Opting Out: The Illusion

You’ll need to visit 343 different sites to do so (if they work)

Rob Leathern
4 min readAug 11, 2016

Mistake number 1: I visited the website of American Giant, a maker of apparently-popular hard-to-get-but-not-really hoodies. You might know them from their frequent appearances on BusinessInsider.com, and in little text+image ads on other news websites.

BusinessInsider wants you to know how good these hoodies are

Frequent readers here will know that I typically block ads (paying via app.optimal.com in order to feel okay about doing so) but every now and again I need to test things and so I let down the shields. I ask brands on Twitter how to opt-out of seeing their retargeting ads every now and then (they usually have no idea, or give terrible advice), and at least once every 6 months or so I’ll also go through the opt-out procedures with one of the big opt-out service providers who tick the “self-regulation checkbox” for behavioral targeting companies to do what they like with your data.

I saw one of American Giant’s ads, clicked on the top corner to see that it was being served by AdRoll, a retargeting company, and that I could click to opt-out of being targeted by them with a couple of clicks to Ghostery’s opt-out service.

I clicked top left link “opt-out options”

I’ll get back to Ghostery’s opt-out service, but first…

Earlier in the day I’d clicked the little triangle-i icon a different ad that also uses the AdChoices icon, but goes to a website https://www.aboutads.info/ run by the Digital Advertising Alliance (DAA). Now, I’m guessing they’re either not good at UI/UX, or they’re really good at it and don’t want you to find this clickable icon that takes you to “Consumer CHOICE Page”, so I highlighted it with red arrows so you can see where it is on their site:

“Consumer Choice Page” trying to hide over there

This morning, I was greeted by the following screen. When I returned in the afternoon, however, it seemed to function. Were I an average consumer, and I’d actually managed to get to this page in the first place, this would probably put me off, since it was inaccurate regarding my cookies.

First and third party cookies were, in fact, enabled

Let’s go back to the Ghostery example. I wanted to opt out of all behavioral ads, not just AdRoll, and so landed on this “Global opt-out” page. It was easy to select all and choose “Opt out of selected companies”. I saw stuff happening in the browser indicating to me that this seems to work (hard to know though, seems difficult to test as a user). But then I noticed that for a lot of these companies it said “go to site” to opt-out. So let’s go through the numbers here:

a. There are 615 names on this list

Here’s the full list in a Google Doc broken down by ones that you have to visit the site versus not. Here’s a screenshot of the interface.

Source: Ghostery.com, August 11, 2016

b. I was able to opt-out of 269 of them (44%)

c. 4 Didn’t respond in the browser

d. 342 Required me to visit the website (56%)

AdRoll was one of the 342 that required me to visit the website to opt-out. I’ve heard of them and they’re generally thought of as a good company, but there are hundreds of names on this list even people who’ve worked in this industry for years have never heard of (and affiliations with industry organizations usually require a membership fee only, not any degree of vetting).

It seems like a lot of clicks to opt-out of things; and by the way, if you for some reason delete your cookies, IRONICALLY you’ll have to go through this entire rigamarole once more since opting-out from being targeted based on your cookie data, requires cookie data.

Lets finish with the important warning all these opt-out mechanisms leave you with, namely: “Opting out does not mean you will stop seeing ads. It means that the company you opt out of will no longer use your data to target ads to you.”

It does NOT mean the company will no longer track you (remember, your cookies are still getting touched, unique user identifiers are still being exchanged), they just will “no longer use your data” (so they say — but I’ve seen at least one example of a large company having a broken opt-out mechanism that persisted for weeks and only got fixed after I told them about it). And yes, the complete lack of standards as to how many ads could or should be jammed into your browser will persist -- publishers are free to choose any number, are bound by no standards or controls on the number of behavioral targeting pixels that may hitch a ride with these ads on their pages, and publishers are not counting up the bytes of your mobile data plan being used for these things either.

So I guess you’ll just keep seeing (an indeterminate number of) ads and being tracked. By over 600 companies you’ve mostly never heard of.

--

--

Rob Leathern

Entrepreneur and product leader, prev at Google and Facebook: security, privacy, ads & integrity