WHAT EXACTLY IS A WEB BUG?
A Web bug is a graphic on a Web page or in an e-mail message designed to monitor who is reading the page or message. Web bugs are often invisible because they are typically only 1-by-1 pixels in size. In many cases, Web bugs are placed on Web pages by third parties interested in collecting data about visitors to those pages.
WHAT INFORMATION IS SENT TO A SERVER BY A WEB BUG?
The IP address of the computer that fetched the Web bug
The URL of the page that the Web bug is located on
The URL of the Web bug image, which contains the information to be communicated between the Web page visited and the site collecting the data
The time the Web bug was viewed
The type of browser that fetched the Web bug image
A previously set cookie value
(Although this doesn't seem like much, these items can be used to spread information between multiple Web sites. Click here for a more detailed explanation.)
WHAT ARE SOME OF THE USES OF A WEB BUG ON A WEB PAGE?
Web bugs can be used to provide an independent accounting of how many people have visited a particular Web site. Web bugs are also used to gather statistics about Web browser use at different sites on the Internet.
In addition, advertising networks can use Web bugs to collect information on what sites a person is visiting to create a personal profile. The personal profile is stored in a database server belonging to the ad network and identified by the browser cookie of the network. The profile determines what banner ad one is shown at a later time.
A more detailed outline of the uses of Web bugs appears under Advanced Topics.
WHY ARE THEY CALLED WEB BUGS?
The word "bug" is being used to denote a small, eavesdropping device. It is not a euphemism for a programming error.
Rather than the term "Web bugs," the Internet advertising community prefers the more sanitized term "clear GIFs." Web bugs are also known as "1-by-1 GIFs," "invisible GIFs." and "beacon GIFs."
ARE ALL INVISIBLE GIF IMAGES WEB BUGS?
No. Invisible GIF files are also used for alignment purposes on Web pages. A Web bug will typically be loaded from a different Web server than the rest of the page, so they are easy to distinguish from alignment GIF files.
ARE WEB BUGS ALWAYS INVISIBLE ON A PAGE?
Yes, according to our definition. But Web bugs are not the only types of Web elements that can track user activity. See the Advanced Topics below.
HOW CAN I MANUALLY LOCATE A WEB BUG ON A PAGE?
Before Bugnosis, the only way to find a Web bug was by viewing the HTML source code of a Web page and searching for IMG tags that match up with cookies stored on the user's computer. A Web bug will typically have its HEIGHT and WIDTH parameters in the IMG tag set to 1, it will be loaded from a different server than the rest of the Web page, and it will have an associated cookie.
WEB BUGS, ADVANCED
I was visiting www.buy.com when Bugnosis told me about a Web bug from ad.doubleclick.net. Which company is responsible for the Web bug: Buy.com or Doubleclick.net?
The companies may have decided together to place the Web bug on Buy.com’s page. In fact, both Web sites need to add a little bit to their Web servers to put the Web bugs there. However, sometimes the main site — the one you are aware of visiting — defers such matters to the site actually providing the bug.
WHY ARE THEY BUGGING ME?
Companies use Web bugs to:
Count the number of times a particular Web page has been viewed.
Track the Web pages a visitor views within a Web site.
Track what Web pages an individual visits across many different Web sites.
Count the number of times a banner ad has appeared.
Measure the effectiveness of a banner ad campaign by matching visits to a Web site to where banner ads for the site were originally viewed.
Match a purchase to a banner ad that a person viewed before making the purchase. The Web site that displayed the banner ad is typically given a percentage of the sale.
Allow a third party to provide server logging to a Web site that cannot perform this function.
Record and report the type and configuration of the Internet browser used by a visitor to a Web site. This information is typically used in aggregate form to determine what kind of content can be put on a Web site to be viewed by most visitors.
Record and report search strings from a search engine to an Internet marketing company. The search strings are typically used to profile users.
Transfer previously input demographic data (gender, age, zip code, etc.) about visitors of a Web site to an Internet marketing company. This information is typically used for online profiling purposes.
Transfer previously input personally identifiable information (name, address, phone number, e-mail address, etc.) about visitors of a Web site to an Internet marketing company. This information is typically used for online profiling purposes. It also can be combined with other offline demographic data such as household income, number of family members, type(s) of car(s) owned, mortgage balance, etc.
Cookie sync, which allows two companies to exchange data in the background about Web site visitors. This data can be demographics or personally identifiable data, typically used for online profiling purposes.
HOW MANY COMPUTERS ARE INVOLVED WHEN A WEB BUG IS USED?
Usually three. For example, suppose Alice surfs to Spend.com, which contains a Web bug. Technically speaking, the Web bug looks like an image embedded in the Spend.com Web page. In response to loading the Spend.com Web page, Alice's computer automatically tries to fetch the embedded image. But it was deposited in Spend.com in a way that says "the image is actually located at Bug.com, go get it from there." Alice's computer dutifully contacts Bug.com, which delivers an invisible image, so this transaction is not at all apparent to Alice. Effectively, the Spend.com site has tricked Alice into transmitting information from Spend.com and/or Alice's computer to Bug.com, without Alice's knowledge.
WITH THREE (OR MORE) COMPUTERS, IT'S HARD TO KEEP TRACK OF THINGS. IS THERE ANY STANDARD TERMINOLOGY WE CAN USE?
In the previous example, Alice's computer is called the user or originator or first party. Spend.com is called the main or intended Web site or second party, and Bug.com is called the Web bug recipient, hidden Web site, or third party.
WHAT INFORMATION IS CARRIED BY A WEB BUG?
1. The type of browser that fetched the Web bug image. 2. The time the Web bug was fetched. 3. The IP address of the computer that fetched the Web bug. 4. The URL of the main Web site. 5. The URL of the Web bug image located on the hidden Web site. 6. A previously-set cookie value.
Information types (1-2) are not necessarily such a big deal. However, (3-6) are more sensitive. The computer's IP address (3) can be traced by network providers, but this usually takes a fair amount of effort. By receiving (4), the hidden Web site learns where the user intended to browse. And the main Web site can control (5) to communicate any extra information it has through Alice's computer to the hidden Web site. Item (6) allows the hidden Web site to recognize the user's computer.
For example, suppose Alice creates an account at Spend.com, which contains a Web bug to Bug.com. During this process she enters her e-mail address alice at example.com. The Spend.com Web site could use a Web bug to transmit her address to Bug.com without Alice's knowledge. But the Spend.com site could send that information directly to Bug.com without involving Alice's computer at all!
WHY IS THIS IMPORTANT?
If Spend.com sent the infomation to Bug.com without going through Alice's computer, then all Bug.com could learn is that someone created a login at Spend.com with the e-mail address alice at example.com. Certainly Bug.com could add an e-mail address to their collection, but they would have no automatic way to associate the e-mail address with Alice's Web browser. When Alice visits other Web sites that also contain Bug.com Web bugs, they still wouldn't be able to deduce her e-mail address. Having given her e-mail address to Spend.com for the sole purpose of establishing an account there, Spend.com remains the only site that can recognize her and remember her e-mail address when she returns.
But if Spend.com uses a Web bug to transmit the information through Alice's computer to Bug.com, then Bug.com could arrange to communicate her e-mail address to many other Web sites. For example, when she later visits Splurge.com, it could get her e-mail address from Bug.com with very little effort. So in this case, even though Alice gave her e-mail address to Spend.com for the sole purpose of establishing an account there, she later discovers (without knowing why) that many other Web sites seem to suddenly know her e-mail address.
CAN INFORMATION OTHER THAN E-MAIL ADDRESSES BE SHARED BETWEEN SITES IN THIS WAY?
Yes. Health interests, political affiliations, personally identifiable information, sexual disclosures: whatever is expressed at one Web site could be carried by a Web bug to many other Web sites.