Civic Nerdom

Last week Facebook enabled a new level of preference sharing, in which the site shares information about the music you’re listening to and the movies you’re watching on certain services that allow you to login via Facebook. As is common, the change has a number of people concerned about privacy, since it pushes a new and unexpected set of information about people into the public. Among these concerns, the Numbers Rule Your World blog at Junk Charts has argued that Internet researchers are among the few groups that will benefit from these changes.

I have to disagree with the idea that Facebook’s forced sharing is for the benefit of researchers. For starters, Facebook has never cared about appeasing researchers. They have usually been cold to the academic community, and the codes of their site (computer and legal) make it nearly impossible to gather data from the service for research.

Lets put aside Facebook’s relationship with research, and instead focus on the ethics of research. Ethical researchers won’t be very happy with this arrangement. It violates the research ethic of keeping information private and anonymous unless there is a compelling research interest to do otherwise. Ethical researchers wouldn’t be happy with forcing the information into the public so it can be observed, since it violates the core of research ethics: respect for individuals. While there are web researchers who don’t adhere to this ethic, there are many who do and apply it to their own research and the work of others. Even when data is out in the open, this ethic causes researchers to question the morality of collecting and analyzing public data without user consent, as seen in the case of Harvard’s 2006 Facebook study.

If Facebook actually wants to provide data to researchers, it would do so in a way that respects the ethics of research. Provide researchers with a means to request anonymous, private data about users who have consented to this form of searching. Don’t shove individuals’ data into the spotlight.

A couple of weeks ago the Interactive Advertising Bureau, one of the largest industry groups and self-regulatory bodies in online advertising, instated a new code of conduct for its members. In summary, the new code requires any IAB member site that collect information about users to display the logo to the right as an indication to users that collection is occurring, and to provide users with information about what is being collected and why.

While the new code of conduct has taken flack for not actually providing clear notice, this latest action by the IAB does bring some attention to the organization’s (beta) Opt-Out page. The Opt-Out page provides users with a way to request that IAB members not collect information about them for advertising purposes. The page, located at http://www.aboutads.info/choices/, is pretty simple to use: all you need to do is visit the page, make sure you are on the “All Participating Companies” tab, select the companies that you don’t want to have track you (or click “Select All Shown” to opt-out of tracking from all IAB advertisers), and then click Submit Your Choices at the bottom. Once you submit your choices, a cookie will be placed on your computer informing the companies you selected that you do not wish to be tracked. Aside form the Opt-Out page, the site includes information about online advertising (with an industry spin of course) such as how to adjust the privacy settings in your browser and the self regulatory principles of the IAB that are worth checking out.

Does it Work?

So the page is easy to use, but does it actually increase your privacy? Well, there are a few factors to consider that show the weaknesses of the opt-out page:

It applies to IAB members – which are a lot of advertisers to be sure, and includes most of the biggest advertising companies. Still, there are a lot of other companies and sites out there that are not IAB members, and thus are not affected by this Opt-Out page.

It relies on companies respecting your decisions – Between the IAB’s own enforcement and the threat of FTC legal actions, IAB companies have plenty of reason to not track you if you tell them not to. Unfortunately, the history of Internet privacy is full of examples of sites or companies not respecting the wishes of consumers, even when they have said they would. For that reason, some skeptisim is reasonable here, and personally I’m not yet ready to trust the intentions or ability of the IAB to respect my privacy decisions. This opt-out page allows you to ask that companies shutoff their tracking, which is different from the approach tools such as Ghostery take, which actually blocks information from being sent, and is an approach I’m more willing to trust right now.

It uses cookies – If you are concerned about privacy on the Internet, you probably have your browser set to not accept cookies/delete cookies when you close the browser/or delete cookies often. That means the Opt-Out page is pretty useless to the privacy concerned, since any choices set via the page will be lost within a short amount of time. This is a problem that engineers and policy makers have been discussing since Do-Not-Track became a big deal, and in my opinion it reveals a problem with how cookies are managed by browsers. The current cookie management model of the major browsers is built on an all or nothing choice – either have all cookies on and retained, or have all cookies off and deleted. Despite years of messaging about how bad cookies are, the IAB’s Opt-Out page shows that not all cookies are bad. Browsers need a more sophisticated cookie management system that allows a user to select which cookies can be kept for a long time and which should be deleted right away. Until that happens, the Opt-Out page might as well not exist, and users should instead use opt-out plugins like TACO.

It only applies to one browser on one machine – This limitation applies to many privacy protection tools, but it is an important one. If you submit opt-out requests in Firefox on your home PC, then tracking will still occur on IE on that PC, or Firefox on your laptop.

So Should I Use It?

The short answer is no.

Unfortunately, the Opt-Out page isn’t a reliable tool for privacy protection, mostly because of the cookie problem discussed above. This is especially unfortunate since this page is likely the result of hours of discussion involving IAB companies, the FTC, and consumer groups, and represents what I would like to believe is an honest effort by the industry to address privacy concerns.

Given the level of discussion and work going into Do-Not-Track, it is likely that the IAB’s Opt-Out page will merge with a browser based Do-Not-Track manager. Until that happens, privacy concerned consumers will have to continue to rely on third party tools to prevent companies from tracking them all around the Internet.

Its funny how quickly the weather has changed from summer to autumn, and how perfectly the fresh chill of fall arrived with the start of the school year. The University of Minnesota’s semester started a week ago. Friends are already talking about all of the reading they have to do. The days are getting shorter, the nights are getting cooler, and like geese who know it is time to migrate south I feel an instinctive need to buy books and flock to a lecture hall.

For nineteen of the last twenty years I have been in school. The one year I wasn’t in school, I spent fall applying to schools. For the vast majority of my years, school has been the structure of my life. It has set my schedule, defined commitments, created my goals, and provided me a social life. Through all those years, the structure of school has been remarkably consistent: September was always the “beginning of the year”; classes always lasted 4 or 9 months; my goal was always to understand a new topic or at least write passable papers and exam responses; and my friends were always among my classmates or housemates. Given all these years of repetition, its no surprise my natural response to fall is to think of school.

So I’m entering this September feeling a little sad and very anxious. Nostalgia is fueling the sadness, as this weather makes me think of friends and fun from past school years. But the sadness is little because I know I can and will see my old friends again. The anxiety comes in large part from the loss of this familiar structure. What schedule do I plan my life around now? I don’t know if I’ll be working on today’s projects and job for four months or four years.  How do I manage the myriad goals now presented to me? And as an introvert who works from home and coffee shops, where do I meet new friends?

The lack of structure is stressing me out now, but I know that will pass. The comfort of school comes with a lot of restrictions, restrictions that I have outgrown. I recognize the freedom I’m now living in. Once I embrace it, I know I’ll be able to define my life the way I want to. Without a school provided structure, I’m free to set my schedule, my commitments, my goals, and my social life. I have the freedom to create my own structure. But right now, that freedom is a little scary.

“… there is no way we should do business with companies that have agreements with stealth provisions and that aren’t intelligible. So how are we going to change the world? Make clarity, transparency, and simplicity a national priority.”

A year and a half ago, Alan Siegel described in less than 5 minutes why the problems of privacy and consumer trust run rampant on the Internet. That legalese that every website presents you doesn’t actually inform you of anything. It is a tool of websites to obtain legal authorizations and protection.

Privacy policies were not meant to be used this way. The FTC originally promoted privacy policies as a tool for informing consumers of the benefits and risks of using websites. Over the years they have evolved into dense blocks of text that are not only useless to consumers, they are harmful to consumers.

Why aren’t clear notices a national priority? Siegel thinks they should be. The FTC has stated again and again that consumer notices should be clear and easy to understand. Unfortunately, industry self-regulation bodies and Congress don’t seem to be as interested in presenting consumers with clear and transparent information.

Why aren’t clear notices a national priority? I think we should ask the DMA’s Consumer, Ethics, and Privacy department, or IAB President Randall Rothenberg. More importantly, we should ask that question to our Representatives and Senators. We might also want to ask, why is it OK for businesses to trick consumers? Why aren’t consumers treated with respect by our businesses and our government?