Privacy II: Cookies (Does Google Sell Cookie Placement Privileges?)

In a previous blog Who is to Blame for Cavalier Attitudes About Privacy?, I questioned whether privacy invasion is much a problem of lax attitudes from us users as the companies who abuse our privacy. In the companies’ defense, we as users do not have a very good process to express our expectations to privacy, and I believe many have taken advantage of that. Quite honestly, the biggest enabler of privacy lapses is our own ignorance–most of us are oblivious to what is happening behind the scenes while we surf the web.  In the next two blogs I will share tools to help us better understand how much we are being tracked. Let’s focus first on cookies.

Most of us know and expect that web sites use cookies to monitor and track us as we use their websites. What is more interesting is how often Company A allows other companies to post cookies on  your computer when you visit their website.

Firefox has great tools to monitor this. First clear all your cookies, then set Firefox to ask you to accept cookies.   This setting will drive you nuts in the beginning but as you revisit sites FF will remember which cookies you wanted to keep and which to deny.  Note the URL of cookies, particularly how many are not from the site you are visiting. Now think about this–as you browse a single site, you may have several companies placing cookies on your computer to monitor you. These cookies are used to identify you as an individual to make it easier to track you usage as a web user.

Now here is where it gets interesting. Some search terms with a Google search will produce cookies from other sites while  you are still searching on Google.com. It begs the question: does Google sell cookie privileges to other companies while you are searching on Google?

For example, at Google.com type “zap2it” and note the top query suggestion is “zap2it tv listing”–choose that and note that Google wants to place a cookie, not from Google.com.

Search engines have long struggled  with their competing interests in determining their top search listings–especially since most people only look at the first 3-5 listings at the top of their search. Companies are willing to pay good money to make top listings, yet users want listings based on their search needs, not the highest bidder. According to Search Engine Watch, in 2005 Google implemented a quality score program as an alternative to the old bid-to-position model (whoever had the most money secured the top position). Search Engine Watch also references “paid inclusion” as another option as opposed to paid position.

So search engines have had to adjust their bid-to-position practices for search listings, where the most attention is focused. But this brings up an interesting question: what about query suggestions? In other words, before the search engine provides listings as you start typing your search, query suggestions are offered to the user. Does Google sell position for those query suggestions? And, based on your choices from those query suggestions, do search engines sell the right for other companies to set cookies while you are still searching within Google? It sure appears to be the case.

This Google practice is just an example of broader privacy issues. We as users can learn a lot about the practices of web sites by tracking cookie placement from web sites–I recommend trying it for at least a couple weeks.  As you observe the cookies-setting practices of many websites, questions start to arise: What should be allowed to track my movement on a website as an individual? Should companies allow other companies to place cookies on your browser? Should we worry that cookies and query suggestions may be based not on our needs but rather the highest bidder? Should companies be able to track all your cookies, not just the ones they place in your browser?

I think most people believe that unless they log in to a site, they are anonymous–that is not true. To what level should companies inform  you of their tracking practices?

More on privacy coming next: how much can companies track you as an individual?