• by Wendy Davis , July 12, 2011

Almost half of the companies that belong to the self-regulatory group Network Advertising Initiative leave tracking cookies on users' computers even after they opt out of online behavioral targeting, according to a new report by Stanford Center for Internet and Society.

Self-regulatory standards call for ad networks to stop targeting ads to people based on the sites they have visited if they opt out. But the standards do not specifically require companies to stop gathering data about users' Web activity.

That distinction between targeting and tracking has been a focus of attention since last December, when the Federal Trade Commission called for ad companies to offer a universal do-not-track mechanism that enables users to avoid online tracking. FTC officials, as well as some lawmakers, have specifically said that companies should enable users to opt out of data collection as well as receiving targeted ads.

Stanford researcher Jonathan Mayer reported Tuesday in "Tracking the Trackers" that 33 NAI members of a total of 75 either left tracking cookies on users' computers or installed tracking cookies after the users opted out. Mayer also reported that at least eight of those companies -- including well-known networks like 24/7 Real Media and Audience Science -- did so despite having privacy policies that indicate they stop collecting data from people who opt out.

At Audience Science, for instance, the privacy policy includes the language "Should you choose to opt-out, we delete all previously collected information from the cookies, and put new information in the cookie which tells us to stop collecting information from that device."

The 24/7 Real Media privacy policy says users can opt out of "receiving our ad delivery, audience management and behavioral targeting cookies."

Audience Science and 24/7 Real Media did not respond to requests for comment for this article.

But some privacy experts say the companies might have explanations for the report's findings. For instance, it's possible that the companies are discarding the information as soon as it's collected, says Justin Brookman, director for the Center for Democracy & Technology's project on consumer privacy, although he admits the report "raises very legitimate questions."

NAI executive director Charles Curran says that one reason why self-regulatory standards do not require ad networks to stop collecting data about users is because that information is often used for operational purposes, frequency capping or analytics.

Still, 10 ad networks that belong to the NAI remove tracking cookies when users opt out, according to Mayer's report. Those ad networks are BlueKai, Yahoo's Dapper, FetchBack, Google, Invite Media, Media6Degrees, Mediaplex, Quantcast, TidalTV and YuMe.

In addition, BlueKai and Media6Degrees are honoring new browser-based do-not-track headers, Mayer reported.