The battle for privacy when browsing the Web

Legislation in the US and Europe is looking to curtail advertisers' ability to track consumers' internet activity

Online advertising companies are resisting efforts in the US and Europe to impose new privacy laws that could slash the amount of targeted ads on websites and which could equally dramatically hit their bottom lines.

The industry has been alarmed by recent moves to impose an “online privacy bill of rights” in the US and a “right to be forgotten” in the EU, both of which could give consumers greater control over their personal data, including the right to block tracking of their online behaviour.

Lobbyists for the industry say that some of the proposed legislation could paralyse the $70bn-a-year online ad market and have unintended consequences for the development of the internet, because the technology needed to implement some of the new regulations has not been invented yet.

And many of the technology companies and internet media groups involved are expressing their own concerns that the proposed rules are not practical.

Web giants such as Microsoft and Google have been experimenting with new technology, in response to demands that online adverts or web browsers should have a “do not track” option that users can click so that their online behaviour is not recorded and sent to advertisers. But the complexity of the internet is making it hard to come up with easy solutions.

“The idea of ‘Do Not Track’ is interesting, but there doesn’t seem to be consensus on what ‘tracking’ really means, nor how new proposals could be implemented in a way that respects people’s current privacy controls,” said Google spokesman Rob Shilkin. “We look forward to ongoing dialogue about what Do Not Track could look like, and in the meantime we are always looking into new tools to give people more transparency and control over their online privacy.”

If the internet is to remain an interactive, personal experience, then some amount of data tracking is vital. The questions are: how much, and what for, and who by, and with what kind of opt-in or opt-out mechanisms for consumers?

The problem is that, behind the contents of any single web page lies an increasingly complex ecosystem of companies using an array of different systems to tailor that web page to suit the reader. At its most basic, a website itself will tailor content. Amazon generates book recommendations for its customers by knowing what they have purchased in the past, for example. Google can predict your search query, and serve the answer faster, because it knows what you have searched for in the past.

Increasingly, websites are tying up together to make their content more “social”. Facebook users may find information about what their friends are sharing pop up on partner sites such as listings site Yelp.

And most controversially, the ads that appear on web pages are often now based on data collected about the user. This so-called “behavioural advertising” may serve up ads for golf clubs to a reader who has a history of visiting golf websites, whether or not the website they are currently looking at is a golf website.

A study by the Network Advertising Initiative last year found that behavioural advertising was three times more effective, in terms of click-through-rates, and three times as lucrative, in terms of purchases made by the consumer from the advertiser, than traditional online ads that were not personally targeted in this way. And that was a year ago. The effort being made by the advertising industry to hone advertising even more closely to what it thinks the consumer wants to see becomes more sophisticated all the time.

A new generation of online brokers have sprung up whose key skill is the analysis of large amounts of data. These brokers collect or buy data that can be specifically linked to an IP address or cookies (the little parcels of data left on an individual’s computer as a message to web publishers, which store information such as log-in names or other personal data) and use what they learn to place the most appropriate ads instantaneously on a web page.

To many privacy campaigners, the explosion in data collection, data analysis and use of personal targeting by ad networks has crossed a line.

“This is a commercial Orwellian environment,” says Jeff Chester, head of the Centre for Digital Democracy. “What is at stake is that we are granting influence over our lives to largely invisible and unaccountable digital giants, who have developed a far-reaching system of data collection across platforms and across networks.”

Alarmingly, information gathered from cookies is more than enough to deduce a person’s medical history, sexuality or political views, Mr Chester said, but he admitted that privacy campaigners are divided on how new regulation should be structured.

Most ad networks and data collectors have signed up to an online advertising industry code of conduct, the main plank of the industry’s efforts to persuade politicians that self-regulation is sufficient. The code includes a promise to put a link on every ad which will take consumers to a page detailing the network’s privacy policies and giving an option for the consumer to opt out of receiving targeted ads. The industry has even designed a logo for the link, an i in a blue arrow, but so far it has appeared on few ads.

Even assuming consumers can spot the link on their online ads, and know that following it will allow them to opt out, there remain numerous problems over what happens next. The burgeoning number of data collectors and networks involved means that consumers currently have to opt out numerous times if they want to sweep away all behavioural ads. The makers of web browsers have begun introducing features aimed at making the process easier. Google launched “Keep My Opt Outs” as a service for users of its Chrome browser; Microsoft’s new Internet Explorer includes a “do not track” option that broadcasts users’ desire not to be tracked online – but at the moment there is no guarantee that ad networks will know how to read or respond to the information it is broadcasting.

Last week, European Parliament justice commissioner Viviane Reding said new regulations in the EU would include a right to be forgotten, applied to data collected not just by advertisers but by social networks and other websites, presenting an even bigger technical challenge to the industry.

In the US, proposals are more modest. One House of Representatives plan would allow behavioural advertising only when consumers have opted in; the bill of rights proposed by Senator John Kerry would reverse that, but would mandate a clear and easy opt-out procedure.

What none of the proposals spell out, though, is how, technically, it can be done.