• by Wendy Davis  @wendyndavis, September 27, 2011

Two senior lawmakers are condemning new "supercookie" technology, which can be used to thwart people's attempts to prevent online tracking.

"We believe this new business practice raises serious privacy concerns and is unacceptable," Reps. Joe Barton (R-Texas) and Ed Markey (D-Mass.) say in a letter to the Federal Trade Commission. "We believe the usage of supercookies takes away consumer control over their own personal information, presents a greater opportunity for the misuse of personal information, and provides another way for consumers to be tracked online."

They are urging the FTC to investigate whether using supercookies constitutes an unfair or deceptive practice. Barton said separately that he believes supercookies should be "outlawed."

Some consumers have long tried to avoid online tracking by deleting their HTTP cookies. But the new "supercookie" techniques rely on storing information in files that aren't erased when users delete their HTTP cookies.

For instance, analytics company KISSmetrics stored data about users in ETags, which reside in the browser cache and can be used to respawn deleted HTTP cookies. Until KISSmetrics revised its practices in August, the only way of avoiding ETag tracking was by deleting the browser cache or installing AdBlock.

Flash cookies, which are stored in a different place in the browser than HTTP cookies, are an older form of supercookies. Quantcast, Clearspring and Say Media's Video Egg recently paid a total of $3.4 million to settle privacy lawsuits stemming from their alleged use of Flash cookies. Adobe recently made it easier to delete Flash cookies.

FTC officials have previously criticized the use of Flash cookies, but the commission has never brought an enforcement action regarding supercookies.

It's not clear whether courts or regulators would rule that using a hard-to-delete tracking technology is illegal. But advocate Justin Brookman, director of the Center for Democracy & Technology's Consumer Privacy Project, says he believes there is a good argument that tracking people by methods other than traditional cookies is a deceptive and unfair practice. "Using another means to track just seems like a means to evade user choice," he says in an email to Online Media Daily.