Losing control of your online life

London: When Peter Eckersley recently clicked on to one of America's biggest online job sites, he was not alone for long.

Using software to monitor programmes running on the page of CareerBuilder.com, the researcher for the Electronic Frontier Foundation, an advocacy group, saw data identifying his computer being whisked off to at least 10 outfits that track where people go on the internet. More troubling was his inability to tell what the companies did with the data.

His experience goes to the heart of a battle that could shape the future of life on the web — while also having very real knock-on effects in the physical world. The digital dossiers that companies are building from the browsing, searching and other habits of ordinary web users are becoming increasingly refined. At the same time, a deluge of personal information has been unleashed publicly on the web, with Facebook's 500 million users at the forefront.

With rapid inroads on both fronts being made into many traditional expectations of personal privacy, the results could prove explosive.

"Tiny pieces of disparate data are being mashed together to create a digital profile of you in detail you never thought imaginable," says Michael Fertik of ReputationDefender, a company that helps people manage their online footprint. "Whether you stay up late at night or have ever complained about a company could affect your employability. Whether you have expensive spending habits may affect if someone will invest in your company or date you."

As such concerns have spread, the heat has been turned up this year under a long-simmering debate about the limits of online privacy. As an official at one leading US internet company concedes, it would take only one big scandal to do with the misuse of personal information for the issue to boil over.

"Ultimately, there will be some chicanery that will emerge, some dreadful harm that will result from a lack of rules and a lack of strong privacy protection," says Bobby Rush, a Democratic member of the US House of Representatives. "We are at a critical juncture."

Commercial interests

The tensions created by the twin advance of internet tracking technologies and user's own less inhibited approach to exposing personal information online have exposed some deep philosophical differences, while also highlighting the powerful commercial interests that are at stake.

Mark Zuckerberg, the 26-year-old founder of Facebook, has become the champion of what many in the internet industry claim is a generational shift in attitudes to privacy. "People have got really comfortable not only sharing more information and different kinds, but more openly and with more people," he said in a speech in January. "That social norm is just something that's evolving."

Yet he recently discovered that attitudes are not changing as fast he would like. Facebook ran into a barrage of complaints when it changed settings on its site so that some information about users, such as their job and home city, was published automatically, overriding any choice they had made to keep it private. The move drew the fire of European regulators and prompted an investigation by the US Federal Trade Commission, forcing Facebook into a partial retreat.

Legislators and regulators are concerned that internet users have been left with too little control of how their personal information is used and lack the information and understanding needed to make informed decisions. "Internet users must have effective control of what they put online and be able to correct, withdraw or delete it at will," according to Viviane Reding, the European Union's justice commissioner.

"If the goal is providing consumers with information about how their information is being used and giving them some control, that is not being achieved," says Jessica Rich, deputy director of the FTC's Bureau of Consumer Protection.

The outcome of this clash of visions will have a big impact on the profits of companies that operate online. Access to detailed information about users "is extraordinarily important" to Google, Facebook and others offering free services on the web, says Rebecca Arbogast, an analyst at Stifel Nicolaus in Washington. "Their business model depends on them being able to target advertisements more and more precisely to us. It goes to the core of what they are all about."

"Without data, the web would be far less interesting to advertisers," adds Michael Rappa, a computer science professor at North Carolina State University.

If fears about the limits of online privacy have been thrust into the headlines this year, internet companies have only themselves to blame.

"There is a scary race to the privacy bottom that we're seeing," says Fertik.

Google also slipped up in its race to catch up with Facebook. A social function called Buzz, added this year to Google's email service, displayed users' frequent email contacts for others to see. The company changed its policy after an outcry.

In May, Google suffered further criticism for an apparent disregard for its users' privacy after investigators in Germany forced it to admit that it had illicitly collected snippets of internet activity from unsecured home wireless networks.

While gaffes like these have made the headlines, many of the more insidious inroads into online privacy are taking place beyond the view of most internet users.

"In the last few years we've seen the industry develop and deploy these incredibly sophisticated and hard-to-defend-against techniques for following users around the web, building records of what they're reading and thinking and doing," says Eckersley. "Advertisers have an understandable desire to target people more effectively, but that means they end up engaging in surveillance that is often covert, creepy, and non-consensual."

The networks are sharing data with each other to build more complete records and peddling access to millions of internet protocol addresses of individuals with specific attributes.

"Everybody has been moving to do more with identifying individuals or using individuals' behaviour," says Tom Alison, chief executive of ClearSight, an online direct marketing company.

Transparency and choice figure prominently in the responses that regulators are preparing.

The effectiveness of such rules will lie in the detail — and in whether ordinary internet users understand or care enough to exercise whatever new controls they are given.

Careful what you post, it could land you in court

Linda Lea Viken, a South Dakota divorce lawyer, says she has all but stopped using private investigators to collect evidence against clients' spouses. "We used to use PIs, and occasionally got incriminating pictures. Now we just look on Facebook. It's cheaper, and it's usually better. Instead of pictures taken from outside houses, I get pictures taken inside."

Even as new technologies paint ever finer portraits of individuals based on their web activity, the greatest risk to privacy online for many users is their own ineptitude. Sites such as Facebook and Twitter encourage the sharing of status updates, travel plans and photographs, making it easier inadvertently to wreck a marriage, friendship or job.

A psychological disconnect is growing between the real and online worlds. "No matter how much you know that what you post can be subpoenaed, if not copied and pasted and spread all over the world, you behave as if you were alone," says Sherry Turkle of the Massachusetts Institute of Technology. Evidence from social networking sites is now common in divorce cases, according to the American Academy of Matrimonial Lawyers. "What you tweet and what you post can and will be held against you in a court of law," says Viken.

Beware of the net nasties

Online advertising and marketing companies say the profiles they compile of internet users do not contain information that would make it possible to identify individuals, write Joseph Menn and Stephanie Kirchgaessner. But some experts warn that the supposedly anonymous data that come from web browsing habits and other sources could result in the unwanted attention of identity thieves and others. Part of the problem is that the data are spread widely.

A visit can be logged by the site owner and tied to an internet protocol address, which in many cases can be linked to a specific computer. The data are typically shared with the advertising network delivering the adverts, which in turn sends data to the agency that bought the space and to the advertiser itself. Other parties include re-targeters who refine the marketing campaign based on what sort of people are clicking on the adverts. Datran Media, a US marketing company, buys personal data from brokers and combines them with an individual's web history.