Original URL: https://www.theregister.com/2009/03/16/taco_add/

Google inspires behavioral ad-zapping Firefox add-on

Cookie-filled TACO

By Cade Metz

Posted in Legal, 16th March 2009 20:47 GMT

Last week, when Google rolled out its new interest-based advertising behavioral ad targeting operation, it enveloped the world's web surfers in the sort of cookie conundrum we've come to expect from these privacy-hedging ad schemes.

Across YouTube and countless third party sites in its AdSense advertising network, Google is now targeting ads according to your personal browsing history. Yes, you can opt-out. But it's a cookie-based opt-out. You'll have to set cookies on every machine and every browser you use. And if you're someone who regularly flushes your cookies for privacy reasons, you'll soon opt yourself back in.

To its credit, Google also offers IE and Firefox plug-ins that maintain your opt-out even when cookies are cleared. But what about all the those other behavioral ad schemes serving up an identical cookie conundrum? There's still Microsoft, Yahoo!, AOL, ValueClick, Akamai, Nielsen - and the list goes on. And on.

In an effort to solve this conundrum of conundrums, privacy crusader Christopher Soghoian is offering a single Firefox plug-in that maintains your opt-out on 27 separate behavioral ad networks - and counting.

Google released its Firefox add-on as an open source project under the Apache 2.0 license, and Soghoian has forked the code, adding other opt-out cookies to the mix. He calls it the Targeted Advertising Cookie Opt-Out project. TACO, for short.

As of Monday, the add-on permanently sets opt-out cookies for 26 additional ad networks, including the Microsoft-owned Atlas network and AOL's Advertising.com. So, if you clear your browser cookies, these opt-out cookies remain in place. A full list of supported cookies is available here. And you can download the new add-on from Soghoian's personal web site here.

TACO is also available from Mozilla (here). But since it's still classified as under development, you can't download without signing up for a (free) developer account.

The add-on does not maintain opt-out cookies for all behavioral ad networks. TACO only deals with generic, non-identifiable cookies. Operations like Yahoo!, Nielsen, and Microsoft's Live.com still tag you with a unique numerical identifier when you opt-out, and Soghoian has left them out of his TACO. He doesn't want to "encourage their sketchy ways."

"Users who opt-out on these networks are 100 per cent relying on the word of those companies to not track them," Soghoian, a research fellow at Harvard University's Berkman Center for Internet & Society, tells The Reg. "Consumers have no way of knowing what's happening."

Instead, Soghoian is attempting to contact the likes of Yahoo!, Microsoft, and Nielsen, intent on talking them into a change of policy. We wish him good luck.

Even if he succeeds, the situation is, as he admits, "a gigantic mess." Because some networks set multiple identifiers, TACO already juggles 41 cookies, and the number could potentially grow to 60 - and beyond. We have no way of even knowing whether the project has lassoed all ad opt-out cookies. And in all likelihood, his add-on will reach only a small subsection of the world's web users.

"This huge number of cookies just confirms the need for a single opt out mechanism, and not a different cookie for each possible advertising network," he says.

Better still, behavioral targeting networks should be opt-in only - from Google on down. But this won't happen unless the government makes it happen. Rick Boucher - the newly installed chairman of the US House Energy Subcommittee on Communications, Technology, and the Internet - is now calling for opt-in legislation. And we wish him luck too. ®