The Wall Street Journal continues its in-depth report, “What They Know,” about the state of surveillance in the United States and how these surveillance programs affect individual privacy. In the latest installment, the Journal discusses the issue on anonymity online, “de-anonymization,” and how some companies are creating vast databases of consumers’ Web habits to market products to individuals. (I’ve discussed de-anonymization and its privacy risks before.)
From a single click on a web site, [x+1] correctly identified Carrie Isaac as a young Colorado Springs parent who lives on about $50,000 a year, shops at Wal-Mart and rents kids’ videos. The company deduced that Paul Boulifard, a Nashville architect, is childless, likes to travel and buys used cars. And [x+1] determined that Thomas Burney, a Colorado building contractor, is a skier with a college degree and looks like he has good credit.
The company didn’t get every detail correct. But its ability to make snap assessments of individuals is accurate enough that Capital One Financial Corp. uses [x+1]’s calculations to instantly decide which credit cards to show first-time visitors to its website.
In short: Websites are gaining the ability to decide whether or not you’d be a good customer, before you tell them a single thing about yourself. […]
By contrast, firms like [x+1] tap into vast databases of people’s online behavior—mainly gathered surreptitiously by tracking technologies that have become ubiquitous on websites across the Internet. They don’t have people’s names, but cross-reference that data with records of home ownership, family income, marital status and favorite restaurants, among other things. Then, using statistical analysis, they start to make assumptions about the proclivities of individual Web surfers. […]
A Wall Street Journal investigation into online privacy has found that the analytical skill of data handlers like [x+1] is transforming the Internet into a place where people are becoming anonymous in name only. The findings offer an early glimpse of a new, personalized Internet where sites have the ability to adjust many things—look, content, prices—based on the kind of person they think you are. […]
The technology raises the prospect that different visitors to a website could see different prices as well. Price discrimination is generally legal, so long as it’s not based on race, gender or geography, which can be deemed “redlining.” […]
In fact, [x+1]’s assessment of Mr. Burney’s location and Nielsen demographic segment are specific enough that it comes extremely close to identifying him as an individual—that is, “de-anonymizing” him—according to Peter Eckersley, staff scientist at the Electronic Frontier Foundation, a privacy-advocacy group.
Mr. Eckersley does research in the field of de-anonymization, the mathematics of identifying individuals based on a few specific details from their life. In the jargon of the field, Mr. Eckersley says, all that’s needed to uniquely identify one person is a total of 33 “bits” of information about him or her.