Washington, DC - So you’ve taken every precaution against a zombie attack. You’ve sealed the windows, stockpiled kerosene, and keep a machete or two handy. But despite your best efforts, The Undead still manage to reanimate themselves and stalk their unsuspecting prey. We hate when that happens. But this time it’s not an episode of The Walking Dead. According to an FTC complaint, it’s an analogy to how digital advertising company Turn, Inc.’s “zombie cookie” continued to track consumers, even after people took affirmative steps to protect their privacy.
California-based Turn describes itself as the “largest independent company in the advertising technology sector” with half of the global online advertising inventory flowing through its platform. Turn claims to have “rich profile data on more than 99 percent of North American consumers.” The company uses all that data to help its clients engage in targeted advertising by serving up ads based on an individual user’s interests.
How does Turn help clients know who’s shopping for a luxury car vs. who’s buying baby blankets? They use web beacons (embedded code on webpages that tells the browser to connect to third-party services like Turn) and cookies (unique text files stored on a consumer’s browser). But consumers spend a lot of time on mobile apps that can’t set or access cookies. Turn has that covered, too, by using device advertising identifiers like Apple iOS’s Identifier for Advertisers and Google’s Advertising ID.
Of course, many people take advantage of browser settings that let them delete cookies, limit them, or prevent them from being set altogether. For apps, they can use Apple and Android settings that perform similar functions. That’s how consumers send a loud-and-clear message that they want to restrict how they’re tracked or stop being tracked altogether.
Turn’s privacy policy reassured consumers that their personal choices would be honored. As the policy stated, “Most internet browsers automatically accept cookies. You can instruct your browser, by editing in options, to stop accepting cookies or prompt you before accepting a cookie from the websites you visit.”
According to the complaint, Turn’s privacy policy page also led consumers to believe they could use the company’s opt-out mechanism to block tailored anonymous ads on websites and apps. Although Turn tried to persuade consumers that “opting out may hurt the sites and apps you love,” the company provided a link consumers could use “if you’d like to opt out of tailored advertising from Turn.”
But here’s the thing about zombies. Seal the windows all you want, but there’s no stopping them. In that way, they’re sort of like the methods Turn used to circumvent consumers’ decision not to be tracked.
Beginning in 2013, Turn participated in a Verizon Wireless program that let companies like Turn access certain demographic information about Verizon Wireless users. According to the complaint, Verizon attached unique identifiers – called tracking headers – to all unencrypted mobile internet traffic for more than 100 million consumers on its network. (In case you’re wondering, there was nothing consumers could do prevent the transmission of the header.)
As a result, even if a consumer deleted cookies or reset the device advertising identifier, Turn could still use the unique tracking header assigned to that person’s device to reassociate the consumer with his or her previous history. In fact, Turn recreated cookies that consumers had previously deleted. Put another way, even when people used the tech equivalent of kerosene and machetes, Turn created zombies out of consumers’ deleted cookies.
Count One of the complaint charges that Turn falsely claimed that blocking or limiting cookies would restrict the company’s ability to track consumers. In fact, in many instances, even when Verizon Wireless users blocked or limited cookies, Turn continued to track them through the header.
What about Turn’s opt-out mechanism? According to Count Two, Turn led consumers to believe they could use the link to opt out of Turn’s tailored ads on mobile apps. However, the mechanism applied only to mobile browsers and not to mobile apps. Thus, the FTC says Turn’s claim was false or misleading.
To settle the case, Turn has agreed that it won’t make misrepresentations about the privacy of broad categories of covered information. In addition, the proposed order requires Turn to include a clear and conspicuous “Consumer Opt Out of Targeted Advertising” hyperlink on its homepage. That link must take consumers to a clear explanation of the information Turn collects for targeted ads – and an effective opt-out mechanism. Turn also has to honor any signal it receives indicating that a consumer has used mobile operating signal controls to opt out of targeted advertising or limit it.
You can file an online comment about the proposed settlement by January 19, 2017.
What’s the message for others in the industry?
- Not to mix our horror metaphors, but when it comes to information practices, companies should take a transparency lesson from H.G. Wells’ The Invisible Man. Live up to your express and implied claims about consumer privacy.
- Furthermore, much has been made of the choices that tech-savvy consumers can make to protect themselves from tracking. But if companies use misleading tactics to circumvent users’ preferences, those otherwise useful tools can be rendered about as effective as a “Keep Out” sign during a zombie apocalypse. It’s in everyone’s interest that consumers’ choices are respected.