Digital fingerprints leave internet trail for anyone to follow

Your online behavior may be tracked without your knowledge by new technology known as device fingerprinting, according to a study by KU Leuven-iMinds.

Most websites that use device fingerprinting do not disclose the practice and users can do nothing to protect themselves from such invasive tactics. Device fingerprinting circumvents legal restrictions imposed on the use of cookies, software codes downloaded by websites to track consumer behavior, and is not governed by Do Not Track laws.

In the first comprehensive effort to expose the prevalence of device fingerprinting on the internet, researchers found that 145 of the top 10,000 websites have developed the ability to collect information about users’ computers, smartphones, and tablets to identify and track them. Site owners are able to track screen size, versions of installed software and plugins, and the list of installed fonts.

According to Science Daily, a 2010 study by the Electronic Frontier Foundation (EFF) showed that the combination of these properties is unique, and thus functions as a “fingerprint.” Unlike cookies, which are usually easy to detect and simple to delete from hard drives, most users have no way of knowing that their computers are being fingerprinted.

Device fingerprinting is not all bad. It has many helpful uses, including security-related tasks such as fraud detection and protection against account hijacking. But data privacy experts fear it will be used, just as many other tracking techniques currently are, to build a fairly accurate profile of a user’s interests, socioeconomic status, purchasing history, medical status, family situation, credit information, passwords, etc.

A profile can be sold for a profit, with no legal limits on how that data can be used. Security experts argue the information could be used in a legal proceeding, during a job interview, in a loan application process, or as a means of identity theft. It could lead to discrimination based on what users read or write and could make anonymity impossible.

Consider this example provided by Oregon State University’s communications department: You visit a travel website to browse airline ticket fees, and then decide to do some shopping on other websites. You find a good deal on a hotel at your proposed destination, so you make a reservation. A few hours later you re-check the travel site only to find that the price has increased by $100. The site knew your other purchase and that you would need to buy that plane ticket.

Online behavioral advertising offers the highest return on investment for dollars spent on e-advertising, Oregon State associate professor Nancy King told Science Daily. King seeks potential solutions to protect consumers’ privacy, but she said it is important to avoid privacy solutions that go too far and might unduly restrict the behavioral advertising industry.

But internet users understandably worry about how personal information gained by tracking their online behavior may be used, she told Science Daily: “As lawsuits continue to increase, it is inevitable that the issue of online and mobile privacy will be addressed, if not by Congress, then by the courts.”