Oops, We Did It Again

The Wall Street Journal’s ongoing What They Know investigative series, about online marketing and privacy practices, is a must-read for anyone interested in commerce and privacy.  Every week the Journal reports on some widely-used but little-known aspect of electronic tracking and data collection, and it seems every week the Journal article reveals one or more companies violating their internal data-disclosure policies.  The companies sing the same refrain:  Oops, we didn’t mean to do that; because of the mistake we’ve changed our software/data collection/security protocols; now it’s all better.  Today’s article–A Web Pioneer Profiles Users By Name–reports that tracking company RapLeaf maintains the holy grail of online data collection, a detailed database containing users’ real names and home addresses.

[P]ossessing real names means RapLeaf can build extraordinarily intimate databases on people by tapping voter-registration files, shopping histories, social-networking activities and real estate records, among other things.

RapLeaf has 1 billion email addresses in its database, not all of which are linked to real names.

RapLeaf acknowledges collecting names. It says it doesn’t include Web-browsing behavior in its database, and it strips out names, email addresses and other personally identifiable data from profiles before selling them for online advertising.   Nevertheless, the Journal found that, in certain circumstances, RapLeaf had transmitted identifying details about Mrs. Twombly—such as a unique Facebook ID number, which can be linked back to a person’s real name—to at least 12 companies. The Journal also found RapLeaf had transmitted a unique MySpace ID number (which is sometimes linked to a person’s real name), to six companies. MySpace is owned by News Corp., which publishes the Journal.   RapLeaf says its transmission of Facebook and MySpace IDs was inadvertent and the practice was ended after the Journal brought it to the company’s attention. The company says people can permanently opt out of its services at RapLeaf.com.

The article contains too much to summarize or excerpt here.  It’s worth a look.

After finishing the article I checked my computer for a RapLeaf cookie.  I did not find one, but I’m not confident it’s not there.