Who is tracking you across the Web? Even the ad industry doesn’t know

Anyone who’s been following the twists and turns of the raging Do Not Track debate knows that both sides are still pretty far apart. Privacy advocates want consumers to have the ability to block all tracking. Period, full stop.

Advertisers claim that without tracking, the “free” Internet as we know it would die. They also claim that, if people could only see how benign data collection is and how it benefits them, they would happily agree to be tracked all the livelong day. (Despite the fact that half a dozen consumer surveys indicate the exact opposite.) This is what advertisers like to call “transparency.”

So let’s take Sears.com as an example. Sears is not a publisher in the traditional sense. Its business model does not rely on advertising. Sears exists to sell people dishwashers – and really, to sell extended warranties on those dishwashers, charged to a Sears credit card with a 24 percent annual interest rate.

But when you visit Sears.com, this is what happens.

This image comes via TrackerMap, a new service being marketed to Web publishers by Evidon. TrackerMap uses data collected by the Ghostery browser tool to display the various entities that take up residence on your computer when you visit a site. Some of these entities just deliver the ads, some record who viewed them, some collect analytics data on Web traffic, and some are behavioral trackers that use cookies to follow you around the Web so they can build profiles of you and your habits. (Often, comically inaccurate ones.)

As you can see from the map, most of these trackers have no direct relationship with Sears. They are brought in by other companies like BrightTag and Rubicon, who in turn bring in their own tracking and analytics friends. It’s like a party on your hard drive, only you haven’t been invited.

(Evidon has a dozen sample tracking maps on its site, some even more complicated than this one. Their man purpose is to show publishers how all these uninvited bits of code slow down page loads, but they’re still fascinating to look at.)

My first question: Who the hell are all these companies? So I randomly picked one of the outlying ones, a tracking company called ToneFuse, and decided to take a closer look.

My first stop was Evidon’s database of tracking companies, which is supposed to offer transparency into the shadowy world of online tracking. Here’s how ToneFuse describes itself:

"ToneFuse is a marketing and monetization company centered around music. Our company caters to marketers and high traffic music properties in a number of ways."

What kind of data does ToneFuse collect? We don’t know, because ToneFuse doesn’t disclose that information. How does it use that information? Undisclosed. Who does it share that data with and how long does it keep it? Also undisclosed. ToneFuse is not a member of any of the self-regulatory groups set up by the online advertising industry. Want to tell ToneFuse to sod off? Sorry Charlie – there’s no opt-out option.

So much for all that transparency the ad industry keeps raving about. Not surprisingly, PrivacyScore gives ToneFuse a total of zero points out of 50.

It gets worse. Turns out ToneFuse has its roots in the ringtone merchant business, and also has dipped its toes in the ever popular lyrics site industry. Neither of those Web categories has what can be called a good reputation. Though I can find no evidence ToneFuse has ever done anything unsavory, at the very least it has not been keeping very good company.

Ki Mae Heussner of AdWeek had this to say about ToneFuse last year:

By pairing information about music preferences (from ToneFuse's ringtone product) with third-party data, the company says it has created 900 audience segments to help brands target consumers across some 100 publishers. The result is a slew of odd, non-intuitive insights. John Lennon fans, for instance, are 101 percent more likely to own pets while Rihanna lovers are 189 percent more likely to be interested in cruises.

In other words, ToneFuse is in the data mining business, along with just about everyone else.

I sent an email to ToneFuse asking what data it collects and what it does with it. I’m still waiting for a response. I also emailed Scott Meyer, CEO of Evidon, asking how consumers could be expected to navigate through a world where even the ad industry’s own watchdogs don’t know who many of these players are.

He wrote back:

I think you have hit on a key point. In this case, ToneFuse's lack of transparency has you as a consumer not feeling as comfortable as you would with another company that discloses more information. That's precisely why Ghostery users, who provide the anonymous, aggregated data that powers Evidon Encompass, typically chose to selectively block companies that are not as forthcoming with this type of information.

In the spirit of transparency, I also asked Evidon to analyze my personal Web site for tracking. What they sent back both surprised and appalled me:

It appears that the social media widget AddThis invited a bunch of its pals over for a kegger on my Web site and didn’t tell me. I quickly uninstalled it and booted all those freeloaders.

Three lessons here:

1. Transparency may sound good in theory, but in practice it’s kind of a nightmare. There’s either too much data to make an informed decision or not enough. It’s not a viable alternative to a true one-click Do Not Track option.

2. When even the ad industry can’t tell you who the trackers are, you know it’s gotten totally out of control.

3. Be careful whom you accuse of being a tracker -- you might be one of them.

Got a question about social media or privacy? TY4NS blogger Dan Tynan may have the answer (and if not, he’ll make something up). Visit his snarky, occasionally NSFW blog eSarcasm or follow him on Twitter: @tynanwrites. For the latest IT news, analysis and how-to’s, follow ITworld on Twitter and Facebook.

Now read this:

Web trackers are totally out of control

Further adventures in data mining, or welcome to my Lear Jet Lifestyle

Four reasons why Do Not Track turned into Do Not Trust