The all-seeing advertising cookie

Accord­ing to the New York Times, UK com­pany Phorm has devel­oped the long-feared ulti­mate ad-serving cookie.

The term “cookie” is a nick­name for per­sis­tent client-side web browser data. Cook­ies solve one of the ear­li­est prob­lems of the com­mer­cial World Wide Web: stor­ing user infor­ma­tion in the web browser for mul­ti­ple pages of the same web site. Wikipedia’s arti­cle is rich with details, and has a good ref­er­ence list.

Most Web browsers allow users to erase their cook­ies, usu­ally through a set­ting in the pri­vacy or secu­rity set­tings. But users are lazy, so most browsers are left in their default, cookie-storing state. Some web sites rec­om­mend the defaults, so users do not have to reen­ter their cre­den­tials dur­ing their session.

Adver­tis­ing revenue

Web adver­tis­ing firms sell third-party cook­ies, which work on sev­eral dif­fer­ent web sites. This helps adver­tis­ers track users, so that the ad firms can serve up appro­pri­ate adver­tise­ments to each users. Users can opt-out of these third-party cook­ies by find­ing an opt-out page that itself sets a cookie in their browser.

Google’s main source of rev­enue is adver­tis­ing. So is Yahoo’s. In fact, many large web por­tals, blogs and mag­a­zines rely on their adver­tis­ing rev­enue to sur­vive. So any­thing that can pro­vide more pre­cise tar­get­ing of adver­tise­ments might improve revenue.

Phorm’s cookie tech­nol­ogy relies on ISPs. Phorm installs hard­ware in ISP net­works that helps Phorm track indi­vid­ual users at the web page level, no mat­ter what site they access because Phorm’s cook­ies are linked to the third-party adver­tiser cookies.

For more details, read the arti­cles at Open Rights Group and Richard Clayton’s blog. The Wikipedia arti­cle on Phorm has many more references.

Clayton’s secu­rity analy­sis of Phorm’s Web­wise tech­nol­ogy is also avail­able as a PDF doc­u­ment, with even more tech­ni­cal details. Clay­ton doesn’t like the tech­nol­ogy at all, for very good reasons:

Phorm assumes that their sys­tem “anonymises” and there­fore can­not pos­si­bly do any­one any harm; they assume that their pro­cess­ing is generic and so it can­not be inter­cep­tion; they assume that their busi­ness processes gives them the right to imper­son­ate trusted web­sites and add track­ing cook­ies under an assumed name; and they assume that if only peo­ple under­stood all the tech­ni­cal details they’d be happy.

Tagged as: advertising, marketing, privacy, revenue, UK