Tracking the Trackers

Report monitors third-party cookie tracking

When it comes to online tracking, does “no” really mean “no”?

Not really, according to a Stanford researcher studying third-party tracking.

For the past few months, researchers at the Stanford Security Lab have been working on software to monitor the placement of cookies, beacons, and other online tracking mechanisms.

The surprising result? Nearly half of the companies participating in the self-regulatory Network Advertising Initiative do not remove tracking cookies after users opt out of online behavioral ad targeting, according to Jonathan Mayer, a graduate student and research fellow at the Stanford Center for Internet and Society.

At least eight of the companies explicitly say they’ll stop tracking after users opt out but continue to leave tracking cookies in place, said Mayer.  

While the NAI members promise only to stop targeting advertising—not stop collecting data—when users opt out, Mayer said the research shows that self-regulation isn’t satisfactory.

On the NAI’s site, for example, he said that the generic use of the phrase “opt out” in the context of privacy protection might lead users to believe that they’re opting out of data collection when they’re only opting out of ad targeting.

He also said that on some industry sites that specifically mention data collection, the language is written in such a way that people might think they’re opting out of collection altogether, but they’re actually only opting out of information gathering for the specific use of ad targeting. 

“Overall, the industry needs to do much better job of bringing transparency to their practices,” he said.

To monitor tracking, Mayer said the researchers identified tracking content for 64 of the 75 NAI members. After opting out of the targeted ads delivered by the company on the NAI site, the researchers loaded the content again.

Of the companies studied, 33 left tracking cookies in place after opting out, eight of which say in their privacy policies they’ll stop tracking.

However, 10 of the companies actually go beyond their privacy policies and remove tracking cookies when users opt out.

Separately, he said the researchers looked at which companies were explicitly respecting new browser-based Do Not Track efforts and found that only two companies (Media6Degrees and Bluekai) actually responded to Do Not Track requests.

Since the report’s release, two of the eight companies—24/7 Real Media and Wall Street on Demand—have updated their policies to clarify their actions, according to Mayer’s Twitter account.

The NAI did not immediately respond to a request for comment from Adweek. But, pointing to the Digital Advertising Alliance, Linda Woolley, executive vice president for the Direct Marketing Association, disagreed with the notion that self-regulation is ineffective. (The DAA is separate from the NAI but includes many of the same companies.)

“The whole program that DAA has built is to give consumers notice and choice of behavioral advertising and to allow them to opt out of behavioral target ads,” she said. “And that is exactly what the companies that have signed on to the DAA program do. And we have built a very large enforcement program around that.”

While the program doesn’t require companies to stop collecting data when they stop targeting ads, she said that’s because cookies are placed for a variety of reasons, including to “operationalize the Internet.”

Still, Justin Brookman, director of consumer privacy for the Center for Democracy and Technology, said that though the Stanford study was preliminary and didn’t drill deeply into the practices of each company, it raises interesting questions.

He said he was surprised to see that some of the companies may be misrepresenting their practices and concedes that self-regulation has been insufficient.

“It can’t just be about the usage of these profiles,” he said. “It has to be somewhat about collection as well . . . The industry may get there, but they haven’t gotten there yet.”