Websites fail to protect personal data, researchers contend

By signing in to many of the Web's most popular sites, consumers send their names, email addresses or other personal information to other websites and data-collection companies, according to a Stanford University study that sparked new calls Tuesday for "do not track" laws.

The study found that on 185 heavily visited websites, a user name or user ID provided by consumers was shared with another website 61 percent of the time. In many cases, the study said, that data "leakage" would appear to violate websites' , which typically promise not to share with other parties.

Many of the sites receiving consumer information were online data-collection services that help target online ads, including Quantcast and Google's .

Chairman Jon Leibowitz praised the study as "absolutely terrific work" and said at the forum that the findings would help in the agency's efforts to protect consumers' online . The FTC last year backed the creation of "do not track" features, now available on some , that allow consumers to block online data-collection and from following their movements on the Web.

"Once you enter cyberspace, software placed on your computer, usually without your consent or even knowledge, turns your private information into a commodity out of your control," Leibowitz said. "Your computer is your property, and people shouldn't be putting things in it without your permission."

The study, released at an online privacy forum at the National Press Club in Washington, did not say how those data collection companies use the personal information they receive from popular websites. Among the "first party" websites that Stanford computer science researchers examined were NBC, the sports site Bleacher Report, the Home Depot, and the weather site Weather Underground.

By logging into an account at many popular websites or sometimes by just viewing an ad, consumers sent all or part of their names or email address to multiple "third party" data collection sites, the study found. In some cases, the leaked data included detailed personal information such as gender, age, ZIP code or relationship status.

But Jonathan Mayer, the study's author, said many of the sites say in their privacy policies that they do not share personally identifiable information with other sites.

"From a legal perspective, personal information leakage is a debacle," Mayer wrote in a blog post about the study. "Many first-party websites and third parties make what would appear to be incorrect representations about not sharing or collecting 'personally identifiable information.' "

The study found that clicking on a local ad on the Home Depot website sent a user's first name and email address to 13 data collection companies, while signing up for an account on Weather Underground sent the email address to 22 companies.

Weather Underground said Tuesday that "we currently have our team resolving this issue." Home Depot said its website does not trade, sell or rent but was "researching carefully to determine if anything unusual occurred."

, one of the sites that the study said received user information, maintained it does not use any personally identifiable information for any software product. "We've never attempted or wanted to parse out personal information" received by Google, the company said.

But Mayer said in an interview that the purpose of the study was to show that data collection and tracking companies have the ability to link anonymous tracking data with a person's real identity.

"It's a very different claim to say, 'Yeah, we know who you are, but we don't act on it,' to 'We don't know who you are,' " he said.

The study did not investigate the sites of Google, Yahoo or Facebook because there are so many different features that the researchers could not take a reasonable sample. The findings led to calls by members of a coalition of 10 consumer, privacy and civil rights groups for more investigation by the FTC about whether the identified companies violated their privacy obligations to consumers. The coalition organized the privacy forum.

The online advertising industry "tries to lull consumers by claiming that online tracking gathers behavioral data anonymously," John Simpson, privacy project director at the advocacy group Consumer Watchdog, said in a written statement. "This study proves that personally identifiable information is regularly shared without consumers' knowledge. We can't rely on industry promises to protect consumer privacy; clearly we need 'do not track' legislation, and we need it now."

Explore further

Leakage of private information from popular websites is common, new study finds

(c)2011 the San Jose Mercury News (San Jose, Calif.)
Distributed by MCT Information Services

Citation: Websites fail to protect personal data, researchers contend (2011, October 12) retrieved 14 October 2019 from
This document is subject to copyright. Apart from any fair dealing for the purpose of private study or research, no part may be reproduced without the written permission. The content is provided for information purposes only.

Feedback to editors

User comments

Oct 13, 2011
Websites fail to protect personal data, researchers contend

That is unethical conduct. Website profit from traffic, the publics involvement. This is self destructive conduct on their behalf. Organizations need to fight for their market shares. (whether transitory clientele or actual consumers is irrelative, sites receive payment from "air time", if one page has 100% viewership 100% of the time they have 100% share of Internet traffic so 100% of the monthly Internet service fee we pay ends up in the pocket of the site that has 100% share).

Divulging information is unacceptable conduct. We pay for every webpage we view. It is a pay per use service.

Taxes make politicians salaries. Governments are owned by the people. That little fact got lost somewhere along the lines and it needs to be re-found. We don't need leaders, we need to take the reigns and lead together. Stop appointing figures to lead us. Internet can be the conduit that allows full involvement from everyone on lifes

Oct 13, 2011
matters. The government, the law, cannot override and extend itself into governing and presiding over the world wide web.

For the people by the people. We can inclusively, unitedly, run this world without appointing others as decision makers. We need to decide for ourselves the conditions we establish and direction we set forth in. This leader type system puts 1% of people in a position to make decisions for 99% of the people. This is wrong. It is time to head in a new direction. It is time to move into a higher civilization and out of this primitive system filled with presidents, prime ministers, kings, and so forth. We don't need the 1% deciding things for the 99% of the people. 100% of the people need to make the decision together.

The time has come to change the world.

Oct 13, 2011
Today's governments would have been alright for Plato's time. This was a long time ago. With lightning fast speeds worldwide communication is now available due to advancement in technology. We can all be connected in the decision processes wherever we are. We don't need representatives to act on our behalfs anymore. Sometimes the representatives intentionally or unintentionally miss-act. Luckily with communication advancements today we can do without them. We don't need to appoint representatives (like presidents, judges, etc.). We've come to a new age. It is time to advance. It is time to place the power where it belongs. The power is everyones. Put every issue up online for everyone to decide together. It is as simple as that. Instead of the FEW appointed ones making the decision on the issue we ALL decide on the issue. The communication technology is here, we are ready for the shift.

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more