doubleclick monitoring web browsing habits

A post on comp.risks described a web adverstising service called
"doubleclick".  As described in its web pages at <URL:
http://ad.doubleclick.net >, this service provides targetted
advertising on the web.

Participating web sites include links to doubleclick to show graphic
images.  Advertisers sign up with doubleclick and specify profiles for
where and when they want their ads to appear.  Doubleclick then selects
an ad for each user who visits a participating site.  Participating sites
get paid for each such hit, and advertisers pay based on how many hits
are expected.

Apparently this is being used quite a bit.  But what I found disturbing
was the scope of the information being collected by doubleclick.  The
various parameters that advertisers can use in setting up their profiles
for where their ads should appear are described at <URL:
http://ad.doubleclick.net/advertising/adreghelp.htm > and include:

  TARGET BY WEB PAGE/SITE CATEGORY
  TARGET BY SERVICE PROVIDER (SP)
  TARGET BY GEOGRAPHIC LOCATION
   We determine a person's geographic location through the physical
   location of their network or through user registration. We have
   created an extensive map of both organization and Internet Service
   Provider (ISP) networks.
  TARGET BY USER'S OPERATING SYSTEM 
  TARGET BY USER'S BROWSER TYPE 
  TARGET BY HIGH-LEVEL INTERNET DOMAIN TYPE 
  TARGET BY ORGANIZATION TYPE (SIC CODE) 
  TARGET BY ORGANIZATION SIZE OR REVENUE
  TARGET BY PERSONAL INTERESTS
   doubleclick.net continues to add to an extensive database of user
   interests from activity on doubleclick.net member web sites as well as
   from publicly available sources like netnews. User interests are kept
   strictly confidential and will not be released to advertisers. We do
   allow advertisers to target ad banners based on user's interests. The
   more your ad banner is targeted at specific user interests, the more
   likely you are to generate a response. Personal interest categories
   include:
   
   Arts and Literature
   Business, Finance, and Economy
   Computers, Software and Internet
   Culture, Religion, and Society
   Education and InstructionalEntertainment
   Government, Politics, and Military
   Health and Medicine
   News
   Recreation and LeisureScience and Technology
   Social Science
   Sports
   Travel

This last category is the really worrisome one.  doubleclick monitors
the web browsing habits of users whenever they hit a doubleclick-
participating site, and builds up databases about users from that, as
well as from usenet posts.  This is exactly what people have been
talking about as an abuse of privacy on the net.

One question is whether enough information to uniquely identify users
is routinely provided by widely used browsers like Netscape.  I have
refrained from telling my Netscape browser my name and email address out
of fear that it would reveal this information; as a result, I can't use
mailto: links, which is annoying (and also suspicious; lynx allows me to
do mailto: without permanently entering an email address).

This points out the need for browser providers to be sensitive to the
privacy needs of their users and to clearly explain when and under what
circumstances private information is revealed.  It also suggests that
services like www.anonymizer.com will be increasingly important for
people to protect their privacy while browsing.

Hal

-----BEGIN PGP SIGNED MESSAGE-----

On Thu, 13 Jun 1996, Hal wrote:

> One question is whether enough information to uniquely identify users
> is routinely provided by widely used browsers like Netscape.  I have
> refrained from telling my Netscape browser my name and email address out
> of fear that it would reveal this information; as a result, I can't use
> mailto: links, which is annoying (and also suspicious; lynx allows me to
> do mailto: without permanently entering an email address).

I do this too.  Until recently, it was trivial for a server to either force
the browser to download something via FTP and record the e-mail address or use
the infamous Javascript hack.  I currently have Netscape setup to disable Java,
and issue warnings whenever sending a form via e-mail or accepting a cookie.
I think this will prevent my e-mail address from being revealed to any server,
but it is not enough to satisfy my paranoia.  I would be truely satisfied if
Netscape would prompt for an e-mail address whenever it sends mail or post to
usenet.

> 
> This points out the need for browser providers to be sensitive to the
> privacy needs of their users and to clearly explain when and under what
> circumstances private information is revealed.  It also suggests that
> services like www.anonymizer.com will be increasingly important for
> people to protect their privacy while browsing.

Definitely.  Although they will never be as secure as anonymous remailers
(messages can not be delayed), this will be much better protection against
information gatherers.

- -- Mark

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
markm@voicenet.com              | finger -l for PGP key 0xe3bf2169
http://www.voicenet.com/~markm/ | d61734f2800486ae6f79bfeb70f95348
"In Christianity neither morality nor religion come into contact with
reality at any point."
                -- Friedrich Nietzsche


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQCVAwUBMcHiaLZc+sv5siulAQF6DwQAqjNIai5zPDqCUxyCq2Y9BuM7EjUjp7IF
7GhSalQAilThBB+v4N6cQ6glkGOE+9heGBqsob0HKdQdIP2/AdbVCCgobO5JRGy+
kUPpMBve51PWjBu+ey85AlcJIwi0d8Upkb8aC4HYf79UTfzkOd2/84eBY0F5iY4X
iuoTsUwcFt4=
=RfVo
-----END PGP SIGNATURE-----