And I'm Melissa Block.
This week, we're exploring the many ways you share personal information with the digital universe, whether you know it or not. When you search online, when you shop, when you look for love.
And as NPR's Daniel Zwerdling reports, if you leave a digital footprint, private companies you've likely never heard of are keeping track.
DANIEL ZWERDLING, BYLINE: We stopped by a popular cafe one evening here in Washington, D.C. Lots of 20 and 30-somethings, beer and wine, plates of hummus. And the first three we talk to say, yep, they share intimate details about themselves on the Internet.
Hi, guys. Could I ask you a question for a second? Have you ever used one of those dating sites online?
SASHA: Yes, I met my current boyfriend of three years on OKCupid.
ZWERDLING: Can I use your name?
SASHA: Use my first name. It's Sasha.
JITHU RAMESH: My name is Jithu Ramesh. I've tried OKCupid, Match.com.
ZWERDLING: Have you ever used a dating site? Millions of people do. And they spotlight one of the most sensitive questions in the digital world: Who has access to the personal information you put on the Web? Consider OKCupid.
RAMESH: It asks you about your drug use. It asks you about, like, the number of sexual partners you've had, sexual habits.
ZWERDLING: And did you answer those kinds of questions honestly?
RAMESH: I did.
ZWERDLING: Because websites like OKCupid work by automatically matching people who seem to fit each other's answers. Then those people can message each other, anonymously, until they decide if they want to reveal more.
RAMESH: Yeah, usually I don't share my name until we've exchanged a few messages and I feel comfortable. And I feel like, yes, I'm going to meet you.
ZWERDLING: An understandable attempt to protect her privacy. But back at the office, I sit down with a computer privacy specialist and he gives us a striking demonstration...
(SOUNDBITE OF MUSIC)
ZWERDLING: ...to show how un-private the Internet can be. He signs up with OKCupid, as we watch.
(SOUNDBITE OF TYPING)
ASKHAN SOLTANI: It's creating an account now on this site.
ZWERDLING: And now, OKCupid has said Hooray - exclamation mark.
SOLTANI: That's right. So we're now signing in and we have to choose a username.
ZWERDLING: Ashkan Soltani used to work at the Federal Trade Commission. He helped investigate how Google and Facebook handle consumers' privacy. Now he studies the industry as a private consultant.
SOLTANI: And then we have to create a password.
(SOUNDBITE OF TYPING)
ZWERDLING: And first, Soltani shows us what you see when you go to OKCupid.com. Sure enough, the personal questionnaire pops up on the screen. OKCupid wants to know your sex, age, job, your income.
SOLTANI: Your ethnicity, your body type.
ZWERDLING: Your religion.
SOLTANI: Your diet.
ZWERDLING: Do you support the right to abortion? Are you left-wing or right-wing? How much do you drink?
SOLTANI: And I'm going to pretend that I drink very often.
ZWERDLING: And then OKCupid asks this question: How often do you take drugs?
SOLTANI: For drugs I selected "often" just for the purpose of this interview.
ZWERDLING: And now, Soltani is going to show us what you don't see. He launches special software that basically pulls the curtain aside and shows the inner workings of the Internet. Suddenly, we see what looks like lots of white ping-pong balls moving on a black background. Each of those balls is a different company that's monitoring him as he visits OKCupid.com. He starts counting the companies.
SOLTANI: Oh, wow. This is a lot. One, two, three, four, five, six...
ZWERDLING: There's nothing unusual about OKCupid. Websites commonly allow other companies to monitor what you're doing on their site.
SOLTANI: ...31, -2, -3...
ZWERDLING: But unless you know how to reveal those companies, as Soltani does, they're pretty much invisible.
SOLTANI: ...38, 39, 40, 41, 42, 43...
ZWERDLING: It turns out that 50 companies are tracking Soltani's computer on OKCupid.com. Some are advertising firms, others just collect information and then sell it to ad firms. Soltani's software shows that some companies are getting basic information like his age, gender, body type. Others get more personal.
SOLTANI: They know that we're Middle Eastern, drinking very often, smoking, yes.
ZWERDLING: And the software shows that at least one company has learned that Soltani uses drugs often. That company is called Lotame. Lotame's website states, quote, "Lotame does not buy, sell, or otherwise use information related to drug use frequency," unquote. But the software shows it in black and white: Soltani's drug answer has gone to Lotame, even if they're not using it.
So this company most of us have never heard of, Lotame, learned that you do drugs.
SOLTANI: That's right. So by me being naive and disclosing to OKCupid that I do drugs, this company, Lotame, that I've never heard of, gets to know that I commit a crime.
ZWERDLING: Soltani says, please remember, he made up that answer and others for this demonstration. In any case, we got in touch with OKCupid and Lotame, and many of the other companies that were tracking him at OKCupid. None would give us an interview. So we met with the head of a group that's mainly financed by Internet companies. It's called the Future of Privacy Forum.
One company after another, the executives have said they will not talk with us.
JULES POLONETSKY: Clearly, there are folks who haven't figured out how to make the case for what they're doing. And we think that's a big part of why the industry has such a bad rap.
ZWERDLING: Jules Polonetsky is executive director of the forum. Dozens of leading companies support it, including Amazon, Google, Microsoft and Lotame. The group is trying to find common ground between industry and privacy advocates.
POLONETSKY: I think companies haven't figured out how to talk to people about data or privacy. They're worried that their reaction will be: that's creepy, I don't like it.
ZWERDLING: But he says, you know what, most of the companies that track you have an innocent explanation. They're helping other companies advertise their products directly to you. Have you ever wondered: Weird, I keep getting ads for running shoes - how do they know I jog?
POLONETSKY: There's nothing they should be ashamed of if what they're doing is fair and honest. Hey, we're trying to sell you stuff.
ZWERDLING: Polonetsky says it's true, some companies ask for information that seems too personal.
POLONETSKY: The other day I downloaded a prayer book app. And the first thing it did when I opened it up, it asked me for location. And I'm like what, what? Hey, you're some righteous prayer book kind of thing, what are you also doing this? Later on, I learned it was going to also tell me where the closest synagogue was. So it was actually trying to help me, but it didn't say so up front and so I had my guard up right away.
ZWERDLING: In any case, Polonetsky says, most of the companies that track you don't really know who you are. Now, they do know your computer, because every time you browse the Internet, the companies that track you put invisible markers on your computer. They're called cookies, and cookies are like your own ID tag. In theory, nobody else's computer in the world has the same one.
In addition, your Internet company tags your computer in another way; it's called an IP address. So, as you browse the Internet, some companies can recognize, hey, that's the same computer that downloaded Jewish prayers last week and was checking out new cars the other day and was researching asthma and was looking at hotels in Hawaii. But Polonetsky says...
POLONETSKY: Most of these companies go to some great length to keep this non-personal, to keep your name, your email, your explicit information from being linked together with that.
ZWERDLING: To which some computer specialists say...
JONATHAN MAYER: One of the greatest myths about Web privacy is don't worry 'cause it's all anonymous. And there are in fact many ways in which what you do online is not anonymous.
ZWERDLING: Jonathan Mayer researches Web privacy at Stanford University. He's with their Center for Internet and Society. And listen to this. He and his colleagues at Stanford studied almost 200 companies on the Internet, from Home Depot to Facebook. The Stanford researchers found that more than 60 percent of those websites leaked personal information to other companies that track you.
Leak, that's a term Web researchers use. It means the tracking companies might have received personal information inadvertently, or maybe not. The trackers got usernames or email addresses or other information that could make it easy to figure out who you are.
MAYER: I, at least, take many of these companies at face value when they say we don't want to know who the users are, we just want to show them a more relevant ad. But, of course, there's a world of difference - as far as privacy goes - between we know who you are, we just at present don't act on that information, and we have no way of knowing who you are.
ZWERDLING: And as a handful of companies takes over more and more of the digital world, it's becoming even easier to know who you are. Mayer points to Google.
MAYER: And I don't mean to really single out Google. In fact, I actually think Google, on balance, does a lot better than many companies.
ZWERDLING: Mayer means that Google is more open than many companies are about the personal information they collect. If you have an account, you can go to a section on Google that shows some of the details it's gathered about your life. To give us a glimpse, Mayer looked up information that Google has archived about one of our producers. Her name is Emma Anderson. She gave him her password.
MAYER: Google here is indicating that there is a calendar, an event scheduled on that calendar was talking with J.D., not quite sure who J.D. is, on August 15th.
EMMA ANDERSON: Yeah, J.D. is a friend from my university. I didn't realize that I had synched my calendar, I guess, to my Google account.
MAYER: A Web history is kind of interesting. So I guess you were looking into Kim Kardashian's kid just a few days back.
ANDERSON: (Laughing) Apparently I was, yeah, just on my phone, I think.
ZWERDLING: This one company, Google, also knows what YouTube videos our producer has watched. It knows about her NPR projects, which she stores in Google's cloud.
MAYER: The document you worked on most recently is called "Full State by State."
ANDERSON: Another story that I'm working on.
ZWERDLING: Google's computers know where she's gone.
MAYER: You navigated to possibly a bar on M Street in Washington, just a few days back.
ANDERSON: Oh, it's a - yeah, it's a pizza place and I guess there's a bar.
ZWERDLING: We asked Google's spokesperson for a recorded interview and she declined. She sent a written statement, quote, "We are committed to keeping people's information safe and helping them control their personal data," unquote.
MAYER: Okay. Let's see. You were looking to buy a Carl Sagan autograph earlier in the year.
ANDERSON: Yeah, my boyfriend's birthday was coming up. He's into Carl Sagan.
ZWERDLING: So far, Google won't say whether police or, say, the FBI have gotten access to those kinds of personal details. Google has reported that law enforcement demanded information from its user accounts more than 21,000 times last year. Google has sometimes resisted, but a Google report says the company ended up turning over information in response to roughly two-thirds of those requests.
Other big companies like Yahoo and Facebook and Microsoft say they get tens of thousands of requests from law enforcement, too. Meanwhile, back at the cafe bar in Washington, D.C., we told one of the customers, Jithu Ramesh, you know those intimate details you put on the dating site, they might not be as private as you think. Does it bother you?
RAMESH: It doesn't bother me when somebody is - like, something is as removed as like a company, like a big corporation looking at it. It's not personal at all to me. I feel like I'm just a statistic or data for them. Will my mom have access to it? Probably not.
ZWERDLING: But know who can get access to some of your personal digital files? Your neighborhood lawyer. It turns out that some states consider private attorneys to be officers of the court, so lawyers can issue subpoenas for your phone texts, credit card records, even your digital medical files, despite the HIPAA law. Lawyers say that's one of the best ways to dig up dirt these days on people like cheating spouses. Daniel Zwerdling, NPR News.
BLOCK: Our story was co-reported by G.W. Schulz at the Center for Investigative Reporting. Tomorrow, we'll hear how the Bill of Rights has failed to keep up with the digital age. For more on our series, you can go to npr.org.
