In November, the Federal Trade Commission (FTC) will host a workshop on cross-device tracking for marketing and advertising purposes. It's not that device-tracking is a new practice, but the number of devices each person uses has significantly increased over time, creating lucrative opportunities for marketers to learn even more about web browsers' habits. Now, it's possible to watch users browse for vacation destinations on their iPads, buy a weekend in the country on their desktop and then drive there using their cell phone's GPS. That kind of detailed consumer picture is worth a lot of money if you're job is finding out what people are interested in with an eye toward selling them something they'll entertain buying. 

But it obviously presents privacy pitfalls. That was the topic of discussion at the IAPP's Privacy. Security. Risk session, "I See You Here, There, Everywhere: The Implications of Cross-Device Tracking." Shane Wiley, CIPP/US, is vice president of privacy and data governance for Yahoo, which employs cross-device tracking but allows users—as do sites like Google and Facebook—to view which devices are being tracked and to opt out if desired. 

The benefits of tracking aren't solely marketers'. Users, for example, might enjoy reading a novel on their kindle and then picking up their cell phone to find it open to the same page they'd been reading on the last device. That's what marketers call "continuity of service." Or say you're watching your favorite show on Netflix on your smart TV and later open up your iPad to find it's saved the place you paused and you're able to pick back up on the very next episode. 

But what kind of understanding do users have that they're being tracked in such ways, and what kinds of inferences might marketers make about unwitting users? Imagine, for example, a couple who live together. They share use of their desktop computer and iPad, but each has their own cell phone. If the user has been identified across devices, what's to say an advertisement based on one of their online queries for an engagement ring doesn't show up on the others' device? Or imagine a more dire circumstance, in which a person sharing a device within a household is researching cancer treatment before announcing to anyone she's been diagnosed. 

Those are the kinds of questions the FTC hopes to answer in November, said the FTC's Megan Cox, who's an attorney in the agency's Division of Privacy and Identity Protection. 

"We're holding it now because we know the space is evolving rapidly as the number of devices in consumer hands grows, corresponding technologies are evolving, and marketers are facing new challenges," Cox said. "The way information is collected and the volume its collected are growing. Where it used to be one device and cookies, which a user could exercise choice, that's not necessarily true for these new technologies. It's not the same exercise of choice and tracking." 

David Wainberg, CIPP/US, privacy and policy counsel at AppNexus, said companies like Facebook, Yahoo and Google have really effective and established cross-device maps, which they use to organize who they're tracking and on what, because they've got authenticated relationships and a lot of users. 

"But for the rest of industry, we're in a pretty early phase," he said. "The market adoption has been slow, but it's growing." 

While adoption of cross-device tracking might be slow, it's a fast-paced world because of the frequency with which users switch devices. Wiley said users change devices every 18 months or so. That being true, questions around opt-out come into play. For example, Yahoo allows users to opt out of device-tracking, and when a user gets a new device and registers Yahoo mail on it, the opt out holds true for the new device. But that's not because there's a law or regulation on that, it's just a choice Yahoo made. What if some ad platforms don't honor that lifetime opt out? Will that message be clearly communicated to users? And how do you communicate that message to users in a meaningful way? 

"There's a level of control that needs to come to the marketplace, and that is 'When I rotated that ID, I meant it to go for everything,'" Wiley said. 

There are two kinds of tracking, really. There's deterministic tracking, in which ad platforms ask users to sign in on their devices, giving them a definitive answer of who's using the device. Then, there's probablistic tracking, in which ad networks aggregate troves and troves of data to make educated guesses about who's using the device rather than knowing definitively who the user is. It's thought that they're right about 60 to 90 percent of the time. 

That kind of tracking is particularly troubling to the FTC, Cox said, because it's one thing to track a user who's logged into your website, but it's another to track someone who hasn't.

"If the customer has a relationship with that platform, it's more transparent to the consumer that might be being tracked, and the site's privacy policy gives them notice and transparency," she said. "With probabilistic, we're interested in learning about where there is transparency, where there could be more and the consumer's level of education on that topic."

Wiley said industry is also excited about the idea of some answers coming out of the FTC workshop. 

"One of the best things that could come from the FTC workshop is that transparency and (user) control needs to follow the technology more closely," he said.