What’s a Tracker Network and What Can it See?
In Wednesday’s Senate floor debate over the Congressional Review Act resolution on the Wheeler FCC’s privacy regulations, each Democratic Senator made the same claim: ISPs can see all the web browsing activity of their customers, but advertising networks can only see what we do in their own domains.
Regardless of what you may think about the efficacy of the CRA resolution, the FCC’s privacy regulations, or about the Internet in general, this is a false claim. As such, it needs to be corrected before we can have a rational dialog about privacy policy.
What ISPs See
ISPs transmit and receive all the information from and to their customers while we use a given ISP network. This means they can generally known what domains we’re accessing while we use their services, including the domains that deliver ads to the web pages we read. But there are some significant limitations.
The wireline ISP we use at home can see the traffic that goes in and out of our mobile devices while they’re connected to our home Wi-Fi networks. But they can’t see data that these devices pass directly to their mobile networks, nor can the ISP see the Wi-Fi traffic we generate outside the home. Our residential ISP also can’t see data we generate at work unless we work at home.
And each ISP only serves a fraction of the total Internet population: the largest ISPs by market share serve 30% of the wired market and 35% of the wireless market. To limit things even more, ISPs can’t see encrypted data. This means they can see that we go to Netflix, but they can’t tell which movies we watch. And they can see we go to Google, but they can’t see what we search for. And they can see we go to Facebook, but they don’t know what groups we join or who our friends are.
Add this all up and it becomes clear that you can’t say “ISPs see everything we do on the Internet” truthfully. Each sees a lot, but none comes anywhere close to seeing it all.
What Tracker Networks See
Contrary to the talking point, you don’t have to type “google.com” into your browser for Google to see what you’re doing. Google doesn’t just have search, maps, mail, and apps; it also has a tracker network. A tracker is a piece of code embedded in a web page – often invisible to the user – that reports visits to a central database. When a web site includes tracking code from Google (or one of its subsidiaries such as DoubleClick), a trip to the web site takes us to Google without our knowledge.
So in a narrow, pedantic sense it’s true that we have to go to Google to be tracked, the larger truth is that we go to Google all the time whether we intend to do so or not. Google has tracker code embedded in roughly 60-90% of the top web sites today. This explains why Google and Facebook combined earn 90% of new display ad dollars.
In other words, Google has tentacles inside most of the top web sites that feed it information about browsing activity. The fact that the Democratic talking points fail to represent this tracker network truthfully and accurately can only mean that the politicians and their staffers don’t know this is going on. They certainly wouldn’t try to deceive us intentionally.
The Public Clearly Doesn’t Understand This
If our tech policy experts in the Senate – people like Sens. Markey, Schatz, Bill Nelson, and Sanders – don’t understand the nature of tracker networks, it’s fairly certain the average consumer doesn’t understand it either. It’s also probable that those who repeat the talking points don’t appreciate the nature of the information that tracker networks scoop up.
Trackers know what pages they’re in, and they can see both the pages and the visits to the pages in clear text. And trackers can figure out that users who come to them via Comcast at some times come to them via Verizon at others. They have persistent identifiers such as logins, IP addresses, and cookies that tell them who we are. These identifiers allow them to create much more detailed pictures of our web browsing activity than any single ISP can ever have.
So if you believe ISPs should be regulated like the dickens for some reason other than their vision across the Internet – perhaps because they charge fees for using their service – then by all means demand stricter regulations on them than on the tracker networks. But don’t kid yourself that the ISPs can see more than Google, Facebook, and the other trackers see. They just can’t.