Taking the Byte Out of Cookies: Privacy, Consent, and the Web

1
Taking the Byte Out of CookiesPrivacy, Consent,
and the Web

• Daniel Lin
• Department of Computer Science
• University of Illinois at Urbana-Champaign
• Michael C. Loui
• Department of Electrical and Computer
  Engineering,
• and Coordinated Science Laboratory
• University of Illinois at Urbana-Champaign

2
Introduction

• What is different about our concerns with privacy
  when we deal with the Internet?
• Our contributions
• Difference between the collection and
  centralization of information.
• The role of informed consent in the theory of
  privacy
• Reasonable expectation of privacy and Internet
  cookies

3
Theories of Privacy

• Right to be let alone (Warren Brandeis)
• Control of information (Fried, )
• Undocumented personal knowledge (Parent)
• Privacy as restricted access (Gavison)
• Secrecy
• Anonymity
• Solitude
• Loss of privacy versus violation of privacy
• Why privacy is important (Rachels, Benn)

4
Informed Consent and theCollection of Information

• Disclosure
• Comprehension
• Voluntariness
• Competence
• Consent

5
Collection of Personal Information

• An ethical collection of personal information
  causes a loss of privacy
• Obtaining informed consent is sufficient but not
  necessary for an ethical collection of personal
  information
• An unethical collection of personal information
  causes a violation of privacy
• Collection of personal information is unethical
  when it does not comport with the reasonable
  expectation of privacy for this situation

6
Centralization of Information

• Assembling personal information from multiple
  sources, originally collected for different
  purposes digital dossier
• Violation of privacy with no extra loss of
  privacy
• Composite portrait out of context
• Unauthorized subsets of information

7
Reasonable Expectation of Privacy

• Natural versus normative privacy (Moor)
• Privacy in public places (Nissenbaum)
• Supermarket public place
• Shopping cart private in public?
• The Internet
• Home office private place
• Web access public in private?

8
Internet Cookies

• The Internet
• Reasonable expectations of privacy are neither
  firmly rooted nor well developed
• What are Internet cookies?
• Internet cookies allow a Web site to gather and
  store information about our visit to that Web site

9
What do Cookies Look Like?

• All cookies contain the same information
• The name of the cookie
• The value of the cookie
• An expiration date
• The path for which the cookie is valid
• The domain for which the cookie is valid
• A flag indicating whether the cookie requires
  secure transport

10
What do Cookies Look Like?

• An example cookie file from a UNIX workstation
  using Netscape
• Netscape HTTP Cookie File
• http//www.netscape.com/newsref/std/cookie_spec.
  html
• This is a generated file! Do not edit.
• victory.cnn.com FALSE / FALSE 942189160 NGUserID
  cf1947b7-20682-881794064-1
• revenue.infi.net FALSE / FALSE 942189160 KRRC
  d083adf8-4235-882047182-1
• adserv.newcentury.net FALSE / FALSE 942189160
  NGUserID d101991f-10174-882047153-1
• .doubleclick.net TRUE / FALSE 1920499140 id
  117828a6
• .illuminatus.com TRUE / FALSE 945734399 Count 1

11
Argument Against Cookies(Mayer-Schoenberger)

• Cookies are stored on the users computer without
  the users consent or knowledge
• Cookies are clandestinely and automatically
  transferred from the users computer to the Web
  server
• Because cookies allow the Web server to set an
  expiration date, they violate the accuracy and
  timeliness principles in the European Union
  Directive on the Protection of Personal Data
• Once the cookie is set, it is freely accessible
  to Web servers FALSE

12
Morally Permissible CookiesCollection of
Personal Information

• Customer preferences
• Online shopping

Mr. Smith
13
Immoral Uses of CookiesCentralization of
Personal Information
In order to measure our browsing behavior, target
marketers track us over the Internet by adding
cookies to the advertisement banners on so many
Web pages. Is such a use of cookies ethical?
Does it fit within a reasonable expectation of
privacy on the Web?
14
Development of Cookie Awareness

• Most Web browsers allow the user to configure
  their cookie options

Netscape Navigator
Netscape Communicator
15
Summary and Conclusions

• If the collection of personal information exceeds
  a reasonable expectation of privacy, obtaining
  informed consent makes such a collection ethical.
  If the collection of information lies within a
  reasonable expectation, informed consent does not
  seem necessary.
• Internet cookies are a tool. They can be used in
  both morally permissible and immoral ways.
• In general, Web servers cannot obtain your
  personal information unless you explicitly give
  it (e-mail address, credit card numbers, home
  address, phone number).
• Do cookie notifications provide sufficient
  information for an informed choice?
• Cookie notification detracts from the usability
  of Web browsers. How to improve?