Prying Eyes

Kiplinger's Personal Finance Magazine, August, 2000 by Ronaleen R. Roha

INTERNET | Online advertisers are building detailed profiles of you. With few regulations to PROTECT YOUR PRIVACY, the main watchdog of your information has to be you.

THE SAME technology that makes it easy for you to find what you want when you want it on the Internet also makes it easy for others to learn about you. That's what persuaded Harriett Judnick, an administrative assistant in San Francisco, to file a lawsuit earlier this year against DoubleClick, the largest advertising agency on the Web.

Judnick bought her first computer last year and soon became a regular surfer. But within a couple of days of doing some online research on medical insurance, she began to receive unsolicited e-mail messages and lots of online ads trying to sell her, among other things, medical insurance. Judnick didn't like being bombarded with pitches and wondered how they had found her. The answer to that question led to the lawsuit.

The crucial ingredient in the DoubleClick lawsuit is the cookie--the small data file sent to your computer by Web sites. Cookies are useful tools for Web surfers--in fact, they are key to the "personalization" of the Web. For example, when you customize a Web site's home page, that site deposits cookies on your hard drive and then reads them each time you log on. (For more on how cookies work, see the box.)

But cookies also have a dark side: They allow whoever deposits them to track your online comings and goings and build a profile of your surfing habits. Judnick learned that banner ads on sites in DoubleClick's ad network were leaving and reading cookies on her hard drive--even though she never clicked on the ads. The upshot: DoubleClick could track her visits to any site in its network. In the lawsuit, Judnick is demanding that the ad agency get users' permission before it compiles information about them.

Linking you to a cookie

THE COOKIES deposited on your computer leave a data trail that reveals a lot about you--your surfing habits, your interests, clues about your finances and perhaps about your medical history. Each click on a page in a Web site may be added to your profile in a database--databases that are coveted by advertisers and marketers.

Fortunately, most data collected via the Internet, while it can be traced to your computer, is still anonymous. That's because it doesn't contain "personally identifiable information"--such as your address or social security number--that would allow someone to connect your name, address and phone number to your online activities. You may see more car ads online if you've been pointing your browser to car Web sites and perhaps more auto-related spam, but you won't get more junk mail (the snail variety) or telephone solicitations.

But the rules can change if you've filled out a form or volunteered information about yourself online, says David Steer, spokesman for TRUSTe, the largest online privacy-seal program. Sometimes a banner ad that happens to be on the same page as a form you complete can capture the information on the form, too.

The possible linking of anonymous cookies to personally identifiable information is fueling the DoubleClick firestorm. DoubleClick wants to match data it has collected, which may include a name here or an address there, to its much more complete database, Abacus Direct, a collector of catalog shoppers' data that DoubleClick bought last year. Then it will be able to sell that profile of you, including your name, address and other personal details, to advertisers. Other online advertising agencies, such as Open Vertical and 24/7 Media, have the same capability, says Jason Catlett, a privacy consultant in Green Brook, N.J.

Ira Rothken, a San Rafael, Cal., lawyer who is Judnick's attorney in the lawsuit, says DoubleClick has amassed personally identifiable profiles on 150,000 surfers--a database that's a potential gold mine as DoubleClick and other advertisers fine-tune ways to target ads to Internet users. (DoubleClick now says it will not merge its database with Abacus's until the industry and government agree upon standards.)

It's the potential for abuse that provokes the battle cry of privacy advocates. They worry that online profiles, especially concerning financial, medical or sexual-preference topics, could be used to, say, deny you a job or health insurance. And the information could be out of date or simply untrue because cookies are assigned to a computer, not a person. For example, if you share your computer with your teenage son, your surfing habits and his are lumped together.

Although privacy advocates can't point to anyone who's been harmed by the use of such data, there are glimmers of the possibilities. For example, a survey by the California HealthCare Foundation showed that the majority of health care sites in the survey, including WebMD, DrKoop and Healthcentral.com, allowed advertisers to use cookies to collect personally identifiable information that appeared to violate their own privacy policies.

Protecting your privacy