I heard a rumor that I hope isn’t true. Specifically, I heard that opting out of behavioral profiling may not stop advertising companies from tracking you as you travel across the Web. Rather, according to the rumor, in many cases you merely opt out of seeing the tailored ads your web history might otherwise trigger.
The ability to opt out of behavioral profiling essentially underpins the argument for self-regulation by the industry. The idea is that (1) people like tailored ads and (2) those that worry about the practice, for instance, from a privacy perspective, can opt out of it. Setting aside the apparent frailty of cookie-based opt out (when you delete your cookies, you delete your opt out as well) and the availability of other means to track users (like flash cookies), this seems pretty straightforward and convincing.
But what does “opting out” mean, exactly? A close look at the Network Advertising Initiative website, which offers an opt out tool on behalf of most major online advertisers, turns up no guarantee that opting out will stop a company from logging where a user has traveled.
In the NAI's words:
The NAI Opt-out Tool replaces a network advertiser's unique online preference marketing cookie on your browser with a general opt-out cookie. It does not delete individual cookies nor does it necessarily replace other cookies delivered by network advertisers, such as those that are used for aggregate ad reporting or mere ad serving purposes. Such cookies allow network advertisers to change the sequence of ad banners, as well as track the aggregate number of ads delivered (impressions).
You don’t need to be Derrida to see that this carefully crafted language comes apart upon reflection. How can the tool "replace[] a network advertiser's unique online preference marketing cookie" but at the same time not "delete individual cookies [or] replace other cookies delivered by network advertisers, such as those that are used for … mere ad serving purposes”? Where I come from, "replace" means "to put something new in the place of" something else. You take the cookie that tracks me away, and you replace it with a cookie that says not to.
So does opting out stop tracking or not? Lawyer and blogger Sarah Bird wrote about the NAI’s opt out cookie about a year ago after attending a conference at Berkely Law School. Specifically, she wrote:
The audience was extremely interested in cookies and how they work. ... People were surprised and confused to learn that the NAI’s opt-out program doesn’t prevent advertisers from collecting information about you; it only prevents advertisers from serving you targeted ads. The companies still get to benefit from your information, you still have to see ads, but the ads aren’t targeted towards your preferences. Somehow, I have a feeling that most consumers who bother to use the NAI's opt-out program don't realize this. After all, I have to imagine that it is the tracking itself that bothers privacy-sensitive people, not the targeted ads.
I have to agree with Sarah here.
To be clear, I’m not convinced that behavioral advertising is all that dangerous a practice from the perspective of personal privacy. Advertisers don’t really care who you are and much of the tracking that occurs is anonymous. True blocking is easy—for a veritable buffet of privacy enhancing technologies, visit our wiki database—and the government can go directly to users’ Internet service providers if they want access to web surfing habits.
But still, this rumor bothers me. Have advertisers allowed the misapprehension to persist that opting out of behavioral profiling stops the practice of tracking? If so, for shame. The industry should confront the harms of tracking, real or imagined, head on, instead of lulling users into a false sense of control over their browsing history.