Sandwiched between a bakery and a health food supermarket in the heart of Cupertino, California, is the headquarters of a new kind of stock exchange - one that trades data, your data.
It is operated by a US company called BlueKai and at any moment on a typical day the interests and preferences of more than 200 million web users are for sale to the highest bidder.
The data is divided into categories - everything from wedding dresses and mountain bike helmets to coffee makers and luggage - with users identified by the ''unique identifier'' of their web browser, the software that finds, retrieves and presents information online. In the right hands, the data is marketing gold dust because it allows advertisers to target consumers showing a clear interest in a product or category. Someone who goes online to research internet security software, for example, might receive advertisements from a software company within hours, perhaps minutes of their first mouse click. The potency of such advertising has turned online data trading into a burgeoning industry. (There are already at least seven US data exchanges similar to BlueKai.)
------------------------------------------
Profiling children proves kids' stuff for advertisers
------------------------------------------
Many users are oblivious to its existence but this multimillion-dollar enterprise is founded on the covert business of spying on web surfers.
The industry's primary tools are tracking devices deployed on thousands of websites, surreptitiously gathering information about visitors. Australian users are far from immune.
A review of the top 10 most-viewed Australian-owned websites - or those with an Australian subsidiary - revealed a startling picture of this extensive, and increasingly intrusive, practice.
Ninemsn.com.au installed the most tracking devices - 109. Bigpond.com had 93 and smh.com.au 86. Google tracks users on the more than 1 million websites that display its advertisements.
The information these devices gather is considered anonymous because it identifies web browsers, not individuals. But the aggregation of data from multiple sources means companies can quickly build a detailed profile of a user - so detailed that some people outside the industry fear privacy is at risk.
Privacy laws in Australia cover only the use of personal information such as names and addresses. But because your online activity is linked only to a browser ID, it is not considered personal information and as a result the industry is almost entirely self-regulated.
Website privacy policies are often vague and unclear, leading to suggestions that web users are being manipulated by advertisers who are not open about what they are doing. There are also genuine fears that all this data could end up in the wrong hands. Tracking devices come in a variety of forms, including cookies, web beacons and flash cookies. Cookies are placed by the owner of the website and record basic information such as passwords and preferences. They have a reputation for being innocuous.
Online tracking is done almost entirely by cookies and beacons - invisible images embedded in a web page - which belong to companies other than the original website. The combination of the beacon and the cookie allows this third-party company to see automatically what elements of a page the user has clicked on, potentially identifying information held in the URL of the page the computer is visiting, such as an email address.
What happens with that data is now out of the user's hands.
Most of these third-party companies, usually advertisers and data collectors, have relationships with hundreds, sometimes thousands, of websites, making it possible for them to follow a user's progress across the web. Over time, this covert surveillance allows them to build detailed profiles of the user's interests and activities.
Ed Harrison, the commercial director of media for Fairfax Digital - which is part of Fairfax Media, the publisher of this website - said it used cookies to track users' behaviour, create a better user experience and optimise the effectiveness of advertising.
"The benefit is that we are providing more relevant advertising to consumers," he said.
The ABC website has 42 tracking devices. Carolyn MacDonald, the head of marketing at ABC Innovation, said they were used to monitor audience engagement with an external advertising campaign and to measure website traffic.
But the privacy policies of smh.com.au, news.com.au and the ABC do not mention their use of third-party cookies or beacons. Bigpond.com and ninemsn do disclose their use of third-party tracking devices and who installed them. But none of the websites declared how long data would be retained.
"Privacy policies are often intentionally really vague and you can't tell what they do," wrote a privacy researcher, Ashkan Soltani, in a recent study.
Most of the websites this website analysed said they shared information on web customers only within their network or with business partners.
But Mr Soltani said that as some companies had up to 2000 affiliates, that was hardly an exclusive group.
The websites said the information collected was anonymous because users were identified by a unique code in a cookie assigned to their computer and their data was often aggregated with information from other users. Users were also free to delete their cookies, or opt out of being tracked. "We are not tracking an individual, but a browser," Mr Harrison said.
In Australia and many other countries, data collecting is not a crime because the information is not considered personal.
But the Greens senator Scott Ludlam said Australia's privacy laws needed to be reviewed to keep up with the changing online environment.
The acting Privacy Commissioner, John McMillan, admitted data aggregation was a privacy issue but would not say the practice could be breaking the law.
The extent and sophistication of consumer profiling has sparked fears among technologists, privacy advocates and even regulators that web users' anonymity is under threat.
''If you start collecting these bits of data from all over the place you can develop quite a detailed profile of [a] person,'' said a computer engineer, Carlos Jensen, of Oregon State University.
A computer researcher, Catherine Dwyer, at Pace University in New York, said: ''The clear intent of data collection is to track consumers over time and build up digital dossiers of their interests and shopping activities.''
For more than a year, Telstra has been combining demographic information about its phone customers with data culled from their online browsing habits. When customers access their online account to pay a bill, MediaSmart - which Telstra owns - places a unique ID in a cookie on the user's computer. Telstra then builds a detailed profile that includes the user's age and gender as well as search categories used on Telstra's other websites such as the Yellow and White Pages, Where Is and Big Pond shopping and movies. The more Telstra knows about a web user, the more targeted its ads can be.
For example, if a user searches the Yellow Pages for paint, they might receive paint advertisements on the BigPond home page the next day.
The general manager of MediaSmart, Mark Shaw, said this approach allowed ''advertisers to influence people at a critical moment in their purchasing decision-making''.
BigPond said users could opt out of targeted advertising.
Telstra is not the only company to gather web users' online interests and behaviour. Fairfax Digital and Yahoo7 also do it.
While all these companies insist the information is not shared outside their network, there are concerns that businesses will eventually sell their data. "If there is money to be made, you'd be amazed what companies will do," said Mr Soltani.
eBay.com.au already allows information on its web browsers to be collected and auctioned on data exchanges such as BlueKai.
BlueKai said it did not allow sensitive information such as mental health, sexual orientation or religious beliefs to be auctioned on the exchange.
But the greatest fear of many watching the rapid expansion of online tracking and data collecting is whose hands the information may ultimately fall into. With the industry almost entirely self-regulated, there appear to be almost no practical legal limits on how the data can be used.
WHAT WE DID
This website analysed the tracking devices installed on a Fairfax Media laptop by the top 10 most-viewed Australian-owned websites (including websites with Australian subsidiaries) as identified by analytics company Nielsen. Each site was reviewed using software programs called Tamper Data, Ghostery and Add and Edit Cookie. Each website was visited multiple times and all data was removed from the computer before the next website was assessed. This website considers tracking devices to be any cookies, beacons or flash cookies placed by companies other than the original website visited.
HOW TO STOP THE TRACKERS
Cookies are managed by the user’s web browser. You can set your web browser to not accept third-party cookies or automatically delete cookies when the browser is closed. Beacons cannot be deleted and are not stored on your computer. They run as part of the normal function of many websites. However, you can opt out of being tracked by publishers, advertisers or data collectors and exchanges by visiting the Network Advertising Initiative's opt-out page or the websites of various companies such as BlueKai and Yahoo. To remove Flash cookies, web users must visit Adobe’s website.
