• PC World
• » Security

Caught With a Hand in the Cookie Jar

If you surf the Web, you likely have plenty of cookies on your hard drive. Nearly all commercial Web sites (including PC World.com) set cookies, as do noncommercial sites that carry advertising. Probably the only sites that won't prompt your browser for cookies are personal home pages that don't carry ads and originate on local or regional Internet service provider servers. Cookies are often fewer than 100 bytes, so they won't affect your browsing speed. But because browsers are set to accept cookies by default, you may not know one has been placed; if you are concerned about your privacy, you may want to avoid sites that use them.

Cookies perform myriad functions for both Web surfers and Web sites. For the user, they make the Web more convenient. Sites that require registration, such as the New York Times' site, place a cookie on your hard drive with your user name and password; the cookie logs you in each time you visit. Personalized Web pages, such as My Yahoo, use cookies to customize the page with news, stock quotes, and other information that you indicate you want to see. Online stores use cookies to record purchases in electronic shopping carts before you leave the site. Those sites may also use cookies to help with order forms, so that the next time you buy something, the shipping and billing information gets filled in automatically.

For businesses, cookies can play a role similar to that of a salesperson. Some shopping sites, such as Amazon.com, tie your purchase history to your cookie. These sites can make on-the-fly recommendations for new books or music based on your tastes, thanks to a database they keep that includes your unique ID and purchase history. The vast majority of Web sites (as well as advertisers) also set cookies to track how many individual users visit the site. The resulting numbers are now seen as a measure of how busy a site is.

Some consumer groups claim that cookies have a dark side: reduced user privacy. Cookies track where you've been and what you've looked at on the Web. A visit to a single site can result in several cookies, and not all of the cookies report back directly to the site you are visiting: Some send the information to the site's advertisers. Cookie Central, a clearinghouse for cookie information, states that some Web advertising companies, including FocaLink and DoubleClick, surreptitiously set cookies that report back directly to them and keep track of your cookies with a database. By cross-referencing various cookies they have on you, they can profile your interests, spending habits, and lifestyle to target-market products to you. And as Net advertising companies grow and buy out related firms--as DoubleClick recently did with direct-marketing agency Abacus Direct--more people are growing concerned about how information gathered through cookies will be used. Using data Abacus may have on you, such as your name and address, DoubleClick could use its cookies, which contain a record of your surfing habits, to create a profile of your activities.

You do have a say in this: Browsers include features to block cookies. Both Communicator and IE let you disable cookies completely or will prompt you when a cookie is being set. Communicator includes an option to accept only cookies that get sent back to the originating server. But because some sites contain so many cookies, it's often not worth being notified: You could spend a lot of time approving or denying cookie requests.

Instead of using your browser to block them, you can run utilities that remove cookies from your hard drive, such as IEClean or NSClean, Cookie Crusher, and Cookie Cutter. For even more protection, sites such as The Rewebber and tools such as Zero Knowledge's Freedom mask your identity while surfing, so even if a site places cookies on your hard drive, it has no idea who you are.

Additional Resources:

• Cookie Central's Cookie FAQ
  
  
• RFC 2109: Technical notes about cookies
  
  
• Microsoft's Information About Cookies
  
  
• Netscape's Cookie Page
  
  

Andrew Brandt is an associate editor for PC World.

• See more like this:
• doubleclick