In other news, a woman in Michigan is suing the distributor of the recently released movie “Drive” because the trailer suggested it there would be more car chase scenes. I’d suggest the defendants cite “The French Connection” precedent — one great car chase is worth the entire film.

While the latter case will likely be thrown out immediately (if not un-filed in embarrassment), the five against Facebook may not have much of a chance either considering that similar suits brought against online companies for wiretap law violations were summarily dismissed — if not settled first. As Future of Privacy Forum Director Jules Polonetsky explained to MSNBC, in addition to lack of grounds for a wiretapping case, many of these suits get canned because the defendants can’t show harm.

There’s definitely a whiff of ambulance-chasing in the air. One of the suits seeks statutory damages of $100 per day for every member of the class (the lawsuit is trying to certify all 150 million U.S. Facebook members as a class — so $15 billion a day, huh?) or $10,000 per violation, plus punitive damages, attorney fees and court costs.

Evidence disclosed in these lawsuits (if they make it anywhere) could be quite useful in understanding how Facebook maintains collected browsing data, but there’s a third-party not looking for Facebook’s money that could prove to be a better auditor: the Federal Trade Commission. And its findings could shake Internet consumers and tech developers out of our online privacy malaise.

But What’s Facebook Actually Done Now?

Right as the addition of Facebook apps freaked out some users about how much data was headed back to Papa Zuck, Australian developer Nik Cubrilovic illustrated that when you log out of Facebook, nine cookies still hop on your browser including the one with your unique account number. These stay on your browser until deleted (think about if you access the social network from a public computer) and record whenever you hit a site integrated with Facebook (which is like the half the Internet, right?).

Probably because we haven’t had a good Facebook privacy scandal in a while, the story got picked up across the media and Zuck & Crew were forced to answer. First off, they changed the logout rules so the cookie containing the user id (A_USER) was deleted on sign-out, along with A_XS, which is used to stop “cross-site forgery.” Facebook explained that the rest of the cookies are used for security purposes — pretty much challenging hacking attempts by ensuring users are who they claim to be on login.

Well, that explanation hasn’t sat right with everyone. DATR, the cookie that sends data back to Facebook from Facebook-integrated sites whether they’re logged in or not, was first noted by The Wall Street Journal (complete with hyper-paranoid and obtuse/not quite correct headline: “‘Like Button Follows Users”) back in the spring, but DATR was removed before publication of the article.

It’s back now – Stanford Security Lab’s Jonathan Mayer noticed it had begun appearing a few weeks and Cubrilovic asked Facebook just what it’s doing with the data sent from third-party sites:

“Facebook keeps the data collected for up to 90 days and then delete it. I believe them when they say this and that they are not hiding anything, but I also believe that our definitions of tracking differ. If you set a cookie on a users machine from one website, and then read that cookie from that persons machine from another website, that is tracking (emphasis in original)…. [I]t is still tracking and still has the potential to violate the privacy of users simply by being collected.

“At a minimum they are tracking by reading the cookies, and if you look further into some of the patents that Facebook has filed, as well as their business model (advertising), it is not a big leap to make to conclude that Facebook are tracking users and analyzing that data.”

Yep — speculation that it’s being used or could be used for advertising purposes, but no smoking gun. If Facebook is even using the cookie for security purposes, it’s associating browsing data with specific users. However, there’s no evidence such profiling is being used for targeted advertising. All the targeted advertising on Facebook is based on user-submitted/shared information.

Ad Network? Nah…

And Facebook has a great counter to claims it’s building profiles of browsing data: We don’t sell the data to third parties or have an ad network that employs behavioral targeting, and we’re not building one.

Of course, many in the industry are incredulous about that plea. Why? Money: Facebook is reportedly set to bring in $4 billion in ad revenue from on-site advertising, but that’s nothing compared to what Google brings in during a quarter.

And as it hit the 800 million user mark (with about half the U.S. population on the network), questions arose about the future of the network in general — after seeing Badgeville’s easily insertable social layer, I could imagine activity on Facebook the site slowing down. I was impressed with the introduction of apps, which nearly effortlessly connects off-site activities with the social network, but I still wonder if it’s about to hit peak velocity.

At a Federated Media conference during Internet Week, Facebook Vice President of Global Sales Carolyn Everson strongly pushed the (relatively) new Sponsored Stories unit, suggesting that Facebook wanted to “partner with brands” on their advertising. Facebook has long eschewed typical online advertising products (Everson suggested homepage takeovers would never appear on Facebook — but what about sleeves like on MySpace? No on that too?) even when it lead to disasters like Beacon (which also got Facebook sued — successfully).

Sure, Mark Zuckerberg wants to innovate in the online advertising arena, but it’s still hard to believe that Facebook simply won’t take advantage of the huge revenue opportunity staring it in the face – it’s got the data, it’s got the reach, so where’s the behavioral targeting platform and display network?

On the other hand, Zuck may be more concerned about the long-term survival of Facebook the brand and the social network (or possibly as a deeply integrated social layer stretching the Internet) that he won’t take the money and run.

Also, if Facebook was to turn on an ad network tomorrow, the public ire at the about-face could be overwhelming. And now there’s a service around that disenfranchised users could arguably jump to.

Online Privacy Fatigue

I caught a GigaOm piece by Derrick Harris lamenting the lack of media coverage regarding The Wall Street Journal’s privacy policy update that included the use of new registrants’ personal identifiable information in building online profiles — for content purposes only, they swore. (I had an email give and take with a WSJ press person who denied me any clarification on whether profiles built with PII and browsing data would be used in selling Harris’ story targeted advertising.)

One paragraph of particularly grabbed me:

“I don’t particularly care that the WSJ expanded its data mining reach — it’s the company’s right as long as we treat personal data as property that can be contracted away — but I do care what the lack of discussion says about how we think about online data privacy. If this had been Facebook making a similar move — or, actually, making a much less aggressive move — you couldn’t escape the outcry.”

Interestingly, this story was published on Oct. 4, when the outcry over the logged-out cookies was starting to boil. I was one of the proud few who immediately jumped on that story because it sounded like the WSJ network was implementing a profiling system that WSJ reporters had sensationalized in the year prior.(I have no issues with WSJ’s data mining either.)

But I was actually going to leave the latest Facebook “privacy scandal” to sites like ZDNet and Inside Facebook, which have offered great analysis. Truth be told, I just wasn’t that interested in diving into this mess again, painstakingly reading all the coverage and research to figure out what the hell was actually going on — whose claims were overstated, whose were obtuse and what the data actually meant. I just did it with Apple on “locationgate” and Hulu/KISSmetrics in regards to e-tag tracking.

Just like a lot of the ambivalent people (consumers and OBA industry folk) out there that Harris is worried about, I got a bad case of online privacy fatigue. There’s so much back and forth and so many accusations shouted into the media megaphone, but nothing really ever happens. Nothing ever changes. E.g., Facebook shut down the DATR cookie after WSJ got word and now it’s back on duty.

Today a research paper is being released at an event in Washington, DC, sponsored by the ACLU, Center for Digital Democracy, Consumer Action, Consumer Federation of America, Consumers Union, Consumer Watchdog, Electronic Privacy Information Center, Privacy Rights Clearinghouse, US PIRG and World Privacy Forum. The press invite claims it will definitively prove that tracking methods aren’t anonymous. When I sent some feelers out to industry contacts for their takes, I mainly received back yawns. Oh, this shit again.

The keynote at this speech, however, is being given by Federal Trade Commission Chair Jon Leibowitz, who, according to the press invite, will “discuss the proposed FTC framework for protecting consumer privacy and ensure industry can continue to innovate on the Internet.”

It so happens, EPIC joined eight other online privacy advocates (almost all involved in the above event) in writing a letter to the FTC asking the agency to investigate Facebooks use of tracking cookies post-logout. I hope they plead their case again because an FTC investigation is the ideal solution for both examining Facebook’s data collection practices and stirring the online privacy fatigue.

While the evidence disclosed in the suits mentioned at the top could be useful, it’s hard to ignore the ulterior motive — the remuneration demanded (for what harm?) in the lawsuits kind of shoots them in the foot. On the other hand, an unmotivated, third-party auditor could show us just what browsing data Facebook has and what it is doing with it.

And it’s time for the FTC to talk less and act more. For at least two years, the FTC has been fanning consumer fires over privacy controls while promising OBA companies it won’t “strangle the golden goose.” But what’s it actually done? File suit against some affiliate marketers? Great — that totally solved the belly fat ads crisis.

Granted, I’ve gotten used to the speed of digital innovation and forgotten the lurching pace at which Washington moves. But agency members constant tsk-tsking about the industry pulling its act together has only highlighted the lack of progress in an OBA framework.

Well, here’s your chance for action, FTC — to actually show you’re protecting online consumers while insuring a fledgling (relatively) industry can continue to flourish. Investigate Facebook’s use of tracking cookies, give us a detailed report. And please don’t take two years to do it….

UPDATED: WSJ reached out and highlighted this paragraph from their privacy policy: We will not sell, rent, or share your Personal Information with these third parties for such parties’ own marketing purposes, unless you choose in advance to have your Personal Information shared for this purpose. I asked for clarification on whether the network would use the combined PII/browsing data in segmenting audiences (anonymously) for selling targeted advertising. The response: “We do not use PII to serve online advertising, and this has not changed with the release of the updated policy.” Clarification denied!

The change — which applies to WSJ.com, Marketwatch.com, AllthingsD.com, Barrons.com and SmartMoney.com – from seeking “express affirmative consent” (lawyer-speak for “opt-in”) only applies to new registered users and subscribers. The updated privacy policy includes additional details about tracking practices as well as links for opting out of third-party tracking. The Journal does rent out its print subscriber list, but not its online one.

According to the article and WSJ Digital Network General Manager Alisa Bown, it’s all about consistency across the board: The change “allows us to be consistent with how we handle privacy across our network of sites, it makes our policy easier to understand and use, and it ensures our practices are consistent with the way we are evolving to better meet the needs of our users.”

It’s a bit of an ironic announcement considering WSJ’s “What They Know” series about online data collection practices, which has been raising all kinds of paranoia about web tracking through the kind of sensational journalism that made News Corp. charirman Rupert Murdoch a rich, rich man.

In particular, reporters set their sites on data company Rapleaf, which builds targeting profiles using names and email addresses (that are not shared with the advertisers). The series, which for the most part I’ve detested for trying to raise controversy without clear explaining how tracking and targeting technologies operate, actually had several insightful articles related to mobile IDs — in particular, mobile apps sending UDIDs to third parties without user consent.

To make it clear, I’m not condemning the move or trying to spread paranoia about WSJ’s tracking/data-gathering practices. I applaud WSJ for being so transparent not only in its privacy policy (which is very easy to navigate and read) but also on its sites.

Considering that some sites on the network are subscription-based, connecting PII and browsing data may be the optimum way for WSJ to sell inventory for targeting. Data collected using mobile UDIDs will likely be advantageous for internal analytics concerning mobile content consumption.

I’m just reporting the news — with a smirk on my face I can’t get rid of.

As much as I may criticize The Wall Street Journal’s “What They Know” series for being hyper-paranoid, the paper’s coverage on mobile app data has actually been very informative. WSJ shares viaForensics findings that several apps aren’t encrypting stored user name and password data on Android devices, which frankly seems bizarre…

Fwix tells TechCrunch it plans to index the web location by location — starting with NBC’s local sites in New York and the Bay Area.

Video audience targeter Grab Networks will provide clients with a slew of new advertising formats thanks to a partnership with AdoTube.

PointRoll claims to be the first ad tech company that will be able to support the six winners of the Interactive Advertising Bureau’s “Rising Stars” contest, including AOL’s Project Devil, renamed IAB Portrait.

Thanks to a partnership with mobile rich media tech firm Phluant, TRAFFIQ clients to will now be able to serve rich media mobile creative across a wide variety of mobile inventory services.

I imagine most avid WTK readers safely tucked away in isolation booths, handling the print edition with latex gloves while tightly clutching their tin-foil hats.

Yup, WTK (so close to “WTF?”, my typical reaction when reading entries in the series) is back with a new shocking privacy intrusion, and they roped not only Facebook but also Google and Twitter. The mighty triumvirate! So what are these meddling kids guilty of this time?

The social networks’ widgets — the Like button, the Retweet knob and… well, Google Buzz has some doohickey that a whole five people probably use — are collecting browser data and sending it back to the network even if a user doesn’t click. The only way to stop the collection is to “explicitly” log out of Facebook, Twitter or your Google account. WSJ discovered this by charging Brian Kennish, former Google engineer and maker of anti-online-tracking software Disconnect, with examining data collection on the Google ad network’s top 1,000 sites.

Such data could be used for tracking and building profiles for targeting. There’s no explicit proof anywhere that the data are, but they could be.

The networks claim that the data collection is a side effect to how these smart widgets work. Twitter claims it deletes this kinda superflous data immediately, while Facebook and Google say they anonymize them (similar to what Apple and Google do with location data for smartphones) to analyze widget performance and “and help other websites attract visitors” before deleting them — within 90 days for Facebook, two weeks for Google.

I’m curious what helping “other websites attract visitors” entails, but I’m inclined to think the collection is innocuos. I’d argue a lot of this browser information is junk data — fatty, no-good data that would probably mar targeting efforts.

Consider Gmail ads — how many show up that reference a random term within the text? If I commented that so-and-so isn’t the sharpest tool in the shed, I might receive an ad for wrench sets on sale. That’s dumb targeting, likely to annoy me or justify my continued ambivalence toward online advertising.

There’s a prevalent paranoid theory that Facebook and Google are sinking vast amounts of browser information into detailed, secret profiles that could be used for targeting ads (or worse — just wait till Mark Zuckerberg is president!). But browsing data is so plentiful that the majority is useless — unless the browser engages with the site at hand by using a social widget.

At the same time, Google, Facebook and Twitter could probably look into a remedy for collecting unnecessary data — call it an olive branch to the tin-foil hat community.

Because these highly valued companies remain private, action on the secondary market — where current private stockholders such as venture investors and employees can trade shares — has drawn the attention of the media for driving up valuations. The market has also drawn some chin-scratching from the Securities Exchange Commission, though it wasn’t exchange operators like SharesPost and SecondMarket that were being scrutinized but company-specific funds that were pooling smaller, nonprofessional investors and giving private companies a loophole out of the Exchange Act registration and regulatory scrutiny.

A new controversy developed last week as Wall Street Journal would-be muckraker Dennis Berman misrepresented the truth (that is, lied) in registering his long-departed grandmother as an accredited investor on SharesPost. The SEC deems accredited investors as having minimal financial assets of $1 million or annual family income of $300,000.

Scandalous, huh? Well, SharesPost CEO Dave Weir sent out an angry email on Friday night explaining that Berman actually proved how well the private exchange’s qualification system worked.

“Our broker and electronic systems detected his fraud and barred him from our platform within six hours of submitting his fraudulent information and long before he would have been able to execute trades,” Weir wrote. “Somehow that fact was treated as a mere footnote to the story, leaving readers largely misinformed and our company unfairly maligned.”

Berman, on the other hand, suggested in his story that he spent “a few days loitering, testing and playing in these private markets.”

But the point of Berman’s deception was not to portray the secondary markets as amateur or crooked operation — yes, he was able to fool the sentries at the gate for a little while and get a look at the inside workings of the secondary market, but he didn’t actually do anything. Buying shares on these exchanges is pretty difficult, he wrote — it’s not Amazon with one-click buying.

Berman did, however, achieve in shedding doubt on whether private markets can scale. His “insider” perspective showed that the exchanges not as big as media hype might make you believe. There are a few huge companies — ahem, Facebook, Twitter, yada yada — drawing attention, but a limited pool of investors (though whether some of these investors aren’t pools in themselves has yet to be answered). In essence, his piece is meant to quell the super paranoid who think the end is near for the public markets and question how much more the secondary markets can swell.

It’s also another sign that if there is a social tech bubble expanding — you know you ponder that question every time Facebook’s valuation jumps another $10 billion — it’s a private bubble and the fallout from it popping will be minimal.

However, The Wall Street Journal has a few anonymous sources saying that YouTube will spend $100 million on low-cost programming specifically produced for the web. YouTube spokespeople declined to comment.

The new content would be part of a major overhaul of the most popular online video site to make it a better experience for those tuning in on their Internet-enabled TVs. According to WSJ’s sources, YouTube’s homepage will be reorganized to highlight “channels” dedicated to various verticals, including arts and sports. Many channels will consist of posted content, but 20 or so will feature several hours of “professionally produced original programming” a week, WSJ reported.

Google has been chatting with the National Basketball Association and other sports leagues about live-streaming games, which could be a super boon for viewership. The company has also been talking with Hollywood talent agencies — including Creative Artists Agency, William Morris Endeavor and International Creative Management — about content creation for the aforementioned channels.

Apparently Google wants YouTube to compete with broadcast and cable channels — but I don’t understand why. YouTube is a haven for user-generated content — users head there for that specific reason, even if they’re watching on a television set. With the NNN acquisition, Google had a talent agency for hooking up its UGC stars with brands — such branded content is where the real money is made in online video, hence why Google wanted a cut of the action.

But putting $100 million toward original video content seems a little puzzling. Such a paltry amount of spend isn’t really enough to make products that can “compete” with broadcast and cable television — not 20 channels worth, anyway. The fact that no one will go on the record about it makes me all the more specious.

Along with refreshing its search algorithm to boost rankings of high-quality sites while — i.e., giving content farms the boot — Google has come down hard on discount retailer Overstock.com after it practiced some naughty SEO. According to The Wall Street Journal, Google has banished Overstock’s listings to the fifth or even sixth page of results.

What was Overstock’s crime? Well, the retailer said it made Google real mad when it was encouraging college and university websites to post links to Overstock pages — all the retailer wanted was to give out some discounts to teachers and students (I hear they’re our future). Alas, those sites boast .edu addresses, which Google values as more authoritative in its rankings. Google won’t be played like dat.

Overstock CEO Patrick Byrne replied in a statement: “We understand Google’s position and have made the appropriate changes to remain within Google’s guidelines.” The company also says that it killed the program on Feb. 10 — before it was contacted by Google.

Whoa — did Google jump the gun here? Was Big G trying to look tough after blowing it with J.C. Penney? Or did the Overstock guys simply get caught in the act?

Also, on a side note, WSJ makes no distinction in its coverage between white hat and black hat SEO practice, kinda suggesting that all SEO is an attempt to boondoggle search engines. Google doesn’t disapprove of a great deal of SEO techniques that businesses should apply in their online presence to ensure they’re seen in search results.

Just like its reporting on online data collecting technology, Rupert Murdoch’s pub has made SEO sound like another dastardly online activity… Practiced by them!

Similarly, BlueCava gathers the plethora of information shared by a browser with a website to build a device profile, complete with an identifier — the system recognizes if a user deletes cookies or refreshes IP and simply updates the profile. According to CEO David Norris, BlueCava has fingerprinted 200 million devices.

And one of them could be yours! Run to the bunker!

As is typically the case in history, technology has improved faster than our ability to evaluate the ramifications (the nuclear revolution comes to mind), hence the overblown fuss about behavioral targeting and other newfangled advertising technologies – of course, you also have politicians and media outlets exploiting privacy fears for personal gain.

A common argument of privacy advocates is, “If they were tracking you in real life, you’d be frightened.” But that’s a poor analogy: Internet tracking is not equivalent to real-world stalking.  The Internet is still a growing medium with constantly changing rules, and thus it should be contemplated differently.

Fortunately, industry players like Norris speak openly frequently about the privacy implications of technologies such as device fingerprinting in order to foster true debate. He was kind enough to talk to me (again — I didn’t scare him off the first time!) being featured in WSJ, privacy concerns around device fingerprinting and whether the Internet has become a surveillance state.

ADOTAS: How about that WSJ? Did you feel honored to be included in Rupert Murdoch’s “War Against the Internet” and the Journal’s hyperventilating “What They Know” series? Received any sympathy calls from RapLeaf?

NORRIS: I really enjoyed doing the interviews with the WSJ – they went pretty deep into what we do, how it works, and after spending a bunch of time with them I think they really got why we are different. I think they wrote a good piece and we got a ton of press inquiries afterwards.

Why are privacy advocates calling you an “idiot“? Sounds a bit harsher than saying you guys have a difference of opinion.

Not sure about that – have not heard that one. We have been contacted by a wide range of privacy advocates and most of them are quite interested in our business model. We have had very open discussions with them and I look forward to a continued dialogue with productive results.

What are your thoughts on the FTC’s proposed “Do Not Track” list? How would such a list effect device fingerprinting?

I think that privacy is an important topic and that consumers should be protected. And I support the FTC’s efforts to push the industry to self-regulate. BlueCava’s privacy system allows consumers to specify their preferences and opt-in/out of being tracked, separately from being targeted.

We believe that there is an important distinction between the two – tracking is all about “watching” which sites you visit on the web, while targeting is all about serving relevant information for consumers. We believe that consumers should have the choice, so we provide both options.

Is there a way to opt-out of device fingerprinting?

Yes, we provide a way. Some vendors do not… so it varies a bit depending on who you are dealing with. To opt-out of BlueCava, you can simply visit our website and select “preferences” at the bottom. This takes you to our preferences page, which allows you to set your preferences and/or opt-out of tracking or targeting.

Can you give us a sneak preview of BlueCava’s soon to be debuted “Reputation Exchange”? How will it work?

BlueCava’s Device Reputation Exchange allows businesses to share their experiences with various devices that visit their website. This allows businesses that experience fraud, to tell other businesses about the “bad” devices, so they can be blocked from doing further fraudulent transactions. Just like credit card companies have been doing it for years, only with devices.

BlueCava’s exchange also allows businesses to share useful information about the category of product that devices are purchasing, such as shoes or travel. This enables other websites to provide more relevant content for each device, improving the overall experience for users.

What kind of companies are most interested in BlueCava’s technology? Are mobile-oriented firms and agency divisions more piqued than their online cousins?

We have a very wide range of interest in BlueCava’s technology, from large e-commerce sites, to gaming sites, to social networking sites, and more. Basically any site that is interested in creating a better experience for their users.

Mobile is certainly a very fast growing segment of the market and in important part of our business. We offer a very powerful multi-channel marketing solution that allows mobile advertisers to measure the ROI for their campaigns, by measuring the influences and/or conversions that occur, as a result of their mobile ad campaigns. This has been a missing piece of the mobile advertising puzzle, until now.

Is device fingerprinting an alternative or a companion to current targeting and data collection methods?

Device fingerprinting can be both an alternative or a complement to existing targeting technologies. Most ecommerce sites will use it as an additional technology, allowing them to extend the value that they receive from older technology solutions. In the mobile advertising space, device fingerprinting is one of the few solutions, since older technologies like cookies were not available for mobile apps.

You mentioned in WSJ that the cookie system was created by accident — sounds like a funny story…

Yeah, it is a system that we created out of a pure need for something, but was never intended to be used to the level that it is now.

How much more time do cookies have left before they are abandoned? Or are they never going away?

They will be around for a long time, as tends to happen with any legacy technology. Once it is used widely, it takes a long time to fade away. Their use will be greatly reduced over the coming years…

Do you consider gathering offline data to assist in building online device profiles a privacy violation? Does it matter that you strip out PPI such as names?

Not at all. Usage of offline data has been happening for years. We are helping to move offline data online so that more relevant content can be provided to consumers. In the end, that is what consumers really want. We do not use any personal information, and in fact we have no idea who the actual user of a device is, so the privacy of the individual is protected.

Is collecting online consumer data “surveillance”? Is the Internet a surveillance state?

Not really. Collecting data about consumers is just a well-tested method for understanding what the consumer wants. This has been done for years, but now we have better tools to allow information to be collected across a broader audience, faster and easier than before. This results in more tailored content for consumers, which is good for everyone.

It’s a big enough deal that the Mobile Markting Association (MMA) has launched an initiative to develop a comprehensive sets of mobile privacy guidelines that would complement its current Global Code of Conduct. Led by Alan Chapell of Chapell & Associates, the MMA’s Privacy Committee will tap mobile carriers, marketers, agencies and technology firms to build a framework regarding mobile data collection.

Analyzing the data transfered by 101 popular smartphone apps, WSJ found that 56 sent the unique device ID (UDID) to third-party companies such as ad networks without informing or asking for consent from users. A UDID is not an equivalent to an IP address, mainly because it can’t be refreshed; for example, each iPhone has a 40-character ID that is set in stone.

Some tracking companies are building profiles (anonymous — no PPI) based on data received from apps for targeted advertising. That use isn’t necessarily wrong or something that consumers will light the torches and sharpen the pitchforks over — the issue is that these apps have been tossing about data secretly.

It’s very disappointing that mobile app makers have been lazy/thoughtless/sneaky in regards to informing consumers about data shared with third parties. You’d think they would have taken a hint about data-sharing transparency from the online world, but WSJ found even worse stuff: 47 apps transmitted device location details in some fashion and five sent age, gender and other personal details to third parties, all without explicit explanation or permission from the user.

For some reason I keep thinking about device fingerprinting firm BlueCava, another company the Journal profiled recently; I had interviewed CEO David Norris a few months prior.

BlueCava’s software gathers the surprisingly large amount of information a browser shares with a website, encrypts it, analyzes it and dispenses a unique ID that allows it to track a device wherever it goes online. If you switch browsers or dump your cookies, BlueCava’s system is smart enough to realize it’s the same device and simply updates its records.

According to WSJ, BlueCava has identified 200 million devices, but there isn’t really a method for informing consumers they’ve been fingerprinted. While suggesting it was building an opt-out system, Norris said it was trying to be crystal clear about how the data is used.

Frightened of cookies? Did the idea of the evercookie make your hair stand on end? Who cares? The technology already exists to identify and follow your device — be it PC, smartphone or tablet, regardless of IP address. So is a device an extension of a person? Does it deserve the same level of privacy?

If you take their word for it (and you should — accessing PPI only leads to headaches for trackers and advertising tech firms), firms like BlueCava are not diving into your address book or financial records — they’re just examining what you browse, what games you play, etc., then putting you into broad audience categories for advertisers to target. Not really that alarming when you lay it out on the table.

The sneaky business is the issue. Tech firms, app developers, publishers all gotta be upfront about data collection — and to its credit, BlueCava has been very forthright in talking about its technology.

To ease the minds of worried consumers, there should be an easy, universal way to opt out of data collection. Although it’s definitely a middle finger pointed in Google’s direction, Microsoft’s “Do-Not-Track” option on the updated Internet Explorer browser truly puts the control in consumer hands.

No matter how much it will affect the targeting industry, a do not track list might be the answer. Then again, considering what a bustling business the data-collecting and targeting industry is (and what a crap economy we’re wading through), I kinda doubt such a thing will gain traction in Congress. Lobbyists will likely grease the right squeaky wheels to ensure the tracking business keeps on growing.

And I’m in the camp that targeting — behavioral, social, whatever — is the last, best hope for effectively monetizing most content on the Internet. Maybe we should just drop the pretense and admit that there is no such thing as privacy on the Internet — or with mobile apps. Granted, “browse at your own peril” isn’t much of a slogan…

Arguably, developers of browsers should be the ones to offer a universal “Do not track” option. And publishers of premium content will build systems that recognize when users have opted out of tracking and deny them access without paying an entrance fee — cash or the ability to grab your IP address and possibly drop a cookie. This mobile app is free as long as you let it collect information to sell to third parties; otherwise it’s $10.

Content isn’t free. It may sound like a pain in the ass, but that’s the compromise consumers and advertisers are eventually going to have to reach — either with federal interference or blessing.

Beyond that, though, groups like the Digital Advertising Initiative should be setting industry limits on the amount of data that is actually collected — that’s the next can of worms waiting to be dealt with…

In 2004, the documentary “Super Size Me”, followed American independent filmmaker Morgan Spurlock as he ate three meals a day for a period of 30 days at various McDonald’s fast food restaurants. During the 30 days, Spurlock’s weight increased from 185.5 pounds to 210 pounds for a gain of 24.5 pounds.

According to his personal trainer, Spurlock is in above average physical shape at the beginning of the project. Despite this, he suffers from heart palpitations during day 21, and is advised to stop eating at McDonald’s immediately by his internist, Dr. Daryl Isaacs, in order to avoid any serious health problems. Other side effects include a cholesterol level of 230, mood swings, sexual dysfunction and fat accumulation to his liver.

“Super Size Me” is the twelth highest grossing documentary film of all time, generating revenue of $20.6 million worldwide. In addition, the film was nominated for the Best Documentary Academy Award, but ultimately lost to “Born Into Brothels.”

I was wondering what effect the movie would have on (1) obesity in America and (2) sales at McDonald’s.

According to the research from the Centers for Disease Control and Prevention, the prevalence of obesity among adults aged 20 years and over in 2004 was 24.5% (crude estimate), which grew to 28.7% in 2010 (crude estimate), an increase of more than 17%.

Revenue at McDonald’s also increased from $17,889 billion in 2004 to $22,745 billion in 2009 (2010 results aren’t published yet), a 27% increase (NOTE: these numbers include all international revenues for the McDonald’s corporation, taking into account revenue from other, non-McDonald’s operations. In addition, it should be noted that revenue decreased from $23,522 billion in 2008 to $22,745 in 2009).

Though my analogies aren’t 100% definitive or necessary relevant to how people perceive online privacy, they do raise some questions regarding the impact (or lack thereof) of the controversial movie “Super Size Me.” Did it have any impact on America? If it had an impact, what is it?

“Super Size Me” did impact McDonald’s marketing and product management. The company discontinued its Super Size option six weeks after the premiere of the movie, and has focused more on healthier products like salads.

If people aren’t concerned with their physical health, are they really worried about an advertiser knowing that they’re 35-44 with more than 300 friends on Facebook who play Farmville and watch “Solid Gold” on YouTube? Or is it an issue of control and personal choice – they go to McDonald’s by choice, but don’t choose to be targeted by advertisers.