As consumers increasingly go online in so many aspects of their daily lives, the challenge is enjoy the conveniences of online activities while limiting the privacy sacrifices. As the focus of online activity migrates from desktop and laptop computers to smartphones and other mobile devices, the mechanisms for protecting your privacy continue to evolve.
Most internet users would like to be anonymous online, but many think it is not possible to be completely anonymous online. Many internet users have experienced problems because others stole their personal information or otherwise took advantage of their visibility online. These are the conclusions of a September 2013 survey by the Pew Research Center’s Internet Project.
1: Which Online Activities Reveal My Personal Information?
When you are online, you provide information to others at almost every step of the way. Often this information is like a puzzle that needs to be connected before your picture is revealed. Information you provide to one person or company may not make sense unless it is combined with information you provide to another person or company.
Signing up for Internet service
If you use a computer to access the Internet and pay for the service yourself, you signed up with an Internet Service Provider (ISP). Your ISP provides the mechanism for connecting to the Internet.
Each computer connected to the Internet, including yours, has a unique address, known as an IP address (Internet Protocol address). It takes the form of four sets of numbers separated by dots, for example: 123.45.67.890. It’s that number that actually allows you to send and receive information over the Internet.
Depending upon your type of service, your IP address may be "dynamic", that is, one that changes periodically, or "static", one that is permanently assigned to you for as long as you maintain your service.
Your IP address by itself doesn’t provide personally identifiable information. However, because your ISP knows your IP address, it is a possible weak link when it comes to protecting your privacy. ISPs have widely varying policies for how long they store IP addresses. Unfortunately, many ISPs do not disclose their data retention policies. This can make it difficult to shop for a “privacy-friendly” ISP.
When you visit a website, the site can see your IP address. Your IP address can let a site know your geographical region. The level of accuracy depends upon how your ISP assigns IP addresses.
You can block your IP address by utilizing a service such as Tor (https://www.torproject.org/) which effectively blocks this information. Another alternative is to use a Virtual Private Network (VPN). A VPN replaces your IP address with one from the VPN provider. A VPN subscriber can obtain an IP address from any gateway city the VPN service provides.
If you access the Internet with a smartphone or other mobile device, you may access the internet using a data plan tied to your cellular phone service or through a Wi-Fi hotspot. If you have a data plan, your service provider (such as AT&T, Sprint, Verizon, and T-Mobile) collects data about your usage.
Browsing the Internet
Although it may not seem like you are giving very much information, when you browse the Internet you are relaying personal information to websites. Your browser provides your IP address to the site operators. As you move from site to site online, numerous companies utilize sophisticated methods to track and identify you. The Web Privacy Census measures trends in internet tracking at the 25,000 most popular websites.
Almost all browsers give you some control over how much information is kept and stored. Generally, you can change the settings to restrict cookies and enhance your privacy. Most major browsers now offer a "Private Browsing" tool to increase your privacy. However, researchers have found that "Private Browsing" may fail to purge all traces of online activity. Many popular browser extensions and plugins undermine the security of "Private Browsing".
Do Not Track (DNT) is a setting in most major browsers that tells websites that you do not wish to be tracked. In order for DNT to work, the sites that you visited must agree to honor the preference to not be tracked. Although a few large companies have agreed to honor DNT, many have refused because DNT threatens advertising dollars.
Effective January 1, 2014, websites collecting personally identifiable information about California consumers’ online activities must include information in their Privacy Policy about how the website operator responds to "Do Not Track" signals and whether third parties may collect personal information when a consumer uses the site. This is the first law in the United States to impose disclosure requirements on website operators that track consumers’ online behavior.
Search engines. Most of us navigate the Internet by using search engines. Search engines have and use the ability to track each one of your searches. They can record your IP address, the search terms you used, the time of your search, and other information. We encourage you to closely review your search engine's privacy policy.
You may also inadvertently reveal information through your search strings. For example, you might do a search to determine if your Social Security number appears on any websites. You might enter the search terms " Jane Doe 123-45-6789." The Google search string might look like this: http://www.google.com/#hl=en&source=hp&q=Jane+Roe+123-45-6789&btnG=Googl... Retention of that search string would mean that your search engine has a record of your name and Social Security number.
Major search engines have said they need to retain personal data, in part, to provide better services, to thwart security threats, to keep people from gaming search ranking results, and to combat click fraud scammers. However, major search engines often have retained this data for over a year, seemingly well beyond the time frame necessary to address these concerns. Some search engines have reduced the time that they retain users' IP addresses. Major search engines delete or anonymize IP addresses according to the following schedule:
Yahoo-18 months
Bing (formerly MSN/Windows Live)-6 months
Google-9 months
Startpage, a search engine operated by Ixquick, based in The Netherlands, does not record users’ IP addresses at all. The privacy policy was created partially in response to fears that if the company retained the information, it would eventually be misused. The company concluded, “If the data is not stored, users privacy can't be breached.” Startpage will remove all identifying information from your query and submit it anonymously to Google. Startpage uses advanced encryption technology for your search queries.
DuckDuckGo is another search engine that, according to its Privacy Policy "does not collect or share personal information".
Online Privacy Tip: It's a good idea to avoid using the same website for both your web-based email and as your search engine. Web email accounts will always require some type of a login, so if you use the same site as your search engine, your searches can be connected to your email account. By using different websites for different needs -- perhaps Yahoo for your email and Google for your searches -- you can help limit the total amount of information retained by any one site. Alternatively, log out of your email and clear your browser's cookies (see Cookies below) before going to other sites, so that your searches and browsing are not connected to your email address. Another method for preventing a search engine from associating your searches and web browsing with your web mail account is to use a different browser for your email account than for your searches and web browsing.
Online Privacy Tip: Avoid downloading search engine toolbars (for example, the Google toolbar or Yahoo toolbar). Toolbars may permit the collection of information about your web surfing habits. Watch out that you do not inadvertently download a toolbar when downloading software, particularly free software.
Online Privacy Tip: Google combines information about you from most of its services, including its search engine, Gmail, and YouTube. Be sure to disable automatic sign-ins by following the instructions at http://support.google.com/accounts/bin/answer.py?hl=en&answer=39273 Also be sure to clear your browser's cache and cookies by following the instructions at https://support.google.com/accounts/answer/32050?hl=en. While you must be signed in to access Gmail, most Google services can be used without being signed in to your account.
Cookies. When you visit different websites, many of the sites deposit data about your visit, called "cookies," on your hard drive. Cookies are pieces of information sent by a web server to a user's browser. Cookies may include information such as login or registration identification, user preferences, online "shopping cart" information, and so on. The browser saves the information, and sends it back to the web server whenever the browser returns to the website. The web server may use the cookie to customize the display it sends to the user, or it may keep track of the different pages within the site that the user accesses.
For example, if you use the Internet to complete the registration card for a product, such as a computer or television, you generally provide your name and address, which then may be stored in a cookie. Legitimate websites use cookies to make special offers to returning users and to track the results of their advertising. These cookies are called first-party cookies.
However, there are some cookies, called third-party cookies, that communicate data about you to an advertising clearinghouse which in turn shares that data with other online marketers. These third-party cookies include "tracking cookies" which use your online history to deliver other ads.
Your browser and some software products enable you to detect and delete cookies, including third-party cookies.
Ghostery is a browser tool that scans webpages for trackers (including cookies) and notifies you of the companies whose code is present on the page you are visiting. Ghostery allows you to learn more about these companies and block their trackers from loading if you choose to do so.
DoNotTrackMe (DNTMe) is a browser tool that blocks the tracking capabilities of advertisers, social networks, and data-collection companies. It stops data collection by preventing your browser from communicating with tracking companies.
Disconnect is a browser extension that stops major third parties from tracking the webpages you go to. Every time you visit a site, Disconnect automatically detects when your browser tries to make a connection to anything other than the site you are visiting.
Flash cookies. Many websites utilize a type of cookie called a "flash cookie" (sometimes also called a "supercookie") that is more persistent than a regular cookie. Normal procedures for erasing standard cookies, clearing history, erasing the cache, or choosing a delete private data option within the browser will not affect flash cookies. Flash cookies thus may persist despite user efforts to delete all cookies. They cannot be deleted by any commercially available anti-spyware or adware removal program. However, if you use the Firefox browser, there is an add-on called "BetterPrivacy" that can assist in deleting flash cookies.
During July and August 2010, three class action lawsuits were filed against several major companies for their use of flash cookies. These companies are alleged to have knowingly tracked users in a way that was not adequately disclosed in their privacy policies. The lawsuits were settled in June 2011. Under the terms of the settlement, the defendants will cease respawning cookies and amend their privacy policies. They also paid a $3.2 million monetary settlement.
Fingerprinting. A device fingerprint (or machine fingerprint) is a summary of the software and hardware settings collected from a computer or other device. Each device has a different clock setting, fonts, software and other characteristics that make it unique. When you go online, your device broadcasts these details, which can can be collected and pieced together to form a unique "fingerprint" for that particular device. That fingerprint can then be assigned an identifying number, and used for similar purposes as a cookie.
Fingerprinting could eventually replace the cookie as the primary means of tracking. Tracking companies are embracing fingerprinting because it is tougher to block than cookies. Cookies are subject to deletion and expiration, and are rendered useless if a user decides to switch to a new browser. Some browsers block third-party cookies by default and certain browser add-ons enable blocking or removal of cookies.
Unlike cookies and flash cookies, fingerprints leave no evidence on a user's computer. Therefore, it is impossible for you to know when you are being tracked by fingerprinting.
You can test your browser to see how unique it is based on the information that it will share with the sites that you visit. Panopticlick will give you a uniqueness score, letting you see how easily identifiable you might be as you surf the web. A paper reporting the statistical results of Panopticlick submissions titled How Unique Is Your Browser? explains he degree to which modern browsers are subject to "device fingerprinting" through the information that they transmit to websites upon request.
Unfortunately, fingerprinting is generally invisible, difficult to prevent, and semi-permanent. There's no easy way to delete fingerprints that have been collected. Computer users determined to prevent fingerprinting can block JavaScript on their computer. However, some parts of a website (for example, video and interactive graphics) may not load, resulting in a blank space on the webpage.
One way to block JavaScript is to use the Firefox browser with the “add-on” program called NoScript,. The combination of Firefox and NoScript can stop JavaScript on websites.
Disabling JavaScript stops browser fingerprinting, because it prevents websites from detecting plugins and fonts, which are necessary to effectively fingerprint a device.
A particular kind of fingerprinting known as "canvas fingerprinting" works by instructing your browser to draw a hidden image. Because each computer draws the image slightly differently, these images can be used to assign a number that uniquely identifies your device. Using the Firefox browser with NoScript can defeat this type of fingerprinting. Learn more by reading Meet the Online Tracking Device That is Virtually Impossible to Block.
Householding. A company called BlueCava takes device fingerprinting (see previous section) one step further. BlueCava is able to identify and track users online across multiple devices, a practice BlueCava refers to as “householding.” They can associate multiple devices to the same person or household, by attaching an IP address to a BlueCava identifier and by recognizing and collecting information about the various computers, smart phones, and tablets that people use to connect the internet. Thus, your behavior on one device can be associated with other devices from both your home and office. This information can be very valuable for marketing purposes.
BlueCava's technology enables them to recognize computers and devices by collecting information about your screen type, IP address, browser version, time zone, fonts installed, browser plug-ins and various other properties of your screen and browser. This information is put into a “snapshot” and is sent to their servers to create a unique ID for every browser and to “match” the snapshot to the snapshots they receive from their marketing partners. When they use snapshots to create a unique ID, they are also able to group related screens into “households” based on common characteristics among the snapshots, such as IP addresses.
BlueCava allows you to opt-out. However, the opt-out will only apply to the particular device that you are using and not other devices. So it's important to opt-out from each computer, smartphone and other device that you use to go online.
Using Mobile Apps
If you use a smartphone or other mobile device to access the Internet, chances are that you may be using mobile applications (apps) rather than an Internet browser for many online activities. An app is a program you can download and access directly using your mobile device.There are hundreds of thousands of apps available, including numerous free or low-priced choices. Unfortunately, apps can collect all sorts of data and transmit it to the app-maker and/or third-party advertisers. This data may then be shared or sold.
When you install an app, you are allowing it to access certain data on your phone. What data does it collect, how does it store your data, and where is your data going? These are the questions you should be asking. You may be able to find the answers in the app’s privacy policy. However, many mobile apps do not have privacy policies, and when they do, they are often dense with legalese, lengthy, and difficult to read on devices with smaller screens.
Some of the data points that an app may access from your smartphone or mobile device include:
your phone and email contacts
call logs
internet data
calendar data
data about the device’s location
the device’s unique IDs
information about how you use the app itself
In a 2013 study, Carnegie Mellon researchers found that of the top 100 Android apps, 56 accessed device ID, contact lists and/or location data.
Many apps track your location. There are location-based services like Yelp and Foursquare that need your location in order to function properly. However, there are also apps (such as a simple flashlight) that do not need your location to function and yet still track it.
Smartphones and other mobile devices may ask you for specific permissions when you install an app. Read these and think about what the app is asking for permission to access. Ask yourself, “Is this app requesting access to only the data it needs to function?” If the answer is no, don’t download it. Learn where to go on your particular phone to determine what you will allow the app to access, and if you are at all suspicious do more research on the app before you download.
Mobile apps generally do not provide ad networks with the ability to set a cookie to track users. Instead, ad networks may use your smartphone's device identifier. To opt-out of targeting that relies on your smartphone's device identifier, you must provide the ad networks with your identifier to be kept on their “do not target” list.
Using e-mail
When you correspond through e-mail you are no doubt aware that you are giving information to the recipient. You might also be giving information to any number of people, including your employer, the government, your e-mail provider, and anybody that the recipient passes your message to. An unencrypted e-mail message can potentially be seen by anyone while in transit. If sent from an employer-owned device, it could be read by your employer.
If you use a webmail service such as Gmail or Yahoo, your e-mails could be scanned by the webmail provider, both to detect spam and to deliver advertising content. Gmail scans incoming e-mails and places relevant advertisements next to the e-mail. Yahoo Mail says that it performs "automated content scanning and analyzing of your communications content.” If your recipient uses Gmail, Google will scan your message and provide advertisements to the recipient even if you, the sender, do not use Gmail. Microsoft's webmail service Outlook.com states that it does not use the content of customers’ emails to target advertising.
The federal Electronic Communications Privacy Act (ECPA) makes it unlawful under certain circumstances for someone to read or disclose the contents of an electronic communication (18 USC § 2511).
ECPA is a complicated law and contains many exceptions. ECPA makes a distinction between messages in transit and those stored on computers. Stored messages are generally given less protection than those intercepted during transmission. Here are some exceptions to the ECPA:
The ISP may view private e-mail if it suspects the sender is attempting to damage the system or harm another user. However, random monitoring of e-mail is generally prohibited.
The ISP may legally view and disclose private e-mail if either the sender or the recipient of the message consents to the inspection or disclosure. Many ISPs require a consent agreement from new members when signing up for the service.
If the e-mail system is owned by an employer, the employer may inspect the contents of employee e-mail on the system. Therefore, any e-mail sent from a business location is probably not private. Several court cases have determined that employers have a right to monitor e-mail messages of their employees.
Services may be required to disclose personal information in response to a court order or subpoena. A subpoena may be obtained by law enforcement or as part of a civil lawsuit. The government can only get basic subscriber information with a subpoena. The government needs a search warrant to get further records. A subpoena as part of a private civil lawsuit may disclose more personal information.
The USA PATRIOT Act, passed by Congress after the terrorist attacks of September 11, 2001, and amended in 2006, makes it easier for the government to access records about online activity. In an effort to increase the speed in which records are acquired, the Act eliminates much of the oversight provided by other branches of the government. And it expands the types of records that can be sought without a court order.
In U.S. v Warshak (decided December 14, 2010), the Sixth Circuit Court of Appeals ruled that although an ISP has access to private e-mail, the government must obtain a search warrant before seizing such e-mail. The issue that the court dealt with in this case was the expectation of privacy that is afforded to e-mail hosted on a remote server. The court stated:
Given the fundamental similarities between email and traditional forms of communication [like postal mail and telephone calls], it would defy common sense to afford emails lesser Fourth Amendment protection.... It follows that email requires strong protection under the Fourth Amendment; otherwise the Fourth Amendment would prove an ineffective guardian of private communication, an essential purpose it has long been recognized to serve....
The decision is particularly important to the extent that it could spur Congress to update the federal statutes that, in some cases, do allow warrantless searches of e-mail.
For an in-depth discussion of ECPA, see the U.S. Department of Justice's Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations.
Instant messaging (IM)
IM conversations have a feel of casualness about them, which can lead some to let down their guard. Although seemingly informal, IM conversations can be archived, stored, and recorded on your computer as easily as e-mails.
The rule that "delete does not mean delete" applies to IM conversations as well as e-mail. Virtually all IM programs have the ability to archive and the IM program may automatically turn this feature on. Archiving IM conversations simply means saving the conversation in a text file just like you would any other file, such as a Word document. Some of these IM programs automatically save your chats unless you select otherwise.
It is important to realize that your conversation can be saved onto a computer even if only one person agrees. When you are talking to a person over IM, they do not need to tell you if they are recording and saving your conversation. If you want to make sure that your Google Talk conversation partner is not saving your chat on their computer you can select the feature called "off the record."
Similar to e-mail, workplace IM can be monitored by your employer.
IM has become a new target for spammers. “Spim,” usually involves get-rich-quick scams or pornography. Often the spimmer will include a link in the message, which could cause spyware to be installed on your computer if you click on the link. You can reduce your exposure to spim by adjusting your IM account to only allow messages from specified people.
Social networking
Online social networks are websites that allow users to build connections and relationships to other Internet users. Social networking can be used to keep in touch with friends, make new contacts and find people with similar interests and ideas.
Secondary use of information posted to social networks is a major problem. Although you may post a picture or comment online that is intended to be seen only by friends, it can be difficult to control re-use of that information by others. By adjusting the privacy settings on your social networking sites to the highest privacy level, you may be able to limit the amount of information leaked for secondary uses.
Many people besides friends and acquaintances are interested in the information people post on social networks. Identity thieves, scam artists, debt collectors, stalkers, and corporations looking for a market advantage are using social networks to gather information about consumers. Companies that operate social networks are themselves collecting a variety of data about their users, both to personalize the services for the users and to sell to advertisers.
Our Fact Sheet 35- Social Networking Privacy: How to be Safe, Secure and Social provides information about the advantages and disadvantages of using social networks, what kind of information may be safe to post and how to protect it, as well as who is able to access different types of information posted to these networks.
Maintaining a personal website
Many individuals obtain their own website address or URL (Uniform Resource Locator), called domain names. Domain registrations are public information unless you pay an additional fee to make your domain name private. (Search on private domain registration to find providers of this service).
If you set up your own website, you will need to provide an address where the registration service can reach you. You may be able to use a P.O. Box which would reduce the amount of information someone sees if they look up your domain name. In addition you may want to choose an e-mail account that does not reveal unnecessary information, such as where you attend school. An e-mail address from a free webmail service might be preferable to one with an .edu domain for example.
Blogging
Web logs, or “blogs,” are journals (or newsletters) that are frequently updated and intended for general public consumption. Depending on the service you use to post your blog, your private information may be available. Generally blog services will allow you at least some control over how much personal information you make public. Read the service agreement carefully to determine exactly what is required and what will be revealed.
Most blogs also allow comments by readers. Although some allow you to comment anonymously, others require registration and at least an e-mail address. Consider carefully how much information you’re willing to give and if you want your personal information linked to your comments or posts forever. Most blogs will record your IP address, which may enable them to determine your identity. In addition, if the blog has placed a cookie on your device, it may be able to associate your post with other comments that you have made.
In addition to information you may be providing through signing up for the blog, the contents of your blog are published for everyone, including employers, to see. There have been reports of employers firing employees for blogging. The content does not even necessarily have to be about the employer.
Online Privacy Tip: Determine who you want your audience to be. If you are writing only for friends and family consider making your blog accessible only by password. Using a pseudonym can help hide your identity, but if your blog becomes popular people may try to uncover your true identity. To limit this possibility you can keep Google and other search engines from listing your blog. To find out how and for other tips, read the Electronic Frontier Foundation’s (EFF) tips on safe blogging, available at www.eff.org/Privacy/Anonymity/blog-anonymously.php EFF has also written a free legal guide for bloggers, at www.eff.org/bloggers/lg..
Using online banking services
Being able to check your balances, transfer money between accounts, pay your bills, and track your checks online is a great convenience. But online banking requires you to transmit a lot of sensitive information over the Internet. While it makes sense for the bank to have that information, you don’t want anyone else to get it.
Most banks and other financial institutions use a system of passwords and encryption to safeguard your information. Be sure to use a different password for online banking (and for any other online financial accounts) than you use on any other website. Make sure that your password is random and cannot be easily guessed. See PRC's Alert "10 Rules for Creating a Hacker-Resistant Password". Unfortunately, experts warn that the security of passwords has never been weaker. New hardware and techniques have contributed to a sharp rise in password cracking by hackers.
Make sure that any device used for managing your financial account has an up-to-date operating system, firewall, and software (Including antivirus and anti-malware programs). Otherwise, your login credentials could be stolen.
Never login to your financial accounts from a public computer. Keyloggers or other malware could steal your login credentials. Likewise, it's not a good idea to login from a public Wi-Fi hotspot, since your communications might be intercepted.
When managing your financial accounts online, be careful that you are giving your information to the proper institution. Many fraudulent sites have been set up to look like the real thing. Beware of “phishing” e-mails, which typically ask you to update your account information, but are really looking to steal your personal information. Never respond to unsolicited requests for passwords or account numbers, no matter how realistic they look.
Consumer (but not business) bank accounts generally are protected by the Electronic Funds Transfer Act, which limits consumer losses for online theft to $50, as long as the consumer reports the loss within 60 days after the fraudulent transfer appears on the statement.
Each bank has its own privacy policy. It’s up to you to determine if that policy meets your needs. Some banks will share some of your information with others for marketing purposes unless you specifically notify them not to. Generally this is referred to as an “opt out” option.
2: How Do Others Get Information about Me Online?
Marketing
The Internet can be useful to businesses for marketing purposes. Through the Internet, businesses can sell and communicate with customers. The Internet also allows businesses to identify and learn about their customer base.
Additionally, many customers expect that a company they interact with in the physical world will also have an online presence. What consumers may not be aware of is how all of these purposes interact. When a business meets your need of having a website with store hours and directions, it may also meets its need of determining how many customers may want to go to a particular store branch.
Web bugs. Many websites use Web bugs to track who is viewing their pages. A Web bug (also known as a tracking bug, pixel tag, Web beacon, or clear gif) is a graphic in a website or a graphic-enabled e-mail message. The Web bug can confirm when the message or page is viewed and record the IP address of the viewer.
An example you might be familiar with is an electronic greeting card. Hallmark and other companies allow you to request that you be notified when the recipient views your card. The sites likely employ Web bugs to tell them when the recipient viewed the card.
Unfortunately, users have little control over the data collection by Web bugs on most sites. Furthermore, Web bugs placed by third-parties are not governed by a website's privacy policy.
Online Privacy Tip: You can defeat e-mail Web bugs by reading your e-mail while offline, an option on most e-mail programs. Some e-mail systems avoid Web bugs by blocking images that have URLs embedded in them. You might have seen the message “To protect your privacy, portions of this e-mail have not been downloaded.” This message refers to Web bugs. You can choose to allow these images to be downloaded, but they likely contain Web bugs.
Direct marketing. Consumers may notice that online newspapers and other businesses have boxes asking you if the site can save your account information for future transactions. Whether it asks you for permission to save your information or not, you can bet that your information is being stored and used by the marketing department.
Websites have increased their use of direct marketing. Direct marketing is a sales pitch targeted to a person based on prior consumer choices. For example, Amazon may recommend books that are similar to others you have purchased.
Use of your information for marketing is not limited to companies you do business with. Many companies sell or share your information to others. If you sign up for a free magazine subscription, the company may share your information with affiliates. This is similar to what happens with traditional junk mail, but since you have entered the information yourself into an electronic system, sharing with other businesses can be done rapidly and cheaply.
To avoid spam laws, most sites ask your permission to send you future information and offers. However, this permission is often presumed and the permission box already checked. To avoid the use of your information this way, always uncheck boxes that state that you agree to receive periodic offers and information.
Behavioral marketing or targeting refers to the practice of collecting and compiling a record of individuals' online activities, interests, preferences, and/or communications over time. Companies engaged in behavioral targeting routinely monitor individuals, the searches they make, the pages they visit, the content they view, their interactions on social networking sites, and the products and services they purchase. Further, when consumers are using mobile devices, even their physical location may be tracked. This data may be compiled, analyzed, and combined with information from offline sources to create even more detailed profiles.
Marketers can then use this information to serve advertisements to a consumer based on his or her behavioral record. Ads may be displayed based upon an individual's web-browsing behavior, such as the pages they have visited or the searches they have made. Advertisers believe that this may help them deliver their online advertisements to the users who are most likely to be influenced by them.
Behavioral information can be used on its own or in conjunction with other forms of targeting based on factors like geography or demographics. Marketers have developed an array of sophisticated data collection and profiling tools which monitor and analyze our online activity. Over 1300 tracking companies utilize more than 2800 tracking scripts to deliver advertising that is targeted consumers' online activity.
Typically, behavioral targeting is accomplished through use of a cookie, flash cookie, device fingerprinting, or other technologies that identify a user or device. Whatever the technology used, it attempts to personalize ads based upon the user's online history and possibly other external data.
Behavioral marketing is much more sophisticated than so-called “contextual marketing” by which marketers target users with ads that are served based solely upon on a given web page's content. In February 2009, Federal Trade Commission (FTC) issued a report, “Self-Regulatory Principles for Online Behavioral Advertising.” The report examined behavioral marketing and proposed principles to govern industry self-regulatory efforts.
In March 2012, the FTC issued a report setting forth best practices for businesses to protect the privacy of American consumers and give them greater control over the collection and use of their personal data. In the report, Protecting Consumer Privacy in an Era of Rapid Change: Recommendations For Businesses and Policymakers, the FTC also recommended that Congress consider enacting general privacy legislation, data security and breach notification legislation, and data broker legislation.
The March 2012 FTC report calls on companies handling consumer data to implement recommendations for protecting privacy, including:
Privacy by Design - companies should build in consumers' privacy protections at every stage in developing their products. These include reasonable security for consumer data, limited collection and retention of such data, and reasonable procedures to promote data accuracy
Simplified Choice for Businesses and Consumers - companies should give consumers the option to decide what information is shared about them, and with whom. This should include a Do-Not-Track mechanism that would provide a simple, easy way for consumers to control the tracking of their online activities
Greater Transparency - companies should disclose details about their collection and use of consumers' information, and provide consumers access to the data collected about them.
A May 2014 Consumer Reports survey found that by a ratio of more than 6 to 1, online consumers are unwilling to trade their personal data, even anonymously, for the sake of being served ads that online advertisers think are more relevant to them.
Location tracking
Any website or app can determine the approximate location of your computer or device by using one of several technologies. If you are using a computer, your IP address can identify your approximate location. Most IP addresses can identify you by your city or metropolitan area. Some can identify a more specific location.
You can block your IP address by utilizing a service such as Tor (https://www.torproject.org/) which effectively blocks this information. Another alternative is to use a Virtual Private Network (VPN). A VPN replaces your IP address with one from the VPN provider. A VPN subscriber can obtain an IP address from any gateway city the VPN service provides.
If your are using a wireless connection, Wi-Fi triangulation can determine your location by surveying nearby wireless networks. Similarly, GPS triangulation can determine your location from a network of satellites. GPS triangulation is more accurate than Wi-Fi triangulation. Finally, cell phone tower identification can determine the location of a smartphone.
Your location information might be used for a useful purpose, for example, providing accurate travel directions. However, it may also be stored and combined with other information about you and used for behavioral marketing and other purposes.
Location information can pose a significant privacy risk, particularly when it is stored or combined with other information about you. It can reveal your whereabouts at any given time, including your presence at sensitive locations. It can be dangerous for individuals who are stalking or domestic violence victims.
Most major browsers and mobile operating systems offer a mechanism for disabling location tracking.
Employee monitoring
Individuals who access the Internet from work should know that employers are increasingly monitoring the Internet sites that employees visit. Be sure to inquire about your employer's online privacy policy. If there is none, recommend that such a policy be developed. If you are unsure of what the policy is or if there is no policy, assume everything you do on your work computer is being monitored. In most states there is no law requiring your employer to tell you if it monitors e-mail or Internet usage. In Delaware and Connecticut, an employer must advise employees in a “conspicuous manner” that monitoring is occurring. In Connecticut there is a limited exception for investigations of illegal activity.
Government surveillance
The government may want your personal information for law enforcement purposes as well as for foreign intelligence investigations.
Law enforcement generally can access your electronic communications and records in two ways: through wiretapping or through subpoena.
The Electronic Communications Privacy Act of 1986 (ECPA) provides some protection against government access to email and other online activities. ECPA is a difficult law to understand and apply, because the law relies upon outdated practices and technology. ECPA does reflect a legislative recognition that some Internet activities deserve protection. The difficulty is figuring out to which Internet activities these protections apply. Case law continues to address the proper application of ECPA.
Law enforcement can also use a pen/trap tap to get the following information from your ISP:
e-mail header information other than the subject line,
your IP address,
the IP address of computers you communicate with, and
possibly a list of all sites you visit.
A pen/trap is defined in the Patriot Act as “a device or process which records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, provided, however, that such information shall not include the contents of any communication.” In order to use a pen/trap wiretap, law enforcement only needs to establish that such information is relevant to an ongoing investigation. This is a lower standard than the probable cause standard required for a search warrant.
The Electronic Frontier Foundation examined the policies of major Internet companies (including email providers, ISPs, cloud storage providers, and social networking sites) to assess how well they publicly commit to standing with users when the government seeks access to user data. Read their report When the Government Comes Knocking, Who Has Your Back? for details.
Under the Foreign Intelligence Surveillance Act of 1978 (FISA) the government is supposed to get a search warrant from a secret court for this type of surveillance. The government is required to show that the target of the surveillance is a foreign power or the agent of a foreign power.
Court Records
When you file a lawsuit for divorce or are a party to a civil lawsuit or criminal case, court records are accessible to the public. As the government increasingly moves to eliminate paper records in favor of electronic records, your personal information could end up on the Internet.
There are two ways public records are accessible electronically. Some jurisdictions post them on their government websites, thereby providing free or low-cost access to records. Government agencies and courts also sell their public files to commercial data compilers and information brokers. They in turn make them available either online or through special network hookups. The following are examples of public records containing personal information that may be available (availabilty may vary from state to state):
Property tax assessor files. Typical records contain name of owner, description of property, and the assessed value for taxation purposes. Some systems even provide blueprints and photographs of the property.
Motor vehicle records. Registration, licensing, and driver history information
Registered voter files
Professional and business licenses
Court files
Case indexes
Tax liens and judgments
Bankruptcy files
Criminal arrest and conviction records, and warrants
Civil court recordings
Registered sex offenders
Shopping online
Use a credit card for online financial transactions. Debit cards do not provide as much protection from fraud as credit cards. If a criminal uses your debit card, your entire checking account can be wiped out. With a credit card you are able to see the charges before you pay for them, which gives you an opportunity to dispute the charges.
When you provide your credit card account number to a shopping site, you want to be sure that the transmission is secure. Look for an unbroken padlock on the address bar of your screen. You can right click on the padlock to make sure the security certificate is up-to-date. If it is not, you should not order from that site. Also make sure the Web address has the letter 's' after http in the address bar. The ‘s’ indicates that your information will be encrypted during transmission.
Illegal activity and scams
Criminals can capture your information online in various ways, but one distinguishing factor is that in some cases you give them the information yourself. And sometimes criminals use technology to steal your personal information without your knowledge. It is important to recognize that theft occurs both ways.
Increasingly these activities may lead to financial losses. Losing money from computer crime can be especially devastating because often it is very difficult to get the money back. Because of the remote nature of the Internet, computer crime presents at least three challenges: (1) locating the criminal, (2) finding a court having jurisdiction, and (3) collecting the money. In fact many cyber criminals operate in other countries. Although law enforcement is becoming increasingly aware of computer crime, you should largely rely on yourself for protection.
Many of these scams are complicated, and criminals are always likely to come up with new tricks to stay ahead of the law. If you are buying over the Internet or setting up online accounts, be aware that these risks are out there.
Online auctions. Online auction fraud takes many forms. Some forms of fraud are difficult to avoid, while others can be avoided by taking smart precautions. Fraud can occur when the seller doesn’t ship what was bought or the product is not as good as promised. This type of fraud can be frustrating and hard to avoid. Buyers should pay close attention to fraud alerts posted by the online auction companies. If you pay with a credit card, your credit card company may be able to reimburse you for the fraud.
Never use a wire transfer to pay for something from an online auction site. The FTC issued an alert warning about the dangers of wire transfers.
Nigerian 419 letters. Nigerian 419 letters, also called advance-fee scams, are sent via e-mail to millions of people. The letters typically relay a story of a foreign person who has inherited a windfall of money, but needs help in getting the money out of the country. The sender offers the recipient a share of the money for help in transferring the money. The assistance required is usually to front money to pay for "taxes," "attorneys costs," "bribes," or "advance fees.” Although this scam sounds far-fetched the FBI reports that the average financial loss from these scams is $3,000.
Malicious Links
It is very easy to get duped into clicking on a malicious link. If you click on a malicious link, you will most likely be taken to a site that tricks you into providing personal information that can then be used to steal your money, or even worse, your identity. Clicking on a dangerous link could also cause malware to automatically download onto your computer.
Malicious links may look like they were sent by someone you trust, such as:
A friend or someone who you know.
A legitimate-looking company selling a product or service.
A bank or other business that you have an existing account with.
Most people think that malicious links arrive by email. But, criminals are finding even sneakier ways to trick you into clicking on a dangerous link. You could receive the malicious link in an instant message, a text message, or on a social networking site like Facebook or Twitter.
Malicious links are hard to spot. They often:
Are ever-so-slightly misspelled versions of well-known URLs.
Use popular URL shortener sites to hide the real URL.
Use simple HTML formatting to hide the real URL. This is the most common method for emailed dangerous links. You think you’re clicking on a trustworthy link, but you are redirected to a dangerous link.
To protect yourself from malicious links, consider the following tips:
Do not click on a link that appears to be randomly sent by someone you know, especially if there is no explanation for why the link was sent, or if the explanation is out of character for the sender (i.e. horribly misspelled or talking about what a great deal they discovered).
Do not click on a link that was sent to you by a business you don’t know that is advertising a great deal. Instead, perform an online search for the business, make sure it’s legitimate, and go directly to the business’ website to find the deal yourself.
Do not click on a link that was sent to you by a business you have an existing account with. Either go to the business’ site yourself, or call up the business and confirm the legitimacy of the link.
Note that some businesses may require that you verify your email address as part of a registration process, which requires you to click on a link contained in an email. Typically, the link will be emailed to you immediately after you register online with the business. It’s a good idea to check your email right after you register with a business.
3: What is Cloud Computing?
It is difficult to come up with a precise definition of cloud computing. In general terms, it’s the idea that your computer’s or device's applications run somewhere on the “cloud”, that is to say, on someone else’s server accessed via the Internet. Instead of running program applications or storing data on your own device, these functions are performed at remote servers which are connected to your device through the Internet.
In telecommunications, a “cloud” is the unpredictable part of any network through which data passes between two end points. In cloud computing the term is used to refer generally to any computer, network or system through which personal information is transmitted, processed and stored, and over which individuals have little direct knowledge, involvement, or control.
With more reliable, affordable broadband access, the Internet no longer functions solely as a communications network. It has become a platform for computing. Rather than running software on your own device or server, Internet users reach to the “cloud” to combine software applications, data storage, and massive computing power.
It’s interesting to note that cloud computing is really nothing new. It's the modern version of the 1960’s-era computer timesharing model. That model was based upon the high cost of computers at that time. With computer and data storage prices plummeting, it seems odd that there would be a return to that sort of model.
Who provides cloud computing services and what services do they provide?
It’s a bit easier to understand the concept of cloud computing by providing examples. Google operates several well-known cloud computing services. It offers its users applications such as e-mail, word processing, spreadsheets and storage, and hosts them "in the cloud"--in other words, on its own servers, not yours. So, for example, you can type a document without maintaining any word processing software on your computer or device. You can use Google’s software “in the cloud”. All you need is an Internet capable device.
Cloud computing services also may allow you to synchronize files between your Internet accessible devices, so that you can see a file from your home or office computer on a mobile device. Some of best known consumer-oriented cloud services include:
Google Drive
Dropbox
Microsoft Skydrive
Apple iCloud
Evernote
Other examples of cloud computing include:
Web-based email services such as Yahoo Mail
Web-based office suites such as Google Drive
Photo storing services such as Google’s Picassa
Spreadsheet applications such as Zoho
Online medical records storage such as Microsoft’s HealthVault
Social networking sites such as Facebook
Applications associated with social networking sites such as Farmville
Tax preparation services such as H & R Block
Accounting and payroll services such as Intuit
The above services are ready to use “out of the box”. In addition, many cloud computing companies offer customized cloud computing services tailored to the specific needs of businesses and other organizations.
Some of the major players in cloud computing include:
Google
Yahoo
Microsoft
Red Hat
Amazon
Salesforce
Rackspace
Intuit
Apple
Spider Oak
What are the risks of cloud computing?
When users store their data with programs hosted on someone else's hardware, they lose a degree of control over their sensitive information. The responsibility for protecting that information from hackers, internal breaches, and subpoenas then falls into the hands of the hosting company rather than the individual user. This can have many possible adverse consequences for users.
A growing number of cloud computing providers have experienced serious security breaches, potentially jeopardizing users' data stored on their servers. For example, in March 2013, the cloud computing provider Evernote announced a hacking incident that exposed user names, passwords, and email addresses. The breach impacted 50 million users.
The privacy policy and terms of service of the hosting company should always be read carefully. While generally lengthy and sometimes difficult to understand, they will provide a good outline of what the host can and cannot do with your information. However, it is important to realize that most privacy policies and terms of service can and do change. In fact, you may not have an opportunity to remove your information from the hosting site before such a change.
The location of the host’s operations can significantly impact a user’s rights under the law. The location of the records might not be disclosed in the terms of service or might be changed without notice. This could have substantial legal consequences.
Government investigators or civil litigants trying to subpoena information could approach the hosting company without informing the data's owners. The hosting company generally does not have the same motivation as the user to defend against disclosure of the information.
Some companies could even willingly share sensitive data with marketing firms. So there is a privacy risk in putting your data in someone else's hands. Obviously, the safest approach is to maintain your data under your own control.
There is also a risk that the host might shut down its operations, declare bankruptcy, or sell the business to another provider. What might happen to your data if that were to happen?
Unexpected service disruptions can prevent cloud computer users from accessing their data or performing vital business functions. For example, in June 2010, Intuit suffered a massive site disruption interrupting its Quicken and QuickBooks services. Customers were unable to access Quicken sites for an extended period of time.
One of the problems with cloud computing is that technology is frequently light years ahead of the law. There are many questions that need to be answered. Does the user or the hosting company own the data? Can the host deny a user access to their own data? And, most importantly from a privacy standpoint, how does the host protect the user’s data?
So, before you utilize any cloud computing services, be aware of the potential risks. And make sure that you carefully read the privacy policy and terms of service of the hosting company to become aware of your rights.
Who is legally responsible for data breaches in the cloud?
If, through no fault of your own, information stored in the cloud were breached, who would bear responsibility for the consequences? The standard contract from the major cloud providers puts the responsibility for any data loss on the person or business placing the information in the cloud. Of course, it might be possible for a large business to negotiate the terms of the standard contract. As a consumer, you probably have no control over whether an organization you do business with places your personal information in the cloud.