Privacy protections on Internet browsers are anything but ironclad. Companies circumvent them routinely. Most people know they are being observed online but figuring out how is complicated.
Copyright NPR. View this article on npr.org.
RENEE MONTAGNE, HOST:
To some different news now. This Thursday, March 1st, Google will change its privacy policies, which will allow the Internet giant to take a whole lot of information it already collects about individual users and consolidate it, to better target advertising.
The move is raising privacy concerns, and has prompted lawsuits by consumer groups and a letter of complaint to Google, signed by three-dozen state attorneys general. So we asked NPR's Steve Henn to explain to us how all this online tracking works, and what its impact is.
STEVE HENN, BYLINE: President's Weekend, I grabbed a box of Thin Mints and piled my kids into the minivan.
UNIDENTIFIED CHILD #1: I am here, too.
HENN: We were headed skiing.
UNIDENTIFIED CHILD #2: I think we're almost there, but I don't know. Are we, Daddy?
HENN: Two hours away.
The last thing on my mind was that I was being watched.
UNIDENTIFIED CHILD #2: Our car's a mess.
(SOUNDBITE OF LAUGHTER)
HENN: Except for the fact that my daughter was playing with a video camera in the back seat. But when we got home and I clicked on my computer, one of the very first ads I saw was for the ski resort we had just left.
JONATHAN MAYER: What you saw is something called re-targeting.
HENN: Jonathan Mayer is a grad student at Stanford. He says computer cookies are tiny bits of code that track you online, and make ads like that one possible.
MAYER: Where the user goes to some website and then later on, an ad is targeted.
HENN: Turns out, I saw an ad for a discount on lift tickets when we got back because I had checked the weather at the ski resort before we left. Now, most people know they're being observed online, but figuring out exactly how this all works can be incredibly complicated. A couple of weeks ago, Jonathan Mayer caught Google circumventing built-in privacy protections on Apple's Safari web browsers. Most of the time, Safari blocks tracking code, or cookies, from ad networks, but...
MAYER: There's an exception to Safari's cookie-blocking policy.
HENN: If an ad network creates an online form and builds it into a website, and then you fill that form out, that network's allowed to give you a cookie.
MAYER: And there are some totally legitimate-use cases for this exception. But there was a known abuse, where you could create an invisible form and then submit the form without any user click - just using script. And we noticed that four companies were doing just that.
HENN: Google was one of them - submitting invisible forms and planting cookies, without permission. Google says it was just trying to make its social- networking services and ads work on Apple computers, but its engineers goofed.
LORRIE FAITH CRANOR: I definitely felt like I've seen this before.
HENN: Lorrie Faith Cranor is a computer science professor at Carnegie Mellon University. She says there is a long tradition in this industry of companies tricking built-in privacy protections.
CRANOR: There are a large number of companies that have been circumventing Internet Explorer's privacy protections for a long time.
HENN: Lorrie Cranor did a study in 2010 that found more than 11,000 of them.
Marc Rotenberg is from the Electronic Privacy Information Center. He says expecting consumer to protect their privacy, by managing cookies on their computer browsers, is insanity.
MARC ROTENBERG: It's completely unrealistic. It's like asking people who drive cars to measure their brake lining every time they get in their vehicle.
HENN: These days, cookies are just the beginning. Newer technologies, like beacons and pixel tags, make online tracking more refined and persistent. Beacons can actually track the movements of your mouse around your screen.
Consumer advocates and academics have been arguing for years that this system is out of control. The Web needs simple principals for privacy protection.
CRANOR: One is that when a consumer sets up their privacy settings, they have to actually work.
HENN: Lorrie Cranor.
CRANOR: The second thing is that consumers have to actually be able to understand what they're doing, and have settings and controls that actually make sense to them.
HENN: So privacy advocates have been pushing the idea of a do-not-track list. And Jonathan Mayer came up with a simple technology to make it work.
MAYER: It's kind of like planting a no-trespassing sign on your lawn - only, for your Web privacy.
HENN: One click on your browser...
MAYER: ...and you check off: Tell Websites I Don't Want To Be Tracked. And then your browser handles the rest.
HENN: It sends a signal to every site on the Internet saying: Stop.
Last week, some of the biggest sites out there said they'd listen. The Digital Advertising Alliance, which includes Google, announced it would adopt Jonathan Mayer's do-not-track technology. But...
MAYER: ...what they have to do when you turn on the do-not-track feature is not quite settled yet.
HENN: Advertisers, like Google, say they won't send you any more targeted ads.
MAYER: But they don't say anything about tracking itself.
HENN: And some big firms, like Facebook and Twitter, are not part of the deal.
MAYER: And so, in the privacy space, I think increasingly what's becoming common is privacy theater, where companies offer functionality not because it actually provides consumers with privacy protections or privacy choice but rather, because it provides the illusion of privacy protections or privacy choice.
HENN: Still, consumer advocates say the do-not-track function doesn't have to play out this way. But for it to work, the digital no-trespassing sign you plant in your yard will have to mean something; companies will have to respect it. And there will need to be cops on the beat you can call when someone break in anyway.
Steve Henn, NPR News, Silicon Valley.
(SOUNDBITE OF MUSIC)
MONTAGNE: You're listening to MORNING EDITION from NPR News. Transcript provided by NPR, Copyright NPR.