DoubleClick, Google AdSense, and YieldManager are watching you

[foxfirefey]

Previous posts on this include this and this.

I've been hearing reports from several in lj_biz that paid users are having ad network tracking cookies set. But I have been unable to duplicate this myself. Post contents:

• Shows the parts of the privacy policy that allow third party advertiser tracking cookies to be set. Note that these advertisers do not have to follow LJ's privacy policy.


• Talks about why blocking them is a bit harder than flipping a single browser setting.
• The list of third parties that I have personally caught setting cookies while browsing on LJ using plus_tester.
• How a paid user (or any user, really) can test for whether or not they are somehow having third party cookies set.

Tracking Cookies?

Yup, tracking cookies. Tracking cookies used by ad networks to trace you across their affiliates. And if ads are served to you on an LJ page, whether you're Plus, Basic, or logged out, the ad networks are allowed to set their own cookies. From LJ's Privacy Policy:

LiveJournal lets other entities that show advertisements on some of our web pages set and access their cookies on your computer. Other entities' use of their cookies is subject to their own privacy policies, and not this policy. Advertisers or other entities do not have access to LiveJournal's cookies.

and
Our advertising partners may set cookies. These cookies allow the ad server to recognize your computer each time they send you an online advertisement. In this way, advertising partners (or "ad networks") may compile information about where you, or others who are using your computer, saw their advertisements and determine which ads are clicked on. This information allows an ad network to deliver targeted advertisements that they believe will be of most interest to you. This privacy policy covers the use of cookies by LiveJournal and does not cover the use of cookies by any advertisers.

So if you want a "more relevant advertising experience" on the web, let them set the tracking cookies they want. But if you don't care to let them easily track you across their network, you'll need to find some way to block them.

Unfortunately, it's not as easy as it sounds. Most browsers have settings to load cookies only from the original site (say, livejournal.com and company), but that won't work here, because the ads are served in iframes. And FireFox, for instance, will load a cookie that's been set from an iframe even if that cookie is not from the original site of the main page you are currently on. So it might be time to look into AdBlock and AdBlock Plus and blocking iframes with it, or disable iframes if you're in Opera.

List O' Third Parties Caught Setting Cookies or Serving Content So Far (Base domains)

• yieldmanager.com -- Right Media
• googlesyndication.com -- Google
• anrdoezrs.net -- Commission Junction. CJ has about a gazillion nonsense domains they use for this stuff; I'm not sure how often they change them around, but it's possible you could be blocking this one one day and the next they're using another.
• unicast.com -- Unicast
• indieclick.com -- IndieClick
• adrevolver.com -- AdRevolver
• fatlens.com -- FatLens
• doubleclick.net -- DoubleClick
• yahoo.com -- Yahoo

Paid users: how to test

This might only be useful for people who are pretty adept with their browsers already.

1. First, clear out all of your cookies. Most of them are probably ad tracking trash anyway. However, do keep in mind that it will log you out of every site, including LiveJournal.
2. You might want to change your cookie settings to "ask before setting". This way, you'll get a notification if one of the ad tracking sites tries to set a cookie and know which page tried to load it. Also, make sure to "accept cookies from any site" instead of "accept cookies only from originating site".
3. Log back in and browse around LJ and only LJ, following a link to any other site is verboten and will ruin the test set.
4. If somewhere other than livejournal.com is trying to set a cookie, note what page it is happening on. If you can, look at the source code. Look for any "iframes" or content loaded from the attempted cookie's domain. Accept the cookie and see what content it has, its title, and when it expires.
5. Copy paste the relevant code here (changing < to < and > to > or run it through this) while noting the page you saw it on and what cookie the domain tried to set.