海角大神

For Internet users worried about guarding their privacy, these are troubling times.

There were more reported data breaches last year than ever before, leaking credit card information and health data far and wide.听And听long after Edward Snowden became a household name, new听reports of听spying by the National Security Agency, Britain's听GCHQ, and other governments continue to come to light.听Meanwhile, in the commercial sphere, online advertisers and merchants are听armed with sophisticated tools for tracking Internet users' keystrokes and clicks.听

In the absence of legal reforms, the pervasiveness of online听surveillance and consumer tracking is听beginning to turn听privacy into a 21st听century luxury item. To meet savvy Internet users' demands, a growing number of tech firms offer those with the desire for privacy 鈥撎齛nd the means to pay 鈥� everything from self-destructing e-mail messages to the virtual听equivalent of Kleenex: throwaway identities to keep advertisers, merchants, and government snoops at bay.

Consumers are already pushing back against pervasive tracking.听Telecommunications giants AT&T and Verizon Wireless were both forced to acknowledge and modify their use of so-called 鈥渟uper cookies鈥� to听collect and correlate data on their customers鈥� online movements 鈥� tracking that was taking place without their customers鈥� explicit consent.听

And, in January, the Department of Health and Human Services found itself in hot water when news outlets reported听that the Federal Government鈥檚 health exchange, Healthcare.gov, was collecting and transmitting sensitive health information about visitors to third party tracking firms.听

At long last, policymakers have started to take notice. In January, President Obama made the first presidential visit to the Federal Trade Commission since the Teddy Roosevelt administration to propose laws for protecting consumer privacy.听But legislation may be slow, and tracking tools are developing fast.听

鈥淚n terms of the technology that is used to track people, there is an arms race," says Jeremy Gillula, a staff technologist at the Electronic Frontier Foundation. 鈥淚t started with [Web browser] cookies. Then we blocked those. Then the tracking companies moved to browser fingerprinting and then super cookies and HTML headers inserted into Web traffic."

The Problem:听Eyes (and ears) everywhere

Today, the arsenal of tracking tools is large and diverse, comprising traditional website 鈥渃ookies鈥� as well as JavaScript trackers and beacons, Adobe Flash cookies, and tracking that leverages HTML5 local storage, says Andrew Sudbury, the chief technology officer at the tech firm Abine.

Abine cofounder Eugene Kuznetsov said that spirited debates about specific tracking tools, like the 鈥渟uper cookies鈥� miss the point. 鈥淭o me the 鈥榮uper cookies鈥� thing is interesting, but its just one of many, smaller battles in a much bigger war,鈥� says Mr. Kuznetsov.

That war is over consumers鈥� basic protections: their right to privacy and their right of "ownership" of their own information. Mr. Gillula of the EFF points to incidents such as the widely reported case of Target determining, based on purchasing patterns, that a teenage customer was pregnant and sending her coupons 鈥� all before she had a chance to inform her parents.

With online tracking via websites, the opportunity for violations of individuals鈥� privacy are even greater. 鈥淚t could be that I鈥檓 on a shared computer and looked up a health condition. Maybe I cleared the [webpage] cookies, but because someone placed a super cookie into my session, the next person who sits down at that computer sees an ad about that health condition,鈥� he says.

Andrea Matwyshyn, a law professor at Princeton University and former senior policy advisor at the FTC, says that mobile devices 鈥� including smartphones 鈥� have greatly increased the amount and intimacy of data that can be harvested from individuals. At the same time, their small size and limited interfaces make it harder for consumers to know when they鈥檙e being tracked.听"You have听all the same concerns about transparency and consumers knowing what they're consenting to 鈥� just heightened," she says.

Kuznetsov agrees.听鈥淏eing tracked by a unique number across web sessions may not be bad. But when that data is tied to an e-mail or phone number or physical address and name, all of a sudden you have a situation where you have a composite profile built,鈥澨齅r.听Kuznetsov听says.

In the absence of a clear policy from the federal government, there have been industry-led efforts to create privacy protections 鈥� from to . But companies have shown a willingness to ignore or narrowly interpret voluntary codes of conduct that try to give consumers a choice about whether or not to consent to tracking.

鈥淪ome of the major Web players take the position that they don't know that users want privacy," says Kuznetsov. "You had five percent of Firefox users sign up for DoNotTrack. That鈥檚 between 25 and 50 million people. That clearly shows people care."听

More and more, experts worry that the mushrooming population of connected devices that make up the Internet of Things will exacerbate the situation. Just last week, the electronics giant Samsung was forced to respond to consumer 鈥� and media 鈥� complaints that it recorded the living room conversations of owners of its SmartTV sets, transmitting the harvested voice data to unnamed 鈥渢hird parties.鈥� This wasn鈥檛 the first time a smart TV maker had been caught doing so, but Samsung was forced to modify and clarify its Smart TV voice collection policy all the same.

鈥淚 think you鈥檙e seeing a merger of traditional privacy concerns left over from earlier generations of data collection and the current generation of security concerns about the impact of all this [tracking] code that allows for unintended repurposing of consumer information,鈥� says听Ms.听Matwyshyn.听

One solution: A throw-away identity

That shift is fueling investment in a new generation of privacy-protecting products and services, as consumer concerns about discrete problems like Web tracking or identity theft merge to encompass an individual鈥檚 entire online identity.

Abine鈥檚 Blur is one example. The Web browser plug-in started life as a product called DoNotTrackMe that blocked website cookies and the great variety of other technologies used to track visitor activity on websites, says Mr. Sudbury. 听

But blocking trackers is only so useful, Abine鈥檚 founders realized. Advertisers today have access to many different pieces of information about any user from countless sources: e-mail newsletters, credit card transactions, and mobile applications. Those allow them to build composite profiles 鈥� Web browser cookies or no.

As its name suggests, Blur does much more than just blocking website trackers. It lets听users create 鈥渕asks鈥� for vital information including e-mail addresses, credit cards numbers, and phone numbers. Blur users navigating purchase or sign-up forms on their Web browser are prompted to create a masked e-mail and phone number. They can even set up a one-time credit card in the amount of the transaction.

The disposable identities link back to accounts controlled by the user, but can鈥檛 be traced back to the user鈥檚 actual accounts. They can also be disposed of with the click of a mouse button should any of the data be compromised by hackers or abused by online advertisers and retailers.

Other firms are following suit, with products that do everything from hiding e-mail addresses to erasing social media posts.

DSTRUX, a New York firm, said earlier this month that it was extending its cloud-based platform from documents like spreadsheets and Microsoft Word documents to social media platforms such as Facebook. Among other things, DSTRUX enables "Mission Impossible" style document 鈥渟elf destruct鈥� policies for messages left on Facebook. 鈥淚t basically comes down to ownership,鈥� said DSTRUX chief executive officer Nathan Hecht in a statement. 鈥淒o you own your content or does the social network?鈥澨�

Another is , a privacy-focused service that is currently invite-only. It gives users the ability to create policies that govern specific accounts or even communications, explains Ekko.net founder Rick Peters. For example, a user might decide to assign a password to protect a specific e-mail thread, text message, or social media communication. Or they might set a 鈥渟elf destruct鈥� date for a message, causing it to be erased at a predetermined time.

Peters said the service is targeted at a subset of consumers who care about privacy online. 鈥淭hese are people who don鈥檛 want to be scanned, or tracked, or profiled. We鈥檙e offering them the ability to still use these services without exposing their personal data,鈥� he says.

Like Abine鈥檚 Blur, Ekko.net, won鈥檛 be free. Users will be asked to pay $5 a month to use it (or $50 for a one year subscription). 鈥淲hat you鈥檙e paying for is privacy and no tracking,鈥� he said. 鈥淐ompanies have to make money, so I think people understand that if you don鈥檛 pay for something that, essentially, you are the product,鈥� Peters says.

Matwyshyn of Princeton recognizes that security and privacy are becoming premium items. 鈥淚 think that 鈥� now 鈥� as the average consumer becomes more aware of the risk of identity theft, or the fact that cars are just computers on wheels, I think you鈥檒l see that consumers are willing to pay for having privacy and security."听

Limits to new privacy tools

Will tools such as Blur and Ekko.net tilt the playing field in favor of consumers and their privacy?

Privacy experts say:听Probably not.

While masking technologies are useful in preventing some kinds of online tracking, Gillula says听many transactions such as purchases must necessarily be traced back to individuals. Without broader protections built into Web browsers and other online platforms, the advantage goes to advertisers, merchants, and governments, he says.

And having the tools to manage your privacy in a granular fashion isn鈥檛 the same as having the time or the wherewithal to do so.

鈥淐onsumers really don鈥檛 have a fighting chance,鈥澨齭ays听Matwyshyn. 鈥淭echnology moves entirely too fast ... . To expect a consumer who spends all day working as a math teacher or something to become a computer security and privacy expert in his spare time is absurd.鈥�

She and others see the need for both bigger fixes and the level of Internet infrastructure, and for a larger conversation about the need for privacy and security that both protects consumers and girds consumer trust in online merchants and services.

鈥淎s a consumer protection matter, there needs to be a floor,鈥� she said. Just as there are laws protecting renters from substandard housing, or car buyers from 鈥渓emons,鈥� there need to be regulations that create a buffer between consumers and companies.

"Innovation is only as successful if consumers have faith in it and are willing to engage with new products,鈥澨齅atwyshyn says. 鈥淲e need safety nets so consumers feel like they can engage with new products reasonably without getting hurt.鈥�

听