Some wine industry websites track their visitors egregiously

Much fuss is made these days about the potential invasion of privacy involved in the act of tracking visitors to websites. In many cases, the visitors are not told about the extent to which they are being tracked by any given website, least of all by the website providers themselves. Indeed, this is so bad that the European Union has legislated against it, which prevents quite a number of US websites from serving EU visitors.

Most of this tracking is allegedly done in the name of "providing a helpful customer experience", but in actual fact this requires very little tracking, if any at all. In practice, most of the tracking is done in the name of advertising — tracking the potential customers' online behavior so that they can be served carefully targeted ads. (Note: this is quite a different thing from other forms of web privacy invasion, such as data security, and leaking of personal information.)

Ad tracking borders on the unethical in many cases, and clearly passes that border in some cases. So, the obvious question is: where does the wine industry stand on this matter, in practice? (What people say, is another matter entirely!) It turns out that we can actually find this out for ourselves.

This is because the topic has been the subject of some practical research, in the sense that there are now tools for you to find out what any given website is doing when you visit it. One of the most ambitious of these is the Blacklight Privacy Inspector. The public release of this tool a few months ago did attract some media attention (eg. 87 percent of websites are tracking you. This new tool will let you run a creepiness check). The Markup company itself ran its own checks on 80,000 of the most popular sites, which provides us with some useful comparison data. One of the most unexpected outcomes was that the site owners themselves often did not know that the homepage set-up tool they had used had inserted trackers into their website (The high privacy cost of a “free” website).

The Blacklight tool checks any web address that you give it, and looks for a number of potential privacy invasions that could be occurring:
  Number of ad trackers
  Number of third-party cookies
  Tracking that evades cookie blockers
  Session recording
  Keystroke capturing
  Facebook pixel
  Google Analytics internet tracking
These are described in detail in an online article (How we built a real-time privacy inspector), and I briefly discuss them below.

So, let's name names. The table at the bottom of this post presents a somewhat arbitrary collection of five dozen wine-related websites. I have tried to include all of the usual suspects, supplemented by a few sites that I sometimes read myself. I apologize in advance to those of you who have been left out, or if anyone finds releasing this information embarrassing. My ultimate aim is to make wine-industry websites as clean as possible, by pointing out where the dirt has accumulated.

Note, also, that I have excluded online stores selling wine and accessories, which are far and away the most likely sites to be tracking you (for their own purposes). They may appear in a future post (now online as: Ad Tracking by online wine shops is variable).

The columns of the table present each of the seven Blacklight criteria, evaluated by me during this past week, for each of the named sites (one per row). The first two criteria list the number of trackers encountered, while the other five columns indicate (Y=yes) that the site was detected carrying out the named tracking activity.

I am pleased to report that 11 / 60 (18%) of the sites were not detected doing any ad tracking at all. Kudos to those one-fifth of the website owners. Note that the Wine Gourd does have one cookie, as do all Blogger sites (owned by Google), and also Facebook sites.

Potentially the most invasive activity is Keystroke Capturing, which records every single time you press a keyboard key (such as when entering your personal details in a form). There were 2 sites apparently doing this, which Blacklight reports as an average percentage across the web. It is possible that this use is (or once was) actually legitimate, as it is sometimes used for auto-completion of forms. This would need to be checked.

Session Recording keeps a record of your on-site activity, including mouse movements, clicks and page scrolling. This is sometimes ostensibly done to optimize the layout of web pages, but it can also be used for ad tracking (see Advertisers can now tell if we're paying attention). There were 4 sites doing this, which is half the Blacklight average; but why do it at all? These sites definitely do not need to be doing this.

Evading Cookie Blockers (aka Canvas Fingerprinting) is the next most egregious action. There are browser add-ons or extensions that we can use to stop cookie tracking by any website that we visit (the one I use is Privacy Badger); and when we use them we mean: Don't Track Me! There were 5 websites found to be using fingerprinting, which is a bit above average, according to Blacklight. It is possible, but unlikely, that this activity was actually an attempt to protect those sites from botnet attacks.

Next, Ad Trackers try to identify and collate information about users, and send that information back to the tracker's website, to be used for ad targeting. The average number per website, as reported by Blacklight, is 7, and the wine sites had an average of 6. So, the wine industry is no worse than elsewhere, in this regard. However, you can see in the table that several wine websites currently exceed this number massively. This occurred in all four categories of website, although the Wine Professionals were the least egregious. But why on earth does anyone need to put 20 or 30 ad trackers on their website? Sadly, we all know the answer.

The same thing applies to Third Party Cookies. These have nothing to do with the running of the website itself (which legitimately uses cookies to keep a track of things like visited pages and log-in details). Instead, these other cookies are installed on behalf of external sites, and store information on your own device, to identify you when you visit other sites with the same cookie. Blacklight says that the web average is 3 per site (often associated with the ads displayed on the pages), but the wine industry apparently thinks that a better number is 11 per site. More to the point, you can see for yourselves that quite a number of sites massively exceed even this large average — and there are not that many ads displayed on their pages, so the cookies are covert. These sites are usually the same ones that have a large number of ad trackers, as well; so, we are left in no doubt about the attitude towards site visitors by these website owners.

Next is Facebook, which is monetized by serving personalized ads (and is currently embroiled in anti-trust lawsuits — Federal government and 46 states file antitrust suit seeking to split up Facebook). To serve these ads, Facebook wants to know which websites you visit, and it finds this out by getting the website owners to tell it. Blacklight says that about 30% of sites agree to do this, and 23% of the wine industry sites also currently do so. Did you know that a quarter of the websites you visit are telling Facebook that you are there? This explains why Facebook ads seem so directly relevant to your past web activity.

Finally, we come to Google, which is also monetized by ads, and whose web behavior has resulted in fines of tens of millions of dollars, especially in the European Union (eg. Google, Amazon fined $163 million as France takes hard line on privacy). Google wants to track you across all of the web, which it does by cross-collating every bit of information it can find about you, and especially your activity. In order to succeed, it helps if the website owners tell them about your activity, which Blacklight says about 50% of sites agree to do. In the wine industry, it is about 45% of the websites. So, Google must know a lot about you all, by now.

As I noted earlier, it is possible that some the website owners fingered here do not know what their own website is doing. If they used a "free" package to set up their sites, then the tracking activity could have been installed without their knowledge. Blacklight reports that a number of site owners immediately removed the trackers when they were informed about them. It would be nice if that happened here, as well.

For the rest of you site owners, please clean up your act. A cookie or two is one thing, but the table below indicates some seriously invasive activity. If a site really does need to do this sort of thing, then it should tell us about it when we first visit the site, rather than making us find out for ourselves. Indeed, this is actually mandatory in the EU — although I doubt that too many people read all of those Cookie Consent pop-ups (they are usually quite uninformative).

In the meantime, the rest of you can all try out Blacklight, and test your favorite websites for yourselves. Some people apparently don't mind having advertisers looking over their shoulders as they browse the web. Indeed, anyone who logs into a website using their Facebook or Google credentials is actually demanding that they be tracked (in exchange for saving a few seconds, or having to remember only one set of login details). However, we should all be given the option to opt into tracking if we want to, rather than being forced to opt out.