Hello, thanks for your patience. We wanted to avoid any jargon in our clarification (and this is not an area where plain English abounds).
"The provider list I'm looking at is the one in the privacy settings where you can toggle cookie permissions on and off."
The software that we use for this is provided by a technology company called Quantcast.
The software is called a "Consent Management Platform" or "CMP". The CMP allows you to change your permission for Mumsnet to automatically tell advertising buyers you are willing to share your cookie data for these buyers to show you ads they think might be relevant to you. This is called a "consent flag".
If you toggle to "off" in both the Mumsnet "Ad selection, delivery, reporting" section and the 3rd Party "Ad selection, delivery, reporting", then you will be shown generic ads - this means the ads you see won't be targeted to you based on assumptions made about your browsing behaviour using cookies.
"Does this happen even if you've set your browser to not track across sites?"
Do Not Track is functionality that is integrated into Chrome and Safari, unfortunately it isn't as widely adopted as the current versions of CMPs which adhere to the Internet Advertising Bureau (IAB) framework - some 3rd party technology vendors recognise it, and some don't.
The CMP also allows you to manage your cookie permissions for "Third Party Vendors" by selecting "Reject all", toggling "off" for classes such as "Measurement", or managing companies individually.
Third Party Vendors are companies such as Rubicon, which sells ads, or Google Analytics which is used by publishers to report on their traffic. We work with some of those on the list, but not all of them.
We do not pass your email address to Third Party Vendors. We think the ability to manage your permissions with them for any website is a useful additional service.
" What level of tracking detail? Simply the top domain (ie BBC website) or individual pages? Or clicks within pages? Or keystrokes? Or login data for other pages?"
Each 3rd party vendor has their own privacy policy, but we don't pass 3rd parties data like your email address, passwords, things that you write on MN or your account details. Some 3rd party vendors may be interested in which pages you are reading to help them personalise what they show you. They may be able to detect what the page is about. If you don't feel reassured by this explanation and this is something you are still concerned about we'd advise you to select 'Reject all' on permissions for 3rd party vendors in the CMP.
What third party providers see our data? Our Privacy Policy shows the vendors we work with directly, but they in turn work with other vendors. Within the CMP you can select 'See Full Vendor List' and this lists all potential global vendors - we don't work with them all.
"What do they see? I'm particularly concerned about any providers who can hoover user details from across the web and link them (in the light of the poster on the breach thread who says you've contacted her with an email she's never used for you.)"
It isn't possible to hoover or scrape email addresses in this way.
"I guess I just want to be absolutely sure that a user cannot be identified by a third party data user. I've looked through the ones you use and one in particular is capable of linking user data across platforms to gain contact details."
If you are concerned about what 3rd parties can track across the web, we recommend selecting to reject all 3rd party permissions via the CMP. You can see the privacy setting toggle at any time at the bottom right of your account settings page.
"Second, many analytics companies have capacity to link information. What does 'device linking' and 'precise geographical information' mean in screen shot 2? More importantly, what does matching data to offline sources mean? (Screen shot 2.) What data? What offline sources? Where is the information collected? For what? Who uses it?"
In case it's useful, here's an explanation of the terms you have asked about that these Third Party Vendors use:
- "Device linking" means, for example, linking data about the pages you've browsed in desktop with data about the pages you've browsed on your mobile, to create a fuller picture of your interests.
- "Precise geographical information" means your location.
- "Matching data to offline sources" may mean, for example, linking your cookies and the pages you have browsed to items you have purchased in a shopping basket or in a store.
As mentioned above, if you are concerned about what 3rd parties can track across the web (pages you have viewed), we recommend selecting to reject all 3rd party permissions via the CMP. You can see the privacy setting toggle at any time at the bottom right of your account settings page.