From: Hal <hfinney@shell.portal.com>
Date: Fri, 14 Jun 1996 14:22:15 +0800
To: cypherpunks@toad.com
Subject: doubleclick monitoring web browsing habits
Message-ID: <199606132319.QAA14901@jobe.shell.portal.com>
MIME-Version: 1.0
Content-Type: text/plain


A post on comp.risks described a web adverstising service called
"doubleclick".  As described in its web pages at <URL:
http://ad.doubleclick.net >, this service provides targetted
advertising on the web.

Participating web sites include links to doubleclick to show graphic
images.  Advertisers sign up with doubleclick and specify profiles for
where and when they want their ads to appear.  Doubleclick then selects
an ad for each user who visits a participating site.  Participating sites
get paid for each such hit, and advertisers pay based on how many hits
are expected.

Apparently this is being used quite a bit.  But what I found disturbing
was the scope of the information being collected by doubleclick.  The
various parameters that advertisers can use in setting up their profiles
for where their ads should appear are described at <URL:
http://ad.doubleclick.net/advertising/adreghelp.htm > and include:

  TARGET BY WEB PAGE/SITE CATEGORY
  TARGET BY SERVICE PROVIDER (SP)
  TARGET BY GEOGRAPHIC LOCATION
   We determine a person's geographic location through the physical
   location of their network or through user registration. We have
   created an extensive map of both organization and Internet Service
   Provider (ISP) networks.
  TARGET BY USER'S OPERATING SYSTEM 
  TARGET BY USER'S BROWSER TYPE 
  TARGET BY HIGH-LEVEL INTERNET DOMAIN TYPE 
  TARGET BY ORGANIZATION TYPE (SIC CODE) 
  TARGET BY ORGANIZATION SIZE OR REVENUE
  TARGET BY PERSONAL INTERESTS
   doubleclick.net continues to add to an extensive database of user
   interests from activity on doubleclick.net member web sites as well as
   from publicly available sources like netnews. User interests are kept
   strictly confidential and will not be released to advertisers. We do
   allow advertisers to target ad banners based on user's interests. The
   more your ad banner is targeted at specific user interests, the more
   likely you are to generate a response. Personal interest categories
   include:
   
   Arts and Literature
   Business, Finance, and Economy
   Computers, Software and Internet
   Culture, Religion, and Society
   Education and InstructionalEntertainment
   Government, Politics, and Military
   Health and Medicine
   News
   Recreation and LeisureScience and Technology
   Social Science
   Sports
   Travel

This last category is the really worrisome one.  doubleclick monitors
the web browsing habits of users whenever they hit a doubleclick-
participating site, and builds up databases about users from that, as
well as from usenet posts.  This is exactly what people have been
talking about as an abuse of privacy on the net.

One question is whether enough information to uniquely identify users
is routinely provided by widely used browsers like Netscape.  I have
refrained from telling my Netscape browser my name and email address out
of fear that it would reveal this information; as a result, I can't use
mailto: links, which is annoying (and also suspicious; lynx allows me to
do mailto: without permanently entering an email address).

This points out the need for browser providers to be sensitive to the
privacy needs of their users and to clearly explain when and under what
circumstances private information is revealed.  It also suggests that
services like www.anonymizer.com will be increasingly important for
people to protect their privacy while browsing.

Hal