Online Behavior Tracking and Privacy: 7 Worst Case Scenarios

Nov. 6, 2010— -- If you've never been targeted by an ad because of your online behavior, then you're probably just not paying much attention.

According to an informal survey by the Interactive Advertising Bureau (IAB), more than 80% of advertising campaigns in 2009 involved tracking of some sort. The advertising business, in short, loves online tracking just about as much as privacy advocates hate it.

Privacy advocates argue that online tracking undermines citizen rights and feels a little too big-brotherish for comfort. Their concerns were part of what led the FTC to release a report last February urging advertisers to evaluate their policies and beef up their privacy efforts. The industry's response has been to improve self-regulation — largely by adding opt-out buttons to online behavioral advertising.

Meanwhile, the rest of us are left wondering what the big deal is. We might be slightly creeped out when a particular ad follows us around the Internet, but is that really a debate worth getting worked up about?

We spoke with experts on both sides to find out the very worst that could happen is if online tracking goes unchecked, or if regulations to control it are instated.

1. Consumers Remain Ignorant of Tracking

In an August 2010 study about Internet users' understanding of behavioral advertising, Aleecia McDonald asked survey participants to imagine that an ad company determined what ads to show to them based on the history of prior websites that they visited. Only 51% of participants recognized that this was something that "happens a lot right now."

When she asked them to imagine that ads served by their e-mail providers were based on the e-mails they sent and received, they were even less aware. The majority of participants didn't understand that this practice commonly occurred, and almost 30% believed that it would never occur. One participant in the study said that behavioral advertising sounded like something her "paranoid" friend would dream up, but not something that would ever occur in real life.

This ignorance about the prevalence of online tracking, privacy advocates say, leads people to treat the web as though they're anonymous and makes them unable to protect themselves from unwanted tracking.

"Consumers treat the search engine box like their psychiatrist, their rabbi, their priest, their doctor," explains Christopher Soghoian, a privacy advocate who studies data security and privacy as a Ph.D. candidate at Indiana University. "People type the most intimate things into search engines and other websites primarily because they think they're anonymous. They type in things on WebMD that sometimes they wouldn't even ask their own doctors… And in fact, we are not anonymous, these sites are tracking us."

2. Online Tracking Evolves Past the "Creepy Line"

Google CEO Eric Schmidt once was quoted saying, "There is what I call the creepy line. The Google policy on a lot of things is to get right up to the creepy line and not cross it."

This begs some questions: What is on the other side of the creepy line, and why does Google get to decide where it is?

Right now, companies that collect data about what users do online claim that they do so only in very broad categories that help them determine what ad they should serve. This is probably true in the case of most advertisers. But data companies like Rapleaf — whose habit of selling Facebook IDs was only recently exposed — are clearly starting to cross the line.

In the worst case scenario, a lack of regulation would lead companies to push the envelope when it comes to what they track. "If the data is there, it is potentially something that could be obtained by government law enforcement authorities without you knowing about it," explains John Simpson, a privacy advocate with the non-profit Consumer Watchdog advocacy group. "It could potentially be subpoenaed in civil trials again… The issue is that people don't realize the tracks that they leave when they do these routine things."

3. Privacy Solutions Require You to Opt Out — Not In — And Nobody Notices

Advertisers say they have made an effort to stop tracking people who don't want to be tracked. In response to the FTC's call to improve self-regulation, leading advertising trade organizations introduced a self-regulation program that urged advertisers to include an "Advertising Option Icon" on targeted advertisements that would allow consumers to opt out of online tracking. The advertiser would still collect information about the user, but the company would agree not to leverage it when choosing which ads to display.

Because most people aren't aware that they're being tracked and advertisers would still collect information, Soghoian finds this to be an unsatisfying solution. "If consumers are to effectively evaluate the pros and cons of this process, they need to know that it's happening, know at least to some extent how it's happening and who [is] conducting it." he says. "And I think those three bits of information are missing right now."

If customers are hardly aware that they're being tracked, how will they know to opt out? Previously, sites like the Network Advertising Initiative and Firefox plug-in TACO (Targeted Advertising Cookie Opt-Out) have provided opt-out cookie solutions for Internet users who don't want to be tracked. None of the participants in McDonald's study had ever heard of them.

Soghoian and other privacy advocates would much prefer an opt-in solution.

4. Privacy Solutions Require You to Opt In — And Kill the Ad Industry

Opt-in, however, would effectively derail the advertising industry's behavioral advertising strategy (which, if we consider the IAB's aforementioned survey, accounts for about 80% of current online campaigns). Mike Zaneis, the IAB's vice president of public policy, calls opt-in an "unworkable" and "inappropriate" standard.

"In the United States, we only require opt-in as a choice for truly sensitive data categories such as certain uses of medical information or financial information," he says. He doesn't believe that general marketing information deserves the same treatment. After all, the FTC's February report suggested that "some form of prominent notice and opt-out choice may be sufficient."

Advertising is approximately a $450 billion global industry, and one of the few quickly recovering ones to boot. Shutting down online tracking with an opt-in policy could slow that growth — not to mention handicap U.S. firms in competition with agencies unencumbered by any U.S. privacy legislation.

"You can certainly imagine if you overnight flipped the switch and turned off all of the targeting –- not the tracking –- but just turned off the targeting, that you're going to have a negative impact," Zaneis says.

Soghoian believes that opt-out is an appealing choice for advertisers because it won't be used.

"[Advertisers] want to be able to offer an opt-out so that they can say they're doing it, but then not actually have any consumer use it," he says. "A good analogy is that Google has been using this opt-out with Google Street View for a while. And now that more than 200,000 people in Germany have said, 'I don't want my home in Street View,' Google is freaking out — because that's a significant amount of people."

5. Individuals Leverage Online Tracking

Using your computer on an unprotected wireless network has always left your online world vulnerable to hackers. But before last month, it at least required some technical prowess to pull it off. The launch of Firefox plugin Firesheep brought this kind of hacking to the mainstream. Now anybody in any coffee shop with a shared unprotected network can download the tools to hijack your sensitive information with a click. Since October 24, when it was uploaded to a popular sharing site, the plugin has been downloaded more than 500,000 times.

Firesheep has nothing to do with online tracking other than to provide a cautionary tale.

"What it shows is that something that was known for 10 years that was difficult, but easy enough for technically skilled users to do, suddenly becomes a major deal when the tools to make use of it become mainstream," says Soghoian. "And by that same token, you know, tracking is already happening. Right now it is limited to those people who will pay for it and those people who know the details. In the not-so-distant future, it will be not so difficult to track people or, more importantly, it will be even easier to use the data from sites like Rapleaf."

The buds of easy-access online tracking are visible in plugins like Rapportive, which let you "see everything about your contacts right inside your inbox." In a worst case scenario, these plugins would develop to a point where you would be able to see anybody's online activity.

6. The Internet Gets Expensive

Zaneis points out that part of what makes many of our favorite websites free is the targeted advertising that is sold on them. User data has become the number one factor that advertisers take into account when searching for a media partner, and the Network Advertising Initiative released a study that found behaviorally targeted advertising secured more than 2.5 times as much revenue per ad as its non-targeted counterpart. Fewer targeted ads could mean less profit for both advertisers and websites, making pay walls more prevalent.

Simpson understands the risk of lost ad revenue, but he would prefer a solution to this problem that mimics a grocery store discount card: you can choose between not being tracked or getting a discount.

"People understand that the [grocery store] is obviously keeping track of the food that they buy, but they're getting it cheaper," he says. "And if they're using those cards, they're willing to give up some of their information for cheaper prices. The thing about what's going on online is nobody really understood what they were giving up."

Soghoian thinks the whole argument is a bit ridiculous. "The web was free for the last 15 years before they were tracking people, and it will continue to be free after they track people," he says.

7. Personalization on Websites Disappears

In response to the negative press that Rapleaf received from, in the company's words, "inadvertently passing Facebook and MySpace IDs to ad networks in a small minority of cases," CEO Auren Hoffman wrote in a blog post:

"We believe that a more personalized world is a more helpful, efficient, and respectful world. Today, Rapleaf customers help people receive useful product recommendations, enjoy higher levels of customer service, engage directly with candidates running for office, see better ads, receive less spam, and view relevant content."

It's true that cookies enable the personalized "hello" and book recommendations that greet you when you log into Amazon's site. And heck, if you're shopping for a car, you might want to see car ads on every site you visit. Banning online tracking altogether would do away with much of the personalized goodness on the Internet.

Simpson agrees that people might want to be tracked in some cases. But he says that the best way to decide that they want to be tracked is to have them opt in.

Using your computer on an unprotected wireless network has always left your online world vulnerable to hackers. But before last month, it at least required some technical prowess to pull it off. The launch of Firefox plugin Firesheep brought this kind of hacking to the mainstream. Now anybody in any coffee shop with a shared unprotected network can download the tools to hijack your sensitive information with a click. Since October 24, when it was uploaded to a popular sharing site, the plugin has been downloaded more than 500,000 times.

Firesheep has nothing to do with online tracking other than to provide a cautionary tale.

"What it shows is that something that was known for 10 years that was difficult, but easy enough for technically skilled users to do, suddenly becomes a major deal when the tools to make use of it become mainstream," says Soghoian. "And by that same token, you know, tracking is already happening. Right now it is limited to those people who will pay for it and those people who know the details. In the not-so-distant future, it will be not so difficult to track people or, more importantly, it will be even easier to use the data from sites like Rapleaf."

The buds of easy-access online tracking are visible in plugins like Rapportive, which let you "see everything about your contacts right inside your inbox." In a worst case scenario, these plugins would develop to a point where you would be able to see anybody's online activity.

6. The Internet Gets Expensive

Zaneis points out that part of what makes many of our favorite websites free is the targeted advertising that is sold on them. User data has become the number one factor that advertisers take into account when searching for a media partner, and the Network Advertising Initiative released a study that found behaviorally targeted advertising secured more than 2.5 times as much revenue per ad as its non-targeted counterpart. Fewer targeted ads could mean less profit for both advertisers and websites, making pay walls more prevalent.

Simpson understands the risk of lost ad revenue, but he would prefer a solution to this problem that mimics a grocery store discount card: you can choose between not being tracked or getting a discount.

"People understand that the [grocery store] is obviously keeping track of the food that they buy, but they're getting it cheaper," he says. "And if they're using those cards, they're willing to give up some of their information for cheaper prices. The thing about what's going on online is nobody really understood what they were giving up."

Soghoian thinks the whole argument is a bit ridiculous. "The web was free for the last 15 years before they were tracking people, and it will continue to be free after they track people," he says.

7. Personalization on Websites Disappears

In response to the negative press that Rapleaf received from, in the company's words, "inadvertently passing Facebook and MySpace IDs to ad networks in a small minority of cases," CEO Auren Hoffman wrote in a blog post:

"We believe that a more personalized world is a more helpful, efficient, and respectful world. Today, Rapleaf customers help people receive useful product recommendations, enjoy higher levels of customer service, engage directly with candidates running for office, see better ads, receive less spam, and view relevant content."

It's true that cookies enable the personalized "hello" and book recommendations that greet you when you log into Amazon's site. And heck, if you're shopping for a car, you might want to see car ads on every site you visit. Banning online tracking altogether would do away with much of the personalized goodness on the Internet.

Simpson agrees that people might want to be tracked in some cases. But he says that the best way to decide that they want to be tracked is to have them opt in.