A large number of commercial companies now track users' browsing across the web, in order to profile them, and then serve them targeted advertising. This so called behavioral advertising is a threat to the average user's privacy.
An industry group, The Network Advertising Initiative, provides an easy way for users to opt-out of the tracking performed by its member companies. Users can visit a single web page, and then easily set opt-out web cookies for all of the NAI members advertising networks.
The problem with this is that the moment a user clears his or her cookies, they also lose the opt-out cookies. Regularly clearing browser cookies, or better, setting the browser to erase them all at the end of a session, is a recommended practice. Unfortunately, by doing this, users are then required to re-visit the NAI opt-out page each time they start browsing the web. This is obviously not a reasonable thing to expect.
Google recently announced that it would be engaging in the large scale collection and use of targeted advertising information. However, in addition to offering an opt-out cookie, the company has also developed a Firefox add-on, so that users can maintain the opt-out cookies, even if they regularly erase the other cookies.
Google should be commended for releasing such a useful privacy enhancing technology (even though their use of targeted advertising is creepy, and should be prohibited by the FTC). If only this add-on could be used to protect people from the prying eyes of the other advertising networks.
Since Google released the Firefox-addon as an open-source project (under the Apache 2.0 license), I have forked the code, and added in the opt-out cookies of 16 other advertising networks.
By installing this add-on, you will receive long-term opt-out cookies for the following NAI member advertising networks:
- Google / Doubleclick
- Collective Media
- Acerno
- Turn
- Next Action
- Audience Science
- BlueLithium
- Advertising.com
- [x+1]
- Fox Audience Network
- AlmondNet
- Safecount
- Tacoda Audience Networks
- Traffic Marketplace
- Tribal Fusion
- Undertone Networks
The Bad News
All of the above companies use a cookie similar to "OPT_OUT=1". Unfortunately, some other NAI member companies force a unique tracking ID upon users in the process of opting out of the targeted ad tracking. That is, in addition to an "OPT_OUT=1", they'll also force a "USER=12345678" cookie, which could enable them to uniquely track visitors to their site.
For example, when trying to opt out of Yahoo's tracking, I was given the cookie
B=c97l3894rlqpf&b=3&s=cf.
Similarly, Akamai gave me this cookie
AOOC=368398094.
Simply put, we shouldn't have to trust these companies to not track us. Users should not be given unique IDs in order to opt-out.
The following companies force unique IDs upon users wishing to opt-out. This add-on does not currently provide opt-out functionality for these networks, since I don't want to encourage their sketchy ways. Hopefully, being listed here might shame them into providing a more pro-privacy way of opting out.
These companies are:
- Akamai
- Atlas
- Blue Kai
- BlueLithium
- FetchBack
- Interclick
- MindSet Media
- Media 6 Degrees
- 24/7 Real Media
- Specific Media
- Yahoo
Disclaimer: This code is based on the Advertising Cookie Opt Out Plugin by Valentin Gheorghita, a Google Engineer. It was not sanctioned by Google, the Network Advertising Initiative. While the folks at the Berkman Center (who pay me) are huge supporters of privacy, I have done this in my personal capacity, and this is not an official blessed Berkman project.
5 comments:
I think that this is not really the best way to go about this; better, instead, is to block the tracking cookies themselves. This is probably more difficult, however. I do find that, with an easy way to turn cookies on and off on my toolbar, I can generally leave them off and only enable them when I feel I want to set some new ones. If, in Firefox's cookies settings, you set "Keep until" to "ask me every time," for each cookie you can chose whether or not to accept it, and whether or not automatically to accept future cookies from that site (which will still be enabled even when you later disable "accept cookies from sites."
Of course, this doesn't help if you are using a site that tracks you with your session or login cookie, where is where opt-out cookies may be helpful, in addition.
Also keep in mind that you can also be tracked through various JavaScript techniques. I use the NoScript plugin and keep google-analytics.com in the "untrusted" list.
What are the advantages of using an "opt out cookie" over blocking the cookie in the first place?
So, by using this software, I still have to view advertising, only now it will be for random stuff in which I don't have any interest? That's just silly.
If I'm going to have to view advertising, it might as well be for things that I may want to buy.
I think we're taking the paranoia of the "evil corporation" to new heights here. What's the worst thing a corporation can do to me, persuade me to buy a pair of jeans that I really didn't need? Oh how horrible!
You want to be afraid of someone? Be afraid of your government - they are the ones with all the guns, tanks, and nuclear weapons - they can kill you and get away with it.
the existence of guys who MIGHT kill me (government) is not a reason to ignore the guys who DO stalk me every day (while of course ALSO not ignoring the government). So: Thanks for the plugin!
Do I see it correctly that the plugin works even with cookies disabled for the ad network domains?
This could be used as a defense in depth: Block the ads (adblock/hosts file), block their cookies (for the case adblock has to be disabled and the hosts file fails for example because of a proxy), and if that fails (misconfiguration etc.) there is still the opt-out.
Anonymous two above, you're seeing only part of the issue. There are certainly many particular cases where a single corporation (or other entity) collecting limited data about you is not much of a threat. But data, once stored, can spread (via sale, theft, or other means) and be combined with other stores of data about the same individual. This can cause what was a minor threat to privacy to turn into a major one.
Post a Comment