> A third-party advertiser (or any entity capable of getting content distributed to multiple sites) could use a unique identifier stored in its local storage area to track a user across multiple sessions, building a profile of the user's interests to allow for highly targeted advertising.
To me: any effort by plaintiffs to protect their privacy is moot, especially attacking local storage practices, when it is known that it can be used for tracking.
W3C puts the control and responsibility back in the user's hand:
> There are a number of techniques that can be used to mitigate the risk of user tracking, all involve user agent/browser settings.
So in my mind:
- Plaintiffs (or their browsers) did not enough to protect their online privacy.
- Plaintiffs complain about the abuse of local storage practices, when tracking through local storage is a very real option.
- Plaintiffs can configure their user agent to not accept these cookies.
As for information sharing between sites: this I could see as bad, if proven. But a KissMetrics-wide unique ID doesn't proof that such information is shared.
Even with all security efforts in place, a user can still be tracked (By IP and browser/system settings), and this data can still be shared. I do e-commerce profiling, and while I don't really need a flash cookie, I also don't really need your permission to scan my own servers logs: it was you who made the decision to disclose that information to me.
> However, user tracking is to some extent possible even with no cooperation from the user agent whatsoever, for instance by using session identifiers in URLs, a technique already commonly used for innocuous purposes but easily repurposed for user tracking (even retroactively). This information can then be shared with other sites, using using visitors' IP addresses and other user-specific data (e.g. user-agent headers and configuration settings) to combine separate sessions into coherent user profiles.
Comments
What I didn't understand about this lawsuit is the following angles:
> Plaintiffs believe their decisions to disclose or not disclose information is their decision to make.
> To avoid being tracked online Plaintiffs used and relied on their browser controls.
> It is contrary to standard practices to use DOM local storage instead of cookies.
If you are going to put down a practice as a "hack" or "repurposing" why not quote the standard?
http://dev.w3.org/html5/webstorage/#user-tracking
Very clearly it states:
> A third-party advertiser (or any entity capable of getting content distributed to multiple sites) could use a unique identifier stored in its local storage area to track a user across multiple sessions, building a profile of the user's interests to allow for highly targeted advertising.
To me: any effort by plaintiffs to protect their privacy is moot, especially attacking local storage practices, when it is known that it can be used for tracking.
W3C puts the control and responsibility back in the user's hand:
> There are a number of techniques that can be used to mitigate the risk of user tracking, all involve user agent/browser settings.
So in my mind:
- Plaintiffs (or their browsers) did not enough to protect their online privacy.
- Plaintiffs complain about the abuse of local storage practices, when tracking through local storage is a very real option.
- Plaintiffs can configure their user agent to not accept these cookies.
As for information sharing between sites: this I could see as bad, if proven. But a KissMetrics-wide unique ID doesn't proof that such information is shared.
Even with all security efforts in place, a user can still be tracked (By IP and browser/system settings), and this data can still be shared. I do e-commerce profiling, and while I don't really need a flash cookie, I also don't really need your permission to scan my own servers logs: it was you who made the decision to disclose that information to me.
> However, user tracking is to some extent possible even with no cooperation from the user agent whatsoever, for instance by using session identifiers in URLs, a technique already commonly used for innocuous purposes but easily repurposed for user tracking (even retroactively). This information can then be shared with other sites, using using visitors' IP addresses and other user-specific data (e.g. user-agent headers and configuration settings) to combine separate sessions into coherent user profiles.