How to Avoid Online Tracking. (Hint: You Can’t.)

Online advertisers want to know everything they can about you. To understand why, consider the snow blower. Let’s say it’s January, and Home Depot has 30,000 snow blowers it wants to sell.

There are some customers that Home Depot doesn’t want, like people in Arizona. The retailer probably doesn’t care about customers in Manhattan, either, since most people there don’t own houses or shovel their own driveways.

But there are some customers that Home Depot really wants to reach. It would love to find people who own their own houses, maybe in a northeastern state. Ideally they make enough money to afford a snow blower, and they’re old enough to consider hanging up the shovel for good. Maybe they’ve already been online searching for deals on snow blowers. And maybe the local weather forecaster is predicting their town will get pummeled tomorrow by a blizzard.

That’s the kind of people you want to hit with an advertisement for snow blowers. And now’s the perfect time to do it.

“They know it’s a good bet they could sell you that snow blower before the next storm,” says Jay Sears, general manager of Contextweb, a kind of stock exchange for online advertising.

What Do They Want To Know? Everything.

The information that advertisers need to make that happen is at least as varied as the products they’re trying to sell. Your age, race, gender, income, where you live, your online surfing history, the book you bought last week on Amazon, the things you say to friends on Facebook, all of it can be recorded and used to help serve you an ad that is more likely to catch your eye.

And increasingly, the data isn’t just about what you do online. Internet advertisers are buying access to any data sets they can find – your shopping habits from your grocery store loyalty card, automobile registrations, county criminal records – to learn more things about you than you know yourself (do you remember which brand of toilet paper you bought last week?).

Online advertisers need all this information because they’re trying to decrease the amount of ads they can buy, and increase the success rate on the ads they do buy. Instead of broadcasting ads to the millions of people who watch 60 Minutes, for example, with more data they can drill down to reach just the tens of thousands of people they think might actually buy their product.

The desired effect: More sales for less money.

“The whole point is for the right ad to be shown to the right person at the right time,” Sears says.

Next: How Do They Know That? >>>

Image: James Lee, via Flickr.com

How Do They Know That?

The main tool that online advertisers use to watch you across the Internet is the cookie. Cookies were originally developed so that a single website could track your movements from one part of the site to another. That was especially important because before the cookie, sites had no way to remember who you were when you stopped browsing and proceeded to the checkout page. To do that, each cookie gives your browser a unique code to identify your computer.

It turns out that cookies work just as well tracking your computer across multiple sites as it does following it across just one.

“You no longer need to know a person’s name or address to know what that particular person does online, what their interests and values are,” says Jeff Chester, executive director for the Center for Digital Democracy, a nonprofit group that does consumer advocacy on Internet-related issues.

Over time, new tools have been created to do the same thing, only better. There are “Flash cookies,” which unlike normal cookies cannot be erased. There are also web beacons, which are essentially clear picture files that are embedded on a page and record your movement across a website, or even several websites – including where you move your cursor and how far down a page you scroll before clicking away.  Ultimately, the data on your browsing habits is used to make the browsing experience (including ad-targeting) more efficient.

“Ad sellers and buyers are both getting the data from the cookies and beacons,” says Peter Eckersley, staff scientist at the Electronic Frontier Foundation, a pro-privacy group. “Those are the eyes and ears of the system.”

It’s cliché to say that knowledge is power, but never has it been more true than right now. Literally – right NOW. Because as you read this, dozens, maybe hundreds of different companies are looking over your shoulder, following every move you make online. If that fact makes you uncomfortable enough that you try to avoid it by scrolling away, just think: With beacons, data companies know that, too.

Creepy, huh?

Not really, online advertisers say. Because they’re not really looking for you. They’re looking for tens of thousands of yous – people who fit different profiles that advertisers are guessing will be more likely to buy their stuff. They don’t care about the identity of any one individual because they’re focused on volume.

“I could care less about who you are,” says Sears. “Think about it. Lowe’s doesn’t want to sell one snow blower to one person. They’d go broke. They need to find tens of thousands of people who need snow blowers. So they don’t care about your identity.”

Privacy advocates counter that data tracking and aggregation technology has grown so sophisticated, and so pervasive, there’s no way to tell who’s using it or how. Online advertisers don’t have to know your name to know everything important about you, including sensitive information like where you live, what you buy and the ages of your children.

All that personal information can be stored indefinitely, advocates point out, until someone figures out a reason to track individual consumers. It could be stolen by hackers, or simply lost. It could be subpoenaed by the government. Or it could be used in real-time, piecing together consumers’ movements, who they talk to and text (via cell phone location records), what they buy (via store loyalty card databases, which are commonly bought and sold), and who they’re friends with (via Facebook) to create a more detailed profile than any private detective could ever hope to compile.

“We’re not talking about tracking thousands of people,” Eckersley says. “We’re talking about tracking individuals.”

Anti-Tracking Tools Not Effective

Maybe you like the fact that advertising companies are gathering reams of information about your private and financial life, especially since it means you get ads that fit your tastes, offering you deals on things you actually need.

“I actually think this is great stuff,” says Iggy Fanlo, CEO of AdBrite, another ad exchange. “If I go online at Zappos and almost buy a pair of shoes and then I get busy and forget, I look at the ad that comes up and say ‘thanks for the reminder.’”

Or maybe you don’t like it.

“They can track you wherever you are, and gather hundreds of pieces of data about you, without you ever knowing it,” Chester says.

If you’re one of the skeptics, there are many steps you can take to opt-out of online tracking. Many of them are difficult to find, and cumbersome to maintain.

But here’s the real problem: None of them actually work. Each tool might help reduce the amount of information that online advertisers gather about you. But each one has its problems, and each can be circumvented.

Which means the only way to make sure you’re never tracked online is to never go online.

“It turns out to be very difficult” to avoid being tracked by online marketers, Eckersley says.

Next: Methods for Blocking Cookies … and How They Fall Short >>>

Image: Jared Tarbell, via Flickr.com

Methods for Blocking Cookies … and How They Fall Short

If you want to reduce the amount of information that advertisers gather about you, here’s a step-by-step guide to doing it.

– Delete Existing Cookies.

How to Do It: You can delete cookies using your internet browser. Every new version of every browser has a different procedure for blocking websites from serving your computer cookies. Finding the right place to do it can be confusing. To find what works for your browser, click here.

Why It’s Doomed: One problem with deleting cookies from your browser is that you’re relying on the company that created your browser to have an up-to-date list of companies with cookies to block. If your browser is even a month old, there will be new companies and new cookies that don’t appear on the list, so they can’t be blocked. The only way to stay protected is to continually update to the newest browser.

“The main problem is you really have to know what you’re doing,” says Jonathan Mayer, a student at Stanford University who is researching a universal “Do Not Track” tool similar to “Do Not Call” for telemarketers.

Read: A Privacy Advocate Weighs In on Do Not Track

The other problem with deleting cookies is the Flash cookie. Based on Adobe Flash technology, these cookies simply re-spawn themselves every time you try to delete them.

– Set Your Browser to Ban Future Cookies.

How to Do It: In addition to deleting existing cookies, browsers allow you to ban sites from planting new ones on your computer. To find out how to do it on your browser, click here.

Why It’s Doomed: This method cannot be 100% effective for the same reasons that deleting current cookies doesn’t entirely work. Browser companies can’t keep up with all the new tracking companies and cookies. Once installed, many Flash cookies can’t be deleted.

“Users are limited in self-help,” according to a study of anti-tracking techniques by a team of university researchers, “because anti-tracking tools effective against this technique are not widespread, and presence of Flash cookies is rarely disclosed in privacy policies.”

– Download Super-Cookies.

How to do it: Many online ads are delivered by advertising networks, which have contracts to gather data and serve ads on thousands of different sites. Most reputable ad networks offer people the chance to opt-out of online tracking by giving them opportunity to download “super-cookies,” which delete cookies that the networks’ websites try to download. They place these super-cookies on or near their privacy policies, to show that they care about consumers’ privacy concerns.

Why It’s Doomed: Three Reasons.

1)   Ad networks are basically invisible. It’s difficult for most consumers to even know what an ad network is, much less find their websites. And it’s basically impossible to know which network serves ads to which websites. So you might be protected on some websites and not on others, and you’ll never know which is which.

2)   Since new cookies are always being created, it makes sense to regularly delete them. But deleting the bad cookies also deletes the ad network’s good super-cookies. Which is why Ad networks’ anti-cookie cookies “don’t really work,” Mayer says.

3)   Many ads are delivered to your website without help from ad networks.

Ad networks’ anti-cookie cookies “don’t really work,” says Jonathan Mayer, a student at Stanford University who is researching a universal “Do Not Track” tool similar to “Do Not Call” for telemarketers.

Tips continued … >>>

Image: Rodrigo Senna, via Flickr.com

Tips for Blocking Cookies (cont’d.)

– Let Privacy Experts Do The Work For You

How To Do It: A few privacy-oriented programmers (think of them as anti-hackers) have created tools that automatically delete cookies for you. There’s TACO, or Targeted Advertising Cookie Opt-Out, which blocks cookies from dozens of different ad networks. There’s also PrivacyChoice, and a tool offered by the Network Advertising Initiative, the ad networks’ trade association. All three tools will cut down on the number of companies tracking you.

Why It’s Doomed: The same reasons why other techniques fail. It’s impossible for these tools to keep up with the constant proliferation of new companies and cookies. And they only work against cookies placed by ad networks, not those placed by publishers, advertisers or third-party companies that may gain access to your browser.

– Checkmate: Your Own Computer Gives You Away.

Even after you set your browser to delete existing cookies and ban new ones, download super-cookies and use the tools created by pro-privacy programmers, there’s one data-gathering technique that you simply cannot avoid. Your computer has hundreds of settings that control things like the main interface language (English, Korean, etc.), sound and screen resolution settings, and the color schemes people set for their Microsoft Word documents.

As you scroll the Internet, most websites automatically take snapshots of your settings. That information, combined with data on where you connect to the internet, can be used to track your movements around the web and build a profile about each visitor.

To see how effective this is at tracing individual users, I ran a test designed by Eckerseley called Panopticlick on my own computer. I’ve only had this computer for about a month, so I haven’t even taken the time to open my control panel and customize the settings for the track pad, keyboard, screen, etc. (The program doesn’t search for computers or beacons on your computer.)

Nevertheless, Panopticlick found 20 bits of identifying information on my Mac. Using those bits, it could tell that I was a unique user and not one of the 1.3 million people who ran the test before me.

No tools exist to prevent websites from gathering data on computer settings.

Image: Blaise Alleyne, via Flickr.com