The great cookie conundrum

Until recently, if you asked Joe Bloggs what a cookie is, he would probably have been vaguely aware that it is something on your computer that remembers when you’ve been on a website. But the general level of understanding is becoming more sophisticated – and that matters.

In the past couple of months, cookies have had a great deal of bad press thanks to the revelation that Facebook tracks web users’ behaviour even when they are logged out. That came to a head this past weekend, with Facebook giving a fairly full account to USA Today of how it tracks people’s browsing habits.

Members are tracked in different ways depending on whether they are logged in, but in either case, a cookie will record any visit made to another site using Facebook Platform technology – put simply, any page with a Facebook “like”, “share” or “connect” button.

When logged in, a “session cookie” combines details of these visits with any personal information shared on the individual’s Facebook profile – for example name and friend list – as well as the computer’s unique IP address. When logged out, the personally identifiable profile data is not collected, but a “browser cookie” still logs the same browsing details and the IP address, which could easily be used to link the two sets of data. Facebook claims it does not do this, however.

Even non-members’ website visits can be tracked, as long as their web browser is set to accept cookies. From the moment they visit a page in the Facebook.com domain, a cookie can track their visits to pages on the Facebook Platform and match them to the IP address. Facebook says it keeps records of a user’s browsing for 90 days.

In the US, the Federal Trade Commission has been investigating Facebook’s attitudes towards user privacy, but here in the UK the Information Commissioner’s Office has yet to look into its use of cookies, saying in September it had not yet received a complaint allowing it to act.

The story is important, firstly because Facebook has 800 million members and secondly because it brings cookies to mainstream attention at a time when online advertisers, particularly in Europe, are having to find ways to get consent before placing cookies on a user’s browser. The public’s understanding of what cookies do is going to be important in determining how new laws in this area are enforced – enforcement is likely to be harsher if authorities believe users find behavioural tracking an invasion of their privacy.

Facebook’s disclosure of the level of detail it records is likely to worry more people than it reassures. The company changes its privacy policy so often that no-one can know what the data might be used for in future, even if it is true to its word right now.

But not everyone believes the public is so concerned. Vice president of IBM’s Enterprise Management Group Yunchun Lee told me last week he thinks people are more accepting of and more familiar with the idea of behavioural targeting than they ever have been before. The rate at which users flush cookies from their browsers is declining as years go by, he says, because “people see the value of keeping a cookie”.

But he also says that online marketing needs to be seen as a service rather than a sales pitch if this perception is going to prevail. Facebook, for one, needs to make clear why it needs to track us so closely, and tell us precisely how we benefit, if we are to believe that we get value from the relationship.

Have you used data to drive exceptional ROI this year? Then enter the Marketing Week Engage Awards 2012 by clicking here.