Websites fail to protect personal data, researchers contend

Oct 12, 2011 By Mike Swift

By signing in to many of the Web's most popular sites, consumers send their names, email addresses or other personal information to other websites and data-collection companies, according to a Stanford University study that sparked new calls Tuesday for "do not track" laws.

The study found that on 185 heavily visited websites, a user name or user ID provided by consumers was shared with another website 61 percent of the time. In many cases, the study said, that data "leakage" would appear to violate websites' , which typically promise not to share with other parties.

Many of the sites receiving consumer information were online data-collection services that help target online ads, including Quantcast and Google's .

Chairman Jon Leibowitz praised the study as "absolutely terrific work" and said at the forum that the findings would help in the agency's efforts to protect consumers' online . The FTC last year backed the creation of "do not track" features, now available on some , that allow consumers to block online data-collection and from following their movements on the Web.

"Once you enter cyberspace, software placed on your computer, usually without your consent or even knowledge, turns your private information into a commodity out of your control," Leibowitz said. "Your computer is your property, and people shouldn't be putting things in it without your permission."

The study, released at an online privacy forum at the National Press Club in Washington, did not say how those data collection companies use the personal information they receive from popular websites. Among the "first party" websites that Stanford computer science researchers examined were NBC, the sports site Bleacher Report, the Home Depot, and the weather site Weather Underground.

By logging into an account at many popular websites or sometimes by just viewing an ad, consumers sent all or part of their names or email address to multiple "third party" data collection sites, the study found. In some cases, the leaked data included detailed personal information such as gender, age, ZIP code or relationship status.

But Jonathan Mayer, the study's author, said many of the sites say in their privacy policies that they do not share personally identifiable information with other sites.

"From a legal perspective, personal information leakage is a debacle," Mayer wrote in a blog post about the study. "Many first-party websites and third parties make what would appear to be incorrect representations about not sharing or collecting 'personally identifiable information.' "

The study found that clicking on a local ad on the Home Depot website sent a user's first name and email address to 13 data collection companies, while signing up for an account on Weather Underground sent the email address to 22 companies.

Weather Underground said Tuesday that "we currently have our team resolving this issue." Home Depot said its website does not trade, sell or rent but was "researching carefully to determine if anything unusual occurred."

, one of the sites that the study said received user information, maintained it does not use any personally identifiable information for any software product. "We've never attempted or wanted to parse out personal information" received by Google, the company said.

But Mayer said in an interview that the purpose of the study was to show that data collection and tracking companies have the ability to link anonymous tracking data with a person's real identity.

"It's a very different claim to say, 'Yeah, we know who you are, but we don't act on it,' to 'We don't know who you are,' " he said.

The study did not investigate the sites of Google, Yahoo or Facebook because there are so many different features that the researchers could not take a reasonable sample. The findings led to calls by members of a coalition of 10 consumer, privacy and civil rights groups for more investigation by the FTC about whether the identified companies violated their privacy obligations to consumers. The coalition organized the privacy forum.

The online advertising industry "tries to lull consumers by claiming that online tracking gathers behavioral data anonymously," John Simpson, privacy project director at the advocacy group Consumer Watchdog, said in a written statement. "This study proves that personally identifiable information is regularly shared without consumers' knowledge. We can't rely on industry promises to protect consumer privacy; clearly we need 'do not track' legislation, and we need it now."

Explore further: Twitpic to stay alive with new owner

5 /5 (4 votes)
add to favorites email to friend print save as pdf

Related Stories

Report: Widespread data sharing, 'Web bugs'

Jun 02, 2009

(PhysOrg.com) -- Researchers at the University of California, Berkeley's School of Information released a report late Monday (June 1) showing that the most popular Web sites in the United States all share ...

US privacy groups welcome 'Do Not Track' bill

May 09, 2011

Privacy and consumer groups welcomed a "Do Not Track" bill introduced in the US Senate on Monday that would let Internet users block companies from gathering information about their online activities. ...

Microsoft unveils new privacy feature for IE

Dec 07, 2010

An upcoming version of Microsoft Corp.'s Internet Explorer browser will let users add lists of sites that they don't want tracking them, a peace offering amid uproar over the sneaky ways that websites watch ...

FTC proposes 'Do Not Track' tool for Web surfers (Update 2)

Dec 01, 2010

(AP) -- Federal regulators are proposing to create a "Do Not Track" tool for the Internet so that consumers could prevent marketers from tracking their Web browsing habits and other online behavior in order to target advertising.

Google, FTC reach Google Buzz privacy settlement

Mar 30, 2011

The Federal Trade Commission reached a settlement with Google on Wednesday over Google Buzz, the social networking tool rolled out last year which spawned a slew of privacy complaints.

Recommended for you

Facebook dressed down over 'real names' policy

Sep 17, 2014

Facebook says it temporarily restored hundreds of deleted profiles of self-described drag queens and others, but declined to change a policy requiring account holders to use their real names rather than drag names such as ...

User comments : 4

Adjust slider to filter visible comments by rank

Display comments: newest first

Pirouette
not rated yet Oct 12, 2011
Next thing you know, they'll be sending the Fuller Brush man to your door to sell his wares, uninvited.
Turritopsis
not rated yet Oct 13, 2011
Websites fail to protect personal data, researchers contend


That is unethical conduct. Website profit from traffic, the publics involvement. This is self destructive conduct on their behalf. Organizations need to fight for their market shares. (whether transitory clientele or actual consumers is irrelative, sites receive payment from "air time", if one page has 100% viewership 100% of the time they have 100% share of Internet traffic so 100% of the monthly Internet service fee we pay ends up in the pocket of the site that has 100% share).

Divulging information is unacceptable conduct. We pay for every webpage we view. It is a pay per use service.

Taxes make politicians salaries. Governments are owned by the people. That little fact got lost somewhere along the lines and it needs to be re-found. We don't need leaders, we need to take the reigns and lead together. Stop appointing figures to lead us. Internet can be the conduit that allows full involvement from everyone on lifes
Turritopsis
not rated yet Oct 13, 2011
matters. The government, the law, cannot override and extend itself into governing and presiding over the world wide web.

For the people by the people. We can inclusively, unitedly, run this world without appointing others as decision makers. We need to decide for ourselves the conditions we establish and direction we set forth in. This leader type system puts 1% of people in a position to make decisions for 99% of the people. This is wrong. It is time to head in a new direction. It is time to move into a higher civilization and out of this primitive system filled with presidents, prime ministers, kings, and so forth. We don't need the 1% deciding things for the 99% of the people. 100% of the people need to make the decision together.

The time has come to change the world.
Turritopsis
not rated yet Oct 13, 2011
Today's governments would have been alright for Plato's time. This was a long time ago. With lightning fast speeds worldwide communication is now available due to advancement in technology. We can all be connected in the decision processes wherever we are. We don't need representatives to act on our behalfs anymore. Sometimes the representatives intentionally or unintentionally miss-act. Luckily with communication advancements today we can do without them. We don't need to appoint representatives (like presidents, judges, etc.). We've come to a new age. It is time to advance. It is time to place the power where it belongs. The power is everyones. Put every issue up online for everyone to decide together. It is as simple as that. Instead of the FEW appointed ones making the decision on the issue we ALL decide on the issue. The communication technology is here, we are ready for the shift.