Tracking Legislative Developments in Relation to “Do Not Track” Initiatives

How Online Behavioural Profiling Operates

Online behavioural profiling is “the practice of tracking an individual’s online activities in order to deliver advertising tailored to the individual’s interests” (Federal Trade Commission [FTC], 2009). The actual practice of tracking was once limited to the installation of traditional cookies that record the websites a user visits (Wall Street Journal, n.d.). However, marketing and advertising companies are now employing a range of new tools such as flash cookies, third-party cookies and beacons in order to track the online behaviour of individuals (Electronic Privacy Information Centre [EPIC], n.d.).Third party cookies are the primary mechanism used for online tracking. These cookies are operated by a “third party”, the advertising or marketing company, as opposed to the actual domain a web user is visiting, and place its cookies on the domain that a user is browsing. Generally speaking, third-party cookies will be placed by advertising network domains, allowing them to construct a “profile” of an online user based on their browsing activities that is subsequently used for the purpose of delivering targeted advertisements (Duhig, 2012). Online behavioural tracking has become a burgeoning industry precisely because of the potency of advertising that it provides for (Phillips, 2010). A user who chooses to remove cookies can still have their data accessed as a result of flash cookies, devices that re-install deleted cookies. Beacons are used by online tracking companies to track a user’s every movement on a website, including what is typed and where the user is moving the mouse. The data that people are accessing or browsing on a webpage can be collected in real-time, and then be aggregated with other data about a particular user, including their location, income, hobbies and so on.

The aggregation can be primarily conducted in two ways depending on what information is being collected by the relevant cookie. First, by aggregating data around the Internet Protocol (IP) address of the device that is being used to access the web page. In this situation, it may or may not be possible to identify and aggregate information to an individual as data is being aggregated to a device (e.g. a computer or smart phone) rather than a person. However, it is potentially a relatively simple task to ascertain an identity from an IP address.