Browser add-on locks out targeted advertising
- 18 March, 2009 07:22
A Harvard University fellow has developed a browser extension that stops advertising networks from tracking a person's surfing habits, such as search queries and content they view on the Web.
The extension, called Targeted Advertising Cookie Opt-Out (TACO), enables its users to opt out of 27 advertising networks that are employing behavioral advertising systems, wrote Christopher Soghoian, who developed it, on his Web site.
Soghoian, a fellow at the Berkman Center for Internet and Society at Harvard and a doctoral candidate at Indiana University, modified a browser extension Google released under an Apache 2 open-source license.
Google's opt-out plugin for Internet Explorer and Firefox blocks cookies delivered by its Doubleclick advertising network. A cookie is a small data file stored in a browser that can track a variety of information, such as Web sites visited and search queries, and transmit that information back to the entity that placed the cookie in the browser.
Google's opt-out plugin comes as the company announced plans last week to target advertisements based on the sites people visit. Targeted advertising is seen as a way for advertisers to more precisely find potential customers as well as for Web site publishers to charge higher advertising rates.
But the behavioral advertising technologies have raised concern over how consumers get enrolled in the programs, what data is being tracked and how the data is protected.
Many advertising networks will let consumers add an opt-out cookie to their browser, which means their Web activity won't be traced. But Soghoian wrote that if someone clears cookies from their browser, they'd have to go through the opt-out process again, which can be complicated if a couple dozen opt-out cookies have already been set. Firefox, for example, has a privacy setting that will clear cookies automatically when a browser is closed.
"This is obviously not a reasonable thing to expect," he wrote.
Soghoian's TACO extension sets permanent opt-out cookies for Google's network and 26 others, even if the cookies are flushed from the browser. Since some Web sites use multiple advertising cookies, TACO puts a total of 41 opt-out cookies on a machine, Soghoian wrote.
Page BreakSoghoian said it would be nearly impossible for the average user to collect opt-out cookies from the plethora of advertising networks. He said he spent three or four hours digging through the corporate Web sites of advertising networks to find the opt-out cookies to use in TACO.
"It's ridiculous," Soghoian said. "You don't have to notify every spammer in the world that you don't want to receive his e-mail."
It points to the greater issue of whether ad networks should allowed to proceed on an opt-out basis rather than opt-in. But no user in their right mind would opt-in to behavioral advertising, he said.
"This whole business model is designed around the ignorance of consumers," Soghoian said.
Soghoian acknowledged that an opt-in model would significantly hurt companies such as Google, which have made enormous investments in next-generation advertising systems.
There's an additional privacy concern even with the opt-out cookies. Some of those cookies still contain a unique identifier that could be used to track people, Soghoian said. Some of those cookies still contain a unique identifier that could be used to track people, even though using them cookie for tracking purposes would likely violate those companies' privacy policies, Soghoian said.
Ultimately, TACO is temporary fix for a long-term issue. Ideally, there would be a single, universal opt-out cookie which would be honored by marketers, Soghoian wrote. The problem is that for privacy reasons, cookies can't be accessed by domains that didn't set the cookie in the first place.
Another solution would be adding a way for browsers to send an opt-out HTTP header that is respected by online advertisers. But browser makers such as Microsoft, Google, Apple, Mozilla would have to agree on a technical specification, Soghoian wrote. That may not be in those companies' best interests.
"If the browser vendors went through the hard work of designing and implementing such a system, they'd likely also turn it on by default, as they did with pop-up blockers," Soghoian wrote.
That could mean a nail in the coffin for behavioral advertising systems. TACO can be downloaded on Mozilla's extensions site, but users must have a free developer account.
Soghoian's Web site also has TACO, where it can be downloaded without signing up. However, Soghoian recommends using the Mozilla site since it will notify users of updated versions of TACO.
For the best privacy protection, Soghoian also recommends enabling the feature in Firefox that blocks all third-party cookies.