{"id":76545,"date":"2020-09-27T17:00:08","date_gmt":"2020-09-27T14:00:08","guid":{"rendered":"https:\/\/en.buradabiliyorum.com\/the-high-privacy-cost-of-a-free-website\/"},"modified":"2020-09-27T17:00:08","modified_gmt":"2020-09-27T14:00:08","slug":"the-high-privacy-cost-of-a-free-website","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/the-high-privacy-cost-of-a-free-website\/","title":{"rendered":"#The high privacy cost of a \u2018free\u2019 website"},"content":{"rendered":"

“#The high privacy cost of a \u2018free\u2019 website<\/strong>”
\n<\/p>\n

\n

Kara Zajac said SPART*A, a small nonprofit serving transgender military service members and veterans, helped her begin her transition while in the Navy. To give back, she volunteered to build the group\u2019s website in her spare time after leaving the military\u2014and kept her eye on a key value: privacy.<\/p>\n

\u201cI don\u2019t track users,\u201d Zajac said. \u201cNot everyone in the military is wanting to be known for being trans. They might not be out yet. So any time we can protect privacy in that way, we try to do it.\u201d<\/p>\n

She said she only allowed three trackers on spartapride.org: cookies<\/a> from Twitter and Facebook<\/a> that accompany their \u201clike\u201d buttons on the site, and one from Disqus, a commenting platform she got through a prepackaged website theme<\/a> she bought off the internet for $59 to build the site.<\/p>\n

But when The Markup scanned spartapride.org using our new instant privacy inspector, Blacklight, we found 21 different ad-tech companies tracked visitors to the site, sending possible signals about people\u2019s gender identities to advertisers\u2014without the users\u2019 knowledge or consent.<\/p>\n

Among them were the marketing and advertising arms of Google, Amazon, and Oracle\u2019s BlueKai consumer data division, which reported a massive data exposure this summer, leaving billions of records<\/a>\u2014including personally identifiable information\u2014accessible to the open internet without a password. Oracle did not respond to questions about whether data gathered from spartapride.org\u2019s users was included in the exposure.<\/p>\n

The trackers loaded because Disqus sells ads on the free version of its commenting portal, and that ad space comes with third-party tracking. Disqus discloses<\/a> those trackers on its own website, but the company wouldn\u2019t comment about tracking SPART*A\u2019s users.<\/p>\n

[Read: Are EVs too expensive? Here are 5 common myths, debunked<\/span>]<\/span><\/em><\/p>\n

Zajac was floored when The Markup showed her how many trackers app<\/a>eared on the site. She said she learned a hard lesson: \u201cIf it\u2019s free, that doesn\u2019t mean it\u2019s free. It just means it doesn\u2019t cost money.\u201d Instead, it costs your website visitors\u2019 privacy.<\/p>\n

An array of free website-building tools, many offered by ad-tech and ad-funded companies, has led to a dizzying number of trackers loading on users\u2019 browsers, even when they visit sites where privacy would seem paramount, an investigation by The Markup has found. Some load without the website operators\u2019 explicit knowledge\u2014or disclosure to users.<\/p>\n

Website operators may agree to set cookies\u2014small strings of text that identify you\u2014from one outside company. But they are not always aware that the code setting those cookies can also load dozens of other trackers along with them, like nesting dolls, each collecting user data.<\/p>\n

To investigate the pervasiveness of online tracking, The Markup spent 18 months building a one-of-a-kind free public tool that can be used to inspect websites for potential privacy violations in real-time. Blacklight reveals the trackers loading on any site \u2014 including methods created to thwart privacy-protection tools or watch your every scroll and click.<\/p>\n

We scanned more than 80,000 of the world\u2019s most popular websites with Blacklight and found more than 5,000 were \u201cfingerprinting\u201d users, identifying them even if they block third-party cookies.<\/p>\n

We also found more than 12,000 websites loaded scripts that watch and record all user interactions on a page \u2014 including scrolls and mouse movements. It\u2019s called \u201csession recording\u201d and we found a higher prevalence of it than researchers had documented before.<\/p>\n

More than 200 popular websites used a particularly invasive technique that captures personal information people enter on forms\u2014like names, phone numbers, and passwords\u2014before they hit send. It\u2019s called \u201ckey logging\u201d and it\u2019s sometimes done as part of session recording.<\/p>\n

One of the websites doing this, SunTrust Bank, sent the user name and password<\/a> we entered to a third party, Jornaya, which says it encrypts and discards the data it collects. SunTrust spokesman Kyle Tarrance wouldn\u2019t answer questions about the password leak, but insisted that the company keeps \u201cclients\u2019 well-being at the forefront of everything we do.\u201d After we contacted the company, its website stopped sending data to Jornaya.<\/p>\n

We scanned hundreds of sensitive sites using Blacklight and found that, even there, tracking was surprisingly common:<\/p>\n