Apologies for the delay in replying - I wanted to review the details in greater depth before commenting. Since this issue only occurs once an order is confirmed at Scan though, it does make detailed investigation a little more difficult.
I have taken a closer look at the Shopzilla javascript (https://www.shopzilla.com/css/roi_tracker.js) and can give some good news for those concerned. It does a page scan only with Yahoo websites (this was my major concern, since Scan's order confirmation page does include personal details which could be picked up in this way). With other sites (like Scan) it instead creates a URL for Bizrate.com, including customer type (E for Scan - would this mean eggheads by any chance? ), order ID, value and number - Bizrate then returns a web bug (see this link for an example). The downside however is that Bizrate sets a cookie (with a Tuesday, May 31st 2016 expiry date) which would allow it to correlate this order with any future ones (plus any placed with other sites using this tracker). Since the connection to Bizrate is via https: this cookie would bypass any third-party cookie filters, including firewalls with privacy features enabled.
Now to separate the chaff from the wheat...This is not about whether people should trust Scan or not (if you didn't trust them, you presumably wouldn't order from them!) but whether that trust should be extended to third parties like ShopZilla and NexTag. I personally had not even heard of these sites beforehand so cannot reasonably be expected to have any confidence in them. Unfortunately, the method used to send them data bypasses any third party filters installed meaing that it is very difficult for most users to even see it take place, let alone stop it.Originally Posted by ExceededGokuIf that is your viewpoint, then I would ask you to kindly refrain from further comments in this thread unless you have something more relevant to post.Originally Posted by ExceededGokuThanks for including this response - no name is attached so may we presume this is Elan Raja? Hope you'll excuse me for referring to you as "Scan MD" in the rest of this post.Originally Posted by Steve AFirst of all, thanks for taking the time to address the concerns posted in this thread. There is no intention to criticise Scan itself or its employees, but instead to draw attention to a particular function on Scan's website and its consequences for customer privacy.Originally Posted by Scan MDIf only "relevant orders" need this calculation, then why are details of every order submitted in this way? Regardless of how a customer reaches Scan (via a pricing engine or, as in my case, via typing Scan's URL in directly without using a pricing engine at all), this submission of data to Shopzilla/Nextag still takes place. Also there are far more search engines out there than Shopzilla/Nextag - why aren't similar steps taken with these?Originally Posted by Scan MDIf someone visits Scan via a search engine link, Scan could verify this by checking the referer (where present) or by noting the entry URL (which is almost always customised by the search engine to include extra parameters like affiliate ID) with far less risk to users' privacy. Why isn't this approach taken?Originally Posted by Scan MDSupplying data to search engines yes. Supply data on completed orders, no - while I won't claim to have used every other European etailer, the only other European example of this I have encountered (and noted in the Wilders' thread) is PCWorld.co.uk who sends details on every page visited to Doubleclick.Originally Posted by Scan MDThis is true, until you consider the consequences of data aggregation by the portals. Shopzilla does not set a cookie, but Bizrate certainly does. That means that until Bizrate's cookie expires (Tuesday, May 31st 2016 in my case), it has the ability to correlate all orders placed with Scan, plus any other stores providing data in a similar fashion. All it then requires is one "partner" website to include personal data (name/address) for them to be able to attach this to their order history.Originally Posted by Scan MD
From a security perspective also, Shopzilla can extract any data they want from Scan's order confirmation page just by amending their Javascript code. Allowing third party sites to include their own Javascript on Scan's website poses more dangers than just having a web bug (as with NexTag) since such scripts could alter page contents - and the more widespread Shopzilla's ROITracker becomes, the more attractive a target it becomes to crackers or malware pushers looking for a new way of compromising end-users' systems.So far, your statements about data sent appear to confirm the information included in this thread. While such data on its own cannot be related to an individual, the real danger for consumers (and the real benefit correspondingly for marketeers) is aggregation of this data allowing subsequent identification. Scan obviously has no means of controlling this, but it is fuelling it with its own order data.Originally Posted by Scan MD
In addition users should be aware that whenever they visit a site, details like their IP address, operating system (Windows version in most cases) and browser can be logged (see BrowserSpy for a comprehensive list of the information a website can obtain). In the case of data aggregators like Bizrate, this could be useful in determining if an IP address was dynamic/shared or static/single - static/single addresses could then have a real-world address assigned to then with a higher degree of confidence.Thanks for this, and I look forward to seeing their response. Scan isn't the only site to use this method of transferring data to third parties - but it could be the first to properly address consumer concerns about it.Originally Posted by Scan MDI'd rather keep opinion out of this - let's stick to hard facts shall we?Originally Posted by Scan MD