The Digital Advertising Alliance and the Interactive Advertising Bureau are working to develop standard technology that allows consumers to opt out of online tracking when methods other than traditional cookies are deployed.
While the move appears aimed at protecting user choice, privacy researchers worry it's also an effort to legitimize alternative techniques for identifying consumers, inviting controversial practices like "browser fingerprinting" to become more common.
Cookies are small files that download from websites onto a computer, allowing marketers to target ads based on online activity, among other things.
Stuart Ingis, counsel for the DAA, said that Mozilla's decision to block certain cookies by default in the upcoming update of its popular Firefox browser is driving the timing of the effort.
The trade group's self-regulatory principles require members to allow users to opt out of tracking, but the current mechanism for doing so relies on cookies that at some point soon won't work in one of the most popular browsers. Apple's less-used Safari browser has long blocked the same variety of cookies, known as third party, which are installed by companies that don't have a direct relationship with consumers.
''If they use a different technology for doing the tracking, in order to comply with the DAA, there has to be a choice mechanism that works," Ingis said.
The DAA held a workshop in New York last month to discuss technical options. Data exchange BlueKai of Cupertino, Calif., has emerged as a key player in the effort, coordinating with a self-regulatory group led by the DAA and Interactive Advertising Bureau.
''We've been working with the industry to standardize data transfer that's independent of cookies, but has all the same transparency and notices that cookies have," BlueKai CEO Omar Tawakol said in an interview.
BlueKai offers tools that advertisers can use to analyze and make use of big data sets. It also operates a data marketplace with information on more than 300 million online consumers. The company is rapidly growing and just opened a San Francisco satellite office this week, in part to tap into the city's labor force.
Tawakol and Ingis both said the new technology, which is still under development, would allow companies to use alternative approaches that are sometimes called statistical or probabilistic tracking, while remaining in compliance with industry privacy standards. That includes providing notice, transparency and opt-out options, Tawakol said.
Statistical approaches include identifying a particular web browser by its unique combination of plug-ins, settings, fonts and other characteristics. Privacy researchers call it browser fingerprinting, a term Ingis rejects because the technique doesn't provide a 100 percent positive identification, just a high statistical likelihood.
''Fingerprinting is getting better, and part of that is that the incentives are higher as the rhetoric around Do Not Track increases and people are opting out of cookies," said Ashkan Soltani, a privacy and security researcher.
Statistical techniques can also include what is known as cross-device tracking, where a laptop, smart phone and tablet can be tied to a likely single user through a common IP address or similar patterns of online behavior.
Privacy advocates and researchers are concerned about the prospect of trade groups giving their blessing to these approaches because they can be more difficult for users to detect, delete and disable than the basic variety of cookie. There's no file to see and remove, as the whole process happens online.
''It's a lot harder to find out if they've been tagged, to do something about it in a reliable way and, depending on what the technique is, to counteract it in a way that doesn't undermine functionality," said Jonathan Mayer, a privacy researcher.
In a follow-up email, BlueKai emphasized that the standard under development doesn't condone cross-device tracking or the original approach to fingerprinting. Rather, the company says the technology represents a new generation of statistical methods with privacy built in.