• by Steve Smith , Staff Writer, May 22, 2009

Surveys often suggest that users are not as exorcised over online behavioral tracking as are privacy watchdogs, academics, and the press. But according to Cathy Dwyer, Pace University Associate Professor in the Seidenberg School of Computer Science and Information Systems, this complacency turns quickly to shock when you sit someone down at their PC and show them explicitly all the ways in which a single site may drop cookies and beacons for others to follow. "I do this with 18-, 19- and 20-year-olds, and once they find out this is going on they go ballistic. A few of them in one of my classes canceled their Facebook accounts," she says.

Dwyer explains Web privacy issues for the rest of us in a paper she will be delivering at the 15th American Conference on Information Systems. "Behavioral Targeting: a Case Study of Consumer Tracking on Levis.com" applies browser scanning tools to determine just how much tracking goes on by third parties after a user encounters just a single retailer site.

Using Levis.com, Dwyer discovered, for instance, that a JavaScript downloaded to the browser came from Atlas and contained seven one by one image files from a range of behavioral networks. In all, Dwyer detected nine Web beacons dropped on the client machine, and one Omniture cookie that passed back a list of installed software on the machine.

While few digital marketing professionals will be surprised by these scanning results, they are the underlying reality of online advertising that can shock common users when they see it surfaced. For Dwyer, the real problem in Levis.com's background ad-serving activity is that it is all essentially clandestine. "None of the companies linked to these nine Web beacons are mentioned in Levi's privacy policy," she says in the paper. "The only third party mentioned is the digital advertising provider Avenue A, but none of these Web beacons link to Avenue A." She goes on to argue that "this study shows the amount of data collected and shared with third parties is much higher than what is described in the Levi's privacy policy. Levi's customers are not asked to consent to these practices, and the partners that Levi's shares information with are not identified."

But if that behavioral information is anonymous, as Dwyer agrees it is, then what harm is done to the user? Dwyer makes a case that is becoming increasingly popular in the field, that anonymity does not equal privacy. Privacy is not just a matter of controlling what information about oneself is disclosed to or by a third party.

Dwyer and others contend that undisclosed behavioral tracking compromises our autonomy in the market. "Privacy is valued because it protects the autonomy of the individual and preserves independence and free choice in the decision process," she says in her study.

When I spoke with Dwyer recently, she elaborated on the point. "Imagine you are going into a store or in a negotiating situation. You have a strategy in mind and you don't think there are cameras to see what your cards are. You think that your state of mind is a part of the negotiating process. But if they are inside your head and figuring out what kinds of buttons to press, then they can read you in that way."

Dwyer argues that this kind of knowledge of a consumer, whether it is personally identifiable or not, still can undermine the autonomy of that person's decision-making in a way that is different from the demographic or psychographic profiling that advertisers also use. The person may be anonymous to the advertiser, but the one-sided power that tracking confers to the vendor is exerted onto a real consumer, anonymous or not. "If you do a little surfing online, you don't think that every keystroke is revealing what your strategy is for getting something," she says.

Dwyer further argues that retailers like Levi's, whose brand was built on associations with American independence of mind, risk their reputation by letting third parties drop such tracking tools into their customers' browsers without full transparency. "Not asking for explicit consent, and using anonymity to sanitize the tagging of individuals, are components of behavioral targeting that can destroy trust in e-commerce," she says.

Dwyer insists that she is not at all opposed to advertising, but she does think that the element of trust in the marketplace is undermined by behavioral tracking without consent. If there is a clear benefit to consumers, all the better to be transparent. "There is no reason for it to be secret. If it is so valuable, people will say 'yes.'"