All posts in advertising

Defeating the Cookie Monster: How Firefox can Improve Online Privacy

By On June 2, 2010 In advertising, Features, Firefox, Next Version, Privacy, Security, User Experience With Comments Off on Defeating the Cookie Monster: How Firefox can Improve Online Privacy Permanent Link to Defeating the Cookie Monster: How Firefox can Improve Online PrivacyPermalink

As we choose priorities for the next version of Firefox’s features and development, the Firefox team has been considering the state of the web and looking for areas where online content has changed faster than browser functionality. One area of concern is the growing use of private user data, especially by advertisers. User data being silently and persistently passed between sites and advertisers is disturbing for those with an interest in user choice and transparency on the web.

Privacy vs. Security

Privacy and security are related but distinct topics. Security refers to the prevention of material harm to the user. Avoiding theft, fraud, and data loss are all security issues. Browsers have been working to improve security for decades, prompted by increasingly sophisticated viruses, malware, and other exploits.
Privacy is a broader topic than security. It refers to users’ control over what they reveal about themselves online, whether or not what they reveal might lead to material harm. All internet users reveal some information about themselves to some sites, but the user has privacy if his discretion determines what information is shared with whom.

Firefox has Local Privacy but Needs Network Privacy

The Firefox team has already done some great work on local privacy with improvements such as Private Browsing mode, Clear Recent History, and Forget about this Site. These features give users better control over when their data is exposed and hidden on their own computer. However, wider privacy issues surface when data is shared over a network.

One major problem of the modern web is the ability for private user data to be collected by advertising companies via third-party cookies.

If sites provide rich interaction, they usually require user data. The problem occurs when users willingly share data with a site they trust, but unknowingly their data is shared with other sites and companies via third-party cookies. This is common practice and a growing revenue model online. It first received national attention in November of 1999, when the Federal Trade Commission held a workshop on online profiling and reported that it presented a privacy concern to consumers. The practice has grown since then, despite some failed attempts at regulation by the US’s Federal Trade Commission, the Interactive Advertising Bureau, and Britain’s Office of Fair Trading.

Any website you visit can contain ads and other components that send cookies from your browsing session on the domain you trust to an advertising domain. These third-party cookies can be used to track information about users across multiple sites and multiple browsing sessions, allowing web habits to be profiled and tracked. This data can tell companies limitless kinds of information, such as what purchases you make, what news you read, your income, if you’ve applied for work, and what dating sites you prefer. One manifestation of this data sharing is seeing to ads targeting users based on data and actions from other sites.

The ability for advertisers to gain and use this data violates user privacy for several reasons:

  • It’s nearly impossible to detect. Much of the data-sharing happens in the background during a browsing session without asking or notifying the user. Users usually only discover what has happened when they are seeing targeted ads (long after the data has been transferred).
  • It occurs without user consent. Of the sites that are even aware of third-party cookie sharing, few give users control over how their data is shared with advertisers. Sites that do offer preferences sometimes phrase them in ways that disguise their purpose, such as “do you want relevant content to be shown based on your usage” rather than “do you want ads to be shown based on your personal data.”
  • It contradicts the user’s reasonable expectation of privacy. Some sites that knowingly share data present a false image of being responsible with user data. They may show the user preferences that imply control, assure users that their data is “safe,” or offer to let users read a lengthy privacy policy in order to hide their actual practices. Of course there’s a very special hell set aside for sites that change privacy settings to be more permissive once users have already signed up and entrusted their data.
  • It’s nearly impossible to prevent. Even a user who is privacy conscious and reads all privacy policies, keeps his privacy settings up to date, and avoids sites that don’t guarantee privacy isn’t necessarily safe. Any site he’s given data to could potentially use it without asking, and third-party cookies could be sent via ads and web bugs without the knowledge of the site’s owners. Heck, any site could be scraping identifiable information from his digital fingerprint.
  • It potentially embarrasses the user. Data sharing via third-party cookies takes information given by the user at some point in time and exposes it at another time. While the user may be discrete about where he is viewing certain content and even use Private Browsing Mode for items to not appear in history, advertisers using third-party cookies can expose user actions at times out of the user’s control.

So what can Firefox do to improve its story on privacy?

1. Provide intelligent defaults for third-party cookie behavior

Simply disabling third-party cookies isn’t the solution. Third-party cookies are necessary for legitimate web functionality such as embedded content, session management, mashups, etc. Most bank websites depend on third-party cookies for functions such as bill paying. The goal should not be to outright disable third-party cookies, but to be more intelligent about what behavior is allowed.

The http-state working group is currently working to produce a specification in multiple documents to lay out how clients should behave with regard to cookies (see current drafts here). Dan Witte, the cookie module owner at Mozilla, has been in communication with them and is doing his own work to develop a modern cookie standard. The goal is to create a guideline that Mozilla can follow that aligns with our Manifesto to protect user choice on the web. Dan’s already working on one way Firefox could address the problem by enabling third-party cookies, but only temporarily. His idea is to keep third-party cookies active only for the life of one tab. When the tab is closed, the cookies are deleted – advertisers could not track users from site to site. Dan will be blogging about this later with more details on his work.

2. Give users better control over how sites can access their information in Preferences

Currently, Firefox gives users precise, fine-grained control over the many ways that sites can access user data. All the user needs to do is change their on each Preference panel that effects site privileges:

As can be seen above, the current Firefox interface gives each site privilege type – saving passwords, cookies, etc – its own separate preference window. This design is framed around the implementation model rather than the user’s mental model, meaning it’s designed in a way that corresponds with how it was built rather than how users perceive the action they want to take. Having an individual window for each permission makes sense from an implementation standpoint, because each site privilege is separate in code. From the user’s perspective, however, it’s impossible to tell what privileges a particular site has. A better design would present controls in a site-centric rather than technology-centric view. If a user decides that he doesn’t trust site X and doesn’t want it to have any access, it would be more efficient to control all of site X’s access in one – not 15 – Preference windows. Alex Faaborg made this mockup to illustrate how a site-centric UI could be achieved:

While all of Firefox’s Preferences need to be improved, including site-centric privacy controls like Alex’s above for Firefox 4.0 would go a long way towards putting users back in control of their data.

3. Give users better control of their data while they are browsing

While a site-specific Preference panel will help users have better fine-grained control of their privacy when they’re configuring Firefox, there’s some options and information that can be exposed while the user is browsing. If a site has access to geolocation, for instance, this should be constantly indicated in Firefox’s interface. If a site is storing a password, this should be easy to change or remove without opening Preferences. Firefox’s Site Identity Button, which currently gives very little information about a site, could be improved to give information about a site’s privileges and the ability to change them.

It’s our goal for Firefox 4.0 to give users more control of their data, both by literally giving them controls and, more importantly, creating intelligent defaults that protect a user’s privacy and anonymity without breaking web functionality. It’s my hope that even simply exposing what access sites have to data will be positive for the web by eroding the sense of false security that many sites try to create for their users and creating awareness of and control over how, where, and when data is being shared.

Facebook is acting like your mother, and she’s very disappointed in you

By On October 9, 2008 In advertising, internet With Comments Off on Facebook is acting like your mother, and she’s very disappointed in you Permanent Link to Facebook is acting like your mother, and she’s very disappointed in youPermalink

I hate online ads, in part because they are anti-user experience. Good user experience enables users by giving them positive interactions with the content and tools they want to access, while advertising steers them away from what they want to access. While user experience caters to users’ wants and needs, advertising attempts to hijack them. User experience focuses, advertising distracts.

Fair enough, we’re intelligent people and know that pinching the monkey won’t win us an iPod. But lately, I’m even more disturbed by Facebook’s acutely targeted advertising. It goes beyond critisizing your purchases and begins to critisize you. Mossop pointed out to me last week that Facebook is analyzing your profile and selecting ads which more than suggest a product, suggest you should be living your life differently. I checked my own profile, and here’s what I found:

Lots of engagement rings. Nowhere in my profile have I mentioned an interest in getting married, but I’m a female over a certain age and I fall in Facebook’s targeted social bracket. Facebook thinks it’s about time! Facebook wants grandchildren!

The trend here is disturbing – that as advertising becomes “better,” it begins to sound less like an annoying child and more like a judging peer group. You know you’re fat, because ads are telling you about diet plans. You know you’re old, because ads are telling you about wrinkle cream. We’ve heard complaints that advertising gives us unreasonable expectations from body image to income, but in the pre-digital age these expectations were leveled at no one in particular. With the internet, these ads are targeted at you – your life, your problems, and your choices. If we continue to not care how much companies like Facebook and their advertisers learn about us, the projection here is grim – that advertising becomes a more increasingly personalized, feeding on our insecurities and urging us to conform through consumption.

I’m not trying to be alarmist here, but only say that we must care about where our data goes. The game here is becoming more interesting, because the nature of the internet and even free speech is at stake. Yesterday, the Guardian wrote that the South Korea, a democracy, would like to more heavily police the internet and essentially terminate its anonymity (link). Steps away from anonymous data are harmful ones. Gabe’s dickwad theory aside, the anonymity of the internet is a wonderfully subversive thing – it can guarantee freedom of speech for those otherwise without it. Mitchell Baker has been posting recently about why Mozilla should think about and respond to data (introduction, related topics, what Mozilla should do). Here, she write that Mozilla’s principles of enriching lives, providing security, and giving us control of our online experience “are at risk if individuals have no control over the creation or use of the data that describes us.” How to protect users while still steering away from proprietary data will be a difficult problem to tackle, but we’re in a good place to start the discussion.