Naked online: retail data gathering reveals all

By Sebastian Knoppik Oct 3, 2010, 17:34 GMT

Berlin - It's no secret that privacy is a rare commodity online. That's even more true when it comes to retailers, many of which have become global leaders in gathering data on individuals.

And the data gathering doesn't start when something is ordered. It starts far earlier. Indeed, a new German study has confirmed what many have suspected - only 5 per cent of companies polled by the Karlsruhe Institute for Technology completely followed data protection guidelines.

More than two-thirds said they passed on data about customers, often without notification or grounds.

'There's a lot of lawlessness,' complains Moritz Karg of the independent State Centre for Data Protection in the German state of Schleswig-Holstein. Internet technology, he says, has made it simple to pass on data.

'If something is easy to acquire, then I pass it on easily.' He notes that a lot of the data is gathered without the customer even takes any action. 'If you look through a mail-order catalogue, no-one notices that. But if you visit an online shop, then people notice the way you browse.'

Happily, there are ways to rein in the data gathering instinct most companies seem to have.

Stores use cookies, stored on computers, to recognize individual visitors at online shops. This allows stores to display which items were viewed last, or to suggest items that customers with similar interests viewed or purchased.

Karg says there's no legal problem with creating that kind of user profile. But, he notes, 'I, as the consumer, have the right to challenge that.'

But many online merchants don't offer that right of challenge. That's why Karg recommends surfers set their browsers so that stored cookies are automatically erased after each internet session. Browser add-ons that notify about and block spying attacks are also a good idea. Those include Ghostery for Firefox.

Many shops automatically suggest shoppers set up an account. Doing so has its positives. One doesn't have to provide personal information each time one goes shopping. 'But you should avoid this,' say Karg, noting that skipping this step makes it harder for companies to gather too much data.

Online shops particularly like to ask a lot of questions once an order is made, many more than are usually necessary for an order.

'I think it's absolutely unnecessary to provide your birthdate when you are, for example, booking a trip,' says lawyer Beate Wagner of the Consumer Central in the German state of North-Rhein Westphalia.

'As a rule of thumb, provide as little data as necessary,' advises Susanne Lang of the internet portal Verbraucher sicher online (Consumers safe online) at Berlin's Technical University. If the least expensive online shop is demanding lots of information before a purchase can be made, then it might be better to back off, she says.

'You should maybe think whether that's worth just a couple of euros,' she says. Karg agrees. 'In real life, I don't go into a bakery and state out loud my name, weight and size just so I can get some bread.'

Of course, a lot of people behave differently online if they can find a deal. Even when two items are priced the same, people don't compare the conditions regarding data protection.

A behavioural experiment by Berlin's Technical University and Cambridge University highlighted this. Even for minimal price advantages, customers were prepared to provide more personal data. Even when another retailer was prepared to offer the product for just a little more money, or the same price, shoppers in the experiment tended to favour the store that requested more private data.

'Some data can be passed on without approval by the consumer,' explains Wagner. That includes information for the delivery firm or for banks involved in the payment. Passing on information for advertisement purposes or business data can only be done with customers' approval.

Online shops can make their wares available on the condition that users allow the gathering and distribution of their data, says Wagner. 'There is an exception if the user does not have other access to this service or only in an unacceptable fashion.'

But since there are almost no goods available only at one store, shops can essentially force customers to provide data or allow it to be shared. Lang advises staying away from overly curious merchants.