Does this browser make me look fat?
I am being stalked by ads for plus-sized women’s clothing. The problem: I opted out of tracking ads six months ago. Why is this still happening?
Yesterday I took a break from my hectic life as a bloodless blogging machine to read a Rolling Stone interview with guitarist Steve Van Zandt. When I loaded the page, this weird ad popped up next to it.
I don’t normally see ads for plus-sized women’s clothing, so it kind of stuck out. Still, I didn’t really think that much about it at the time and quickly moved on. When I went to HappyPlace to read funny tweets about the government shutdown farce, however, there was the Zulily gal again, in all her porcine and garishly outfitted glory.
Clearly, my Web browser thinks I am a woman of substance. It’s true that I have put on a few pounds over the years. But a sex change operation? I think I might have noticed that.
This was too weird to be a coincidence. For reasons that are unclear, I was being re-targeted by this ad. (And this isn’t the first time I’ve been stalked by an ad.) The problem is that this should not be happening, because I opted out from these kinds of ads over six months ago.
Choose or lose
Both ads carry the AdChoices icon, that teensy logo with the sideways blue triangle that accompanies most Online Behavioral Advertising (OBA), also known as targeted ads.
Click the icon and it tells you what ad network delivered it. Depending on the network, it may also reveal information about the company and offer a way to opt out. So I clicked the icon, which brought me to the About Google Ads help page.
Wait a minute, I thought. Didn’t I already opt out of targeted ads from Google as well? So I checked my settings. And, it turns out, I had.
The N/As in the right hand column, and the option to opt in to interest-based ads at the bottom, indicate that I did indeed opt out some time ago. Targeted ads from Google should not be tracking me. So why, I asked Google, are zoftig women in loud floral prints following me around the InterWebs?
The answer was not especially satisfying. Not all ads that carry the AdChoices icon are necessarily behaviorally targeted ads, a gSpokesperson explained. And what may look like a Google ad – the Zulily ads were served by DoubleClick – may not necessarily be a Google ad. Per said gSpokesperson, it could be an ad in the DoubleClick AdExchange or served by Doubleclick Bid Manager, but originally from another ad network. Those Google opt outs? They only apply to ads served directly by Google.
I checked with Scott Meyer, CEO of Evidon, which manages the AdChoices opt out program for the Digital Advertising Alliance, whether this was accurate. He essentially confirmed what my Google friend said – most ads that carry the AdChoices icon are behavioral ads, but not all of them. And even if you have opted out, these ads may still be dropping the same cookies on your hard drive to collect data about you for other reasons, like analyzing ad performance or determining your location. Per Meyer:
While privacy advocates and many regulators and advocates believe that OBA is a precise science with dedicated technology, the reality is that it's neither as elegant nor scientific as you might think. Many of the largest ad networks derive OBA data from the same cookies and scripts that are used for other types of reporting that are not controversial (e.g. frequency of exposure to the ads, determining geolocation)….. So when you've opted-out, they are not specifically collecting OBA data or targeting OBA ads to you, but some data is likely being collected for these non-controversial reporting uses.
He adds that if you somehow change your mind and decide to opt back in, those same cookies can be used to deliver targeted ads, based on your Web surfing history.
To me, this is troubling. The AdChoices program was created by the DAA to show that, by being more transparent about who’s behind each targeted ad and offering users a chance to opt out of tracking, the ad industry could both do right by consumers and avoid having Congress or the FTC mandate Do Not Track regulations.
If clicking that icon doesn’t actually show me who’s behind the ad, and choosing to opt out doesn’t actually prevent ad networks from collecting behavioral data about me, then what exactly is the point? Is AdChoices yet another bait and switch from the ad industry? Sure looks like it.
Opt out early & often
This little episode inspired me to check my opt out settings with Evidon, where I discovered that I am not nearly so opted out as I thought I was.
Here’s how some of my settings looked six months ago.
Here’s how they look now.
See those little checkboxes to the right of 33Across and Accordant Media? In April 2013 they were marked “opted out.” In October 2013, suddenly, they are not. And the same is true for most of the 200-odd other companies that use Evidon’s global opt out setting.
The opt out works by setting a cookie that tells ad servers not to use my behavioral data to deliver ads to me. If I choose to opt back in, or that cookie gets deleted or otherwise corrupted, the setting goes back to the default – which is Tracking On.
I did not manually delete my cookies. I did not uninstall and re-install my browser. I did not opt back in. So how did some – but not all – of these settings get changed? That is the mystery I am still trying to solve.
I asked Jonathan Mayer, the Stanford security researcher who played a highly visible role in the ongoing negotiations over the Do Not Track standard, if he had any clues as to what might have happened. His response:
Cookies are fragile. That's one of the very reasons they're a poor choice for consumer privacy controls. You wouldn't have to worry about these issues with cookie blocking. (Or Do Not Track.)
As a sidenote, I also visited Zulily, to see if maybe they had something in my size. But before I could even enter the site it demanded that I sign up with my name, email address, and password. I could find no way to avoid it. And once I did that, it wanted my phone number so it could download an app to my mobile.
Being pushy and stalkerish is really not a good way to earn my business or my trust. That holds equally true for advertisers and ad networks.
Got a question about social media or privacy? TY4NS blogger Dan Tynan may have the answer (and if not, he’ll make something up). Follow him on Twitter: @tynanwrites. For the latest IT news, analysis and how-to’s, follow ITworld on Twitter and Facebook.
Now read this: