Inside Google

If you’re like most Web users, you probably don’t realize how intensively your visits to many of the most popular pages on the Internet are scrutinized.

In fact, the art of anonymous, Internetwide monitoring of who visits what webpage has been advancing dramatically, driven by advertisers’ desire to tailor their messages to specific groups of customers.

This month, however, the Federal Trade Commission — responding to complaints that “tracking” software can violate the privacy of those using the Web — moved to put the brakes on such monitoring. The FTC called for a “Do Not Track” mechanism that would enable consumers to opt out of being tailed around the Web.

Privacy advocates praised the move, saying that tracking has gotten out of hand.

“Consumers have a right to know what information is gathered about them, how it is used and whether it is gathered at all,” says John M. Simpson, spokesman for the advocacy group Consumer Watchdog.

Opponents counter that the Do Not Track plan would disrupt the burgeoning online advertising industry, putting at risk the estimated $300 billion of U.S. economic activity it helps to foster, as calculated by the Interactive Advertising Bureau (IAB).

Display ads, video ads and animation ads that rely heavily on Internet tracking could be thrown out of whack in unpredictable ways, critics of the FTC plan say. And that could negatively affect a $25.8 billion-a-year advertising and marketing industry that’s expected to swell to $40.5 billion by 2014, according to research firm eMarketer.

The debate over the FTC’s plan reflects long-simmering tensions over how privacy and commerce intersect on the Internet. And it’s raising questions about the necessity for a federal law that would require ad networks to heed consumers’ Do Not Track requests.

The technology that would enable people to opt out of being spied on while surfing the Internet is easy to build into a Web browser. Users could check a box telling their Web browser to notify every webpage they visit not to track them. The catch: The advertising industry would have to universally honor such requests. That’s unlikely, absent regulation-backed enforcement.

“Tracking is not a bad thing,” says Steve Sullivan, the IAB’s vice president for supply chain and revenue solutions. “It needs to stay self-regulated within the industry.”

A ‘fingerprint’ of Web use

Anonymous, Internetwide tracking quietly has grown into a gargantuan industry. An estimated 80% of online ad campaigns use some form of “behavioral targeting” technology, according to a 2009 IAB study.

A cadre of large technology companies leads the way in collecting massive amounts of data about how consumers use their Web browsers and computing devices — all without asking Internet users for their permission, according to research conducted by Balachander Krishnamurthy of AT&T Labs and computer science professor Craig E. Wills of Worcester Polytechnic Institute in Massachusetts.

Krishnamurthy and Wills found that Google, Adobe, Yahoo, Microsoft, AOL, Coremetrics and Quantserve act as aggregators, operating families of tracking systems that encompass dozens more smaller, independent ad networks, data analytics firms and tracking services.

Each aggregator and ad network can use myriad techniques to make note of when a person clicks to a particular webpage, instantaneously gathering rich, detailed information from the visitor’s Web browser and computer operating system.

One way to track users is via a snippet of text, called a tracking cookie, that gets downloaded to the visitor’s browser and lets the aggregator record all visits to Web pages on which it has a tracking mechanism. Aggregators also can take a “fingerprint” of the unique combination of plug-ins, fonts and other browser tools and settings a specific visitor tends to use.

Most often, visitors to popular Web pages are tracked by multiple aggregators. “This puts the aggregator in a position to be able to track users’ activities across a wide range of sites that they visit,” Krishnamurthy says.

Last spring, Krishnamurthy and Wills examined 127 popular consumer websites and found Internet users were tracked at 84% of the sites. Their most stunning discovery was that sensitive personal information often was “leaked” from popular social networks — including Facebook, MySpace and LinkedIn — to the top aggregators.

Such a transfer of information occurred when a Web user who already was being tracked by an aggregator happened to visit a social-network page containing the user’s name, address, gender, age, employers, friends and similar profile data.

“One doesn’t know what aggregators are doing with this information,” Wills says. “But if these companies don’t need this information and are not using it, they should not be receiving it.”

Facebook, which has the largest social network at about 500 million members, acknowledged the exposure found by Krishnamurthy and Wills, but says it rarely happened. Facebook has adjusted its profile pages to prevent the flow of such personal information to aggregators, spokesman Simon Axten says.

Google, the largest tracking aggregator, says it provides ways for folks to opt out of tracking. “We work to give users meaningful choices to protect their privacy and to protect the data that users entrust to us,” company spokesman Brian Richardson says.

Even so, privacy advocates worry about similar data leaks. There currently are too few restraints to prevent aggregators from correlating personal data with information about which Web pages an individual visits most often, says Consumer Watchdog’s Simpson.

Doing such analytics could be highly profitable — and invasive. For example, such information could help insurance companies decide on whether to offer someone coverage, or allow banks to decide whether to approve someone’s loan application. It also could affect an employer’s hiring decisions, or help political partisans identify potential targets for support.

“Currently, consumers don’t know how information gathered about them when they go online is used and have no opportunity to correct the data if it is wrong,” Simpson says.

After more than a decade of letting the online advertising industry regulate itself, the FTC during the past year has become increasingly sensitive to consumer privacy concerns. The agency’s Do Not Track plan is part of a broader set of recommendations to give consumers truly meaningful choice over whether to be tracked or not, says Maneesha Mithal, associate director of the FTC’s division of privacy and identity protection.

“No matter what the business model, no matter what the interface, you need to give consumers choice before you share their data with third parties,” Mithal says.

The agency is accepting written comments until Jan. 31, after which the full commission will vote on whether to formally request a congressional mandate requiring ad networks and website publishers to honor Do Not Track requests. Industry lobbyists already are pushing hard for the FTC to stick with the self-regulatory approach.

Do Not Track could hinder website publishers from customizing their services and carrying out certain kinds of ad campaigns, says Pam Horan, president of the Online Publishers Association, a trade group representing large media organizations, including USA TODAY. It also could put an undue burden on website publishers to make sure Do Not Track works at the nuts-and-bolts level, Horan says.

Smaller ad networks and tracking services, in particular, would suffer if Do Not Track is implemented broadly, says Kevin Lee, CEO of online advertising consultancy Didit. That’s because ads aimed at high-end products, which account for a good portion of the smaller ad networks’ profits, command higher premiums because they can be targeted at specific groups of Web users who are being tracked anonymously across the Internet.

“Failure to price this advertising inventory based on anonymous tracking information would probably drop its value in half,” Lee says.

Innovation would prosper

Even so, other analysts say disrupting the status quo could be a good thing, potentially breathing new life into the online advertising models of companies willing to innovate.

“Many things are possible, technologically speaking, in trying to target ads to users without doing the kind of pervasive tracking that raises concerns,” says Edward Felten, a Princeton computer science professor who will become the FTC’s chief technologist on Jan. 1.

Big media websites and large social networks, in particular, should be able to better leverage their trusted brands and develop fresh marketing techniques that aren’t so reliant on Internetwide tracking, says Blake White, director of PricewaterhouseCoopers’ entertainment, media and communications practice.

“The more creative companies will find new ways to legally and ethically make profitable use of information that users openly volunteer,” White says.

A high-visibility website publisher, such as sports network ESPN, for instance, could buttress strategies centered around nurturing “first-party relationships” — open dealings between a website publisher and visitor that stand apart from Internetwide tracking by a third-party ad network. ESPN’s fantasy football leagues and insider columns, for example, already are trusted by hordes of loyal customers who disclose personal information specifically to ESPN in exchange for access to free services.

Facebook, too, looks to be well-positioned for a new era of information-sharing. In support of generating about $1 billion in annual advertising revenue, the world’s No. 1 social network methodically innovates around strategies that involve getting its members to interact and voluntarily share personal information on the company’s Web pages.

“We never share our users’ personal information with advertisers and do not sell it to anyone,” company spokesman Andrew Noyes says.

Facebook recently added new and updated features with the intent of encouraging members to say more about themselves.

It redesigned profile pages so members could more clearly show personal data, added an online check-in application for people to share their location and introduced a groups function for specialized conversations.

Members of Facebook-specific groups, for example, receive tailored ads that reflect their interests. Fans of the World Series champion San Francisco Giants group are being pitched ads for World Series merchandise.

The new features are “designed to strengthen the bonds between Facebook members and the site,” says Charlene Li, an analyst at Altimeter Group who follows Facebook. “There’s value for members, Facebook and, most definitely, advertisers.”