database explode... problem solved