Activists charge DoubleClick double cross
Web users have lost privacy with the drop of a cookie, they say
By Will Rodger, USATODAY.com
Say goodbye to anonymity on the Web.
DoubleClick Inc., the Internet's largest
advertising company, has begun tracking Web users by name and address as they move from
one Web site to the next, USATODAY.com has learned.
The practice, known as profiling, gives marketers the ability to know the household,
and in many cases the precise identity, of the person visiting any one of the 11,500 sites
that use DoubleClick's ad-tracking "cookies."
What made such profiling possible was DoubleClick's purchase in June of Abacus Direct
Corp., a direct-marketing services company that maintains a database of names, addresses,
telephone numbers and retail purchasing habits of 90% of American households.
With the help of its online partners, DoubleClick can now correlate the Abacus database
of names with people's Internet activities.
Company spokeswoman Jennifer Blum said Tuesday that only about a dozen sites are
participating now. But she acknowledged that DoubleClick would like all its partner sites
DoubleClick defends the practice, insisting that it allows better targeting of online
ads -- and thus makes consumers' online experiences at once more relevant and more
profitable for advertisers. The company calls it "personalization."
Consumer advocates have another term for it: privacy invasion.
After being informed of DoubleClick's actions, several privacy activists said they
would file a formal complaint with the Federal Trade Commission next month.
"This is a blatant bait-and-switch trick," says Jason Catlett of Junkbusters Inc., an Internet-privacy consultancy.
"For four years they have said (their services) dont identify you personally,
and now they're admitting they are going to identify you."
To tie Doubleclick's "anonymous" records of
your surfing habits to its Abacus database, it needs only the cooperation of another site
that can identify you positively.
Futuristic though that sounds, positive identification
is actually simple. DoubleClick need only tie your cookie to another one placed by a site
that ships you something through the mail, or one which requires registration.
To do that:
sends a cookie to your browser and gives it a unique ID number.
Doubleclick sends the same ID number on to the site that knows
who you are.
That company then sends back the data that DoubleClick needs to
look you up in the Abacus database.
And voila -- DoubleClick knows who you are, too.
The combination of DoubleClick's cookie-derived information -- more than 100 million
files -- with Abacus' database on the purchasing habits of 90 million households means the
vast majority of Web-connected Americans will likely lose their online anonymity, says
David Banisar, deputy director of Privacy
said she was not sure whether surfing habits tracked by DoubleClick before Abacus data are
merged will be included in future profiles.
DoubleClick executives maintain they still give users who don't want to be tracked a
chance to opt out.
"That person will receive notice that their personal information is being
gathered," DoubleClick Executive Vice President and Abacus unit chief Jonathan
Shapiro says flatly.
Yet, that chance to opt out comes only in the form of a few lines of text placed in the
privacy policies of participating Web sites. Since those policies are often buried two or
three levels down, online consumers will seldom know what is being done with their
personal information in the first place, let alone that they may opt out, activists say.
"That is not permission," Banisar says. "That is fraudulent on its
Catlett, Banisar and the Electronic Privacy Information
Center plan to file a complaint with the Federal Trade Commission by Feb. 16.
They say they will charge that DoubleClick has duped consumers by suggesting the
company's technology lets them remain anonymous. They expect to enlist a wide array of
consumer groups to back their position.
Further troubling to privacy advocates is DoubleClick's refusal to say which Internet
sites are furnishing them the registration rolls that DoubleClick needs to link
once-anonymous cookies to names, addresses, phone numbers and catalog purchases.
"The fact that DoubleClick is not disclosing the names of the companies who are
feeding them consumers' names is a shameful hypocrisy," Catlett says. "They are
trying to protect the confidentiality of the violators of privacy."
Shapiro Tuesday bristled at Catlett's characterization. Any company that uses data from
the Abacus database to target Internet ads must disclose it online, he says.
Moreover, he adds, DoubleClick itself would hand over to privacy advocates the list of
participating companies if it could. But as in many lines of business, partners frown when
their relationships are disclosed without their permission, he says.
"If they all bought a billboard and said they work with us, that would be
great," Shapiro says.
The controversy over DoubleClick began last summer, when the company announced it was
buying Abacus Direct in a deal valued at more than $1 billion.
Privacy experts had feared that DoubleClick would begin merging the two databases at
some point. But they say they were unaware that DoubleClick had begun its profiling
practice late last year.
Before its Abacus purchase, DoubleClick had made its money by targeting banner
advertisements in less direct ways.
DoubleClick ad-serving computers, for instance, check the Internet addresses of people
who visit participating sites. Thus, people in their homes may see ads different from
those seen by workers at General Motors, or a machine-tool company in Ohio.
Every time viewers see or click on those banners, DoubleClick adds that fact to
individual dossiers it builds on them with the help of the cookies it drops on users' hard
Those dossiers, in turn, help DoubleClick target ads more precisely still, increasing
their relevance to consumers and reducing unnecessary repetition.
Those cookies remained anonymous to DoubleClick until now.
Being tracked as they move around the Web "doesnt measure up to people's
expectation on the Net," says Robert Smith, publisher of the newsletter Privacy
Journal. "They don't think that their physical locations, their names will be
combined with what they do on the Internet. If they (DoubleClick) want to do that they
have to expose that plan to the public and have it discussed."