David Kotz

Dartmouth College

kotz AT dartmouth.edu

Revision of January 3, 1999

Abstract. The World-Wide Web is increasingly used for commerce and access to personal information stored in databases. Although the Web is "just another medium" for information exchange, the fact that all the information is stored in computers, and all of the activity happens in computers and computer networks, makes it easier (cheaper) than every to track users’ activities. By recording and analyzing user’s activities in the Web, activities that may seem to be quite private to many users, it is more likely than ever before that a person’s privacy may be threatened. In this paper I examine some of the technology in the Web, and how it affects the privacy of Web users. I also briefly summarize some of the efforts to regulate privacy on the Internet.

As the World-Wide Web is increasingly used for commerce and for access to personal information stored in computerized databases, privacy becomes a significant concern. As noted by Moor [10], computerized information is greased so that it flows easily from place to place and person to person, and can be easily correlated and combined with other computerized information to derive still more information. It is clear that the Web eases access to existing data sources, some of which contain personal information (financial records, medical records, criminal records, etc). More subtly, and perhaps more significantly, by moving many human activities (shopping, entertainment, communication, and so forth) onto the computer and computer networks, the Web makes it possible to track an individual's activities more than ever before.

In this paper I examine some of the technological aspects of the Web that may have an impact on privacy, specifically, what Moor calls informational privacy [10]. Indeed, the law generally sees the invasion of privacy to be the unauthorized access to or disclosure of information [14]. Why is the World-Wide Web, or the Internet in general, so different from earlier technologies in this respect? "The Web is simply another medium of information distribution and gathering; it differs quantitatively because the volumes are so high and the costs so low" [1]. That is, the low cost of collecting personal data, and the sheer volume of such data on the Web, makes it more likely that individual privacy may be invaded, where before it would have been impractical.

For the purposes of this paper, I use Alan F. Westin's definition: "Privacy ...is the claim of individuals... to determine for themselves when, how, and to what extent information about them is communicated to others..." [15]. It is important to consider what "information" individuals may want to control, and to note that the sensitivity of the information varies with the context. Frequently, people distinguish between "personally identifying information," that is, information that can identify a specific individual, and "anonymous information," that is, information that cannot be used to identify them as a specific individual. Normally, people are more sensitive about the former than the latter, but the Web may change that.

It is instructive to consider what it means to identify an individual. Most people probably believe that their name identifies them, but there are often thousands of people with an identical name. Within the United States, a social-security number is a unique identifier for a specific individual (but not all individuals in the U.S. have a social-security number, and it may be that they re-use numbers after death of an individual). Furthermore, knowledge of a name (say, "Jingle Frobnitz") or even a social-security number (say, 111-222-3333) is, in and of itself, completely useless information. Knowledge of information about an individual is only useful unless I have a use for that information, and the potential to use it. For example, I may be able to use a name to locate a telephone number for that person (or at least, a list of telephone numbers for all people with that name). This additional knowledge is itself useless, unless I have a use for the information, and the potential to use it: thus, if I have a desire to call this person, and a telephone, the information is useful to me. If my goal is to send advertisements through electronic mail, I may have no use for a name or telephone number, but an email address is extremely valuable. If my goal is to cross-sell a customer a shirt after they add a sweater to their virtual shopping cart, knowledge of their gender or age may be more useful than their name or social-security number.

In the end, it appears that the value of information about an individual is directly related to the potential uses of that information. Similarly, the individual’s sensitivity to disclosure of certain information about them is directly related to the use (or potential use) of that information, which in turn varies with the context. As such, the line between "personally identifiable" and "anonymous" information is blurry. Furthermore, Web technology makes it increasingly easy to correlate information from multiple sources, so information you provide "anonymously" to one source (such as your age and list of current prescriptions) may be linked with information you provide to another source (such as your email address), allowing someone to send you (or your employer) email about your health-care situation. I discuss the issue of information correlation further in Section 3.

There are three forms of information protection related to privacy on the Web:

• Protection from others eavesdropping in your communications;
• Protection of personal or proprietary information (in databases, caches, or logs);
• Protection from the collection, exchange, and use of personal information, including information about an individual’s activity in the Internet.

The first issue is largely solved by the use of encryption. The second issue is largely solved through encryption, and traditional access-control mechanisms (as described in nearly any Operating Systems textbook for computer scientists). This paper focuses primarily on the third issue.

I begin by outlining some of the mechanisms available for accessing or collecting personal information on the Web. Then in Section 3 I examine methods for correlating multiple data sources to provide a more complete view of a person, and in Section 4 I note a few examples of how such data is disclosed to third parties. Finally, Section 5 discusses some of the technical and legal solutions to the privacy issue.

There are essentially three ways to obtain personal information from a World-Wide Web user:

1. Direct: record the information they type into forms on web pages (such as a name or address).
2. Indirect: record their web-surfing activity, such as the pages they visit, the queries they enter, or items they purchase from a on-line store.
3. Derived: correlate data from several sources to infer new facts about them.

First, I describe several mechanisms for data collection.

Cookies are a greatly misunderstood technology, hotly discussed in the past year, and a powerful tool for data collection (among other things). In this section I hope to provide some background, describe how cookies work, and discuss ways in which they can and are being used to collect information about individual Web users.

World-Wide Web "browser" software acts as a client, sending requests (in the form of URLs) to Web servers, which look up (or compute) the appropriate Web page, and send the page back as a reply. Once the current request is completed (and logged, as I note in the previous section), the Web server forgets everything about this request and goes on to service the next request, most likely from a different client elsewhere. The server is stateless, in that it keeps no state information from request to request. It has no way to know, when a new request comes from a client that made an earlier request, that the request is somehow related to the earlier request. Many useful applications, from search engines displaying multiple pages of results, to commerce sites providing "shopping basket" in which customers collect items to purchase, require the maintenance of short-term (within the same session) state. Other applications require long-term state to be recorded, such as your preferences for a personalized newspaper, the book reviews you have already seen, and so forth.

Cookies provide a way to supply state information to the Web server. A server that wishes to remember something from request to request can send a few bytes of data back with the web page, in response to your first request. Those bytes of data are called a "cookie", and are recorded by the browser software. The cookie is not a program, and thus cannot execute on your machine. As such, it cannot "do" anything with your machine, despite rumors to the contrary. On your next request to the same Web server, the cookie is sent back along with the request. The server, which is otherwise still stateless, looks at the cookie for information that it can use to help process your new request. On reply, it can change or delete the cookie stored by the browser, or send a new cookie.

What is in a cookie? A few bytes of data, typically less than 100 bytes, but apparently as much as 4096 bytes. Each cookie has several fields:

A server may send many cookies, each with a different name. Most browsers will only remember 10-20 cookies from any one server, and at most 300 cookies total. The cookies are recorded in a file on disk, so they can be remembered from one execution of the browser to another.

More technical details about cookies can be found in the cookie specifications (which appear not to be completely followed by current browsers) [10,12] and the Unofficial Cookie FAQ.

As an example of some cookies, here are some of the cookies that I found stored in my browser's records:

Clearly, these cookies’ values have little meaning to the user, but a few things can be gleaned from a casual reading of the cookies. I have visited both the New York Times and Amazon.com Web sites, and each sent me some cookies. Both seem to have sent me a cookie that records some sort of identifier ("ID", "ubid-main"), which is probably used by the server to locate more detailed records about my previous browsing activity in the server's own databases. Amazon.com records that I do not (F=FALSE) have a group discount.

Every time I return to the New York Times or Amazon.com Web site, the appropriate cookies are returned to the server. Thus, it is possible for the server to record (more accurately than through monitoring the IP address, and over longer-term activity than through the use of hidden form fields) the sequence of pages I visit on their server, the time between my accesses, any data I enter into their forms, and so forth. If, at any time, I enter "identifying" (such as my name or email address), all of the recorded information associated with the cookie can now be associated with my name or address. Thus, although it may appear that some parts of the Web site are possible to access "anonymously," in reality it is possible for the server to relate my activity from one part of the Web site (where I identify myself) to other parts of the site (where I have the impression that I am not identifying myself).

In addition to the various data that can be collected from your web-surfing activities, there is an increasing amount of personal data, collected from other media, available on the web. These data are provided in searchable databases, often by traditional information agencies, for free or for a fee.

There are several sites that provide telephone-book data, allowing you to search for the address and telephone number (and sometimes email address), given a name. At least one allows "reverse" searches, providing name and address given a telephone number.

More interesting, several sites will provide a wealth of personal information, given a name and social security number. For that, and $139, I was able to ask InfoSpace to run a "background check" on someone. In 24 hours, they provided me with alternate names, addresses, date of birth, a list of possible relatives, the address and phone number of several neighbors, corporate records, and lists of bankruptcies, real estate owned, watercraft, aircraft, and pilot licenses.

Most of this sort of information comes from public records, which have been scavenged and made easily available through the Internet. Some now question the extent to which public records should be made public, given that the increased accessibility makes abuse more likely.

Given the potential for abuse of personal privacy by various groups on the Web, it is important to consider mechanisms to regulate the collection and use of personal information. There appear to be three primary approaches: legislative, in the form of governmental regulation; self-regulation, in the form of industry associations and certification programs; and technological, in the form of new technology to mediate the exchange of personal information.

The U.S. government appears to be increasingly concerned about on-line privacy, particularly regarding Web users that are young children (under 12 or 13 years of age). Indeed, the Federal Trade Commission (FTC) recently released a report [6] about a study of 1400 Web sites, only 14% of which provide any sort of privacy notice. A subset of 212 sites, aimed at children, had 89% collecting personal data, but only 54% disclosing that fact; less than 10% of these sites provided for parental control over the data collection. The FTC concluded that self-regulation is not working, so far, and warned the industry to improve its record or to expect the government to step in. They suggest the following four principles:

• Notice: Web sites should provide notice of their information collection and use,
• Choice: users should be able to choose how their information is used, and to whom it is disseminated, and
• Access: users should be able to access the information recorded about them.
• Security: databases of personal information shall be secure against tampering or leaks.

Indeed, a bill was recently introduced in Congress (H.R.2368) to establish voluntary guidelines consistent with the above principles, and (in addition) to restrict e-mail spam.

Indeed, Vice President Gore chose to make a significant public statement about on-line privacy on July 31, 1998, one month after the FTC report and the same day that Congress was considering related legislation. He focused on four areas: protection of personal information, particularly medical and banking records; preventing identity theft; protecting children’s privacy, on-line; and asking the private sector to protect on-line privacy [8].

Most of Gore’s statement reiterated previous policies, or lent support to bills already under consideration in Congress. Many of the on-line privacy initiatives he suggested were aimed at children, prohibiting the collection of data from children under 13 without their parent’s consent. Congress has been considering similar legislation in this session, in the Children’s Privacy Protection and Parental Empowerment Act (S.504 and H.R.1972). Congress has only recently begun to consider adult privacy issues. ThePersonal Information Privacy Act of 1997 (S.600 and H.R.1813) primarily deals with uses of the Social Security Number. The Federal Internet Privacy Act prohibits federal agencies from making "available through the Internet any record with respect to an individual." (To me, the bill’s language appears to make it impossible to name an individual in any web page, which seems overly strong.) The Consumer Internet Privacy Protection Act(H.R. 98) addresses the disclosure of "personally identifiable information" by an Internet-service provider to a third party. None of these bills were passed into law, although the Senate has passed a bill banning "identity piracy", in which it becomes a crime to "knowingly … use… someone else’s personal identifying information with the intent to commit a federal crime" (Identity Theft and Assumption Deterrence Act of 1998, S.512). Some privacy advocates are concerned about some provisions in the Digital Millennium Copyright Act (S.2037 and H.R.2281), now law, which implements the WIPO treaty, because it appears to disallow the use of "devices", including software, that circumvent technologies that are used for the protection of intellectual property, e.g., copyright. Thus, it may not be legal to use cookie-blocking software, if some publishers use cookies for copyright enforcement.

Gore encouraged companies that produce digital "profiles" of individuals by correlating multiple data sources to develop adequate self-regulation mechanisms, or be prepared to have the government impose regulations. He supported the Online Privacy Alliance, an industry group that proposes to set privacy regulations, stamp conforming Web sites with their seal of approval, and enforce their regulations by revoking the seal as necessary. TRUSTe , a non-profit initiative, offers a similar stamp of approval on many Web sites. "TRUSTe's position to sites is ‘say what you do, then do what you say.’" Thus, rather than imposing particular rules about use and dissemination of personal information, TRUSTe requires its members to disclose their own use and dissemination policies, and then to stick by those policies.

The issue may have practical significance soon, as the European Union is scheduled to implement fairly strong privacy rules in October 1998. The rules would make it difficult or illegal for European companies to do business with U.S. companies that have fewer safeguards on the privacy of employees’ or customers’ personal information. Although the E.U. has weakened their support for strong encryption, at the request of Britain and France [3], it appears that the U.S. and E.U. fundamentally disagree on the role of government in legislating privacy policy. The U.S. prefers voluntary regulations enforced by a non-profit industry group, and the E.U. prefers strict governmental regulations [5,7]. Negotiations continue at the time of this writing.

In the midst of all the discussion of governmental regulation, or industrial self-regulation, the World-Wide-Web Consortium (W3C) has formed the P3P Project. P3P is the Platform for Privacy Preferences, a technology that might be helpful in managing privacy regulations. The users express their privacy preferences to their browser, describing which information they are willing to disclose, and which they are not. When the browser connects to a new site, it asks the site for its privacy policy, which has been encoded by the site’s administrators. The browser compares the site’s stated policy with the user’s preferences, and alerts the user if there is any discrepancy, but does not bother the user if the site’s policy is as least as strong as the user’s preference for privacy. The goal is to encourage users and sites to codify their preferences and policies, and to automate the users’ effort that verify the policy of each site they visit, so that privacy can be maintained without excessive interruption to the users’ web surfing.