Local Shared Object - Privacy Concerns

Privacy Concerns

As with HTTP cookies, local shared objects can be used by web sites to collect information on how people navigate those web sites even if people believe that they have restricted the data collection. Online banks, merchants, or advertisers may use local shared objects for tracking purposes.

On 10 August 2009, Wired magazine reported that more than half of the top websites used local shared objects to track users and store information about them but only four of them mentioned it in their privacy policy. "Flash cookies are relatively unknown to web users," it said, "even if a user thinks they have cleared their computer of tracking objects, they most likely have not." The article further asserts that some websites use Flash cookies as hidden backups, so that they can revive HTTP cookies when user deletes them.

According to New York Times, since July 2010, there had been at least five class-action lawsuits in the United States against media companies for using local shared objects.

In certain countries, it is illegal to track users without their knowledge and consent. For example, in the United Kingdom, customers must consent to use of cookies/local shared objects:

Cookies or similar devices must not be used unless the subscriber or user of the relevant terminal equipment:

• is provided with clear and comprehensive information about the purposes of the storage of, or access to, that information; and
• is given the opportunity to refuse the storage of, or access to, that information.

Local shared objects were the first subject to be discussed in the Federal Trade Commission roundtable in January 2010. FTC Chairman Jon Leibowitz has been talking with Adobe about what it describes as "the Flash problem."