Ad industry offers a solution to online privacy problems

There are a lot of efforts trying to rein in advertising tech that tracks you online, and the newest option is coming from the ad industry itself. The IAB Tech Lab, a partner to the Interactive Advertising Bureau that has long represented online ad companies, proposed a new digital token on Wednesday designed to offer a better balance between advertisers' needs and your own -- including an ability to tell advertisers to leave you alone.

IAB Tech Lab's proposal will employ a digital token -- a single identifier that you can use to express your preferences to website publishers and online advertisers, said Jordan Mitchell, senior vice president of membership and operations at IAB Tech Lab.

That token differs radically from today's technology -- cookies -- in that all online publishers and advertisers would use the same single token to identify you instead of each using its own. Having the entire industry register you and your preferences with a single identifier may sound creepy -- anybody else worry how much of their lives are indexed by their Social Security number? But the token won't identify you by name, and the proposal comes with an enforcement mechanism that means only those who follow the rules and respect your choices are allowed to use it, Mitchell said.

"We're calling for a centralized mechanism so that you can convey your preferences and all parties...can respect those preferences," Mitchell said. The technology would be jointly developed by advertisers, publishers, browser makers and privacy advocates, he said, and will be offered for consideration at the World Wide Web Consortium's Improving Web Advertising Business Group.

It sounds nice, but as a practical matter, the ad industry has no choice but to try to improve today's tracking technology as the anything-goes era of tracking ends. Everybody from Apple Chief Executive Tim Cook to Facebook CEO Mark Zuckerberg is proclaiming the primacy of privacy. Even Chrome, the laggard, is trying to claim some of the privacy initiative held by browser rivals like Apple's Safari, Mozilla's Firefox, Brave Software's Brave and Microsoft's Edge that are stomping today's tracking cookie technology into crumbs.

Changing tracking tech

But exactly how things will shake out is very much unknown. While Mozilla enabled its tracking protection by default for all Windows and Android users on Tuesday, following Apple's two-year-old intelligent tracking-prevention feature, Chrome is the dominant browser, and there are differences of opinion about the best way to proceed.

In a tweet Tuesday, Chrome security leader Justin Schuh criticized Apple's approach as "hard-line anti-tracking" but "ineffective." In response, Apple's anti-tracking leader John Wilander dinged Google for not offering any anti-tracking technology at all yet.

And Google's proposals, while influential by virtue of its clout as the operator of not only the most widely used browser but also one of the top ad systems and some of the most popular online services, are hardly a shoo-in. Criticisms have filed in from privacy advocates, the Electronic Frontier Foundation and Princeton's Center for Information Technology Policy.

The IAB Tech Lab has started floating its proposal to browser makers, but so far the reaction has been "mixed," Mitchell said.

Brave CEO Brendan Eich said the idea won't protect privacy. 

"Who're they kidding? A single 'token' will uniquely identify you & be linked to your name & personal data in a trice," letting third-party companies harvest your data from the websites you visit, Eich tweeted Wednesday.  

The cookie crumbles

Today's tracking is handled primarily by a technology invented 25 years ago called cookies, small text files a website can instruct your browser to save. The first-party websites you visit can place these cookies, but so can third-party services they employ, like ad networks that embed ads.

Tracking is possible because many companies, including online ad giants Facebook and Google, can see when you use not only their own sites but also countless others that place Google-supplied ads or incorporate Facebook share buttons. Much of the tracking happens with companies you've likely never heard of, though.

The IAB Tech Lab's proposal calls instead for a token that would govern now first-party websites could share information with a "privacy-safe bridge" to third parties -- as long as you've given permission. 

Many details need to be ironed out. Among them: will you be able to set different preferences with each site? How much privacy will default settings offer? And what will be the mechanism by which we can all see if publishers and advertisers don't respect the rules?

Proving ad companies follow your preferences 

On this latter point, IAB Tech Lab plans to share more details in a couple weeks, Mitchell said.

"Who's going to trust the industry come save the day? No one. We recognize we need to show accountability and reliability to the preferences set by consumers," Mitchell said. The proposal, he said, lets advertisers prove their compliance to regulators, privacy advocates and the web browsers that represent us online. It'll also telegraph "early warning signals" that will quickly flag noncompliance.

Advertisers stand to gain from the system, though. It would be potentially vastly simpler to run, and with a single identifier, online ad players wouldn't have such a hard time keeping tabs on the individuals who grant permission.

As designed, though, the IAB Tech Lab proposal will let you disappear off tracking radar if you want to.

"What we really need to do is align on one method for identifying a consumer and their preferences," Mitchell said. "If, as a consumer, you say you want to be a ghost, then you are a ghost. There's no information stored about you, and we can prove it."