6 ms·

Twitter is tracking you on the web

47 points by phillco 14y ago

zxypoo 14y ago
https://twitter.com/twitter/status/203255213946187777 https://twitter.com/twitter/status/203255213946187777 "Widget Data: We may tailor content for you based on your visits to third-party websites that integrate Twitter buttons or widgets. When these websites first load our buttons or widgets for display, we receive Log Data, including the web page you visited and a cookie that identifies your browser ("Widget Data"). After a maximum of 10 days, we start the process of deleting or aggregating Widget Data, which is usually instantaneous but in some cases may take up to a week. While we have the Widget Data, we may use it to tailor content for you, such as suggestions for people to follow on Twitter. Tailored content is stored with only your browser cookie ID and is separated from other Widget Data such as page-visit information. This feature is optional and not yet available to all users. If you want, you can suspend it or turn it off, which removes from your browser the unique cookie that enables the feature. Learn more about the feature here. For Tweets, Log Data, and other information that we receive from interactions with Twitter buttons or widgets, please see the other sections of this Privacy Policy."
- jnorthrop 14y ago
  Thank you for highlighting that section. I'm surprised dcurtis left out this nugget. > After a maximum of 10 days, we start the process of deleting or aggregating Widget Data This make is much less nefarious. I guess it isn't much of a story when you have the full context. They are only keeping it for 10 days. Sure they are still aggregating data but at that point it is anonymized data.
- nabilt 14y ago
  So if I understand correctly Twitter is not storing what pages a given user visits. Although, they could easily find out this information. If this is the case then this is the correct way to do this. The average user does not expect any of their browsing history to be given to a service just because they are logged in while browsing the web even if this is common practice.
TomGullen 14y ago
Twitter is tracking me like Google is reading my emails. > The privacy implications of such behavior by a company so large are sweeping and absolute. Like most articles about tracking cookie this, and tracking widget that, it does come off as overly sensationalist to me and makes me think it's meant to scare people more than they should be about such a thing. > Is it okay for Twitter to sell your web browsing history to advertisers? Serious question, where are the people/businesses that buy peoples browsing histories? It's an argument raised a lot of the time as responses to this sort of thing and I've never seen evidence that a market exists for it. > I'm amazed that Twitter is overtly admitting to this behavior without considering the privacy implications. This is a bit of a confusing sentence, do you expect them to hide it? Or what makes you think they haven't considered privacy implications? Edit: According to tech crunch they have considered your privacy as they are having a switch that lets you turn this functionality off: http://techcrunch.com/2012/05/17/twitter-wants-an-interest-graph/ http://techcrunch.com/2012/05/17/twitter-wants-an-interest-g...
- nl 14y ago
  I agree with you that this is overblown. However: Serious question, where are the people/businesses that buy peoples browsing histories? It's an argument raised a lot of the time as responses to this sort of thing and I've never seen evidence that a market exists for it. There are plenty of businesses that pay for this. Look at the "DMP & Data Aggregators" and the DSPs section of the chart http://imgur.com/M60MM http://imgur.com/M60MM for some example companies.
  - TomGullen 14y ago
    Oh right, fair enough. Just checked out a couple of them and they appear to do as you say. Thanks for the interesting link!
- jnorthrop 14y ago
  Of course "admitting" it, can also be phrased as "being fully transparent" and is actually required by many privacy regulations. If you tell a user you are doing something with their personal data, in the US, you generally have the right to do it.
naner 14y ago
Basically, every time you visit a site that has a follow button, a “tweet this” button, or a hovercard, Twitter is recording your behavior. It is transparently watching your movements and storing them somewhere for later use. Of course. This is likely true for all social buttons, not just Twitter. I've never known a social site to throw away free user-related data.
ericflo 14y ago
So is every advertising network. This really isn't new, but it's certainly over-sensationalized.
DanielRibeiro 14y ago
But it also Implements Do Not Track Privacy Option[1] [1] http://bits.blogs.nytimes.com/2012/05/17/twitter-implements-do-not-track-privacy-option/ http://bits.blogs.nytimes.com/2012/05/17/twitter-implements-...
cmod 14y ago
This issue raised here is nothing new or specific to Twitter. (Not that it makes it any less concerning.) Here's an article from over a year ago talking about how Facebook does the very same thing with their like button: http://www.geek.com/articles/news/facebook-like-button-tracks-you-even-if-you-dont-click-20110519/ http://www.geek.com/articles/news/facebook-like-button-track... "Any time the Like button is displayed, information is zapped back to Facebook’s servers. As long as you’ve been logged into the site in the past month, Facebook happily continues warehousing your whereabouts."
46Bit 14y ago
Duh. As dumb a comment as that seems, I'm sticking with it.
BillSaysThis 14y ago
Surprising someone as experienced in the web would post a rant like this when not only do Facebook, Google and other large/"webscale" sites, but also much smaller ones that participate in ad networks. When I worked at Glam Media we were given a presentation on the ecosystem related to our ad networks and let me tell you the presenter (a VP or C-Level) couldn't come close to fitting all the logos on a moderately large screen. Bottom line is unless you take substantial measures to avoid tracking you are going to be tracked by many interested parties, both direct and indirect!
deleted 14y ago
[deleted]
masterleep 14y ago
Does the Firefox 'No 3rd Party Cookies' setting avoid Twitter-tracking?
- deleted 14y ago
  [deleted]
- esrauch 14y ago
  Yes, the No 3rd Party Cookies stops the twitter buttons on other sites from working at all.
  - GoodIntentions 14y ago
    It doesn't matter if you accept cookies or not. If the site you visits presents content ( script, button, whatever ) served from another site, you may be tracked server side via log + all the goodies in your request header.
    - esrauch 14y ago
      With No third party cookies enabled, the only thing the hosts of the other content should get is IP address. It's possible that they are storing that and cross-referencing against the ip logs otherwise but that would lead to a lot more embarrassing situations considering how much more likely it is that 2 different people are behind the same NAT than logged in to the same account, and it would be explicitly going out of their way to track people who clearly were trying to opt out.
  - deleted 14y ago
    [deleted]
shpoonj 14y ago
Curtis lives in his own little bubble where the average internet user is COMPLETELY unaware of the possibility that they're being watched. Even my parents, who are nontechnical, in the mid 90s, would warn me about these sorts of things. Regardless, Twitter went about this the proper way and I'm glad they're doing what they're doing. Happy to have the Do Not Track option too. Nice sensationalist story though... what will he throw a fit over next time?
LocalPCGuy 14y ago
A lot of outrage for something that many other websites are also doing, and an acknowledged behavior by any of the major companies running social networks with social widgets - i.e. Google, Facebook, etc. Heck, Google recently got in trouble because they were using a fairly standard technique that got around the third-party cookie blocking in Safari, and Facebook had to admit that they are able to track users who are logged out, presumably by comparing IP addresses of those who load the widgets against IP addresses of users when they are logged in.
deleted 14y ago
[deleted]
deleted 14y ago
[deleted]
wamatt 14y ago
What would be surprising Mr Curtis, is if Twitter wasn't tracking it's users.
DigitalSea 14y ago
Oh, look another Dustin Curtis blog post on Hacker News, again. While some of the things Dustin says are true and interesting, this post assumes we're all idiots that don't know that companies like Twitter are tracking user information. What's the big deal here? Oh, Twitter will know what links or sites I'm visiting? Good for them, if they find that information valuable then so-be-it. I think it's more than obvious Dustin is targeting his posts at the HN community who lap them up, it's all just too easy for him now. Sorry about that rant.
zacharyvoase 14y ago
OK, so it's not exactly news. But we only have these 'privacy implications' because our browsers give mines of information to any website that cares to ask for it. GET requests used to be seen as OK to make on behalf of a user, but these days I feel that the hostname in my location bar should be the only one I send any HTTP requests to, for a given page.
jr62 14y ago
This is certainly no worse than what Facebook's collecting, and their opt-out controls mean there's not a lot to be worried about. If you're really paranoid about privacy you should be concerned about Google, not Twitter. Try counting the number of websites with Google Analytics or AdSense (or Google-hosted jQuery, or a +1 button...)
s4nchez 14y ago
I love the irony of @dcurtis complaining about twitter dirty tricks while trying to get "Kudos" using a scammy widget.

47 points by phillco 14y ago

https://twitter.com/twitter/status/203255213946187777 https://twitter.com/twitter/status/203255213946187777 "Widget Data: We may tailor content for you based on your visits to third-party websites that integrate Twitter buttons or widgets. When these websites first load our buttons or widgets for display, we receive Log Data, including the web page you visited and a cookie that identifies your browser ("Widget Data"). After a maximum of 10 days, we start the process of deleting or aggregating Widget Data, which is usually instantaneous but in some cases may take up to a week. While we have the Widget Data, we may use it to tailor content for you, such as suggestions for people to follow on Twitter. Tailored content is stored with only your browser cookie ID and is separated from other Widget Data such as page-visit information. This feature is optional and not yet available to all users. If you want, you can suspend it or turn it off, which removes from your browser the unique cookie that enables the feature. Learn more about the feature here. For Tweets, Log Data, and other information that we receive from interactions with Twitter buttons or widgets, please see the other sections of this Privacy Policy."

jnorthrop 14y ago
Thank you for highlighting that section. I'm surprised dcurtis left out this nugget. > After a maximum of 10 days, we start the process of deleting or aggregating Widget Data This make is much less nefarious. I guess it isn't much of a story when you have the full context. They are only keeping it for 10 days. Sure they are still aggregating data but at that point it is anonymized data.
nabilt 14y ago
So if I understand correctly Twitter is not storing what pages a given user visits. Although, they could easily find out this information. If this is the case then this is the correct way to do this. The average user does not expect any of their browsing history to be given to a service just because they are logged in while browsing the web even if this is common practice.

TomGullen 14y ago

Twitter is tracking me like Google is reading my emails. > The privacy implications of such behavior by a company so large are sweeping and absolute. Like most articles about tracking cookie this, and tracking widget that, it does come off as overly sensationalist to me and makes me think it's meant to scare people more than they should be about such a thing. > Is it okay for Twitter to sell your web browsing history to advertisers? Serious question, where are the people/businesses that buy peoples browsing histories? It's an argument raised a lot of the time as responses to this sort of thing and I've never seen evidence that a market exists for it. > I'm amazed that Twitter is overtly admitting to this behavior without considering the privacy implications. This is a bit of a confusing sentence, do you expect them to hide it? Or what makes you think they haven't considered privacy implications? Edit: According to tech crunch they have considered your privacy as they are having a switch that lets you turn this functionality off: http://techcrunch.com/2012/05/17/twitter-wants-an-interest-graph/ http://techcrunch.com/2012/05/17/twitter-wants-an-interest-g...

nl 14y ago
I agree with you that this is overblown. However: Serious question, where are the people/businesses that buy peoples browsing histories? It's an argument raised a lot of the time as responses to this sort of thing and I've never seen evidence that a market exists for it. There are plenty of businesses that pay for this. Look at the "DMP & Data Aggregators" and the DSPs section of the chart http://imgur.com/M60MM http://imgur.com/M60MM for some example companies.
- TomGullen 14y ago
  Oh right, fair enough. Just checked out a couple of them and they appear to do as you say. Thanks for the interesting link!
jnorthrop 14y ago
Of course "admitting" it, can also be phrased as "being fully transparent" and is actually required by many privacy regulations. If you tell a user you are doing something with their personal data, in the US, you generally have the right to do it.

naner 14y ago

Basically, every time you visit a site that has a follow button, a “tweet this” button, or a hovercard, Twitter is recording your behavior. It is transparently watching your movements and storing them somewhere for later use. Of course. This is likely true for all social buttons, not just Twitter. I've never known a social site to throw away free user-related data.

ericflo 14y ago

So is every advertising network. This really isn't new, but it's certainly over-sensationalized.

DanielRibeiro 14y ago

But it also Implements Do Not Track Privacy Option[1] [1] http://bits.blogs.nytimes.com/2012/05/17/twitter-implements-do-not-track-privacy-option/ http://bits.blogs.nytimes.com/2012/05/17/twitter-implements-...

cmod 14y ago

This issue raised here is nothing new or specific to Twitter. (Not that it makes it any less concerning.) Here's an article from over a year ago talking about how Facebook does the very same thing with their like button: http://www.geek.com/articles/news/facebook-like-button-tracks-you-even-if-you-dont-click-20110519/ http://www.geek.com/articles/news/facebook-like-button-track... "Any time the Like button is displayed, information is zapped back to Facebook’s servers. As long as you’ve been logged into the site in the past month, Facebook happily continues warehousing your whereabouts."

46Bit 14y ago

Duh. As dumb a comment as that seems, I'm sticking with it.

BillSaysThis 14y ago

Surprising someone as experienced in the web would post a rant like this when not only do Facebook, Google and other large/"webscale" sites, but also much smaller ones that participate in ad networks. When I worked at Glam Media we were given a presentation on the ecosystem related to our ad networks and let me tell you the presenter (a VP or C-Level) couldn't come close to fitting all the logos on a moderately large screen. Bottom line is unless you take substantial measures to avoid tracking you are going to be tracked by many interested parties, both direct and indirect!

deleted 14y ago

[deleted]

masterleep 14y ago

Does the Firefox 'No 3rd Party Cookies' setting avoid Twitter-tracking?

deleted 14y ago
[deleted]
esrauch 14y ago
Yes, the No 3rd Party Cookies stops the twitter buttons on other sites from working at all.
- GoodIntentions 14y ago
  It doesn't matter if you accept cookies or not. If the site you visits presents content ( script, button, whatever ) served from another site, you may be tracked server side via log + all the goodies in your request header.
  - esrauch 14y ago
    With No third party cookies enabled, the only thing the hosts of the other content should get is IP address. It's possible that they are storing that and cross-referencing against the ip logs otherwise but that would lead to a lot more embarrassing situations considering how much more likely it is that 2 different people are behind the same NAT than logged in to the same account, and it would be explicitly going out of their way to track people who clearly were trying to opt out.
- deleted 14y ago
  [deleted]

shpoonj 14y ago

Curtis lives in his own little bubble where the average internet user is COMPLETELY unaware of the possibility that they're being watched. Even my parents, who are nontechnical, in the mid 90s, would warn me about these sorts of things. Regardless, Twitter went about this the proper way and I'm glad they're doing what they're doing. Happy to have the Do Not Track option too. Nice sensationalist story though... what will he throw a fit over next time?

LocalPCGuy 14y ago

A lot of outrage for something that many other websites are also doing, and an acknowledged behavior by any of the major companies running social networks with social widgets - i.e. Google, Facebook, etc. Heck, Google recently got in trouble because they were using a fairly standard technique that got around the third-party cookie blocking in Safari, and Facebook had to admit that they are able to track users who are logged out, presumably by comparing IP addresses of those who load the widgets against IP addresses of users when they are logged in.

deleted 14y ago

[deleted]

deleted 14y ago

[deleted]

wamatt 14y ago

What would be surprising Mr Curtis, is if Twitter wasn't tracking it's users.

DigitalSea 14y ago

Oh, look another Dustin Curtis blog post on Hacker News, again. While some of the things Dustin says are true and interesting, this post assumes we're all idiots that don't know that companies like Twitter are tracking user information. What's the big deal here? Oh, Twitter will know what links or sites I'm visiting? Good for them, if they find that information valuable then so-be-it. I think it's more than obvious Dustin is targeting his posts at the HN community who lap them up, it's all just too easy for him now. Sorry about that rant.

zacharyvoase 14y ago

OK, so it's not exactly news. But we only have these 'privacy implications' because our browsers give mines of information to any website that cares to ask for it. GET requests used to be seen as OK to make on behalf of a user, but these days I feel that the hostname in my location bar should be the only one I send any HTTP requests to, for a given page.

jr62 14y ago

This is certainly no worse than what Facebook's collecting, and their opt-out controls mean there's not a lot to be worried about. If you're really paranoid about privacy you should be concerned about Google, not Twitter. Try counting the number of websites with Google Analytics or AdSense (or Google-hosted jQuery, or a +1 button...)

s4nchez 14y ago

I love the irony of @dcurtis complaining about twitter dirty tricks while trying to get "Kudos" using a scammy widget.