Baycloud Systems sets the record straight.
For some time Evidon, formerly known as Better Advertising, – acquirer of the Ghostery ad blocking browser extension, have been publishing misleading information about Baycloud Systems and our CookieQ product. As they have not even bothered to reply to communications requesting them to stop this, we feel we need to set the record straight by refuting their claims about us. We also, in the interests of transparency, provide our own analysis of their product offering which we feel is important given their connections with the so-called “self-regulatory” response to worldwide privacy concerns.
Evidon markets a browser extension which it claims identifies “trackers” and allows a user to block them.
Ghostery does this by scanning every page the browser visits and identifying the external resources that are referenced in “script”, “img” , “iframe” and other tags. If the name of a resource matches an external JavaScript file recorded in an entry on their list of “trackers” and the user has configured the extension to block that entry, the particular JavaScript file is inhibited from loading.
Because the JavaScript file is not loaded then it cannot dynamically create these “img” or “iframe” tags and in this way Ghostery does inhibit tracking by some advertising companies and analytics providers.
The problem with this approach is that perfectly benign JavaScript libraries used to add useful functionality to a site are also blocked, sometimes rendering the site unusable. Although the majority of script on their list is used to track people for the purposes of behavioural advertising, they also include other script which does not.
For example our own CookieQ tool is used to protect a user’s privacy and is never used to track them. It was designed to help sites comply with European Law by acquiring and registering user consent on multiple web domains they control and, when a user has not given consent, by removing cookies and other identifying storage. It lets sites offer either an “explicit consent” mode where the user must opt-in before identifiers such as UID cookies are stored or an “implied consent” mode where the site assumes storage is OK buts gives users the ability to always quickly and easily opt-out from this storage on subsequent visits to the site. We also enable our customers to support the forthcoming W3C Do Not Track protocol and apply its User Granted Exception API across multiple domains when there is agreement for this by the user.
We do not, and have never, collected data, sold data or tracked people. Since this has always been explained in all our documentation and our privacy policy, not only would it entirely conflict with our mission and the purpose of our technology but would also be illegal.
All our technology has been developed in-house. We have developed our own downloadable application that operated as a true tracker blocker, and would have competed directly with AdBlock+, DoNotTrack+, Disconnect.me, and Ghostery etc. This is not a browser specific blocker but a universal system that can intercept network activity and so works with any browser. But we decided that a CookieQ solution based on letting websites collaborate in extending privacy to their visitors in order to build trust with them, was a better approach which would lead to a healthier way for online actors to extend privacy and interact directly with citizens.
Early versions of CookieQ used a 3rd party cookie in our own domain to record a user’s explicit consent at different sites. This was clearly explained to be “strictly necessary to support a service requested by the user”, was only placed if they had given explicit consent at our customers’ sites for cookies or other identifying storage, and could always be instantly removed by clicking on a link on our own or our customers’ sites.
Furthermore, we have recently introduced a major enhancement to our technology in which the information recording a user’s agreement at particular customer sites is only held within their browser or device and is never communicated to our or our customer’s servers. We now only store a 3rd party cookie if a user is using one of the increasingly small numbers of browsers that do not support the HTML5 features needed for this functionality.
Evidon has added the script file used by the CookieQ tool to its list of “trackers” albeit in a sub-category labelled “privacy”. Many people who download Ghostery, or use their list with other ad blockers like AdBlock+, just block every script on the list and so our script is also blocked. As a result these users are not able to opt-out of cookies or identifier storage on our customer’s sites.
Evidon may claim this was accidental but the fact the page on their website describing us misleads people into assuming we support, as Evidon does, the AdChoices opt-out cookie, has an elaborately concocted paragraph wrongly claiming to be a quote from us - claiming to be “in their own words”, and the fact Evidon bought the cookieq.co.uk and other cookieq domain names in 2012 – almost a year after we introduced the product using the cookieq.com domain, leads us to believe they did this simply out of the wish to damage a competitor whose technology they feared. These Evidon owned cookieq domains are parked on a service that displays behavioural and other advertising, and places cookies. We feel this damages our brand as in many cases these may be the pages they see when on making an online search for CookieQ.
The AdChoices program relies on only giving people the ability to opt-out of tracking by specifically visiting one of their member’s sites and requesting an opt-out. This simply places a cookie in the domain used by that particular company’s 3rd-party tracking element, which signals their server that the user wishes not to be tracked. If the user deletes all their cookies, which many do regularly as a privacy protective measure, then the opt-out cookie is lost, paradoxically leaving them in a situation where the behavioural advertiser’s servers will assume the user does not mind being tracked. Also browsers that normally inhibit 3rd party cookies assume that because a 1st party cookie (the opt-out cookie) has been placed the blocking of cookies from that site will be lifted, also probably conflicting with the user’s intention.
If a user wishes not to be tracked by any AdChoices member or if they wish to see what members have placed an opt-out cookie, every subscribing domain must be visited. This leads to slow loading of pages designed to implement the required functionality due to the necessity of script having to insert external origin frame elements directed at the hundreds of domains that use opt-out cookies. These cumbersome and inelegant implementations are only necessary because of the underlying opt-out philosophy with its assumption of implied consent. A mechanism based on the requirement to gain prior consent for tracking would not only be more transparent but would lead to cleaner and more efficient implementations.
Evidon claims that they only sell "aggregated" data based on that collected by the Ghostery extension for GhostRank and that they do not collect personally identifiable information (PII). But on every visit to a page containing script on the Ghostery list, if the user is has subscribed to the “GhostRank” collection mechanism, not only the IP address of the user’s browser but any identifiers that happen to be encoded in the Uris of the external resources are sent to the l.ghostery.com server. Unique identifiers stored in cookies are classed as PII by European DPAs, especially when they occur in combination with IP addresses. If companies collect PII in this way they should be registered Data Collectors and according to the ICO website Evidon is not registered.
For example Google’s third-party analytics service Google Analytics stores a 2 year persistent identifier in the first-party “__utma” named cookie. The value of this cookie encodes a value which, together with the IP address, uniquely identifies the user’s browser and absolutely singles-out the user across domains. This identifier is encoded as a query parameter in the “src” attribute of the image tag that the Google Analytics script creates, and this Uri is sent to l.ghostery.com servers in addition to Google’s whenever the user visits the page. Both IP addresses and unique identifiers in persistent cookies are defined as PII by European Data Protection Authorities exactly because they can easily be used to single-out individual internet users and can be used to profile them.
This PII is sent by browsers incorporating the Ghostery extension (with GhostRank enabled) for every visited page that uses Google Analytics.
Google Analytics is used on the majority of web sites around the world, including most UK Government sites, the sites used by major consumer brands and even the website of the Information Commissioner’s Office. Each GhostRank user sends a record of their visits to these websites to Evidon with information that can uniquely identify them.
Of course whenever a citizen visits these sites this information is also sent to Google and it would also be interesting to read any commitment that Google has given to the ICO or the UK Government, who do not deem it necessary to ask for the consent of citizens for it on the main UK Government website, that they do not use this information to profile people. This hints at the problems that will arise as tracking increasingly relies on identifiers stored in the document origin of 1st party sites, where they are accessible to any 3rd party script included there as well as to browser extensions like Ghostery.
The following list details the Uri parameters sent to the l.ghostery.com server when visiting a sample of sites on 25th May 2013. The domain name that triggered the transmission is coloured green and some of the potential unique user identifiers are coloured yellow.
HTTP Request GETs sent to the l.ghostery.com servers when GhostRank is enabled and a sample of sites are visited .
Visit to gov.uk 25/5/2013
/api/census?bid=13&apid=935&d=www.gov.uk%2F&src=https%3A%2F%2Fssl.google-analytics.com%2F__utm.gif%3Futmwv%3D5.4.2%26utms%3D1%26utmn%3D1194140494%26utmhn%3Dwww.gov.uk%26utme%3D8(2!Format*11!Pixel%2520Ratio)9(2!homepage*11!1)11(11!2)%26utmcs%3DUTF-8%26utmsr%3D1920x1200%26utmvp%3D1899x1102%26utmsc%3D32-bit%26utmul%3Den-us%26utmje%3D1%26utmfl%3D11.7%2520r700%26utmdt%3DWelcome%2520to%2520GOV.UK%26utmhid%3D213367882%26utmr%3D-%26utmp%3D%252F%26utmht%3D1368708040945%26utmac%3DUA-26179049-1%26utmcc%3D__utma%253D12904168.529645517.1368708041.1368708041.1368708041.1%253B%252B__utmz%253D12904168.1368708041.1.1.utmcsr%253D(direct)%257Cutmccn%253D(direct)%257Cutmcmd%253D(none)%253B%26aip%3D1%26utmu%3DqxQ~&bl=false&blm=0&bs=false&nl=85&bv=181&cv=2&ua=chrome&v=4.1.1
/api/page/?d=www.gov.uk%2F&l=231&s=0&ua=chrome
Visit to cnn.com (21 requests to l.ghostery.com each one taking between 169 and 310 ms to load) 25/5/2013
/api/census?bid=588&apid=943&d=edition.cnn.com%2F&src=http%3A%2F%2Fcdn.optimizely.com%2Fjs%2F128727546.js&bl=false&blm=0&bs=false&nl=1723&bv=181&cv=2&ua=chrome&v=4.1.1
/api/census?bid=299&apid=505&d=edition.cnn.com%2F&src=http%3A%2F%2Fads.cnn.com%2Fjs.ng%2Fsite%3Dcnn_international%26cnn_intl_pagetype%3Dmain%26cnn_intl_position%3DBG_Skin%26cnn_intl_rollup%3Dhomepage%26page.allowcompete%3Dno%26Params.User.UserID%3D5194d61b04b18d0a3d146c2e7700980d%26tile%3D9892268078635%26transactionID%3D5430680905318400&bl=true&blm=0&bs=true&nl=-1&bv=181&cv=2&ua=chrome&v=4.1.1
/api/census?bid=464&apid=719&d=edition.cnn.com%2F&src=http%3A%2F%2Fwww.facebook.com%2Fplugins%2Flike.php%3Fhref%3Dhttp%253A%252F%252Fwww.facebook.com%252Fcnninternational%26send%3Dfalse%26layout%3Dbutton_count%26width%3D450%26show_faces%3Dfalse%26action%3Dlike%26colorscheme%3Dlight%26font%3Darial%26height%3D21&bl=false&blm=0&bs=false&nl=653&bv=181&cv=2&ua=chrome&v=4.1.1
/api/census?bid=43&apid=34&d=edition.cnn.com%2F&src=http%3A%2F%2Fsecure-us.imrworldwide.com%2Fcgi-bin%2Fm1%3Fci%3Dus-204044h%26cg%3D0%26cc%3D1%26si%3Dhttp%253A%2F%2Fedition.cnn.com%2F%26rp%3D%26ts%3Dcompact%26rnd%3D1368708627014%26ja%3D1&bl=false&blm=0&bs=false&nl=415&bv=181&cv=2&ua=chrome&v=4.1.1
/api/census?bid=58&apid=47&d=edition.cnn.com%2F&src=http%3A%2F%2Fstatic.chartbeat.com%2Fjs%2Fchartbeat.js&bl=false&blm=0&bs=false&nl=899&bv=181&cv=2&ua=chrome&v=4.1.1 HTTP/1.1
/api/census?bid=605&apid=991&d=edition.cnn.com%2F&src=http%3A%2F%2Fplatform.twitter.com%2Fwidgets%2Ffollow_button.1368146021.html%23_%3D1368708627702%26align%3Dleft%26id%3Dtwitter-widget-0%26lang%3Den%26screen_name%3Dcnni%26show_count%3Dfalse%26show_screen_name%3Dtrue%26size%3Dm&bl=false&blm=0&bs=false&nl=1676&bv=181&cv=2&ua=chrome&v=4.1.1
/api/census?bid=187&apid=181&d=edition.cnn.com%2F&src=http%3A%2F%2Fb.scorecardresearch.com%2Fr2%3Fc2%3D6035748%26d.c%3Dgif%26d.o%3Dcnn-adbp-intl%26d.x%3D150710414%26d.t%3Dpage%26d.u%3Dhttp%253A%252F%252Fedition.cnn.com%252F&bl=false&blm=0&bs=false&nl=228&bv=181&cv=2&ua=chrome&v=4.1.1
/api/page/?d=edition.cnn.com%2F&l=7287&s=40&ua=chrome
/api/census?bid=93&apid=1027&d=edition.cnn.com%2F&src=http%3A%2F%2Fconnect.facebook.net%2Fen_US%2Fall.js&bl=false&blm=0&bs=false&nl=77&bv=181&cv=2&ua=chrome&v=4.1.1
GET /api/census?bid=93&apid=1026&d=edition.cnn.com%2F&src=https%3A%2F%2Fs-static.ak.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D24%23channel%3Df71d00ba4%26origin%3Dhttp%253A%252F%252Fedition.cnn.com%26channel_path%3D%252F%253Ffb_xd_fragment%2523xd_sig%253Df14def80fc%2526&bl=false&blm=0&bs=false&nl=173&bv=181&cv=2&ua=chrome&v=4.1.1
/api/census?bid=93&apid=1026&d=edition.cnn.com%2F&src=http%3A%2F%2Fstatic.ak.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D24%23channel%3Df71d00ba4%26origin%3Dhttp%253A%252F%252Fedition.cnn.com%26channel_path%3D%252F%253Ffb_xd_fragment%2523xd_sig%253Df14def80fc%2526&bl=false&blm=0&bs=false&nl=173&bv=181&cv=2&ua=chrome&v=4.1.1
/api/census?bid=299&apid=505&d=edition.cnn.com%2F&src=http%3A%2F%2Fads.cnn.com%2Fhtml.ng%2Fsite%3Dcnn_international%26cnn_intl_position%3D88x31_spon_worldbiz%26cnn_intl_rollup%3Dhomepage%26page.allowcompete%3Dno%26params.styles%3Dfs%26Params.User.UserID%3D5194d61b04b18d0a3d146c2e7700980d%26transactionID%3D5430680905318400%26tile%3D9892268078631%26domId%3D463051&bl=true&blm=0&bs=true&nl=-1&bv=181&cv=2&ua=chrome&v=4.1.1
/api/census?bid=299&apid=505&d=edition.cnn.com%2F&src=http%3A%2F%2Fads.cnn.com%2Fhtml.ng%2Fsite%3Dcnn_international%26cnn_intl_pagetype%3Dmain%26cnn_intl_position%3D120x90_bot1%26cnn_intl_rollup%3Dhomepage%26page.allowcompete%3Dno%26params.styles%3Dfs%26Params.User.UserID%3D5194d61b04b18d0a3d146c2e7700980d%26transactionID%3D5430680905318400%26tile%3D9892268078635%26domId%3D296281&bl=true&blm=0&bs=true&nl=-1&bv=181&cv=2&ua=chrome&v=4.1.1
/api/census?bid=93&apid=1026&d=edition.cnn.com%2F&src=http%3A%2F%2Fstatic.ak.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D24%23cb%3Df7c803be8%26origin%3Dhttp%253A%252F%252Fedition.cnn.com%252Ff71d00ba4%26domain%3Dedition.cnn.com%26relation%3Dparent%26error%3Dunknown_user&bl=false&blm=0&bs=false&nl=1739&bv=181&cv=2&ua=chrome&v=4.1.1
/api/census?bid=93&apid=1026&d=edition.cnn.com%2F&src=http%3A%2F%2Fstatic.ak.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D24%23cb%3Df2ddd28cd8%26origin%3Dhttp%253A%252F%252Fedition.cnn.com%252Ff71d00ba4%26domain%3Dedition.cnn.com%26relation%3Dparent%26error%3Dunknown_user&bl=false&blm=0&bs=false&nl=1764&bv=181&cv=2&ua=chrome&v=4.1.1
Visit to www.ico.gov.uk 25/5/2013
/api/census?bid=13&apid=2&d=www.ico.org.uk%2F&src=http%3A%2F%2Fwww.google-analytics.com%2Fga.js&bl=false&blm=0&bs=false&nl=4&bv=181&cv=2&ua=chrome&v=4.1.1
/api/census?bid=13&apid=935&d=www.ico.org.uk%2F&src=http%3A%2F%2Fwww.google-analytics.com%2F__utm.gif%3Futmwv%3D5.4.2%26utms%3D1%26utmn%3D1740979234%26utmhn%3Dwww.ico.org.uk%26utmcs%3DUTF-8%26utmsr%3D1920x1200%26utmvp%3D1899x1139%26utmsc%3D32-bit%26utmul%3Den-us%26utmje%3D1%26utmfl%3D11.7%2520r700%26utmdt%3DData%2520Protection%2520and%2520Freedom%2520of%2520Information%2520advice%2520-%2520ICO.org.uk%26utmhid%3D820754349%26utmr%3D-%26utmp%3D%252F%26utmht%3D1368709194881%26utmac%3DUA-1036645-1%26utmcc%3D__utma%253D163087396.1968080715.1368709195.1368709195.1368709195.1%253B%252B__utmz%253D163087396.1368709195.1.1.utmcsr%253D(direct)%257Cutmccn%253D(direct)%257Cutmcmd%253D(none)%253B%26aip%3D1%26utmu%3DqAQ~&bl=false&blm=0&bs=false&nl=721&bv=181&cv=2&ua=chrome&v=4.1.1
/api/page/?d=www.ico.org.uk%2F&l=1594&s=0&ua=chrome
Visit to godaddy.com (9 requests to Ghostery ) 25/5/2013
/api/census?bid=288&apid=488&d=www.godaddy.com%2F&src=http%3A%2F%2Fwww.googleadservices.com%2Fpagead%2Fconversion.js&bl=true&blm=0&bs=true&nl=-1&bv=181&cv=2&ua=chrome&v=4.1.1
/api/census?bid=89&apid=83&d=www.godaddy.com%2F&src=http%3A%2F%2Fleadback.advertising.com%2Fadcedge%2Flb%3Fsite%3D695501%26betr%3Dgodaddy_cs%3D%5B%2B%5D1%5B720%5D%2C3%5B8760%5D%2520%253Chttp%3A%2F%2Fleadback.advertising.com%2Fadcedge%2Flb%3Fsite%3D695501%26betr%3Dgodaddy_cs%3D%255b%2B%255d1%255b720%255d%2C3%255b8760%255d%253E&bl=true&blm=0&bs=true&nl=-1&bv=181&cv=2&ua=chrome&v=4.1.1
/api/census?bid=150&apid=148&d=www.godaddy.com%2F&src=http%3A%2F%2Fads.bluelithium.com%2Fpixel%3Fid%3D2117866%26t%3D2&bl=true&blm=0&bs=true&nl=-1&bv=181&cv=2&ua=chrome&v=4.1.1
/api/census?bid=139&apid=137&d=www.godaddy.com%2F&src=http%3A%2F%2Fmedia.fastclick.net%2Fw%2Ftre%3Fad_id%3D26547%3Bevt%3D21064%3Bcat1%3D28133%3Bcat2%3D28134&bl=true&blm=0&bs=true&nl=-1&bv=181&cv=2&ua=chrome&v=4.1.1
/api/census?bid=588&apid=943&d=www.godaddy.com%2F&src=http%3A%2F%2Fcdn.optimizely.com%2Fjs%2F116723926.js&bl=false&blm=0&bs=false&nl=2563&bv=181&cv=2&ua=chrome&v=4.1.1
/api/census?bid=1283&apid=2127&d=www.godaddy.com%2F&src=http%3A%2F%2Fwww.googletagmanager.com%2Fgtm.js%3Fid%3DGTM-SXRF%26l%3D_gaDataLayer&bl=false&blm=0&bs=false&nl=1495&bv=181&cv=2&ua=chrome&v=4.1.1
/api/census?bid=13&apid=1982&d=www.godaddy.com%2F&src=http%3A%2F%2Fstats.g.doubleclick.net%2Fdc.js&bl=false&blm=0&bs=false&nl=1913&bv=181&cv=2&ua=chrome&v=4.1.1
/api/page/?d=www.godaddy.com%2F&l=5619&s=0&ua=chrome
/api/census?bid=13&apid=935&d=www.godaddy.com%2F&src=http%3A%2F%2Fstats.g.doubleclick.net%2F__utm.gif%3Futmwv%3D5.4.2dc%26utms%3D1%26utmn%3D1173386618%26utmhn%3Dwww.godaddy.com%26utme%3D8(2!privateLabelId*4!server)9(2!1*4!M1PWCORPWEB144)%26utmcs%3DUTF-8%26utmsr%3D1920x1200%26utmvp%3D1899x1139%26utmsc%3D32-bit%26utmul%3Den-us%26utmje%3D1%26utmfl%3D11.7%2520r700%26utmdt%3DDomain%2520Names%2520%257C%2520The%2520World's%2520Largest%2520Domain%2520Name%2520Registrar%2520-%2520GoDaddy.com%26utmhid%3D209174928%26utmr%3D-%26utmp%3D%252F%26utmht%3D1368709690923%26utmac%3DUA-37178807-1%26utmcc%3D__utma%253D247200914.116304885.1368709691.1368709691.1368709691.1%253B%252B__utmz%253D247200914.1368709691.1.1.utmcsr%253D(direct)%257Cutmccn%253D(direct)%257Cutmcmd%253D(none)%253B%26utmu%3DqxAAE~&bl=false&blm=0&bs=false&nl=2978&bv=181&cv=2&ua=chrome&v=4.1.1