Last year, researchers at UC Berkeley documented that some Web companies appeared to be circumventing users' privacy settings by using Flash cookies to recreate deleted HTTP cookies. Now, a new report
by Carnegie Mellon indicates that Web sites are thwarting users' privacy choices by providing erroneous information to Microsoft's Internet Explorer.
Like other browsers, Explorer allows users
to automatically reject certain cookies, including tracking cookies. In order to honor users' preferences, Explorer and other browsers rely on Web site operators to create accurate "compact policies"
or CPs -- described by researchers as "a collection of three-character and four-character tokens that summarize a website's privacy policy pertaining to cookies."
The problem is that a great
many sites aren't doing so. "We collected CPs from 33,139 websites and detected errors in 11,176 of them, including 134 TRUSTe-certified websites and 21 of the top 100 most-visited sites," researchers
state in a summary of their report. The authors add that thousands of sites were using identical invalid compact
policies "that had been recommended as workarounds" to stop Explorer from blocking cookies.
"It appears that large numbers of websites that use CPs are misrepresenting their privacy practices,
thus misleading users and rendering privacy protection tools ineffective," the summary says. "Unless regulators use their authority to take action against companies that provide erroneous
machine-readable policies, users will be unable to rely on these policies."
The Federal Trade Commission has already indicated it's interested in Flash cookies; meanwhile, consumers' class-action attorneys have filed at least three lawsuits
to date against companies who allegedly used Flash to recreate deleted HTTP cookies, including an action
against Specific Media.
Putting out misinformation in order to get around users' privacy preferences certainly seems comparable to using Flash cookies to recreate deleted HTTP cookies. It also
seems like the type of activity that's almost guaranteed to result in new scrutiny by regulators, while fueling calls for new privacy legislation.