Ministry of Innovation / Business of Technology

Microsoft, Comcast, Yahoo: no zombie cookies here, Congress!

Worried about those new-fangled Flash or "zombie" cookies, the ones that …

Representatives Edward Markey (D-MA) and Joe Barton (R-TX) are probing the online privacy policies of major Web content providers, and the responses are in: leading website operators all assure Capitol Hill that they either use Flash cookies in a limited context, or they don't use them at all. But the replies from Microsoft, Verizon, Comcast, MySpace, Yahoo!, and six other companies don't seem to have made Markey, or even the more conservative Barton, very happy.

"While the responses that Rep. Barton and I received cite privacy policies and opt-out choices to enable consumers to preserve their privacy, these policies can be complicated and laborious to navigate," Markey noted after disclosing the letters. "In some cases, a list of all third party affiliates is not readily accessible, keeping consumers in the dark."

The inquiry was launched in response to a Wall Street Journal investigative piece on consumer Web tracking. High on the list of questions Markey and Barton asked is how sites handle so-called "zombie cookies"—those extra strength trackers that have everybody on edge because they can be quickly recreated, even after you delete cookies. Some consumers have even sued Disney and Warner Brothers over the technology.

Here's what these companies say they do or don't do. All offered responses to query no. 3. "How does your company collect consumer information (e.g., direct consumer input, cookies, beacons, Flash cookies, other surveillance technologies)?"


The software giant acknowledges that it uses Flash cookies. "We collect information about the Web pages consumers view through the use of cookies and/or beacons," Microsoft's response explains. "In some limited circumstances, such as storing user preferences like video playback screen size, our Web sites may utilize Flash cookies; but such Flash cookies are not used for purposes related to ad targeting."

At least, they're not used that way now. The company adds that "the specific technologies that we use change over time as we develop and launch new services." Still, Microsoft insists that it adheres to the Network Advertising Initiative (NAI) code regarding Flash cookies, which technically come under the rubric of Locally Shared Objects (LSOs).

The NAI believes that currently available native browser controls do not provide a level of transparency for Flash cookies and other LSOs comparable to that provided for HTML cookies. As a result, the NAI takes the position that its members should not use LSOs for OBA [Online Behavioral Advertising], Ad Delivery & Reporting, and/or Multi-Site Advertising until such time as web browser tools provide the same level of transparency and control available today for standard HTML cookies. LSOs may continue to be used for settings management purposes (such as user preferences and age verification).


The online image hosting/photo sharing company says that it uses Flash cookies to store user preferences, and it deploys Web beacons to gather analytics data and inform its advertising.

For example, Photobucket "may opt to display advertisements for Canon camera accessories to users who have uploaded photos taken with Canon cameras," the company's letter discloses.

The service also taps into domain linking information. If Photobucket knows that a consumer uploads photos on Facebook, the subscriber "may be served promotional units that encourage the user to download the Photobucket Facebook application."

The company's response acknowledges that Photobucket shares user data with third parties "with which we may have contracted to provide certain services to our users," but doesn't share personally identifiable information with them.


The online job placement and recruiting service's letter acknowledges that the Wall Street Journal found a Flash cookie on its site.

But, "that particular cookie was used by one of our vendors to monitor the effectiveness of various videos shown on our Website (i.e., they were used to determine how often unique or new viewers were accessing videos on our Website)," Careerbuilder explains.

"Although we believe that there are legitimate ways to use Flash cookies to improve a user's online experience, and that ours was one such legitimate use, we have removed the Flash cookie in question while we review and update our cookie use policies."


The dictionary service says it only uses Flash cookies that "function as typical cookies - they collect no personally identifiable information." The company also offers a link to the Adobe Flash cookie Web storage page (where you can manage Flash cookies) via the site's privacy policy section.


The WSJ's survey of various websites found that installed 55 Flash cookies on its pages.

"That finding surprised the company, which said it was unaware of them," the article continued. Eventually Comcast told the newspaper that it had deployed free software available from Clearspring Technologies to throw up a celebrity photo slideshow. The cookies came from that slideshow, Comcast insisted.

In general, Comcast doesn't use Flash cookies "as a surveillance technology or to collect information to create a behavior 'profile' for a specific user," the company told Markey and Barton. Comcast does use Flash, however, to "store information related to a user's video playback experience on (e.g., the bitrate capability of the player, whether subtitles have been enabled)."


Yahoo also says that it adheres to the NAI code for Flash cookies. But the Web search and applications company's letter admits that it employs them "in certain situations" to "provide special content such as video clips or animation."

As with Merriam-Wester, Yahoo says its privacy page links to Adobe's Flash cookie management site.

AOL's response letter noted that the WSJ found over 133 data tracking files, including 60 first-party cookies, 46 third-party cookies, 26 beacons, and one Flash cookie.

"The one Flash cookie originated from our partner ClearSpring, the maker of AddThis, a sharing technology widely available across the Web," AOL noted. But, like Microsoft and Yahoo!, AOL says that it adheres to NAI policies against using Flash cookies for behavioral advertising.

Most of AOL's first-party cookies manage basic features like recall preferences, the beacons count visitors, and the third-party cookies inform behavioral advertising, but without the user's name. "Thus, in most cases of the 133 tracking files found on by the Wall Street Journal, the tracking is non-personally identifiable," the company says.

Nope or maybe

As for the rest, Verizon says it collects consumer data via cookies, beacons, and direct input on, but that's as far as it goes. "We do not use Flash cookies or any 'surveillance technologies'," the company told Markey and Barton.

Ditto for, owned by The New York Times. "We collect visitor information only through direct consumer input and cookies,"'s letter explains. "We do not use Flash cookies."

MySpace and AT&T are vague about the feature in their answers to question three. The former says it indeed uses cookies and beacons, and transfers non-personally identifiable information to several third party advertisers (Google and the Fox Audience Network). But the company doesn't mention Flash.

As for AT&T: "We collect information on [AT&T's "Yellow Pages" search engine] that is provided directly by users, such as when they they register on, input search terms, or click on links or advertisements. We also collect information automatically when users visit through the user of cookies, beacons, widgets and Web logs."

All of the letters explain the various ways that consumers can opt-out of these Flash and non-Flash cookies or beacons. None of those explanations seem to have impressed Representative Barton.

"There is now a small army of companies collecting, analyzing, trading, and using information about consumers’ habits, purchases, and private data," Barton noted. "While some of these practices may be entirely legitimate—some, in fact, ultimately beneficial to the consumer—I do worry that not only are many Americans unaware of these practices, but those who seek out information in privacy policies often come up against complicated legalese."

Expand full story

You must to comment.