WO2001057615A2

WO2001057615A2 - Method and apparatus for controlling tracking activities on networks

Info

Publication number: WO2001057615A2
Application number: PCT/US2001/003281
Authority: WO
Inventors: Ron Perry; Erez Manor; Almog Ben-Harosh; Moshe Anisman
Original assignee: Idcide, Inc.
Priority date: 2000-02-01
Filing date: 2001-01-31
Publication date: 2001-08-09
Also published as: AU2001238010A1; WO2001057615A3

Abstract

A method and apparatus for controlling tracking (140) activities on a network (130) are described. In one embodiment, tagging of a network access device and potential tracking (140) of an online activity of a user (120) are identified. Further, the user is notified that the user is being tracked. In one embodiment, the extent of tracking is restricted, up to a capability to completely disable tracking of the online activity of the user.

Description

METHOD AND APPARATUS FOR CONTROLLING TRACKING ACTIVITIES ON NETWORKS

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to protecting the privacy of Internet users by identifying, reporting, and restricting the collection of personal and other data relating to Internet users and their online activity. More particularly, the present invention relates to a method and apparatus for identifying and controlling tracking activities on the Internet and on similar networks.

2. Background Information

With the continuing increase in the number of Internet users and the growth of commercial activities on the Internet, there is a growing trend where various companies and organizations collect large amounts of data relating to individual users of the Internet, in a way that may interfere with and erode the privacy of Internet users. This creates a compelling need for methods and tools that will protect and enhance the privacy of Internet users on the one hand, and will not prevent or degrade from their ability to use the Internet for pleasure and business on the other hand.

Many companies and organizations on the Internet employ various technologies to collect information about the activity of Internet users who visit their Web sites. Some Web sites merely collect statistics about visitors' traffic at the various pages of their site, in order to improve the efficiency of the Web site. Others "remember" users' preferences and settings, in order to provide their users with personalized portals and web pages. Another class of Internet sites collect large amounts of information about the browsing behavior of individual users, and correlate this information with personal and demographic details which they also collect, such as name, address, age, gender, income, credit card number, e-mail address, etc. Recent advances make it possible to track Internet users' activity across many different Web sites. The organizations which perform this data collection, or "profiling", use the collected data-base of users' profiles for commercial purposes, in order to provide targeted advertising and marketing. Some companies use the profile data-bases internally, while others sell their profile data bases to other companies for profit.

Online profiling relies on "cookies" or similar technologies for identifying the individual user. A cookie represents a small amount of "persistent" information which is generated by a web server and is stored on the computer of a user when the user requests a web page from the server. Subsequently, each time the user sends a request for information to this web server, the cookie is sent back to the server along with the user request. The type of information which a cookie can contain is practically unlimited. The storing of cookies or other persistent information on the user's computer, while browsing, is normally invisible and unknown to the user.

Originally, the purpose of cookies was to identify users and possibly prepare customized information for them. That is, instead of soliciting certain personal information (e.g. the user's name and interests) from the user each time the user accesses the server, the server, upon receiving a first request from the user, asks the user for this information, and stores it for later use. Although it is possible to packages all the information into a cookie and send the cookie to the user device for storage, it is more common to store the information itself at the web server, and only put some kind of identification tag in the cookie that is sent back to the user device. The next time the user requests a web page from the same web server, the server uses the cookie sent to it with the request to identify the user and present the user with customized information.

However, marketers use cookies for a different purpose. Profile-based advertisers place a cookie on a user's computer with some arbitrary identification of the user. They maintain a database with information they can gather about the various activities of that user at their web site, such as the pages visited, products viewed, purchases made, etc. They may also collect personal and identifying information such as name, address, age, gender, e-mail address, etc. With the aid of the stored cookies, they can recognize the same user on subsequent visits to the web site, and combine and correlate the data from a series of visits made on different occasions. A particular class of trackers, "multi- site" trackers, can identify the same user as he visits different entities on the web, and put together a comprehensive set of information describing his or her activity over a large number of Internet sites.

Originally, the designers of the "cookie" mechanism designed it in a way that only allows web servers to receive a cookie if they belong in the same "domain" as the server that created the cookie. This was intended to prevent servers from tracking the activity of users as they surf from site to site. However, several techniques have been developed that allow this to be done. As a result, companies that provide "banner ads" for web pages typically perform multi-site, or multi-domain tracking of Internet users, using cookies or other tagging technologies. Multi-site tracking of users is considered as particularly depriving users of their right to privacy.

Modern web browsers let users block cookies entirely. This is normally not desirable, as certain cookies may be beneficial to a user. Cookies are used to personalize the web site for the user, to create a "virtual shopping carts" that makes shopping on the Internet friendly to users, In addition, cookies enable web sites to perform various functions smoothly and easily through firewalls and other network devices that obliterate some of the conventional addressing information on the Internet. Many sites, such as The New York Times, require a user to accept a cookie before they permit the user to browse their web sites. Likewise, the operation of many services on the Internet is dependent on cookies. Microsoft's Hotmail service, for example, will not function for a user who disabled cookies in his browser. Therefore, the user may not want to give up the above benefits, and, as a result, may not be willing to entirely disable the cookies. Some browsers have an option to warn the user that a web server is storing a cookie on the user computer. These browsers typically display a dialog box asking the user whether he or she agrees to have the cookie stored on the computer. The user then must reply to the message by clicking an appropriate button. However, responding to dozens of cookie prompts every time the user surfs the Internet may be annoying and may distract the user's attention from browsing.

It must be emphasized that cookies are just one (though the most common) technique used by web servers to identify, tag and track users, by storing persistent information on their computers or other access devices. There are several other techniques in use today for tagging user access devices, such as Persistent XML, dynamic HTML behavior, etc.

Microsoft's "Active Server Pages" software product contains ready-made tools for tracking the online activity of users. Cookie Munger is a widely available tool used by web sites for tagging users who set their browser to reject cookies. It can be expected that new tagging techniques and tools will continue to evolve as the Internet itself continues in its race of accelerated development.

The net result of the processes described above is that a lot of companies and organizations continuously collect and maintain information relating to private persons using the Internet, without these persons' awareness or consent, and without allowing these persons to examine the information relating to them, or to request that it be erased.

Therefore, what is required is an efficient system for controlling tagging and tracking processes on the Internet, which will protect the privacy of Internet users without interfering with their online activity.

SUMMARY OF THE INVENTION

A method and apparatus for controlling tracking activities on a network are described. In one embodiment, tagging of a network access device and potential tracking of an online activity of a user are identified. Further, the user is notified that the user is being tracked. In one embodiment, the extent of tracking is restricted, up to a capability to completely disable tracking of the online activity of the user.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention is illustrated by way of example and may be better understood by referring to the following description in conjunction with the accompanying drawings, in which like references indicate similar elements and in which:

Figure 1 is a block diagram of one embodiment for a network architecture;

Figure 2 is a block diagram of one embodiment for an architecture of a computer system;

Figure 3a is a block diagram of one embodiment for detecting and reporting tagging and tracking of an online activity of a user over a network;

Figure 3b illustrates an exemplary web page residing on a web server;

Figure 3c is a flow diagram of one embodiment for detecting potential tracking in data incoming to a client device;

Figure 3d is a block diagram of another embodiment for detecting and reporting tagging and tracking of an online activity of a user over a network;

Figure 4 is a block diagram of an embodiment for restricting tracking of an online activity of a user over a network;

Figure 5 is a flow diagram of one embodiment for restricting tracking of an online activity of a user over a network;

Figure 6a is a block diagram of one embodiment for configuring storage and retrieval of persistent information; and

Figure 6b is a block diagram of another embodiment for configuring storage and retrieval of persistent information. Figure 6c is a block diagram of yet another embodiment for configuring storage and retrieval of persistent information.

DETAILED DESCRIPTION OF AN EMBODIMENT OF THE PRESENT INVENTION

A method and apparatus for controlling tracking on a network are described. In one embodiment, the method includes identifying tagging of a network access device and potential tracking of an online activity of a network user and informing the user that the user is being tracked. In one embodiment, the method includes controlling and restricting the extent of tracking, up to a capability to completely disable tracking of the online activity of the user. It should be noted that the term "user" used herein refers both to persons and autonomous devices that may be performing activities over a network.

In the following detailed description of the present invention, numerous specific details are set forth in order to provide a thorough understanding of the present invention. However, it will be apparent to one skilled in the art that the present invention may be practiced without these specific details. In some instances, well-known structures and devices are shown in block diagram form, rather than in detail, in order to avoid obscuring the present invention.

Some portions of the detailed descriptions that follow are presented in terms of algorithms and symbolic representations of operations on data bits within a computer memory. These algorithmic descriptions and representations are the means used by those skilled in the data processing arts to most effectively convey the substance of their work to others skilled in the art. An algorithm is here, and generally, conceived to be a self-consistent sequence of processing blocks leading to a desired result. The processing blocks are those requiring physical manipulations of physical quantities. Usually, though not necessarily, these quantities take the form of electrical or magnetic signals capable of being stored, transferred, combined, compared, and otherwise manipulated. It has proven convenient at times, principally for reasons of common usage, to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like.

It should be borne in mind, however, that all of these and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities. Unless specifically stated otherwise as apparent from the following discussion, it is appreciated that throughout the description, discussions utilizing terms such as "processing" or "computing" or "calculating" or "determining" or "displaying" or the like, refer to the action and processes of a computer system, or similar electronic computing device, that manipulates and transforms data represented as physical (electronic) quantities within the computer system's registers and memories into other data similarly represented as physical quantities within the computer system memories or registers or other such information storage, transmission or display devices.

The present invention also relates to apparatus for performing the operations herein. This apparatus may be specially constructed for the required purposes, or it may comprise a general purpose computer selectively activated or reconfigured by a computer program stored in the computer. Such a computer program may be stored in a computer readable storage medium, such as, but is not limited to, any type of disk including floppy disks, magnetic hard- disk, optical disks, CD-ROMs, and magnetic-optical disks, read-only memories (ROMs), random access memories (RAMs), EPROMs, EEPROMs, magnetic or optical cards, or any type of media suitable for storing electronic instructions, and each coupled to a computer system bus.

The algorithms and displays presented herein are not inherently related to any particular computer or other apparatus. Various general purpose systems may be used with programs in accordance with the teachings herein, or it may prove convenient to construct more specialized apparatus to perform the required method steps. The required structure for a variety of these systems will appear from the description below. In addition, the present invention is not described with reference to any particular programming language. It will be appreciated that a variety of programming languages may be used to implement the teachings of the invention as described herein.

Referring now to Figure 1, a block diagram of one embodiment for a network architecture is illustrated. In this embodiment, client 120 is coupled to servers 110 via wide area network 130. Wide area network 130 may include, for example, the Internet, America On-Line™, CompuServe™, Microsoft Network™, or Prodigy ™. In addition, wide area network 130 may include conventional network backbones, long-haul telephone lines, Internet service providers, various levels of network routers, etc. Using conventional network protocols, servers 110 may communicate through wide area network 130 to a plurality of clients 120.

Client 120 represents any device that may enable user's online activity over a network. Such devices may include, for example, a conventional computer system, a network computer or thin client device (e.g., WebTV Networks™ Internet terminal or Oracle™ NC), a laptop computer or palm-top computing device (e.g., Palm Pilot™), a cellular phone, a "kitchen computer", etc. Client 120 may be a device used by a person (a "user"). Alternatively, client 120 may be an autonomous device performing activities over wide area network 130, in which case client 120 itself is referred to as the "user". In one embodiment, client 120 may have a Graphical User Interface (GUI) to allow users to access data. A GUI is a graphics-based user interface that incorporates icons, pull-down or pop-up menus and a pointing device. GUIs may include, for example, Microsoft Windows, Apple Macintosh, PalmOS, UNIX Motif, or UNIX OPE LOOK. However, it should be understood by one skilled in the art that other user interfaces (including non-graphic interfaces) may be used by client device 120 without loss of generality.

Client 120 may be connected to wide area network 130 in various ways. In one embodiment, client 120 may be connected directly to wide-area network 130 through direct or dial up telephone line, or other network transmission line. Alternatively, client 120 may be connected to wide-area network 130 using a modem pool. A conventional modem pool may allow a plurality of clients to connect with a smaller set of modems in modem pool for connection to wide- area network 130. In yet another network typology, wide-area network 130 may be connected to a gateway computer or a router, which may be used to route data to clients through a local area network. In this manner, clients can communicate with each other through a local area network (LAN) or with servers 110 through a gateway and wide-area network 130.

Using one of a variety of network connection means, servers 110 may communicate with client 120 using conventional means. In one embodiment, servers 110 may operate as web servers if the World-Wide Web (WWW) technology of the Internet is used over wide area network 130. Using the HTTP protocol and the HTML encoding language across a network, web servers 110 may communicate across the World-Wide Web with client 120. It will be realized by one skilled in the art that a wide variety of network protocols and coding languages other than HTTP and HTML may be used with this invention without loss of generality.

In one embodiment, client 120 may use a client application program known as a web browser such as the Netscape™ Navigator™ published by Netscape Corporation of Mountain View, CA, the Internet Explorer™ published by Microsoft Corporation of Redmond, Washington, the user interface of America On-Line™, or the web browser or HTML translator of any other conventional supplier. Using such conventional browsers and the World-Wide Web, client 120 may access graphical and textual data, or video, audio or tactile data provided by web servers 110. Conventional means exist by which client 120 may supply information to web servers 110 through the World-Wide Web 130 and the web servers 110 may return data to client 120.

In one embodiment, web servers 110 may be in various Internet domains. Within the Internet, domains are defined by the domain name system associated with the Internet Protocol (IP) address. Under the current domain name system, all devices sharing the common suffix part of the IP address are said to be in the same domain. Examples of the top level domains are ".com", ".net", ".org", ".edu", ".gov", etc. For sites registered outside of the US, this is further suffixed by a country code, for example ".ac.de", ".com.jp" etc. Examples of specific domains are "yahoo.com" "cnn.com", "whitehouse.gov", "majestic.net.au", etc. It will be recognized by one of ordinary skill in the art that any other form of domain names may be defined in the future without loss of generality. In one embodiment, tracking server 140 is associated with servers 110 in various domains. Alternatively, tracking server 140 may be one of web servers 110. Tracking server 140 represents web servers that monitor and collect data about online activity of clients 120. Tracking server 140 may communicate to client 120 via wide area network 130 in the same ways as described above with respect to servers 110. It should be understood by one skilled in the art that tracking server 140 is not a necessary element of the network topology shown in Figure 1.

Having briefly described one embodiment of the network environment in which the present invention operates, Figure 2 illustrates an example of a computer system 200 illustrating an exemplary client 120, or servers 110 and 140 computer systems in which the features of the present invention may be implemented. Referring to Figure 2, computer system 200 is comprised of a bus or other communications means 201 for communicating information, and a processing means such as processor 202 coupled with bus 201 for processing information. Computer system 200 further comprises a random access memory (RAM) or other dynamic storage device 204 (commonly referred to as main memory), coupled to bus 201 for storing information and instructions to be executed by processor 202. Main memory 204 also may be used for storing temporary variables or other intermediate information during execution of instructions by processor 202. Computer system 200 also comprises a read only memory (ROM) and /or other static storage device 206 coupled to bus 201 for storing static information and instructions for processor 202.

An optional data storage device 207 such as a magnetic disk or optical disk and its corresponding drive may also be coupled to computer system 200 for storing information and instructions. Computer system 200 can also be coupled via bus 201 to a display device 221, such as a cathode ray tube (CRT) or a liquid crystal display (LCD), for displaying information to a computer user. For example, graphical or textual information may be presented to the user on display device 221. Typically, an alphanumeric input device 222, including alphanumeric and other keys is coupled to bus 201 for communicating information and /or command selections to processor 202. Another type of user input device is a pointing device 223, such as a conventional mouse, touch pad, trackball, or other type of cursor direction keys for communicating direction or position information and command selection to processor 202 and for controlling cursor movement on display 221. A fully-loaded computer may optionally include video, camera, speakers, sound card, and many other conventional options.

Alternatively, client 120 can be implemented as any device described above. Such a device does not necessarily include all of the elements and features of the above-described exemplary computer system; however, the functionality of the present invention may nevertheless be implemented with such devices.

A communication device 225 is also coupled to bus 201 for accessing remote computers or servers, such as web servers 110 or 140, or other servers via the Internet, for example. The communication device 225 may include a modem, a network interface card, or other well known interface devices, such as those used for interfacing with Ethernet, Token-ring, or other types of networks. In any event, in this manner, the computer system 200 may be coupled to a number of servers 110 via a network infrastructure such as the infrastructure illustrated in Figure 1 and described above.

Figure 3a is a block diagram of one embodiment of the invention for identifying the tagging of clients 120 and the potential tracking of the online activity of network users, and for informing users that they are being tracked.

Referring to Figure 3a, browser 330 is used on client 120 and may be any browser described above. Browser 330 supports online activity of the user on client device 120. The online activity may include, but is not limited to, sending requests for web pages or objects to web servers 110 and receiving the requested web pages or objects for browsing. Web server 110 may hold web pages for one or more web sites. (It is customary to place multiple web sites on a single commercial server.) Alternatively, a large web site may be spread over a number of servers in different geographic locations. For example, an IBM web site may consist of thousands of files spread out over many servers in multiple countries. A web site is a related collection of information or web pages owned by an individual, company or organization. For the sake of clarity in explanation, it is assumed that a server holds only one web site and the terms "web site" and "server" are used herein interchangeably.

A web page in the Internet-related context is typically a collection of data available on wide area network 130, identified by a Uniform Resource Locator (URL), and stored on one or more servers. Alternatively, the web server may generate web pages and objects dynamically in response to requests from clients 120. Typical pages are written in HyperText Markup Language (HTML). Such pages are often referred to as HTML pages. However, it will be recognized by one of ordinary skill in the art that other technologies, such as extensible markup language (XML) objects, Visual Basic (VB) scripts, Common Gateway Interface (CGI) scripts, Java applets, JavaScript, ActiveX, etc., may be used to create web pages and objects with the present invention without loss of generality.

In one embodiment, tracking detection module 320 is a part of browser 330. In alternate embodiments, tracking detection module 320 may be a part of any other software or be a stand alone software application. In one embodiment, all data incoming to browser 330 and outgoing from browser 330 goes through tracking detection module 320. Tracking detection module 320 analyzes the incoming and outgoing data to identify potential tracking of the user's online activity. An indicator of potential tracking is the presence of certain persistent information in the data incoming to or outgoing from browser 330.

The persistent information may be a cookie, a text file, a persistent XML, or any other form of persistent information that is stored on client device 120 on behalf of server 110 or 140. In one embodiment, the persistent information is information that is created by server 110 or 140 and subsequently stored on client device 120. Alternatively, servers 110 or 140 may send to client 120 a code object, such as Java applets, JavaScript or ActiveX, etc., that will execute on client 120, and will create and store persistent information on client 120. The placement of persistent information on client 120 is referred to as "tagging", and is an indication of potential tracking of the online activity of client 120 by a server.

If tracking detection module 320 finds the persistent information, it then may invoke tracking indicator 340 which notifies the user of the potential tracking. In one embodiment, tracking indicator 340 is an independent module. In alternate embodiments, tracking indicator 340 may be a part of browser 330, a part of tracking detection module 320, or a part of any other software.

In one embodiment, tracking indicator 340 displays a message or a graphic indication on the display screen of client 120. The display screen may include one or more browser windows. In one embodiment, the message is displayed on a toolbar in a browser window, (e.g. by flashing a toolbar icon). In one embodiment, the message does not require a response from the user (unlike a dialog box). Instead, the message warns the user in a friendly manner without interfering with the user's online activity. The message may include a warning, an indication of the type of tracking (single or multi-site), the name of a source of potential tracking, the name of a web site at which the user was tracked, or any combination of this information. It will be recognized by one of ordinary skill in the art that any other relevant information may be included in the message without loss of generality.

In one embodiment, tracking detection module 320 analyzes data outgoing from browser 330. In this embodiment, browser 330 may send a user request for a web page to server 110. The user request may include persistent information (e.g. cookies) which has been created by server 110 (or another server in the same domain) and stored on user device 120. Tracking detection module 320 identifies the persistent information in the user request and invokes tracking indicator 340 which notifies the user in the manner described above that server 110 may be tracking the online activity of the user.

In another embodiment, tracking detection module 320 analyzes data incoming to browser 330. Upon receiving a user request, server 110 sends browser 330 a requested web page. Tracking detection module 320 searches the page for persistent information. It identifies the persistent information and invokes tracking indicator 340 which notifies the user in the manner described above that server 110 may be tracking the online activity of the user.

In yet another embodiment, tracking detection module 320 interacts with browser 330 and with other software elements in client 120 instead of analyzing incoming and outgoing data directly. Figure 3d is a block diagram of an embodiment for identifying the tagging of clients 120 and the potential tracking of the online activity of network users, and for informing users that they are being tracked. Referring to Figure 3d, browser 330 is used on client 120 and may be any browser described above. Browser 330 supports online activity of the user on client device 120. In this embodiment, tracking detection module 320 interfaces with browser 330 through API's (Application Programming Interfaces) 350 available from the browser, and also by intercepting some system services calls 360 of the browser. Tracking detection module 320 is made aware, through these interfaces, of actions performed by browser 330 for storage or retrieval of persistent information on client 120, as a result of requests sent to server 110 or 140, or objects received from server 110 or 140. Tracking detection module 320 determines if any of these actions represent tagging and potential tracking of client 120. If it so determines, it invokes tracking indicator 340 which notifies the user in the manner described above that server 110 or 140 may be tracking the online activity of the user. It will be understood by one of ordinary skill in the art that browser 330, tracking detection module 320 and tracking indicator 340 may interact in any manner other than that described above without loss of generality.

Having described how tagging and tracking activities are identified and how users are notified about these activites, an embodiment for detecting multi- site tracking will now be described in more details. In this embodiment, tracking detection module 320 can identify tracking by multi-site trackers. A multi-site tracker is typically linked to multiple servers 110 in various domains.

This allows the multi-site tracker to collect and correlate information about a user's online activities in multiple domains. Referring to Figure 1, multi-site trackers 140 typically provide web objects (e.g. banner ads) that are linked to servers 110 in different domains, and, consequently, these trackers are able to track clients 120 as they visit multiple web sites 110 in many different domains (and which are not located in the same domain as the tracking server).

Figure 3b illustrates an exemplary web page 370 residing on server 110. Referring to Figure 3b, page 370 is an HTML page. However, page 370 may be any other page as described above. Page 370 may include references to a variety of objects 372-378. Objects 372-378 may include text, graphic images, advertising images such as banners, or any other objects. Objects 372-378 may reside on the same server as the main page 370 or on any other server. For example, objects 374-378 may reside on various servers 110 in the domain of the URL of web page 370, and object 372 may reside on tracking server 140, which may be in a different domain from servers 110.

Referring back to Figure 3a, when a web page requested by the user from server 110 contains objects from other servers, browser 330 receives an initial page (referred to as a "skeleton" page) which includes references to these objects. Browser 330 then requests the objects from corresponding servers. In one embodiment, tracking detection module 320 maintains a record of requested objects and of a main web page with which the objects are associated. In one embodiment, one of the requested objects is object 372 (referred to as a "tracking object"). In response to the request for object 372, tracking server 140 attaches persistent information to object 372 and sends the object with the persistent information to browser 330. Tracking detection module 320 analyzes each object sent to browser 330 and detects persistent information included in tracking object 372. Tracking detection module 320 invokes tracking indicator 340, which then warns the user about this tracking activity, and may specify which web site is tracking the user and at which web site the user was tracked. In addition, tracking indicator 340 may notify the user that the web site tracking the user is a multi-site tracker. Figure 3c is a flow diagram of one embodiment for detecting tracking in data incoming to a client device. At processing block 354, a web page from server 110 is received. In one embodiment, the web page includes one or more objects referred to tracking server 140. At processing block 356, each of these objects is analyzed to identify persistent information included by server 140. Further, the persistent information is detected, and at processing block 358, the user is notified that tracking server 140 may be tracking the online activity of the user.

In one embodiment, tracking detection module 320 provides the user with an option to restrict or block the tracking activity of a server. In one embodiment, if the user decides to block tracking of a selected server 110 or 140, persistent information created by server 110 or 140 is erased from user device 120, which prevents the server from identifying the user in subsequent activity. In addition, the user may be provided with an option to retain the persistent information till the end of a session, and only then erase it. This will allow the user to browse sites that require cookies for their correct operation, and still prevent them from associating different browsing sessions with the same user.

In an alternate embodiment, if the user decides to block tracking of a selected server, persistent information created by this server is not erased from user device 120. Rather, tracking detection module 320, or another component of the invention, will prevent user device 120 from sending this persistent information back to the server, which will also prevent server 140 from identifying the user.

In either embodiment, blocking of the tracking activity may be specified on a per-site or domain basis. Alternatively, the user may request that all multi- site trackers be blocked, that all tracking be blocked for all sites, or for all sites except specified sites.

In one embodiment, if a server 110 requires an email address of the user, tracking detection module 320 may create a new mailbox for the user, that is dedicated for use with this server only, and is not used for any other communication with the user. As a result, the email address cannot be used to correlate the user with activities he or she performed at other web sites, as they were done with different email addresses.

Having described several embodiments for identifying and controlling tracking, Figure 4 illustrates a block diagram of an embodiment for restricting tracking of an online activity of a user over a network. Referring to Figure 4, the privacy of the user is enhanced by associating the user with a multiplicity of roles. In one embodiment, the user's online activity is separated according to a set of "roles". Each role may be associated with a particular set of topics and areas of interest. Each role is also associated with user privacy preferences, and with a set of user identifying information including personal details, such as a name, address, e-mail address, credit card, etc. For example, under the "at work" role, a manager in a car manufacturing company performs Internet activities related to the auto industry, and specifies his business address and company credit card. Under the "hobby" role, the same manager accesses web sites relating to golf or fishing, and specifies his home address and his personal credit card. Under the "private" role, which the user may want to tag as secret, the user accesses health and medical information, etc. Under this role, he may specify no name and address at all, or perhaps use fictitious name and address. Under each role, the user appears as a different entity (user) to the Internet. In addition, a separate set of persistent information (e.g. cookies) is maintained for each role of the user. As a result, tracking server 140 cannot collect a comprehensive profile of the user's web-surfing habits, as it cannot correlate activities performed under one role with activities the same user performed under another role.

As described before, a separate mailbox with a unique e-mail address may be established by the role manager for use with each role, in order to prevent trackers from associating the user with his or her online activities performed under different roles. Likewise, other unique information items (such as credit card number) may be created and associated with a role.

In one embodiment, role manager 420 associates the user with a plurality of roles. For each active browser window, role manager 420 sets the "active" role, and provides the user with a textual or graphic indication of the active role. In one embodiment, if several browser windows are open, each window may have a different active role. Alternatively, several windows may be under the same active role In either embodiment, the active role for a given window may be changed by the user at will, or it may be changed automatically by role manager 420 as the user browses another site.

In one embodiment, role manager 420 analyzes data incoming to and outgoing from browser 330 and automatically sets the "active" role of the browser window. The setting may be based on a topic associated with a web page requested by the user, or on other criteria. Alternatively, role manager 420 sets the user's current role based on an explicit command from the user. That is, the user may specifically identify the role that should be associated with the user's current online activity. For example, a manager in a car manufacturing company may specify that his current online activity must be associated with his "manager" role. Some time later (or at the same time but through a different browser window), the manager may want to have his online activity to be associated with his "hobby" role. As a result, he may access the same web page under different roles, e.g. he may access the page www.amazon.com under the "business" role to search for books on industry and under the "hobby" role to search for books on golf or fishing.

Cookie manager 440 maintains multiple sets of persistent information, such that each role has a separate set of persistent information (sometimes referred to as a "cookie jar" or "cookie set") associated with it. Whenever role manager 420 sets an active role for a browser window, it instructs cookie manager 440 to activate the relevant cookie set for that window.

Subsequently, cookie manager 440 retrieves persistent information that needs to be included in a user request from a cookie set which is associated with the current role. In addition, cookie manager 440 takes care of storing persistent information from incoming web pages and objects in the corresponding cookie set. As a result, persistent information that has been stored on behalf of a server

110 or 140 in cookie set "A", will not be sent back to the server when the active cookie set is cookie set "B". This will prevent the server from associating user activity under role "A" with activity of the same user under role "B", and thus enhance the privacy of the user, and restrict the extent of the tracking activity. Additionally, role manager 420 may verify that the user has not manually sent identifying information relating to role A when he is assuming role B.

In one embodiment, cookie manager 440 is a part of browser 330. In alternate embodiments, cookie manager 440 is a part of role manager 420, a stand-alone software application, or a part of any other software. Role manager 420 may also be an independent application or a part of another application. It should be understood by one of ordinary skill in the art that any function described herein can be performed by any software application or module described herein without loss of generality.

Figure 5 is a flow diagram of one embodiment for controlling and restricting tracking of user's online activity over a network. At processing block 554, a user is associated with a plurality of roles. As described above, each role corresponds to a set of topics or areas of interest and is associated with a set of user identifying information.

At processing block 556, the user online activity is configured differently depending on one of the plurality of roles. That is, each role is associated with a separate cookie set. In one embodiment, when more than one browser window is active, each browser window may correspond to a separate active role. Alternatively, more than one active browser window may be associated with a single active role.

At processing block 558, an active role is set for the current online activity of the user. As described above, the setting is done either automatically or according to a user request.

Three embodiments for storing and retrieving persistent information are now described. Figure 6a illustrates one embodiment, in which cookie manager

440 performs the actual storing and retrieving of persistent information on behalf of browser 330. Referring to Figure 6a, when browser 330 receives the persistent information, it may send this information to cookie manager 440 with the request to store it. This request may include information about the main URL (the "skeleton page") and tracking URL. In one embodiment, the information about the main URL is also sent to role manager 420 which identifies the current role of the user and informs cookie manager 440 which cookie set is associated with this role. Cookie manager 440 uses this cookie set to store persistent information of all objects related to the main web page. In addition, cookie manager 440 stores in this cookie set information identifying a web site associated with the main URL.

In one embodiment, records maintained by cookie manager 440 that identify relationship between the tracking URL and the main URLs are used to specify to the user a list of web sites at which the user has been tracked, and the identity of the tracking site.

Figure 6b illustrates another embodiment for storing and retrieving persistent information. In this embodiment, cookie manager 440 performs control actions on the file system of client 120 each time a role is changed, in such a manner that browser 330 accesses the "correct" cookie set automatically.

Figure 6c illustrates a third embodiment for storing and retrieving persistent information. In this embodiment, cookie manager 440 does not directly communicate with browser 330. In one embodiment, cookie manager 440 intercepts the web pages and objects arriving from remote servers, identifies persistent information included with these objects, and stores this persistent information in the cookie set associated with the active role.

In another embodiment, cookie manager 440 intercepts requests sent by browser 330 to the server and analyzes the request to identify persistent information included in the request. Subsequently, the cookie manager replaces this persistent information with another persistent information, retrieved from a cookie set associated with an active role of the user in the same manner as described above. The request with the new persistent information is then sent to the server.

Several variations in the implementation of the method and system for controlling access to the personal information of a user over a network have been described. The specific arrangements and methods described here are illustrative of the principles of this invention. Numerous modifications in form and detail may be made by those skilled in the art without departing from the true spirit and scope of the invention. Although this invention has been shown in relation to a particular embodiment, it should not be considered so limited. Rather it is limited only by the appended claims.

Claims

CLAIMSWhat is claimed is:

1. A method for controlling tracking on a network, the method comprising: identifying potential tracking of an online activity of a user by a server; and notifying the user that the server may be tracking the online activity of the user.

2. The method of claim 1 wherein identifying potential tracking comprises: analyzing data related to the online activity of the user; and detecting persistent information generated for storage on a client device, said persistent information being indicative of a potential intent to track the online activity of the user.

3. The method of claim 2 wherein analyzing the data comprises: receiving a web page from a first server, the web page including at least one object having a reference to a second server; and analyzing each of the objects in the web page to identify persistent information included by the second server.

4. The method of claim 3 wherein the second server resides in a different domain than the first server.

5. The method of claim 2 wherein the persistent information is a cookie, a persistent XML, or any form of persistent information generated for storage on the client device.

6. The method of claim 1 wherein notifying the user includes displaying information on a toolbar in a browser window.

7. The method of claim 6 wherein the displayed information identifies a tracking server and at least one web site at which the user was tracked.

8. The method of claim 7 wherein the tracking server is identified as a single web site or a multi-site tracker.

9. The method of claim 1 further comprising restricting a tracking activity of the server, said restricting being performed automatically or in response to a user request.

10. The method of claim 9 wherein restricting includes disabling the tracking activity of the server.

11. The method of claim 10 wherein disabling tracking activity comprises erasing persistent information of the server from a client device.

12. The method of claim 10 wherein restricting tracking activity comprises preventing persistent information stored on the client device from being sent to the server.

13. The method of claim 9 wherein restricting tracking activity includes creating at least one e-mail address to be used solely for communications between the user and the server.

14. A method for restricting tracking on a network, the method comprising: associating a user with a plurality of roles; and configuring an online activity of the user differently depending upon one of the plurality of roles to restrict tracking of the online activity

15. The method of claim 14 further comprising setting an active role automatically or according to a user request.

16. The method of claim 14 wherein configuring an online activity comprises: maintaining a separate set of persistent information for each role, each of said persistent information being generated by a server to store on a client device; and dynamically activating a different set of persistent information according to a current role of the user.

17. The method of claim 16 wherein each role is associated with a separate set of user identifying information.

18. The method of claim 16 wherein the current role is determined based upon a topic associated with a web site accessed by the user, a user-defined criterion, or a user action.

19. The method of claim 15 further comprising maintaining a separate role for at least one browser window.

20. The method of claim 15 wherein each of the persistent information is a cookie, a persistent XML, or any form of persistent information generated for storage on the client device.

21. An apparatus for controlling tracking on a network, the apparatus comprising: a tracking detection module for identifying potential tracking of an online activity of a user by a server; and a tracking indicator for notifying the user that the server may be tracking the online activity of the user.

22. The apparatus of claim 21 wherein the tracking detection module is configured to analyze data related to the online activity of the user and detect persistent information generated for storage on a client device, said persistent information being indicative of a potential intent to track the online activity of the user.

23. The apparatus of claim 22 wherein the tracking detection module receives a web page from a first server, the web page including at least one object having a reference to a second server, and analyzes each of the objects in the web page to identify persistent information included by the second server.

24. The apparatus of claim 23 wherein the second server resides in a different domain than the first server.

25. The apparatus of claim 22 wherein the persistent information is a cookie, a persistent XML, or any form of persistent information generated for storage on the client device.

26. The apparatus of claim 21 wherein the tracking indicator is configured to display information on a toolbar in a browser window.

27. The apparatus of claim 26 wherein the displayed information identifies a tracking server and at least one web site at which the user was tracked.

28. The apparatus of claim 27 wherein the tracking server is identified as a single web site or a multi-site tracker.

29. The apparatus of claim 21 further comprising a restrictor for restricting a tracking activity of the server, said restricting being performed automatically or in response to a user request.

30. The apparatus of claim 29 wherein the restrictor is configured to disable the tracking activity of the server, said disabling being performed automatically or in response to a user request.

31. The apparatus of claim 30 wherein the restrictor is configured to erase persistent information of the server from a client device.

32. The apparatus of claim 30 wherein the restrictor is configured to prevent sending persistent information stored on the client device to the server.

33. The apparatus of claim 30 wherein the restrictor is further configured to create at least one e-mail address to be used solely for communications between the user and the server.

34. An apparatus for restricting tracking on a network, the apparatus comprising: a role manager for associating the user with a plurality of roles; and a cookie manager for configuring storage and retrieval of persistent information differently depending upon one of the plurality of roles of the user.

35. The apparatus of claim 34 wherein the role manager is configured to set an active role automatically or according to a user request.

36. The apparatus of claim 34 wherein the role manager is configured to maintain a separate set of persistent information for each role, each of said persistent information being generated by a server to store on a client device, and to dynamically select a set of persistent information according to a current role of the user.

37. The apparatus of claim 36 wherein each role is associated with a separate set of user identifying information.

38. The apparatus of claim 36 wherein the current role is determined based upon a topic associated with a web site accessed by the user, a user-defined criterion, or a user action.

39. The apparatus of claim 35 wherein the cookie manager is configured to maintain a separate role for at least one browser window.

40. The apparatus of claim 35 wherein each of the persistent information is a cookie, a persistent XML, or any form of persistent information generated for storage on the client device.

41. A computer readable medium comprising instructions, which when executed on a processor, perform method for controlling tracking on a network, comprising: identifying potential tracking of an online activity of a user by a server; and notifying the user that the server may be tracking the online activity of the user.

42. The computer readable medium of claim 41 wherein identifying potential tracking further comprises: analyzing data related to the online activity of the user; and detecting persistent information generated for storage on a client device, said persistent information being indicative of a potential intent to track the information retrieval activity of the user.

43. The computer readable medium of claim 42 wherein analyzing the incoming data comprises: receiving a web page from a first server, the web page including at least one object having a reference to a second server; and analyzing each of the objects in the web page to identify persistent information included by the second server.

44. The computer readable medium of claim 43 wherein the second server resides in a different domain than the first server.

45. The computer readable medium of claim 42 wherein the persistent information is a cookie, a persistent XML, or any form of persistent information generated for storage on the client device.

46. The computer readable medium of claim 41 wherein notifying the user includes displaying information on a toolbar in a browser window

47. The computer readable medium of claim 46 wherein the displayed information identifies a tracking server and at least one web site at which the user was tracked.

48. The computer readable medium of claim 47 wherein the tracking server is identified as a single web site or a multi-site tracker.

49. The computer readable medium of claim 41 further comprising restricting a tracking activity of the server, said restricting being performed automatically or in response to a user request.

50. The computer readable medium of claim 49 wherein restricting incldues disabling the tracking activity of the server.

51. The computer readable medium of claim 50 wherein restricting tracking activity comprises erasing persistent information of the server from a client device.

52. The computer readable medium of claim 50 wherein restricting tracking activity comprises preventing persistent information stored on the client device from being sent to the server.

53. The computer readable medium of claim 49 wherein restricting tracking activity comprises creating at least one e-mail address to be used solely for communications between the user and the server.

54. A computer readable medium comprising instructions, which when executed on a processor, perform method for restricting tracking on a network, comprising: associating the user with a plurality of roles; and configuring an online activity of the user differently depending upon one of the plurality of roles of the use.

55. The computer readable medium of claim 54 further comprising setting an active role automatically or according to a user request.

56. The computer readable medium of claim 54 wherein configuring an online activity comprises: maintaining a separate set of persistent information for each role, each of said persistent information being generated by a server to store on a client device; and dynamically activating a different set of persistent information according to a current role of the user.

57. The computer readable medium of claim 56 wherein each role is associated with a set of user identifying information.

58. The computer readable medium of claim 56 wherein the current role is determined based upon a topic associated with a web site accessed by the user, a user-defined criterion, or a user action.

59. The computer readable medium of claim 55 further comprising maintaining a separate role for at least one window.

60. The method of claim 55 wherein each of the persistent information is a cookie, a persistent XML, or any form of persistent information generated for storage on the client device.