p2pnet news view Advertising | P2P:- “Users are concerned about data collection online and want greater control over their personal information. Users lack awareness of some data collection practices. Users don’t know who to complain to.”

And …

“Websites collect and analyze data about users, but only offer partial access and control to the users. Website policies are unclear about several important issues, such as retention and data enhancement. Websites claim they do not share user data with third parties, but they do share with affiliates that users may have no relationship with. Web bug trackers are ubiquitous. Analytics and ad serving companies can track user behavior across large portions of the web.”

Both statement sets come in Know Privacy, new study by graduate students Joshua Gomez, Travis Pinnick and Ashkan Soltani at the University of California, Berkeley.

With Brian Carver as their advisor and Sona Maklker and Mark McCans as assistant members, the team’s plan was to compare user expectations of privacy online with the data collection practices of website operators too identify specific practices, “that may be harmful or deceptive and attract the attention of government regulators”.

The students, at the School of Information, studied consumer expectations by looking at sources like complaints filed with the Federal Trade Commission and data collected by the state of California and a privacy group, says the New York Times, adding:

“They analyzed company practices using Ghostery, a browser plug-in that detects cookies, Web beacons and other types of trackers that allow third parties to gather information about Web site visitors, often without their knowledge. Google showed up as the most conspicuous tracker on third-party sites. Google Analytics, a free product that allows online publishers to gather statistics about visitors to their sites, was used on 81 of the top 100 sites. Cookies from the advertising company DoubleClick, which is owned by Google, were present on 70 of those sites.

“When combining trackers from those two services, Google had a presence on 92 of the top 100 sites. Others weren’t far behind. Cookies from Atlas, Microsoft’s DoubleClick rival, appeared on 60 sites, and trackers from two other analytics companies, Quantcast and Omniture, showed up on 54 sites.”

Based on their findings, the students offer these  recommendations »»»

A.   ACCESS,  CONTROL,  AND SALIENCE

The biggest concern among the complaints we coded was the lack of control.  Users do not want websites to collect or share data without permission, and they want the ability to access, edit, and delete records about themselves.  In 2003, Joseph Turow found that 94% of his sample of 1,200 American adults agreed or agreed strongly with the statement, “I should have a legal right to know everything that a website knows about me.” [Turow, 2003].

We recommend regulation by which both websites and third-party trackers must allow users to see all the data that has been collected about them, not just user-provided information.  Additionally, users should also be allowed to see with whom their data has been shared.  The imposition posed upon companies by such a requirement could be greatly mitigated by merely requiring that websites provide users with the information they have about the user in a form no less convenient than the form in which it is available to the company.

We recommend that companies request permission from users before sharing data about them with any outside party, regardless of affiliation. The presence and purpose of third-party tracking should also be made more salient in the minds of users.  We recommend that all browser developers provide a Ghostery-like function in their browsers that alerts users to the presence of third-party trackers.

B.   AUTHORITY & METRICS

Our analysis of user complaints brings to the fore a larger problem with data collection policy in the United States: no one knows who is in charge of protecting privacy.  The fairly low number of complaints to the various organizations we contacted reveals that users do not know to whom they should complain. Furthermore, the FTC‘s new principles for behavioral tracking make no mention of any enforcement or accountability principles.

According to the FTC‘s Privacy Initiative web page, it safeguards consumer privacy by enforcing the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act, and the Children‘s Online Privacy Protection Act.  It also states that the FTC strives to educate ‘consumers and businesses about the importance of personal information privacy’ [Federal Trade Commission, 'Privacy Initiatives'].  We recommend that the FTC become more aggressive in protecting privacy on the Internet.

The first step for the FTC is to improve the integrity of its current system for taking user complaints.  We recommend an overhaul of both the user interface as well as the database architecture.  The current system may introduce bias in its presentation of complaint categories, especially for users who may lack the technical understanding to accurately describe their exact concerns, thereby affecting the data collected.  If the FTC is going to protect privacy it must be able to gauge public sentiment and measure the efficacy of its policies in an accurate manner.

It should also strive to get a larger picture of user concerns.  Therefore, we recommend that the FTC make more users aware of the complaint assistance system.  One possible way to achieve this is to require websites that collect personal information about users (other than the automated IP logs) to include a link on their privacy policies to the FTC‘s website.  This would direct users to the FTC and help it gain insight into user concerns.

C.   BETTER NOTICE

Notice is the FTC‘s primary Fair Information Principle.  Users must be made aware of data collection practices if they are to make informed decisions.  In the Introduction we discussed several reasons why privacy policies are an ineffective means of notifying users of practices.  However, to the extent that they remain the primary method of notice, we have some suggestions for improvement.

First, the policies should be readable for average users.  Despite years of research showing problems with the language of privacy policies, they are still difficult to read.  We conducted a Flesch-Kinkaid readability test on the 50 policies we analyzed and found that the average grade level was 13.83 (the lowest was Chase with 8.66, and the highest was Adobe with 17.29, standard deviation was 1.89).

Beyond the problems with language, the policies are often vague about actual practices, and contain statements that are contradictory or misleading.  Many state that data is [sic] not shared with third parties even though the data may be shared with affiliates with whom the user has no relationship.  Allowing third-party tracking while claiming that data is not shared with third parties is also misleading.  By sharing space on a  web page for tracking companies to collect information, website operators are in effect sharing user information with third parties.

We recommend that users be given clear and proper notice as to whom the data will be passed, regardless of affiliation or method of sharing.  The policiesshould not contain conflicting statements that third-party sharing is not allowed but third-party tracking and affiliate sharing are.  Therefore, we recommend the FTC adopt strict definitions for the terms ‘affiliate’ and ‘third party.’  In addition, users should be informed as to whether or not the flow of data will stop with the affiliate or if the affiliate may share data with another company.

We also recommend that the practice of third-party tracking be made more transparent.  It currently operates in a policy loophole, by which neither the website nor the tracker are clearly accountable for the data collected.  We recommend that websites define the policies of the third-party trackers it allows on its site or, at a minimum, link to the appropriate policies on the tracking companies‘ websites and specify which practices fall under each policy.

We also recommend that the FTC create an opt-in standard for enhancement, the practice of buying information about users from outside sources.  The FTC‘s self-regulatory regime is premised on the idea that consumers will selectively disclose personal information to websites they trust.  Enhancement circumvents this process, and allows websites to obtain this same information without user participation.

A user who decides to reveal a small amount of personal information to a website that she does not fully trust loses all defenses when that site can simply bump up the submitted data with extrinsic, enhanced data.

Now, “We plan to create a short animated video that explains the technology behind online data collection, exposes the flow of that information between websites, their affiliates, tracking companies, data aggregators, and direct marketers,” says the team, adding:

“The animation will also examine some of the potential harms that can arise from giving away personal information.  We were inspired to do this by animated videos such as the Story of Stuff, and The Crisis of Credit, as well as the Creative Commons video, Get Creative.  We believe animations like this help people understand the issue not just through simplification, but also through simulation.  Danger is most salient to those with personal experience.  Watching a simulation of this danger in a video puts the viewer one step closer to that direct experience.

“We also plan to continue our research in this area.  We plan to push our investigation of affiliate sharing further and begin research on users‘ knowledge and website operators‘ use of Flash cookies.”

Definitely stay tuned.

Follow p2pnet on Twitter.

New York Times – Google Is Top Tracker of Surfers in Study, June 2, 2009