Hundreds of websites share usernames sans permission
Photobucket, Wall Street Journal, Home Depot take liberties with your personal info
Home Depot, The Wall Street Journal, Photobucket, and hundreds of other websites share visitor's names, usernames, or other personal information with advertisers or other third parties, often without disclosing the practice in privacy policies, academic researchers said.
Sixty-one percent of websites tested by researchers from Stanford Law School's Center for Internet and Society leaked the personal information, sometimes to dozens of third-party partners. Home Depot, for example, disclosed the first names and email addresses of visitors who clicked on an ad to 13 companies. The Wall Street Journal divulged to seven of its partners the email address of users who enter the wrong password. And Photobucket handed over the usernames of those who use the site to share images with their friends.
The report comes as US officials have proposed a mandatory Do Not Track option for all websites. Some operators have argued such measures are unnecessary because their systems for tracking visitors' browsing histories aren't linked to a user's specific identity.
In the report, Jonathan Mayer, a Stanford graduate student who led the study, argued against the claim that the online tracking is anonymous. A username alone, he explained, is often more than adequate to identify the owner, and when it's combined with other information, such as his geographic location or first name, even widely used usernames can be uniquely assigned to an individual.
“We believe there is now overwhelming evidence that third-party web tracking is not anonymous,” he wrote. “It is a legitimate policy question whether, on balance, Do Not Track should be enforced by law. But the difficult weighing of competing privacy risks and economics can't be short-circuited by claims of anonymity.”
The report studied websites included in the Quantcast top 250 that offered user signups, didn't require a purchase or other qualification to create a username, and didn't include so many features as to be impractical for study. Of the 185 sites that met the three criteria, 113 of them included usernames and other identifiers in the URLs they shared with advertisers and analytics partners. The five biggest recipients were ComScore, Google Analytics, Google's DoubleClick, Quantcast, and Facebook.
The report cited privacy policies of many of the websites that appeared to make no mention of the practice. The WSJ's, for example, says: “We will not sell, rent, or share your personal information with these third parties for such parties' own marketing purposes.” In its own policy, Home Depot says it “will not trade, rent or sell your personal information, without your prior consent.”
The Stanford researchers have previously documented a variety of attempts by websites and marketers to track users's browsing habits, sometimes when they've taken pains to remain anonymous.
Violating computer security is only a crime if you're "Anonymous"
To me, it isn't that surprising that this occurred. What is disgusting is that nothing has been done about it. Laws are already on the books that make this criminal behavior - not the tracking itself per se, but deliberately and knowingly bypassing the security measures on another computer. Just from this paragraph alone, it is my firm belief that both Microsoft and this marketer should be under criminal investigation. I also question whether or not a fine alone is adequate punitive action; there where individual humans who made the decision to bypass the security settings of thousands, if not millions, of computers on the 'net. If some kid somewhere scraped out this much information from people's computers against their will, the FBI would be turning over the couches and shaking them looking to see if clues would fall out.
Someone, or multiple someones, should be in prison right now.
P.S. - Not trying defend anyone with my title, just pointing out the double standard.
It seems there's more than one use for an adblocker, and I'm so glad I use one.
And Google Analytics and DoubleClick resolve here to 127.0.0.1, for some strange reason.
I find it utterly shocking that a paper owned by NewsCorp has a lax policy on private data.