This story is part of Surveillance Society, a series examining the implications privacy intrusions, many of which occur on a daily basis. For more stories in the series, including a multimedia look at one particular Bad Data Day, go to post-gazette.com/surveillance.
■ ■ ■
As you read this online, scores of unseen eyes are looking back at you.
They’re computer scripts called trackers, and you’ve likely never heard of some of the companies that deploy them, much less invited them to catalog your online travels.
Unless you install special software, you won’t detect them. And even if you realize they’re watching, identify them and look them up online, you likely won’t have a clue what they’re doing with the data they collect.
By contrast, the burgeoning swarm of companies that do online tracking are learning plenty about you, with the ultimate aim of showing you online ads that entice you to buy.
The Pittsburgh Post-Gazette used a software tool called Ghostery to check Western Pennsylvania websites for trackers. While media and sports team websites hosted the largest numbers of trackers, websites for government entities, educational, medical and insurance companies also served as portals for the secret watchers — some of which operated without the knowledge of the site owners.
Some website managers regretted that they were feeding the Big Data industry, but said it was unavoidable.
“I don’t think I could ever build a website with no harvesting of data in this day and age,” said Scott Gutowski, chief of information and technology for the Pittsburgh Public Schools, whose website hosted four trackers — fewer, at the time, than the city’s or the Port Authority’s sites. “There are so many plug-ins and so many social networking technologies that people want and expect, and they come along with this baggage.”
Tracking is the backbone of the system that allows websites to feed you ads that uncannily reflect the sites you’ve visited. "If I'm going to get ads on websites, I'd rather get ads for things I'm actually interested in than things that I would never purchase,” said Lorrie Faith Cranor, director of Carnegie Mellon University's CyLab Usable Privacy and Security Laboratory.
Still, she finds it “somewhat creepy to be tracked all of the time ... for who knows what. I just don't really like the idea of all of these companies knowing all of this information and profiting from it without me really having any say in the matter."
Nothing personal ...
You can have a say, but it takes a bit of work.
The New York marketing technology firm Ghostery Inc. offers easy-to-download software that allows individuals to detect and, if desired, block the tracking that occurs as they visit websites.
On a morning early this month, the Post-Gazette used Ghostery to check 24 websites associated with civic institutions, governments, universities, medical and insurance entities, media outlets and sports teams.
Media websites hosted an average of nearly 47 trackers each, followed by sports teams at nearly 32. (see chart)
These days, team websites are run by their leagues, which therefore control most of the tracking. If anybody’s triangulating the identities of the visitors, it’s not the teams, their spokesmen said.
The Steelers, for one, “do not collect personal and private information from the fans who visit our website,” said spokesman Burt Lauten. “We try to gather information to make sure we are giving our fans the best experience possible each time they visit Steelers.com.”
How’d that get there?
If you want to avoid the trackers watching through, say, the Penguins’ website, you can opt not to go there.
If, however, you forget when to put out your recyclable trash, need to check the bus schedule or want to know the first day of school, it may be hard to find alternatives to the websites of the city of Pittsburgh, Port Authority and Pittsburgh Public Schools.
Pittsburgh Chief Innovation & Performance Officer Debra Lam did not respond to questions about the city’s website, which allows Google, Facebook and Twitter to see who is coming and going. Those giants are some of the most effective trackers. Last year Facebook told Advertising Age that it can track its members' presence on websites that include its "Like" button, whether they click the button or not, and can use the data collected to target ads.
Port Authority spokesman Jim Ritchie said that most of the nine trackers detected on the transit agency’s website by the Post-Gazette weren’t supposed to be there. The authority installed a program called AddThis, which allowed visitors to easily share or bookmark content from the site, but quietly brought another five trackers along with it.
After the Post-Gazette made Port Authority aware of the unwanted trackers peering out through its site, said Mr. Ritchie, “Our IT folks went back in and killed all of those.”
Similarly, Duquesne University responded to the Post-Gazette’s findings by purging from its site the tracker SiteImprove. A spokeswoman said that company did a demonstration for the university, was not retained, but left a program on the server that was transmitting data. She said that SiteImprove was automatically deleting the data, and the tracker was removed after the Post-Gazette inquired.
The Pittsburgh Public Schools website, like most of the 24 sites surveyed, uses Google Analytics to see what is and isn’t working for it online.
(Click image for larger version)
As a free tool, Google Analytics provides “a lot of bang for the buck,” Mr. Gutowski said. “That does come with the reality that because Google Analytics is free, it does play into the identity tracking that Google is famous for.”
Google’s privacy policy notes that information gathered through its analytics tools “is linked … with information about visits to multiple sites” and used for “giving you more relevant search results and ads.”
Healthy profile?
Ms. Cranor said she found it "surprising" that the region's top medical and insurance websites "have so many trackers." While some of the trackers detected through Ghostery seemed to be aimed at helping those firms to monitor traffic internally, "some look like they are designed to do retargeting," said Ms. Cranor, "so you will get ads for those companies at other websites."
Highmark and UPMC said they aren't getting personally identifiable information through the trackers on their sites, but are using them to hone their websites and online advertising.
Allegheny Health Network’s site had 17 trackers, including at least one that is fairly transparent about its use of the data. BlueKai, which is software giant Oracle's online advertising arm, assembles "information that does not identify you" like the Internet addresses of your computer and phone, and the "advertisements clicked, websites and content areas visited" from those devices, it reveals in its privacy policy. It also seeks to learn your name, address, email address, social media usernames, telephone numbers and "purchase behavior and history."
BlueKai creates a "profile" including your unique information, and puts you into "a group of profiles that share a common behavior or preference."
The BlueKai privacy policy acknowledges that it may turn over data on you to "government authorities, including public and government authorities outside your country of residence" and that "marketing information identifying you" could conceivably be stolen.
Stephanie Waite, a spokeswoman for Allegheny Health Network, wrote in an email response to questions that the hospital system “follows all government and industry guidelines” and uses “very narrow and specific products in the context of the web site and none gather personal information except when submitted by the user.”
No opt out
BlueKai aside, most of the trackers don’t reveal much about what they do with their dossiers on your web browsing.
A recent study by Ms. Cranor, CMU’s Candice Hoke and Pedro Giovanni Leon, and the University of Pittsburgh’s Alyssa Au found that the privacy policies of tracking firms are often vague, or even non-existent. The large majority won’t tell you what information they have collected about you, or how long they’re keeping it, according to their article slated for publication in the Journal of Law and Policy for the Information Society.
Almost none of the companies studied swore off of what the researchers called “unrestricted tracking,” which means the merger of your online history with records of your offline spending and other personal information.
Short of installing blocking software, you can’t make them stop, the researchers found, because “most companies do not provide options to stop data collection and less than a third provide opportunities to opt out of targeted ads.”
That’s unfortunate, said Ms. Cranor, whose study suggested that websites disclose their degree of tracking, perhaps through an easily understandable icon.
"I think that it is very much an individual choice,” she said, “as to whether you want to be tracked and whether you feel it's beneficial to you to be tracked.”
Rich Lord: rlord@post-gazette.com, 412-263-1542 or on Twitter @richelord.
First Published: June 14, 2015, 4:00 a.m.
