Sex, drugs, and Internet advertising

Sites like YouTube, Twitter, and OkCupid are sharing your username with Web advertisers -- and often a lot more. So much for 'anonymous' tracking. UPDATE: Lotame and BlueKai respond.

Do you love sex, drugs, booze, and cigarettes? I hope you also love sharing that information with Internet advertising networks.

Stanford grad student Jonathan R. Mayer presented a report earlier this week on how Web sites share information with ad networks that track their visitors. Nearly half of the 185 biggest sites share usernames and other information that can be used to identify you across the Web – despite having privacy policies claiming that they don’t.

It’s called “data leakage,” and it happens when a site puts your username and/or other information into the URL that gets sent back to its advertisers. But some sites leak a lot more than others.

Mayer notes that popular dating site OkCupid leaks information about its members’ drinking habits, drug use, nicotine addiction, and ethnicity in the URLs it sends to ad network Lotame (pronounced "lah-ta-me" "low-da-me"). It also leaks information about your kids, pets, location, income, and more to both Lotame and ad network BlueKai.

[img_assist|nid=212961|title=Your OkCupid mates aren't the only ones who know what a druggie you are|desc=|link=none|align=center|width=586|height=429]

There’s apparently a lot of you in Lotame. But OkCupid cops to none of this in its privacy policy, which reads:

We may allow third-parties, including our authorized service providers, IAC companies, advertising companies and ad networks, to display advertisements on our site. These companies may use tracking technologies, such as cookies, to collect information about users who view or interact with their advertisements. Our website does not provide any personal information to these third parties. [emphasis mine]

Interestingly, OkCupid was acquired eight months ago by Interactive Corp (IAC), parent company to Match.com, CollegeHumor.com, and three dozen other sites. IAC is not exactly a poster child for enlightened privacy policies, reserving the right to share your personal information with any of the companies in its network.

At the time I spoke with OkCupid CEO Sam Yagan to ask him how the acquisition would affect the extremely personal data his subscribers shared on the site. It was a pretty heated discussion, and Yagan swore OkCupid would continue to respect its members’ privacy after the acquisition. Back then he told me:

"Just because we were acquired doesn't mean we're handing over any user data. Can I sign in blood and tell you that our privacy terms will not change for all of eternity? No. Can I tell you we have no plans to do anything with any of that data? Absolutely."

I’ve asked Yagan to comment on this latest report. I’m still waiting for a response from him, as well as from BlueKai. If I get one, I’ll update this post. (BlueKai did respond after this story was posted; see below.)

Meanwhile, Lotame has not been silent. It responded with an unsigned and somewhat haughty blog post, calling Mayer’s post a “gratuitous sideswipe” and declaring “Lotame does not buy, sell or otherwise use information related to drug use frequency… [or] use usernames or other personally-identifiable information (including name, address, e-mail address, phone number or government identifiers).”

No word on what Lotame does with the information it receives from OkCupid about drinking, smoking, religion, and ethnicity. I’ve asked for a clarification. (Which arrived post-post. See below.)

Like all mainstream Internet advertising companies these days, Lotame lets you opt out of having its tracking cookies follow you around the Net – though you’ll have to do it for every browser and every device you use -- and lets you manage the types of information it will gather about you.

I looked at my Lotame data preferences in seven browsers on three machines. One of them already had the opt out cookie I installed from the Network Advertising Initiative Opt Out site. Five of them had no data on me. The last one appears to believe I am a 65-year-old who is both male and female and interested in computers, cars, politics, and games.

[img_assist|nid=212967|title=Lotame profiles: Only aging gender confused gamers need apply|desc=|link=none|align=center|width=429|height=223]

Thus explaining all the ads for transgender seniors cruises I’ve been seeing. (That was a joke.)

Lotame's post concludes:

“We realize these types of stories are an occupational hazard when working with data; and we remain as committed as ever to being a progressive industry leader when it comes to our consumer privacy policies and practices.”

Those poor Internet tracking companies. So wronged by the people they’re spying on.

I believe Lotame when it says it doesn’t match usernames to anonymous profiles. That doesn’t mean it won’t match these things down the road, or that someone else won’t build a highly profitable business based on that very thing. It’s called “lead generation,” and it’s a multi-billion-dollar opportunity. 

I’ve said it before and I’ll say it again. Self regulation ain’t working. It didn’t work for the banking and brokerage industries, why would it work for Internet advertising? We need better options than relying on the goodwill of data profilers to not monetize the information they are being handed for free.

Update #1: BlueKai responds via a spokeshuman:

"BlueKai does not buy or sell sensitive data attributes like 'drug use frequency' from OkCupid.  We do capture standard demographic attributes like zip, age and gender from several publishers. The report that cited BlueKai as a seller of such sensitive attributes was mistaken, and [Mayer] has posted a correction."

Update #2: Lotame COO Adam Lehman responded to my questions via email after this story was published. He says that while Lotame does receive information about drug, alcohol and nicotine use from OkCupid, it discards this data. However, Lotame does use anonymous information from OkCupid about pets, gender, income and some ethnicities for different audience segments.

As for why Lotame thinks I'm a gender-confused geriatric, Lehman writes:

"This is far from a perfect science. Your situation underscores the irony of the intense focus and concern with online behavioral data collection and licensing, given the inherently imprecise nature of this process, based on self-imposed industry restrictions."He adds that Lotame (and BlueKai) support Evidon's Open Data Partnership, which aims to give consumers more control over the data that ad networks compile about them.

Got a question about social media? TY4NS blogger Dan Tynan may have the answer (and if not, he’ll make something up). Visit his snarky, occasionally NSFW blog eSarcasm or follow him on Twitter: @tynan_on_tech. For the latest IT news, analysis and how-to’s, follow ITworld on Twitter and Facebook.

What’s wrong? The new clean desk test
Join the discussion
Be the first to comment on this article. Our Commenting Policies