Who's Watching You on the Web?

Targeted Pitches

These profiles influence the advertising--and in some cases the content--we see online. Mike Griffiths, chief technology officer for MatchLogic, a DoubleClick competitor, explains it this way: "The browser finds the MatchLogic cookie and sends it along with a request for a banner ad. We match that cookie with what's in our system and--depending on demographic and geographic information--we select and return the right banner to the user."

Advertisers love online profiling, since it enables them to direct pitches at the people likeliest to be interested in their products and services. No doubt many consumers agree--if Web banner ads are a fact of life, why not make them as relevant to my wants and needs as possible?

It's a compelling argument, but it also raises some extremely important questions. Don't I have the right to know who's compiling information about me? How do I know these profiles won't be used for purposes other than advertising and marketing? And what happens when a profiling company makes the connection between Browser X and Roberta Furger? Have I lost all hope of online anonymity?

Online profiling companies are quick to emphasize that cookies alone don't provide them with personally identifiable information, such as my name and e-mail address. Information about my online activities (and perhaps my gender, marital status, key interests, and so forth) is associated with a particular copy of Internet Explorer, Netscape Navigator, or another browser installed on my PC, not with the name Roberta Furger.

If you find this distinction trivial, you're not alone. Many privacy advocates argue that whether online profiling companies have our names is almost irrelevant. "Just because information isn't personally identifiable doesn't mean it isn't about you," says Deirdre Mulligan, staff counsel at the Center for Democracy and Technology in Washington, D.C. "It's tied to your identity; it's just not tied to your name."

In fact, if an Internet advertising company wants to tie your profile with your name, it can do so fairly easily. At DoubleClick's Netdeals.com, for example, consumers are enticed to register to win a cruise or $1 million just by entering their name, age, and street and e-mail addresses. At the bottom of the entry form, a seemingly innocuous question asks users if they would like to receive "valuable offers" by e-mail. Consumers who answer "yes" effectively consent to adding their name and e-mail address to the sponsor's direct-marketing database. Surprise! (See Bugs and Fixes for news of a browser loophole companies could use to do the same thing even more subtly.)

Once it has a consumer's name and e-mail address, DoubleClick can associate these with anonymous profiles it has generated through cookies--and it has publicly acknowledged its intention to do so. Through sites like NetDeals and the acquisition of companies like market researcher Abacus Direct, which maintains sales information for some 1500 merchants, DoubleClick is building a huge database of consumer interests, buying patterns, income levels, and more. It plans to rent this database to client companies, allowing them to broadcast advertising e-mails to recipients whose surfing habits fit a desired profile.