CyberSmokeBlog.blogspot.com: The data brokers ..... tracking the trackers!

10 Things Online Data Collectors Won't Say
They know your online browsing secrets. We reveal their hidden tactics

Fania Karas
April 5, 2012

1. "We're always watching you."

If you're reading this on the Internet, chances are you're being followed. More than 200 data collection companies and ad networks use approximately 600 different tracking technologies to gather and sell information on people's web habits, according to Abine, an online privacy firm that tracks the trackers. The online advertising industry is a $31 billion business fueled largely by behind-the-scenes exchanges of consumers' personal online shopping and browsing habits.

Also See

Web-based commercial data collectors work by quietly dropping bits of code called cookies on user computers, which allow collectors to track what people read, click or buy. That information, collected by companies such as BlueKai and DoubleClick (a Google subsidiary), is sold in real-time exchanges to ad networks, which then target segments of users with ads fitting their interests. Someone who just searched Expedia for information on Puerto Rico, for example, would be almost instantly hit with ads featuring San Juan hotels and resorts. Billions of these exchanges occur daily. Search engines and social networking sites such as Google and Facebook also track user data to generate targeted advertising. The result? The new cell phone or spring sandals users willed themselves not to buy show up in ads alongside their morning news.

Companies in the U.S. spend more than $2 billion annually to tap into consumer data, according to Forrester Research. Data trackers, ubiquitous across the web, are collecting, storing and sharing more information than ever before, says Chris Babel, CEO of online privacy solutions provider TRUSTe. "It's happening on nearly every site, all the time," he says.

2. "You can't really opt out of data tracking..."

People may "opt out" of the targeted advertising so common on the web, but that doesn't mean data collectors will stop following their every electronic move. In 2010, the Digital Advertising Alliance introduced a tool that alerts web users that their data is being collected and used for targeted advertising. Consumers who fill out an online form will no longer see targeted ads. However, their web click patterns will still be recorded, stored and sold to marketers, says Linda Woolley, executive vice president of the Direct Marketing Association, a trade group for marketers. Tracking companies built their businesses around using and selling their information to clients, she says.

And those who click "opt out" only get a temporary reprieve from the ads. As soon as they clear their browser cookies, users inadvertently opt back in, experts say, because they also get rid of the cookie that told ad networks not to target them. Consumers' best bet, say experts, is downloading a powerful, free add-on like Abine's, which works on all major browsers and continually updates itself to protect users from new trackers.

3. " And 'Do Not Track' options won't stop us either."

In addition to "opting out," many web browsers now offer "do not track" options, which actually send a signal to data collectors telling them not to track users. Various web browsers have different default settings for tracking. Safari, for example, automatically blocks third-party cookies that track users. Firefox accepts cookies, so it is up to the users to go into the settings and turn them off.

Right now "opt out" and "do not track" are often the same in practice. In fact, recent privacy debates have centered on the ambiguous definition of the terms. Currently there is no industry-wide "do not track" standard. Studies show most web users interpret it to mean their data will not be collected, but the online ad industry interprets it to mean the same thing as opting out, Woolley says. Tracking companies will continue to collect information on web users, but they won't target them with ads based on their data.

Unfortunately not all data tracking companies comply with do-not-track requests, says Sarah Downey, a lawyer and privacy expert for Abine. "Right now, do not track doesn't necessarily stop data collection or development of profiles about you," says Downey. "And it doesn't stop your data from being stored, collected and sold to the highest bidder." According to Woolley, online advertisers continue dropping cookies on users who don't want to be tracked for their own internal purposes. "There are lots of operational reasons why data collection is needed," she says, such as fraud prevention and product development.

Currently the Federal Trade Commission is pushing browser makers to adopt do-not-track tools and encouraging online ad networks to respect users' do-not-track settings. In a report on digital privacy released by the FTC recently, the agency said it would support legislation that defines "do not track" as zero data collection.

4. "We know your secrets."

Data trackers may know a woman is pregnant even before she tells her loved ones. They figure it out based on the web pages and advertisements clicked on recently. Target recently came under fire for combing through customer shopping patterns to identify potential soon-to-be-parents. Like other retailers, Target assigns its shoppers with a personalized code that lets the company record their every interaction with the store, from e-mails to web browsing to physical store visits. (Target declined to comment.) True, this kind of data crunching is mostly innocuous, but many web users have a word to describe it: creepy.

Retailers have used predictive analytics for years to help parse customer buying patterns -- and consumers often benefit. After all, it's not the worst thing to see ads for bridal dresses just as one's planning a wedding. Browsing and purchase history tracking by retailers provide value to a customer they would miss if they weren't tracked, says Fatemeh Khatibloo, an analyst for Forrester Research who covers the consumer data economy.

The potential danger, say privacy experts, is data trackers' access to a new realm of information on the web.

"It's not just your past purchase history," says Chris Conley, a technology and civil liberties fellow for the ACLU of Northern California. Online data collection could conceivably be troubling if web history is used against someone to deny a credit card, job or health insurance, says Babel.

Such practices would be against industry standards, says Woolley. "Marketing data should never be used to make those kinds of decisions. It should only be used for marketing purposes," she says.

5. "We don't know your name..."

As powerful as the data-tracking tools are, the one thing the software often doesn't know is: the user's real name. Instead, consumers' page visits are tied to a random string of numbers designed to keep personally identifiable information private. These unique IDs follow a user around the web, informing data trackers which ads he or she is statistically likely to click based on past web-browsing habits.

Data brokers like Acxiom say they screen collected information to make sure it was obtained according to their privacy standards. "Our program qualifies all of the data we bring in" to ensure consumer privacy is protected, says Jennifer Barrett Glasgow, the company's chief privacy officer.

6. "...but we can probably figure it out."

The more online data trackers know about you, the anonymous web surfer, the easier it becomes for them to tie it to you, the person. For example, if a user is the only 65-year-old grandmother in Ames, Iowa who belongs to a certain gym and went to a particular college, it's just a matter of time before companies accumulate enough information to figure out her name, experts say. From there, data brokers can easily take online information offline, where they can obtain information such as a residential address from public documents. That information also gives companies insight into user's income stream.

Joseph Turow, a University of Pennsylvania professor studying Internet database marketing, maintains it's easy for multiple data collectors to combine databases and identify users. "Eventually someone might get you to fill out a form containing your name," says, author of "The Daily You: How the New Advertising Industry Is Defining Your Identity and Your Worth." Prior to that "you were User 56765 based on your cookies.

You were anonymous, and now you're not," he says -- and this lack of anonymity makes users more vulnerable to identity fraud.

Woolley, however, says people should "absolutely not" be worried that data collectors will waste resources identifying individuals. "Nobody has an interest in doing that," she says. "Advertisers are interested in aggregated data -- entire categories of people who are interested in a particular product."But just because data trackers don't have the time to trace anonymous data back to individuals doesn't mean nobody will. In 2006, Netflix released customer movie-rankings as data sets in a contest without identifying individuals by name. But the company drew the ire of customers and the Federal Trade Commission after some users were able to figure out the names of people ranking the movies. The company reached a deal with the FTC and canceled the contest. A similar incident happened when AOL released its search logs in 2006, prompting an apology from the company. These cases show that not all data collectors and ad agencies take proper steps to protect sensitive personal information, privacy experts say.

7. "We control who sees the best discounts and deals."

The web does not treat all users equally. Because data collectors can infer things like one's income level and credit score based on sites visited, they can also influence which products people see advertised what prices they are charged, Turow says. Companies like Acxiom use high-powered analytics tools to group web users into like categories based on monetary indicators, media consumption, age and other factors. They can sell their clients access to specific audiences, letting marketers pinpoint customers with the highest value and bypass the users who'll never click on an ad.

Data collectors "affect what ads consumers see and what coupons they get," Turow says. When they categorize consumers, "it may affect the way we see the world and see ourselves," he adds. To be sure, categorizing consumers "has been happening in marketing for decades," says Khatibloo. "The best customers get the $10 gift card or a free gift and the ones who don't spend any money, don't," she adds.

8. "We're tracking your smartphone, too."

The smartphone revolution didn't go unnoticed by data trackers. Consumers now spend 94 minutes daily on mobile apps and 72 minutes surfing the web on their phones, according to Flurry, an analytics and advertising company. Smartphone users are gold mines for data trackers and ad networks, which are often integrated into mobile apps, experts say. These so-called ad libraries have "access to your contacts, geo-location, call records, and other information that's stored on your phone," says Conley. On a computer, by comparison, data trackers can only see what one does in a web browser window.
Mobile ad networks target smartphone owners by tracking actions tied to a unique device identification number, a cookie-like code specific to each smartphone. These IDs let ad networks know where the owner of a particular smartphone has been on the mobile web. And that allows app-makers and advertisers to better target phones with ads. They can track users as they move from app to app to learn more about their interests. Unlike cookies within the web browser on a laptop, the unique ID on mobile apps can't be erased. This is potentially dangerous because of the sheer amount of data people keep on their phones, says Conley.
In February, a mobile social-networking app called Path was discovered to be uploading the full names, emails and phone numbers of contacts stored in its users' phones -- without their permission. If Path had been hacked, Babel says, people's private information would have been free for the taking. Path recently said it will scramble data it collects from phones to protect sensitive information it gathers. Congress is now investigating the data collection techniques of 34 mobile app-makers, including Path.
After the Path incident, Apple stepped up efforts to phase out unique device IDs. But advanced tracking companies like Mobile App Tracking and BlueCava are prepared for the switch. They now use a technology called "digital fingerprinting" that creates precise digital profiles of users that will recognize the same person no matter what device they use. In other words, these companies can tell it's you whether you're surfing the web on a computer, iPad or phone. "We look for correlating pieces of data that might indicate it's the same user," says BlueCava CEO David Norris. He argues digital fingerprinting is actually safer because users can install privacy settings, such as "do not track," across all their devices. It's still unclear, consumer privacy experts say, if the new technologies will be any better for consumers than traditional unique IDs.

9. "The information we have on you could be wrong."

Just because data trackers try their best to know your every move on the web doesn't mean they always get it right.
Carole Sharwarko, a 33-year-old woman in Homewood, Ill., says the ads that pop up on her browser about pregnancy and babies -- likely aimed at her due to her age and gender-- make her anxious about still being childless. "All the ads I see are about enrolling my kid in some cutest baby contest or regaining my pre-baby body," she says.
Marketing mix-ups like these are perhaps more annoying than harmful. But where erroneous data on individuals can cause trouble, say privacy experts, is in the case of commercial data collectors. These sites gather information on individuals from publicly available sources into detailed dossiers available to anyone online for little or no cost. Many of these firms are unregulated. One data collection site, Spokeo, combines the data users willingly share online with public records mined from phone books, marketing surveys, real estate listings and other sources, according to its website. "It's basically an FBI background check for $3.95," Downey says. "They're profiting off you, and you're not able to do anything about it." A spokesman for Spokeo says the company makes no guarantee the information is accurate.
There's no one-stop shop where users can view and edit the digital profiles data brokers create for them. But the FTC targeted such companies in its recent consumer privacy report calling for legislation that would give consumers access to data collected about them and allow them to edit it when necessary.
Sites like Reputation.com already monitor and correct erroneous information about its users -- for a fee. Insurance companies and employers may vet potential applicants by searching them online, says Reputation.com CEO Michael Fertik, so scrubbing the web of this kind of data protects users from harm. Simple web browsing information collected by data tracking firms, however, wouldn't fall under Reputation.com's radar. So, for now at least, consumers like Sharwarko have no recourse but to ignore the misfired ads.

10. "Your personal data may be worth thousands of dollars."

In a report last year, the World Economic Forum called personal data the "new oil," a valuable resource of the 21st century that's fueling a new wave of economic activity. The online ad industry alone is expected to balloon to $34 billion this year, according to analysts. Though it's hard to put a dollar amount on the value of one person's data to a data broker or ad firm, estimates range from a fraction of a cent for a single piece of data to $5,000 for a full digital profile. Buyers of certain products, like luxury goods or expensive health-related devices, are worth more to advertisers, Fertik says, so ad networks will pay more to reach them.
What's more, Turow says, data collectors often lure users into handing over even more information with the promise of gifts and coupons. "You might think you're getting a free gift, but once you give out that information, your value goes up far more than the value of whatever they've given you," he says. People should be wary of handing over personal details like their names, addresses or birthdates to marketers, he advises.