Summary

  • The FTC announced a DoubleClick inquiry on 16 February 2000. Its 22 January 2001 closing letter said staff found no apparent combination of personally identifying information from Abacus Direct with DoubleClick’s non-identifying clickstream data and closed the investigation.
  • The same letter recorded a narrower, tangible problem. DoubleClick’s opt-out was stored as a cookie. In certain browsers, selecting the general setting to reject cookies deleted the opt-out cookie too. DoubleClick agreed to tell users they would need to opt out again if they later allowed cookies.
  • The letter also recorded commitments to disclose clear GIF tracking, correct an email-list claim, and notify the FTC before launching certain future products. DoubleClick’s FY2002 SEC filing treated browser cookie blocking as a commercial threat to ad targeting and reporting.

The refusal needed a place to live

Suppose a browser has two cookies from an advertising company. One helps recognize the browser for ad targeting. The other says the browser has opted out. The user opens the privacy settings and chooses the bluntest tool: reject cookies. In the browser configurations the FTC described, that choice removes both cookies. While the blocking setting stays on, the tracking cookie cannot do its usual job. The trouble arrives later. If the user switches cookies back on, the earlier refusal has gone with the rest of the jar. The company needs another opt-out request before it can know to honor the old choice.

This was not an abstract thought experiment written years after the fact. It appears in the Federal Trade Commission’s January 2001 closing letter to DoubleClick. The agency said DoubleClick let consumers stop its collection by requesting an “opt out cookie.” Certain browsers deleted that cookie when a consumer chose the general option not to accept or send cookies. DoubleClick agreed to disclose that a person who later resumed accepting cookies would have to opt out again. A privacy control that looks like a single decision thus depended on a sequence of browser states.

The wording matters because it keeps the mechanism honest. Blocking cookies itself denied the cookie route while the block remained in force. The failure was in remembering the refusal after the block was lifted. A user who changed settings for one website, installed a new browser, or simply reconsidered a global block could find that the advertising company no longer held the token that represented the earlier choice. The FTC letter gives no count of how many people experienced that sequence. The design needed no invented casualty to be worth understanding.

A privacy inquiry closed with a list of repairs

The FTC first acknowledged its inquiry in February 2000. It said staff were examining whether DoubleClick’s collection and use of information involved unfair or deceptive practices under Section 5 of the FTC Act. DoubleClick cooperated. By January 2001, the question had narrowed in the written record to what the company had actually done with personal information and what its own privacy statements told users.

The closing letter described the fear that dominated the case: DoubleClick had bought Abacus Direct, an offline direct-marketing company with personally identifying information. Its advertising network collected clickstream data without those names. The inquiry asked whether DoubleClick joined the two. FTC staff said it appeared that it had not combined Abacus personal information with the clickstream collected on client websites.

Staff also said the company had apparently not used or disclosed personal information beyond the purposes stated in its privacy policy and had not used sensitive data for online preference marketing against its stated policy. The investigation was closed. That finding leaves the cookie defect in a sharper light: the agency found a practical disclosure problem even while the feared database merger was not established.

There were other repairs in the same letter. DoubleClick used transparent image files, often called clear GIFs or web bugs, to track movement within websites and collect information. It agreed to explain their use in the next privacy-policy release. The FTC also pointed to the company’s Internet Address Finder privacy statement, which said it did not sell lists of names, addresses or email addresses even though an opt-in mailing list managed by a partner created an exception. DoubleClick agreed to state that exception. These were specific statements about specific tools, not a generic pledge to “do privacy better.”

The agency described DoubleClick’s Boomerang product as carrying user data from one site to target ads to the same user on other sites. The profiles used for that targeting contained only non-personally identifying information, according to the letter. For new Boomerang clients, the company required a site’s privacy policy to disclose use of the service before implementation. DoubleClick also agreed to give the FTC notice before commercially launching any future product covered by the Network Advertising Initiative principles.

The regulator was examining promises and product behavior at the boundary between the advertising network and the sites that hired it.

The cookie was both the business tool and the escape hatch

DoubleClick’s FY2002 annual filing later made the commercial side plain. The company warned that browser settings or software blocking cookies could diminish the effectiveness of its advertising products and reduce demand. Cookies served ad targeting and reporting. A user rejecting them interfered with the service the company sold. That same technology was also where the opt-out instruction lived.

It is an awkward arrangement, not because storing a preference is inherently strange, but because the preference and the practice it limits shared the same disposable container. A cookie can tell a server “do not treat this browser as an ordinary target.” Remove every cookie and the server no longer receives either the tracking identifier or the refusal marker. Reopen the container and the tracking machinery can work again; the special refusal marker does not reappear by itself. The user has to find and repeat the choice.

The company’s promise to disclose that sequence was a repair to the explanation, not a redesign of the state machine recorded in the letter.

The reliance on a third-party browser setting also made responsibility easy to scatter. The browser decided when cookie data was purged. DoubleClick designed the opt-out as a cookie and controlled whether its server recognized that token. Client websites supplied pages on which the advertising service operated and carried their own privacy statements. The FTC could inspect whether those statements and practices matched. The person clicking “block” controlled a local setting, but could not make a deleted token persist on DoubleClick’s side. Each actor controlled a different step; the sequence crossed all of them.

A closed case left an open design question

The 2001 letter closed the FTC investigation and reserved the agency’s ability to act later. It recorded commitments, not a civil penalty or a court order. Its most useful line for Internet history is the small one about deleting an opt-out cookie. Large privacy claims tend to ask who holds a database. This line asks where a refusal is stored and what happens when that storage is wiped. The latter determines whether a consumer choice survives a routine settings change.

To determine what happened to a particular browser after such a change, one would need its settings history, cookie state and the relevant ad-serving logs. The letter does not supply them. It does supply the exact failure path: a certain kind of cookie blocking could delete the opt-out; later acceptance of cookies required a fresh opt-out. The design made a one-time sounding action into a maintenance task for the user.

The old bargain was easy to sell. The advertising company could say it offered a choice. The browser could say it offered a stronger block. The user could reasonably expect the stronger block to preserve the weaker refusal. In some configurations it did the opposite to the stored token. DoubleClick’s promised policy revision would tell people to remember to say no again. The machine that remembered “no” had been thrown away with the rest of the cookies.