Now you can opt out of its behaviorally targeted ads, but the search giant can still see what you're doing on its site

Yahoo! says it won't target you... to your face. On Aug. 8, the Internet giant announced that it will allow users to opt out of behavioral targeting on its site. But in fact, that change only affects behaviorally targeted ads that users see. The company will still collect information on the Web sites visited by unique computers, it just won't serve ads to individual users based on the info.

"This isn't rejecting cookies outright, you are just preferring not to see the ads," says Anne Toth, Yahoo's head of privacy and vice-president of policy.

So Yahoo (YHOO) will still know that you looked up Fannie Mae's stock on Yahoo Finance and then checked out foreclosed homes on Yahoo's real estate site. It just won't serve you a mortgage ad based on that info when you're checking e-mail. It will also still serve ads to you based on your location and the content of the page that you are on.

Toth says Yahoo must keep the information to report accurate financials on advertising click-through rates and visitors. It probably also wants to tell advertisers about the kind of people who visit certain pages, in aggregate, to sell more expensive advertising. Behavioral targeting can more than triple the price of some ads.

Congressional Pressure

The move came in response to congressional action. On Aug. 1, the House Energy & Commerce Committee sent a letter to 33 companies, including AT&T (ATT), Comcast (CMCSA), Google (GOOG), Microsoft (MSFT), and Yahoo, opening an inquiry into their practices for collecting and using data to target ads to consumers based on what they do online.

Behavioral targeting is different from other kinds of targeting, such as search targeting or geotargeting, which uses IP addresses or Zip Codes that people provide when they sign up for a site. Behavioral targeting works by tracking surfers as they move around the Web. Companies then apply sophisticated algorithms to that past behavior to decide what kinds of ads to show the people they're tracking.

Yahoo's response follows Google's rollout on Aug. 7 of DoubleClick tracking (BusinessWeek.com, 3/12/08) across its network and a way to opt out of tracking on the Google content network and DoubleClick tracking. Microsoft also allows users to shut off targeted ads.

Will these moves be enough to keep Congress happy? The committee seems pretty riled up after holding hearings about NebuAd, a behavioral targeting company that was little known until recently. NebuAd takes behavioral targeting one step further than Google and Yahoo. It works directly with Internet service providers, or ISPs, placing a device on their networks to log surfers' movements, a technique similar to wiretapping.

Guidelines for Self-Regulation

Now the committee is broadening its inquiries to include more companies. Congress is digging into questions about how long data are held, how consumers are alerted to the practice, what kind of data are being collected (health, financial, and other personal information), and how many people are being tracked. And the committee has been making noise about passing legislation and obliging companies to ask people to opt in before collecting data.

The Federal Trade Commission looked into these questions last fall and came up with tentative guidelines for self-regulation. The industry responded with an update of the guidelines it follows, which are set out by the Network Advertising Initiative, the industry association.

Some of the privacy folks aren't entirely happy with either the FTC's recommendations or the NAI's response.

They think they're too weak and don't do enough to keep companies from collecting really sensitive data, or inform consumers about what tracking is and how they can permanently opt out of it.

The Center for Democracy & Technology, for instance, put out an analysis late last month. It advocates a Do Not Target list and wants the targeting companies to sit down and come up with standard guidelines for how long they keep the information. "The industry in general has been growing in a way that allowed them to come up with the practices we're seeing," says Ari Schwartz, an analyst at the CDT. "There isn't a sense that these companies have long-term privacy protection plans in place."

Why Do Few Opt Out?

Indeed, it's not clear how Yahoo's action allays privacy concerns. What worries most Web surfers about behavioral targeting isn't just that they see ads that know a lot about them, it's that the information is collected in the first place. People fear a data leak will expose their online activities to the public. They're not afraid that they'll be tricked into buying a mortgage by carefully targeted advertising. At least not yet.

That's one likely reason few people bother to opt out of targeted advertising. In July, Yahoo said that 75,000 users - a fraction of 1% of the traffic it sees on its network - visited an opt-out page to refuse behaviorally targeted ads across the non-Yahoo sites on which Yahoo serves ads. (The new announcement extended the opt-out to Yahoo's own sites.) Not surprising. Why bother opting out if the information is still out there anyway?

Yahoo believes most people don't opt out because they actually like targeted ads. "It is our strong belief that a more customized experience is what users prefer," says Toth.

That may be. But what users really want isn't the choice to have a customized experience, it's the choice over whether their data are collected in the first place. In a survey released this spring by TRUSTe, a privacy policy accrediting group, 57% of the 1,015 respondents said they weren't comfortable with advertisers using that browsing history to serve relevant ads. That's the concern Congress wants to address. And it explains why more scrutiny is likely to follow.

Green is an associate editor for BusinessWeek . Holahan is a writer for BusinessWeek.com in New York.