Report: Internet privacy tools ineffective for most people

Research conducted at Carnegie Mellon University has backed up the Federal Trade Commission's call for a “Do Not Track” registry for Internet users.

The study found that Internet users who want to protect their privacy by preventing advertisers from tracking their online behavior will have difficulty doing so with commonly available "opt-out" tools. It also described the current approach for advertising industry self-regulation as "fundamentally flawed."

"The status quo clearly is insufficient to empower people to protect their privacy from [online behavioral advertising] companies," said Lorrie Cranor, director of the CyLab Usable Privacy and Security Laboratory (CUPS). "A lot of effort is being put into creating these tools to help consumers, but it will all be wasted — and people will be left vulnerable — unless a greater emphasis is placed on usability."

Internet marketers and advertising agencies use a small data file known as a cookie to track the web history of Internet users and deliver relevant ads. The use of cookies to collect this type of data has become ubiquitous on the web, but the files are almost always downloaded without the users knowledge or consent.

Although it is possible to prevent an Internet browser from accepting cookies and nothing prevents the files from simply being deleted by the user, privacy advocates say the process is too technical and time-consuming for many users.

The researchers found that privacy options in the popular browsers Mozilla Firefox 5 and Internet Explorer 9 were hard for the average Internet user to configure properly. Online tools and plug-ins designed to opt out of tracking fared no better.

"All nine of the tools we tested have serious usability flaws," Cranor explained. "We found that most people were confused by the instructions and had trouble installing or configuring the tools correctly. Often, the settings they chose failed to protect their privacy as much as they expected, or to do anything at all."

The Federal Trade Commission proposed the creation of a “Do Not Track” registry for Internet users in December. Chairman Jon Leibowitz said the proposed registry would be a “universally easy-to-use mechanism for consumers that would run through the FTC or could be run through some sort of private entity.”

Rep. Jackie Speier (D-CA) introduced HR 654, The Do Not Track Me Online Act of 2011, the following month.

“Consumers have a right to determine what if any of their information is shared with big corporations and the federal government must have the authority and tools to enforce reasonable protections,” she said at the time.

Photo credit: Joi Ito