The KnowPrivacy Project: Google and Yahoo (and many others) are watching you

We're all vaguely aware that our use of the internet isn't really private. However, you may be surprised to find out who is monitoring you, how they're doing it, and what they're doing with the information.

UC Berkeley's KnowPrivacy Project ("KnowPrivacy," of course, also sounds like "No Privacy") has recently issued a report of its findings on internet data collection, and it makes for some pretty troubling reading. Here are summaries of a few of their findings:

1. Collecting information with web bugs and beacons: Everyone knows about cookies--the small text files that sites like Amazon and Gmail place on your computer to personally identify you when you visit them. And if you want to order something online or read your web-based e-mail, you have to enable cookies from those sites. However, when you do that cookies can also be placed on your machine by third parties such as advertisers; since an advertiser can have ads on many sites, they can collect personally identifiable information about your browsing behavior across the web.

But even if you set your browser to disable third-party cookies, your internet use can be monitored by web bugs. Web bugs are typically 1 x 1 pixel images that are invisibly embedded in the background of a web page, an ad, or an e-mail. Whenever that web page is opened in your browser, the bug informs the server of your IP address (that is, your computer), the time, and the URL (that is, what you're viewing). The only way to disable web bugs is to block all third-party content, but that means (for example) you couldn't view a YouTube video embedded in someone's blog post. Web bugs can also be embedded in e-mails, alerting the sender when the message has been opened (so a spammer can discover that your e-mail address is valid, even if you don't click on any link and immediately delete the e-mail).

Often, of course, you may want to share information about your internet use with a website operator--it enables the site to be customized to your preferences. Examples include things like Amazon's recommendations for users based on their browsing and purchasing patterns, or Netflix's recommendations based on previous rentals and ratings. Consenting to such information-sharing can make these sites more functional for users. However, the whole point of web bugs is that they do not require your consent to gather information about you.

2. Who is collecting your information: Dozens of advertisers and website operators attempt to track your internet use, but among the leaders in web bug placement is Google. The KnowPrivacy project found that Google-owned sites are saturated with web bugs--in March 2009, 100 separate web bugs were found on Blogspot, 44 on Google and 31 on Blogger. (Typepad, a rival blogging site, had 75 separate web bugs.)

While blogs can contain ads that have their own bugs, many of the bugs on the blogging sites are placed by the bloggers themselves in order to track their traffic. But popular tracking bugs such as Google Analytics, for example, allow bloggers to share that information with the parent company (and in fact, Google offers incentives to do so). Google-owned trackers--Analytics, DoubleClick, AdSense, FriendConnect, and Widgets--appeared on more than 88% of the 394,000 distinct domains visited by the KnowPrivacy Project participants. Clearly, a lot of information on web use is being gathered without the explicit consent of users.

3. Sharing of information: So what's being done with this information? For one thing, companies like Google use it to sell ads targeted to specific users. I have a Gmail account, and my messages are obviously bugged and scanned for keywords. When I open a message containing specific keywords, a text ad that has been matched to those words appears on my screen. But I have to confess that I don't even consciously notice most of these, and the ads were part of the deal I accepted when I set up the account.

But information gathered about you by websites can be shared--that is, sold, rented, or offered as part of a commercial agreement--with other companies without your knowledge or consent. In order to protect yourself, you might try to read websites' privacy policies. But many privacy policies have language that refers to things like "affiliates," "marketing partners" and "third parties." It is almost impossible to find out which companies are getting information about you, and under what constraints.

Of 50 privacy policies analyzed by the KnowPrivacy Project, 36 stated that third-party tracking is allowed, but "the data collection practices of these third parties were outside the coverage of the privacy policy" (p. 27). And as for affiliates, the report points out that "it appears that users have no practical way of knowing with whom their data will be shared" (p. 28). As an example, "MySpace, one of the most popular social networking sites (especially among younger users), is owned by NewsCorp, which has over 1500 subsidiaries....Information pulled from these websites could potentially find its way to all of these affiliated companies" (p. 28).

In my own experience, Yahoo's privacy policy seems particularly confusing and unclear. For example, it states that Yahoo doesn't share personal information about you with without your consent...except "to trusted partners who work on behalf of or with Yahoo! under confidentiality agreements. These companies may use your personal information to help Yahoo! communicate with you about offers from Yahoo! and our marketing partners."

In other words, Yahoo can share any information they gather about you with any entity working "on behalf of or with" Yahoo, although these "trusted partners" aren't supposed to further share your information. Who are these "trusted partners"? "Yahoo! works with vendors, partners, advertisers, and other service providers in different industries and categories of business." Clicking on the offered "reference links" takes you to a page that includes more than 100 links detailing the "privacy practices" of various Yahoo products and services, including more than a dozen "Acquired Companies with Different Privacy Policies." Presumably, the use of your information by these acquired companies--which include AltaVista, del.icio.us, Flickr, and Yahoo Search Marketing--is governed by their "different privacy policies," even though they are owned by Yahoo.

There's also some other troubling language in the Yahoo policy about how merely viewing an ad implies consent. "Yahoo! displays targeted advertisements based on personal information....[B]y interacting with or viewing an ad you are consenting to the possibility that the advertiser will make the assumption that you meet the targeting criteria used to display the ad."

So based on personal information it has collected about you, Yahoo sells display ads on pages you visit. Merely by viewing these ads, which display automatically, you are consenting to the assumption that you fit the profile of users at whom the ad is aimed. Among Yahoo advertisers are "financial service providers (such as banks, insurance agents, stock brokers and mortgage lenders)." The assumptions that financial companies such as insurance companies and lenders make about you can have potentially huge impacts, of course.

I recommend reading the full KnowPrivacy report; it is available through the KnowPrivacy website, which summarizes the report's findings. How personal information is being collected and disseminated should be of concern to everyone who uses the web.

If you're interested in additional resources, the Electronic Frontier Foundation monitors important developments in internet privacy, as well as other issues like free speech, innovation, government transparency, and intellectual property--see my response to Memsaab's comment below.

Reference:
Joshua Gomez, Travis Pinnick, and Ashkan Soltani, "KnowPrivacy" (June 1, 2009)
http://www.knowprivacy.org/report/KnowPrivacy_Final_Report.pdf