Web users have lost privacy with the drop of a cookie, they say
By Will Rodger, USATODAY.com

Say goodbye to anonymity on the Web.

DoubleClick Inc., the Internet's largest advertising company, has begun tracking Web users by name and address as they move from one Web site to the next, USATODAY.com has learned.

The practice, known as profiling, gives marketers the ability to know the household, and in many cases the precise identity, of the person visiting any one of the 11,500 sites that use DoubleClick's ad-tracking "cookies."

What made such profiling possible was DoubleClick's purchase in June of Abacus Direct Corp., a direct-marketing services company that maintains a database of names, addresses, telephone numbers and retail purchasing habits of 90% of American households.

With the help of its online partners, DoubleClick can now correlate the Abacus database of names with people's Internet activities.

Company spokeswoman Jennifer Blum said Tuesday that only about a dozen sites are participating now. But she acknowledged that DoubleClick would like all its partner sites to participate.

DoubleClick defends the practice, insisting that it allows better targeting of online ads -- and thus makes consumers' online experiences at once more relevant and more profitable for advertisers. The company calls it "personalization."

Consumer advocates have another term for it: privacy invasion.

After being informed of DoubleClick's actions, several privacy activists said they would file a formal complaint with the Federal Trade Commission next month.

"This is a blatant bait-and-switch trick," says Jason Catlett of Junkbusters Inc., an Internet-privacy consultancy. "For four years they have said (their services) don't identify you personally, and now they're admitting they are going to identify you."

To tie Doubleclick's "anonymous" records of your surfing habits to its Abacus database, it needs only the cooperation of another site that can identify you positively.

Futuristic though that sounds, positive identification is actually simple. DoubleClick need only tie your cookie to another one placed by a site that ships you something through the mail, or one which requires registration.

To do that:
DoubleClick sends a cookie to your browser and gives it a unique ID number.

Doubleclick sends the same ID number on to the site that knows who you are.

That company then sends back the data that DoubleClick needs to look you up in the Abacus database.

And voila -- DoubleClick knows who you are, too.

The combination of DoubleClick's cookie-derived information -- more than 100 million files -- with Abacus' database on the purchasing habits of 90 million households means the vast majority of Web-connected Americans will likely lose their online anonymity, says David Banisar, deputy director of Privacy International.

DoubleClick's Blum said she was not sure whether surfing habits tracked by DoubleClick before Abacus data are merged will be included in future profiles.

DoubleClick executives maintain they still give users who don't want to be tracked a chance to opt out.

"That person will receive notice that their personal information is being gathered," DoubleClick Executive Vice President and Abacus unit chief Jonathan Shapiro says flatly.

Yet, that chance to opt out comes only in the form of a few lines of text placed in the privacy policies of participating Web sites. Since those policies are often buried two or three levels down, online consumers will seldom know what is being done with their personal information in the first place, let alone that they may opt out, activists say.

"That is not permission," Banisar says. "That is fraudulent on its face."

Catlett, Banisar and the Electronic Privacy Information Center plan to file a complaint with the Federal Trade Commission by Feb. 16.

They say they will charge that DoubleClick has duped consumers by suggesting the company's technology lets them remain anonymous. They expect to enlist a wide array of consumer groups to back their position.

Further troubling to privacy advocates is DoubleClick's refusal to say which Internet sites are furnishing them the registration rolls that DoubleClick needs to link once-anonymous cookies to names, addresses, phone numbers and catalog purchases.

"The fact that DoubleClick is not disclosing the names of the companies who are feeding them consumers' names is a shameful hypocrisy," Catlett says. "They are trying to protect the confidentiality of the violators of privacy."

Shapiro Tuesday bristled at Catlett's characterization. Any company that uses data from the Abacus database to target Internet ads must disclose it online, he says.

Moreover, he adds, DoubleClick itself would hand over to privacy advocates the list of participating companies if it could. But as in many lines of business, partners frown when their relationships are disclosed without their permission, he says.

"If they all bought a billboard and said they work with us, that would be great," Shapiro says.

The controversy over DoubleClick began last summer, when the company announced it was buying Abacus Direct in a deal valued at more than $1 billion.

Privacy experts had feared that DoubleClick would begin merging the two databases at some point. But they say they were unaware that DoubleClick had begun its profiling practice late last year.

Before its Abacus purchase, DoubleClick had made its money by targeting banner advertisements in less direct ways.

DoubleClick ad-serving computers, for instance, check the Internet addresses of people who visit participating sites. Thus, people in their homes may see ads different from those seen by workers at General Motors, or a machine-tool company in Ohio.

Every time viewers see or click on those banners, DoubleClick adds that fact to individual dossiers it builds on them with the help of the cookies it drops on users' hard drives.

Those dossiers, in turn, help DoubleClick target ads more precisely still, increasing their relevance to consumers and reducing unnecessary repetition. Those cookies remained anonymous to DoubleClick until now.