Privacy options for targeted online advertising need some work, said Canada’s Privacy Commissioner in a report released in mid-June.
The Commissioner was interested in how advertisers target people online, and whether they contravene its privacy principles.
Online behavioural advertising (OBA) works by writing small files called cookies to a computer via its web browser when it visits a site. Although this doesn’t typically contain personal information about a user, it will use other information, including their IP address, and what page they were visiting.
When that browser visits another website which has partnered with an online advertising network, the website can pass the information in the cookie to the advertising network. The network will then display an online advertisement on the web site, targeted to that user, based on their previous visit.
This is why you suddenly find advertisements for tents and sleeping bags, say, when you have been researching camping sites for the summer holidays.
The Commissioner tested 46 websites, analysing almost 9000 online advertisements. The tests, which combined automatic scripts and manual visits, browsed target web sites related to 12 topics. They then visited general interest sites and documented what advertisements they were shown.
A little over half the web sites that the Privacy Commissioner tested featured ad tracking technology. On average, around 3% of advertisements served across all sites were targeted, it said.
Under its 2011 online advertising guidance, the Commissioner said that advertisers using an opt-out model should avoid collecting sensitive information about visitors, such as health information, to deliver targeted advertising.
On the positive side, most of the targeted ads displayed the logo for AdChoices. This is a self-regulated program introduced by the advertising industry, which includes clear opt-out choices for users.
“Nevertheless, it appears that many ads may be appearing on websites frequently used by Canadians without the AdChoices icon, or any other form of notification and opt-out,” it said.
“Previous observations of major websites and the ads they contain suggested that, while ads are often tailored based on past web activities, there may be little notice of OBA practices and no easy ability to opt out,” the report said.
Even when opt-out options were provided, they were often not adequate, according to the report. Some were more difficult to find than others, and some of them used unclear language. The report also noted that users had to visit multiple websites with different interfaces to opt out of the tracking networks.
Clicking on the AdChoices icon didn’t lead to a consistent experience, he found. Some sites offer make the opt-out process cumbersome, and often made even the term hard to find on the website. Adobe and Amazon were guilty of this, as was Google, it said. In some cases, there was no feedback to confirm that the opt-out request had been accepted.
The report cited three cases bought by the Commissioner that had involved OBA. Nexopia wasn’t informing users about OBA on its site, the Commissioner found, and didn’t provide an effective opt-out option.
Google tailored advertisements on its AdSense network based on web activities relating to a particular search for health information, which contravened the 2011 guidelines, the report said, citing a Commissioner case.
Ganz, maker of the popular WebKinz childrens’ toy, has taken steps to reign in advertising partners after they used its information to targeted advertisements towards children.
These cases have all now been resolved.
Some ads did use sensitive information to track visitors, and did not feature any opt-in capability. The report found that multiple advertisements were targeted based on sensitive topics, including pregnancy tests, depression, divorce lawyers, and bankruptcy.
The Commissioner concluded that consumers should take some responsibility for their own privacy, by setting privacy controls in their browsers. It gave blocking and clearing cookies as examples, and added that consumers can still take advantage of opt-out capabilities – however difficult they may be to find and use.
The problem is that blocking or clearing cookies may end up negating an opt-out choice, if those choices are stored locally in cookie form. So users may have to seek out browser plug-ins to retain those opt-out preferences.
The question is, what percentage of online users have the time, awareness or technical skill to do all that?