Inside Google

A week ago I wrote about how a graduate student, Chris Soghoian, had exposed the online industry-touted advertising opt-out procedures as misleading.  Shining the light on the online industry’s shortcomings has had impact.

The saga started when the Network Advertising Initiative (NAI) praised industry developed self-regulatory principles that govern "behavioral" advertising. Behavioral advertising is when online companies like Google, Yahoo! and Microsoft track you as you surf the Web and then deliver ads targeted to your online behavior.

Tacitly acknowledging that tracking users is intrusive and downright creepy to many people, the self-regulatory principles provide that online companies should give people a way to opt out. I won’t quibble and point out that if the companies were sincere in their expressed concern for consumers, the mechanism governing behavioral ads would be opt-in.

In any case, the NAI has a Web site where you can opt out of being tracked online by any of its members.

Soghoian, a fellow at the Berkman Center for Internet & Society at Harvard University and a Ph.D. candidate at Indiana University, discovered what a misleading sham the online companies had concocted.

When you opt out, a company has to place a "cookie" — a little piece of computer code — on your browser telling its system not to track you as you surf the Web. Every cookie needs an expiration date. What Soghoian discovered was that there was no uniformity in expiration dates.  A significant number were as short as six months. Nor was there any explanation of cookie expiration policies.

That means a user would opt out and not realize it needed to be done again in six months.  Soghoian dropped NAI executive Charles Curran an open letter pointing out the flaw.

Frankly, I believe many of the companies were deliberately deceptive, but I digress. The result of Soghoian’s  missive?

I’ve been amused all week as one company after another dropped him a line saying, oh, no, we didn’t mean to have such short expiration dates and we’re fixing it.

Finally today, as outlined on his blog, the NAI got back to him and said that all its members would be required to have a five-year minimum expiration date on their opt-out cookies.  Here’s Soghoian’s view on the matter:

"While it is quite fun to see the industry scrambling to perform emergency damage control in response to my blog posts, it is pretty pathetic that I had to do this at all. This multi-billion online advertising industry should not depend upon a single graduate student to keep it honest."

Another factor is at play as well. There is a serious move in Congress to regulate online advertising.  The industry will do anything — even try to act responsibly for awhile — to avoid regulation.  Good work, Chris. Keep it up.