What is it: ETags are similar to self-regenerating, Flash-based “zombie” cookies that helped spark a nationwide debate on privacy recently. They are the nearly indestructible data files that re-spawn on consumers’ computers or tablets, even after users choose to “delete all cookies.” Often, flash cookies and ETags work together like partners in crime, collecting duplicate data pools and assuring that tracking processes are housed in multiple locations on a device. One major distinction between Flash cookies and ETags is that ETags are a native part of HTTP, the core protocol of all Web services. ETags can pass information about a device to a website and then simply re-issue after any subsequent requests are sent to the Web from the same device after cookies are deleted. This allows tracking to renew incessantly. ETags also operate using HTML5 to facilitate local data storage. This allows them to regenerate easily on mobile devices like tablets and hold huge amounts of granular data, without the cross-platform restrictions posed by the use of Flash cookies.
Who is Using Them?:
Several media companies — ABC, MTV, ESPN, NBCUniversal and Myspace, among others — were accused of using Flash cookies
via third parties. They recently settled
with plaintiffs in class-action suits. It is difficult to pin down which companies are using ETags. New allegations
of ETagging have been lodged against KISSmetrics and some of the companies that were its clientele, such as Hulu and Spotify. Both companies dropped KISSmetrics as an ad technology provider last week. The allegations stem from a study
coordinated by researchers from the University of California, Berkeley released last week. The study found that although the use of auto-regenerating flash cookies on the most visited 100 websites in the US has dropped from 281 in 2009 to about 100 in 2011, ETags were in use as tracking methods on several major sites. More sophisticated cookie-deletion tools, such as those on the Firefox browser, have made it easier for Flash cookies to be deleted by consumers and because of this, the report maintained, ETags were being used as a replacement.
Why it Matters: Flash cookies can hold the equivalent of 50 pages of data and semantic-based ETags are even more agile than Flash cookies. Companies that boast of “tracking without cookies” use semantic identifiers to pass on information to end-users. When these tracking practices cannot be eliminated even through the selection of a “do not track” option or manual cookie-deletion, existing privacy laws may be violated.
Assessment: The potential for consumer backlash for this newer form of resilient cookie is enormous. The advertising industry’s indulgence in underhanded methods such as these gives credence to the fears of the fringe element of the privacy movement.