I sent this FOIA request (pdf) to to the Office of Administration today.
Essentially, I'm asking for a copy of all of the whitehouse.gov Web server logs, any analytics reports, data/log retention policies, as well as information on the amount of money paid by the White House for its use of Akamai and Amazon S3.
It'll be interesting to see how the White House counsel responds.
Friday, March 27, 2009
One Man's War on Advertising
I can happily report that two more companies, Blue Kai and Media Math, have in the last few days modified their advertising systems to now use non-identifiable opt-out cookies. Hurrah.
I've received unofficial word that at least one other company is making a similar switch. One by one, most of the online advertising companies are realizing that identifiable opt out cookies are bad for consumers, and more importantly, really bad PR for them.
Expect a new version of TACO in the next few days, incorporating these new opt-out cookies.
As the weeks go on, I wouldn't be surprised to see that initial list of 17 bad advertisers shrink.... to just two: Microsoft and Yahoo. These firms are the largest of the offenders, are slow unwieldy corporations which are unable to turn on a dime, and in some cases, simply don't see why they should be forced to stop tracking users.
If we do get to a point where only these mega advertising titans are refusing to provide consumers with an anonymous way of opting out of tracking and targeting, progress may depend upon legislators showing a bit of interest in the topic.
---------------
In other news, Jim Harper @ CATO took another good-natured another whack at me this week.
Writing at the Tech Liberation Front, he stated that:
To say that I am solely focused on advertisers is unfair and incorrect. I wish to avoid being tracked by all parties, be they Facebook, the RIAA, online advertisers, or the US Government (remember, after all, the name of this blog). However, while the advertising industry has collectively provided consumers with a mechanism to opt-out of their more creepy practices (albeit one that is difficult to use), other would-be-watchers have not.
If Mr. Harper is aware of an opt-out cookie that I can load into my browser to opt myself out of the National Security Agency's illegal monitoring of domestic Internet traffic, I hope that he will let me know.
I will be the first to admit that privacy on the Internet sucks. I wish it were better. I wish we didn't have evil telecom companies who believe that they can monetize their customers' web browsing habits. I wish our government, even with the new President, respected the Fourth Amendment.
I am not claiming that my TACO add-on is perfect, or that it solves all of the privacy issues on the web. It is a specific technical solution for a particular policy problem. It is not a comprehensive solution to all the woes of web privacy -- it is just a way, I believe, for the little guy to reclaim a tiny little bit of that long forgotten right to be left alone.
Later on, Mr. Harper asserts that I am calling for new legislation:
Perhaps I was unclear in my previous post, but I do not believe that new legislation is required to go after advertisers who continue to engage in targeted advertising even after the user has opted out. The FTC has a clear legal mandate to go after those who engage in deceptive and unfair business practices. Advertisers who ignored their own opt-out cookies would seem to be engaging in an unfair and deceptive way. I would argue that the FTC already has all the authority it needs to go after such firms.
I've received unofficial word that at least one other company is making a similar switch. One by one, most of the online advertising companies are realizing that identifiable opt out cookies are bad for consumers, and more importantly, really bad PR for them.
Expect a new version of TACO in the next few days, incorporating these new opt-out cookies.
As the weeks go on, I wouldn't be surprised to see that initial list of 17 bad advertisers shrink.... to just two: Microsoft and Yahoo. These firms are the largest of the offenders, are slow unwieldy corporations which are unable to turn on a dime, and in some cases, simply don't see why they should be forced to stop tracking users.
If we do get to a point where only these mega advertising titans are refusing to provide consumers with an anonymous way of opting out of tracking and targeting, progress may depend upon legislators showing a bit of interest in the topic.
---------------
In other news, Jim Harper @ CATO took another good-natured another whack at me this week.
Writing at the Tech Liberation Front, he stated that:
Chris is deeply focused on advertisers and his dislike of being tracked by advertisers. Though it is not absolute, I have a preference against tracking by anyone other than sites that I know, like, and trust. I’m no more worried about advertisers than any entity that would track my surfing - and there are many.
To say that I am solely focused on advertisers is unfair and incorrect. I wish to avoid being tracked by all parties, be they Facebook, the RIAA, online advertisers, or the US Government (remember, after all, the name of this blog). However, while the advertising industry has collectively provided consumers with a mechanism to opt-out of their more creepy practices (albeit one that is difficult to use), other would-be-watchers have not.
If Mr. Harper is aware of an opt-out cookie that I can load into my browser to opt myself out of the National Security Agency's illegal monitoring of domestic Internet traffic, I hope that he will let me know.
I will be the first to admit that privacy on the Internet sucks. I wish it were better. I wish we didn't have evil telecom companies who believe that they can monetize their customers' web browsing habits. I wish our government, even with the new President, respected the Fourth Amendment.
I am not claiming that my TACO add-on is perfect, or that it solves all of the privacy issues on the web. It is a specific technical solution for a particular policy problem. It is not a comprehensive solution to all the woes of web privacy -- it is just a way, I believe, for the little guy to reclaim a tiny little bit of that long forgotten right to be left alone.
Later on, Mr. Harper asserts that I am calling for new legislation:
With the right law in place, Chris appears to believe, “[t]he Federal Trade Commission and Congress would likely take an interest” when advertisers tried to skirt opt-out cookies, using other technologies to glean information about Web surfers’ interests.
Perhaps I was unclear in my previous post, but I do not believe that new legislation is required to go after advertisers who continue to engage in targeted advertising even after the user has opted out. The FTC has a clear legal mandate to go after those who engage in deceptive and unfair business practices. Advertisers who ignored their own opt-out cookies would seem to be engaging in an unfair and deceptive way. I would argue that the FTC already has all the authority it needs to go after such firms.
Saturday, March 21, 2009
The benefits of using opt-outs
This blog post provides a legal/policy argument in support of opt-out cookies. While the author knows a decent amount about Internet law, he is not a lawyer, and this is not legal advice.
While the response to my Targeted Advertising Cookie Opt-Out (TACO) Firefox add-on has been hugely positive, a number of users have questioned the utility of this tool, as compared to other pro-privacy and anti-advertising solutions.
As just one example of this line of mild criticism, Jim Harper over at the Tech Liberation Front, suggests that users can simply make use of the "block third party cookies" feature available in most Web browsers.
This is an approach that is similarly recommended by Google, which only provided an opt-out software extension to users of Internet Explorer and Firefox. Users of other browsers (such as Safari and Chrome) are advised to just block all advertising cookies.
The problem with blocking any form of unwanted behavior, is that it just leads to an arms race.
Arms races, and the lessons from the pop-up war
Consider, for example, the scourge that was pop-up advertisements. These were a huge problem on the web, and continue to be so for anyone unlucky enough to be using an ancient browser. Their over-use by Web sites can make browsing an unpleasant, and at times, unusable experience.
So how did we do away with them? First, a number of browser add-ons began to offer pop-up blocking functionality. However, these were only used by technically savvy users. It wasn't until similar functionality was included in Firefox and Safari, often by default, that the tables really turned.
Once anti pop-up technology came baked into the browser, the advertising industry effectively lost one of its most powerful tools.
These firms had a strong incentive to find a way around this blocking, and so, over the past few years, new, sneakier forms of advertising, some even using pop-up style effects, have become commonplace.
Advertisers didn't observe the blocking of their previous techniques, and think, 'Oh, I guess we should respect people's preference to not see annoying ads", but instead took it as an invitation to innovate, and create newer, more aggressive and unblockable forms of advertising.
That is, pop-up blocking technology, while providing users with some temporary relief, merely added fuel to the arms race.
Targeted advertisements use more than cookies
Over the past ten years, cookies have gotten a lot of criticism from privacy circles. Browsers have evolved to include sophisticated cookie handling tools, particularly in Safari and IE8. As a result, cookies have become far less useful as a way to track users. After all, every Safari user automatically rejects third party cookies by default.
Just as with the pop-up example mentioned above, this use of blocking technologies has merely encouraged an arms race, with advertisers turning to other methods for long term tracking. Technologies like Adobe's Flash, AIR, Microsoft's Silverlight, and the offline content in HTML5 can all be used to provide cookie-like tracking functionality.
Better yet for the advertisers, most users don't know that these technologies can be used to invade their privacy.
Ending the arms race
Should we follow the traditional approach, and just escalate the arms race? For example, the excellent BetterPrivacy Firefox add-on allows users to protect themselves against the tracking Flash cookies/LSO files used by YouTube, eBay and many other sites.
In my opinion, this cat and mouse game is a huge waste of energy. What we need is a way to remove ourselves from this cycle, and I think that opt-out cookies are a way to do this.
Unlike all of the previous anti-advertising technologies, the opt-out mechanism provides users with a way to positively affirm that they do not wish to be tracked and targeted. This opt-out cookie is something that advertisers cannot ignore.
Now, consider the following hypothetical situation: In a year or two Google/Doubleclick sees that 50% of Web users have opted out of their targeted advertising. In an attempt to innovate around this, the company switches to the use of Flash-based cookies to target and track users.
While the company's privacy policy specifically talks about the use of cookies, it would be tough to see how Google could argue that it had the right to use alternative tracking technologies to track users who had opted out of its older cookie-based system.
The Federal Trade Commission and Congress would likely take an interest, and any attempt by Google's lawyers to argue that opt-outs only applied to html cookies, even if their privacy policy stated as much, would draw laughter and ridicule.
Simply put, opt-out cookies are a game changer. Once consumers affirmatively state their desire to not be tracked, companies can not continue the cycle of innovating around blocking technologies. For the advertisers, the game is over.
Best practices, defense in depth
The funny thing is, you don't need to actually accept third party cookies to get the benefits of opt-out cookies.
On my own computer, I disable all third party cookies, I've set the browser to clear all cookies upon starting, I use the awesome AdBlock Plus and NoScript. However, I still use my own opt-out cookie add-on.
With the other technologies and policies that I've set, no advertising network can use the existing cookie based technologies in order to track and target me. Some might say that the opt-out cookies provide no added value.
However, I see them as a form of defense-in-depth. If these advertising firms find a way around AdBlock Plus, and innovate around the third party cookie block, my positive declaration of my desire to not be targeted might provide me with some more protection.
At the very least, if the advertisers are ever caught tracking opt-ed out users via some other technology, my own use of opt-outs will give me a far better position, should I wish to take legal action.
So -- what are you waiting for? Download the Targeted Advertising Cookie Opt-Out (TACO) add-on today.
While the response to my Targeted Advertising Cookie Opt-Out (TACO) Firefox add-on has been hugely positive, a number of users have questioned the utility of this tool, as compared to other pro-privacy and anti-advertising solutions.
As just one example of this line of mild criticism, Jim Harper over at the Tech Liberation Front, suggests that users can simply make use of the "block third party cookies" feature available in most Web browsers.
This is an approach that is similarly recommended by Google, which only provided an opt-out software extension to users of Internet Explorer and Firefox. Users of other browsers (such as Safari and Chrome) are advised to just block all advertising cookies.
The problem with blocking any form of unwanted behavior, is that it just leads to an arms race.
Arms races, and the lessons from the pop-up war
Consider, for example, the scourge that was pop-up advertisements. These were a huge problem on the web, and continue to be so for anyone unlucky enough to be using an ancient browser. Their over-use by Web sites can make browsing an unpleasant, and at times, unusable experience.
So how did we do away with them? First, a number of browser add-ons began to offer pop-up blocking functionality. However, these were only used by technically savvy users. It wasn't until similar functionality was included in Firefox and Safari, often by default, that the tables really turned.
Once anti pop-up technology came baked into the browser, the advertising industry effectively lost one of its most powerful tools.
These firms had a strong incentive to find a way around this blocking, and so, over the past few years, new, sneakier forms of advertising, some even using pop-up style effects, have become commonplace.
Advertisers didn't observe the blocking of their previous techniques, and think, 'Oh, I guess we should respect people's preference to not see annoying ads", but instead took it as an invitation to innovate, and create newer, more aggressive and unblockable forms of advertising.
That is, pop-up blocking technology, while providing users with some temporary relief, merely added fuel to the arms race.
Targeted advertisements use more than cookies
Over the past ten years, cookies have gotten a lot of criticism from privacy circles. Browsers have evolved to include sophisticated cookie handling tools, particularly in Safari and IE8. As a result, cookies have become far less useful as a way to track users. After all, every Safari user automatically rejects third party cookies by default.
Just as with the pop-up example mentioned above, this use of blocking technologies has merely encouraged an arms race, with advertisers turning to other methods for long term tracking. Technologies like Adobe's Flash, AIR, Microsoft's Silverlight, and the offline content in HTML5 can all be used to provide cookie-like tracking functionality.
Better yet for the advertisers, most users don't know that these technologies can be used to invade their privacy.
Ending the arms race
Should we follow the traditional approach, and just escalate the arms race? For example, the excellent BetterPrivacy Firefox add-on allows users to protect themselves against the tracking Flash cookies/LSO files used by YouTube, eBay and many other sites.
In my opinion, this cat and mouse game is a huge waste of energy. What we need is a way to remove ourselves from this cycle, and I think that opt-out cookies are a way to do this.
Unlike all of the previous anti-advertising technologies, the opt-out mechanism provides users with a way to positively affirm that they do not wish to be tracked and targeted. This opt-out cookie is something that advertisers cannot ignore.
Now, consider the following hypothetical situation: In a year or two Google/Doubleclick sees that 50% of Web users have opted out of their targeted advertising. In an attempt to innovate around this, the company switches to the use of Flash-based cookies to target and track users.
While the company's privacy policy specifically talks about the use of cookies, it would be tough to see how Google could argue that it had the right to use alternative tracking technologies to track users who had opted out of its older cookie-based system.
The Federal Trade Commission and Congress would likely take an interest, and any attempt by Google's lawyers to argue that opt-outs only applied to html cookies, even if their privacy policy stated as much, would draw laughter and ridicule.
Simply put, opt-out cookies are a game changer. Once consumers affirmatively state their desire to not be tracked, companies can not continue the cycle of innovating around blocking technologies. For the advertisers, the game is over.
Best practices, defense in depth
The funny thing is, you don't need to actually accept third party cookies to get the benefits of opt-out cookies.
On my own computer, I disable all third party cookies, I've set the browser to clear all cookies upon starting, I use the awesome AdBlock Plus and NoScript. However, I still use my own opt-out cookie add-on.
With the other technologies and policies that I've set, no advertising network can use the existing cookie based technologies in order to track and target me. Some might say that the opt-out cookies provide no added value.
However, I see them as a form of defense-in-depth. If these advertising firms find a way around AdBlock Plus, and innovate around the third party cookie block, my positive declaration of my desire to not be targeted might provide me with some more protection.
At the very least, if the advertisers are ever caught tracking opt-ed out users via some other technology, my own use of opt-outs will give me a far better position, should I wish to take legal action.
So -- what are you waiting for? Download the Targeted Advertising Cookie Opt-Out (TACO) add-on today.
Subscribe to:
Posts (Atom)