Online privacy: who knows about you? Tracking and targeted advertising

Research shows 67% of Which? members know that companies can track their online behaviour, but do we really know how much information is being collected?

We use some forms of tracking technology at Which?. When you visit our site, or see an advert of ours elsewhere, we will place certain cookies in your browser that let us keep track of our most popular pages, how many of our members are logged in, how you arrive at our site, etc. Our cookie policy explains how you can opt out of these. 

But some other companies collect far more information that you may not have given to them knowingly. Depending on the tracking technology they use they could know, or make educated guesses, on:

  • your exact location
  • your age, gender, marital status, race, income bracket
  • what you like and dislike
  • what you buy
  • the kind of news you read.

What is ‘tracking technology’?

Cookies

A 'cookie' is a tiny file that is stored on your computer by your browser. When you access the internet, these cookies tell your browser what to display based on your past choices. For instance, they could be used to remember your login details for a particular website, or remember the last thing you looked at on Amazon.

The browser then passes that information to the website so it can serve you a customised page. In a Which? survey of 1,468 internet users in February 2010, less than half of those who had heard of cookies claimed a good understanding of what they were used for.

Beacons

A web beacon does a similar thing, but instead of storing the information in your browser it sends the information to another website. A beacon is usually a tiny image – 1pixel by 1 pixel – embedded in a web page or an email. When the code for the beacon points to a site to retrieve that image, it can also pass along other information such as your IP address, the time, the type of browser you’re using, and your location among other things.

Other tracking technologies

Cookies and beacons are the most common forms of tracking technology. However, tracking is a dynamic area with lots of potential growth, and new technologies are evolving rapidly. HTML5 offers opportunities for tracking that does not involve cookies or beacons, and some companies are exploring 'device fingerprinting', which will give a unique profile to each web-connected device that you use.

Why do companies collect browsing data?

Quite simply, information about your browsing habits is worth a lot of money. A company that knows what you like and where you are can better tailor their advertising to you, recommending products and services that you are more likely to buy.

There are some companies who make money purely from this type of tracking. They collect information about the habits of users then sell them on to marketing companies, so that they can serve targeted adverts when you arrive at a particular website.

For example, if you are a 20 year old who regularly visits websites on entertainment gossip a company serving you adverts for student discounted film tickets might have some luck. Without that information, you could be served adverts for gardening supplies, which you'd probably be less likely to buy.

This is called 'Online Behavioural Advertising', and it is big business. A study done by the Office of Fair Trading (OFT) in 2010 estimated that online behavioural advertising is worth between £64-95 million each year, and that figure is rising.

What is the solution?

Traditionally, the only way to protect your personal details was to browse carefully and regularly delete your cookies and clear your cache. But technology is constantly evolving and new developments, such as flash cookies, can track you even if you clear your cache.

In response the browser industry has developed new tools to give you more control and the advertising industry has developed a web page at which you can opt out of receiving targeted ads. But even after opting out, companies could still be collecting information on your online movements.

With increasing pressure from privacy lobbyists and government the advertising industry is also rushing to offer opt-out schemes. You can opt-out of some advertising networks at Your Online Choices.

What Which? wants

We are concerned that companies can hold so much personal information without your knowledge or agreement.

Companies are not allowed to sell your name alongside this information, without your consent. However, there is a lot of detail collected that could potentially identify you as an individual.

At the moment companies take it for granted that you have agreed to share your data by not turning off the cookies in your browser. But this assumes a certain level of knowledge about browser settings, which not all users have. It's also an increasingly outdated assumption as technology moves beyond browsers to smart phones and apps and tracking technologies move beyond cookies. 

We would like to see

  • Companies being far more transparent and upfront about exactly what data they collect, when they collect it, what they use it for and who they pass it to. Consumers should be given choice and control over these factors.
  • Clear guidance for companies on obtaining consent, so they understand what individuals have and have not given permission for. We also need better monitoring and enforcement of the rules.
  • Regulators to work with web browser companies to offer tools to allow tracking opt-out, which will give you control over the adverts that are targeted at you.
  • More honesty in adverts that are served using this information, for instance a sign or symbol that shows the user they are being served a targeted advert.
  • More information for the general public, so that everyone understands what could happen to their data, and how to opt-out.
Which? works for you