Most Consumers Clueless About Online Tracking

Every single move you make online can, and often is, tracked by online marketers and advertising networks that gather and use the information for serving up targeted advertisements.

But the average American consumer is largely unaware that such tracking goes on, the extent to which it is happening or how exactly information is being used.

That's according to a new poll released this week by the Samuelson Clinic at the University of California, Berkeley, and the Annenberg Public Policy Center at the University of Pennsylvania. The survey of nearly 1,200 California adults studied consumer perceptions about online privacy and common advertising practices.

The survey results come as the Federal Trade Commission (FTC) is holding a two-day Town Hall meeting that started today to address consumer protection issues raised by the online tracking of consumer activities for targeted advertising.

"Consumers still think that [online] privacy policies are representing that the Web site will not sell or use data in specific ways," said Chris Hoofnagle, one of the authors of the report and a senior staff attorney at the Berkeley Center for Law and Technology. But "there is a disconnect between the business practices and consumer expectations."

Most consumers treat online privacy notices like the 'UL' labels on physical products, he said. "People think privacy notices mean certain default protections. Consumers don't understand that privacy policies are just notices. They don't guarantee any rights."

One example of that disconnect is that more than half -- about 55 percent -- of those surveyed falsely assumed that a company's privacy polices prohibited it from sharing their addresses and purchases with affiliated companies. Similarly, nearly four out of 10 online shoppers falsely believed that a company's privacy policy prohibits it from using information to analyze an individuals' activities online; in fact, this is a common practice. A similar number also assumed that an online privacy policy meant that a company they're doing business with wouldn't collect data on their online activities and combine it with other information to create a behavioral profile.

Still, when survey respondents were offered a clear explanation of an online advertising model, about 85 percent rejected the idea that a site they value and trust should be allowed to serve up click stream advertisements based on data from their visits to various other sites.

Compounding user ignorance is the fact that many companies say they respect a user's choice not to be tracked, yet still find ways of circumventing that commitment, Hoofnagle said. For instance, some Web sites that promise not to allow third-party tracking cookies to be installed on a user's system do so anyway in a roundabout fashion via so-called first-party sub-domain cookies, he said. Similarly, some companies install flash cookies to uniquely track users across sites, he said.

Even companies that pledge not to share online consumer information with an outside party often store more data, and for longer periods of time, than most consumers realize, or would agree to if they knew, Hoofnagle said.

"From the consumer perspective, many, many thousands of companies track everything they do online and offline, maintain profiles of them and sell them to whoever will pay the most for it," said Steven Gal, CEO of ProQuo, a La Jolla, Calif.-based start-up that allows users to choose which paper junk mail to stop receiving from different sources. Such companies don't let consumers see their profiles, or interact with these profiles, resulting in a lot of junk mail and spam, he said.

Despite the extensive profiling now under way online, consumers still have more control than those in the offline world, Gal said. Large companies, in particular, have begun to disclose more to consumers and allow them to opt out of tracking. Many are beginning to exercise that option, he said.

"I think consumers know much more in the online world. But in general, I don't think most want to understand how it works," he said. "It's kind of scary. It makes them feel overwhelmed and like they have no control."

Concerns about online tracking and profiling have spilled into the open in recent days ahead of the FTC event to discuss the issue.

Just yesterday a group of nine privacy organizations asked the FTC to consider a Do Not Track list to protect people from having their online activities unknowingly tracked and used by marketers. The group also wants the formal definition of the term "personally identifiable information" updated, and it said Internet advertisers should be forced to provide more robust disclosures on any behavioral tracking they are doing.