New Tracking Methods Evade User Control

  |  August 2, 2011   |  Comments

Technologies help publishers and marketers persistently track online behaviors.

Through initiatives such as the Digital Advertising Alliance, the digital media industry continues its attempts to self-regulate the collection of consumer data via the Internet. Despite that fact, ad technology companies are developing new methods to deliberately circumvent user attempts to evade online tracking, according to researchers at the University of California, Berkeley.

A research team consisting of privacy lawyer Chris Hoofnagle and researcher Ashkan Soltani, among others, published a report on Friday describing the use of a practice called "ETag tracking," which stores behavioral information in the browser cache rather than in cookies. The technology supposedly provides the ability to monitor users' behavior even if they block or delete HTTP, Flash, and HTML5 cookies from their machines.

According to the report, researchers found popular video site Hulu.com recreating HTTP and HTML5 behavioral cookies using ETag technology provided by a third party provider called KISSmetrics. Even if a user deletes his or her cookies, data regarding their previous behavior can simply be reinstated, effectively limiting their ability to control how their behavioral information is used.

"To our knowledge, this is the first demonstration of this ETag tracking in the wild," the report read. Speaking with ClickZ, Soltani said the method is specifically designed "to get around the privacy tools built into browsers and still track persistently."

Since the report published, however, KISSmetrics has altered its practices and updated its website to reflect those changes. "As of July 30, 2011 KISSmetrics uses standard first-party cookies to generate a random identity assigned to visitors to our customers sites," the firm's website now reads. Soltani suggested the company is "engaging in a bit of whitewashing" as it backs away from the ETag technology.

Hulu has already found itself scrutinized for reinstating deleted HTTP cookies, and was implicated in a lawsuit alongside tracking vendors Quantcast and Clearspring in 2009 regarding that behavior. The Berkeley study implies the company did so again, albeit with a slightly different technology, this time provided by KISSmetrics.

Bodies such as The Digital Advertising Alliance and the Network Advertising Initiative have gone to great lengths to create cookie-based mechanisms through which consumers can opt out of being tracked as they move around the Web. Those efforts have been formulated largely in response to scrutiny from regulatory bodies such as the Federal Trade Commission and the European Commission, both of which have repeatedly expressed concerns about users' control over online data collection.

Although KISSmetrics is not listed as a member of either of those initiatives, Hoofnagle suggested practices such as ETag tracking could severely undermine the efforts. "This is another example of tracking brought to light by researchers, rather than the industry self-regulatory groups… it is unclear whether they have the technical expertise to engage in the surveillance and reverse engineering of new tracking methods," he wrote in an email to ClickZ.

Hoofnagle also said the NAI and the DAA were failing to cover a reasonable scope of the industry, estimating that the bodies represent well under a third of the network trackers currently operating in the market.

It's worth noting, however, that ETag tracking is not the only technology being used to track users across the Web more persistently. Numerous companies are experimenting with a practice known as device fingerprinting, which doesn’t require the placement of data on users' machines in order to track their activity.

Besides ETag use, the study also monitored the top 100 U.S. sites - according to QuantCast - and recorded how many HTTP cookies were placed by those properties. In total it detected 5,675 cookies, an average of 56 cookies per site. 20 sites placed more than 100 cookies during a ten-page browsing session, it said, including seven that placed more than 150 including wikia.com, legacy.com, foxnews.com and myspace.com. A third party placed the vast majority of those cookies, the research found.

KISSmetrics and Hulu did not respond to requests for comment on this story.

ClickZ Live Chicago Learn Digital Marketing Insights From Leading Brands!
ClickZ Live Chicago (Nov 3-6) will deliver over 50 sessions across 10 individual tracks, including Data-Driven Marketing, Social, Mobile, Display, Search and Email. Check out the full agenda, or register and attend one of the best ClickZ events yet!

ABOUT THE AUTHOR

Jack Marshall

Jack Marshall was a staff writer and stats editor for ClickZ News from 2007 until August 2011. 

COMMENTSCommenting policy

comments powered by Disqus

Get the ClickZ Analytics newsletter delivered to you. Subscribe today!

COMMENTS

UPCOMING EVENTS

UPCOMING TRAINING

Featured White Papers

Google My Business Listings Demystified

Google My Business Listings Demystified
To help brands control how they appear online, Google has developed a new offering: Google My Business Locations. This whitepaper helps marketers understand how to use this powerful new tool.

5 Ways to Personalize Beyond the Subject Line

5 Ways to Personalize Beyond the Subject Line
82 percent of shoppers say they would buy more items from a brand if the emails they sent were more personalized. This white paper offer five tactics that will personalize your email beyond the subject line and drive real business growth.

WEBINARS

    Information currently unavailable

Jobs