Soghoian said it would be nearly impossible for the average user to collect opt-out cookies from the plethora of advertising networks. He said he spent three or four hours digging through the corporate Web sites of advertising networks to find the opt-out cookies to use in TACO.
"It's ridiculous," Soghoian said. "You don't have to notify every spammer in the world that you don't want to receive his e-mail."
It points to the greater issue of whether ad networks should allowed to proceed on an opt-out basis rather than opt-in. But no user in their right mind would opt-in to behavioral advertising, he said.
"This whole business model is designed around the ignorance of consumers," Soghoian said.
Soghoian acknowledged that an opt-in model would significantly hurt companies such as Google, which have made enormous investments in next-generation advertising systems.
There's an additional privacy concern even with the opt-out cookies. Some of those cookies still contain a unique identifier that could be used to track people, Soghoian said. Some of those cookies still contain a unique identifier that could be used to track people, even though using them cookie for tracking purposes would likely violate those companies' privacy policies, Soghoian said.
Ultimately, TACO is temporary fix for a long-term issue. Ideally, there would be a single, universal opt-out cookie which would be honored by marketers, Soghoian wrote. The problem is that for privacy reasons, cookies can't be accessed by domains that didn't set the cookie in the first place.
Another solution would be adding a way for browsers to send an opt-out HTTP header that is respected by online advertisers. But browser makers such as Microsoft, Google, Apple, Mozilla would have to agree on a technical specification, Soghoian wrote. That may not be in those companies' best interests.
"If the browser vendors went through the hard work of designing and implementing such a system, they'd likely also turn it on by default, as they did with pop-up blockers," Soghoian wrote.
That could mean a nail in the coffin for behavioral advertising systems. TACO can be downloaded on Mozilla's extensions site, but users must have a free developer account.
Soghoian's Web site also has TACO, where it can be downloaded without signing up. However, Soghoian recommends using the Mozilla site since it will notify users of updated versions of TACO.
For the best privacy protection, Soghoian also recommends enabling the feature in Firefox that blocks all third-party cookies.