TOKYO -- While internet users have become used to accepting or denying cookies when they log on to a website, device fingerprinting has developed into the latest hot-button issue over online privacy and has exposed the scant regulation in Japan surrounding keeping people's information private.
A lesser-known workaround to cookies, which users can accept or deny, device fingerprinting tracks a person's online movements. And according to a recent Nikkei survey, more than a fifth of Japanese businesses use this workaround to track site users without their knowledge.
Websites for consumers belonging to 100 companies were parsed to see if they use device fingerprinting that keep tabs on visitors. The study, conducted in conjunction with Tokyo-based startup DataSign, confirmed the practice at 22 sites.
The websites analyzed belong to companies involved in consumer services, such as e-commerce groups. Many of these businesses were not aware they had been tracing people via digital fingerprinting.
"We didn't know we were tracking" users, said a communications officer for Park24, a car-sharing platform, which has since halted the practice. In this instance, device fingerprinting was used to gauge advertisement engagement through page views.
"We had delegated [that work] to a contractor," the communications officer said.
Device fingerprinting forms unique digital profiles by surveying the types of hardware and software a device uses when a person is online. Different from cookies, which basically are tracking monitors placed on a specific device, fingerprinting paints a broad picture of a user's habits. This picture creates a profile that can be tracked online.
But because user names and other obviously identifying information are not included in the profiles, device fingerprinting are generally considered exempt from Japanese regulations.
Since cookies have become notorious as tools for nonconsensual data analysis, device fingerprints have risen as a viable alternative. Device fingerprinting is harder to notice than cookies, and can be just as hard to block. Google instituted controls against fingerprinting, as did Apple and other tech companies.
While critics say the practice is a violation of privacy, proponents say the practice creates a better online experience. Reasons to use fingerprinting run the gamut, from advertising and marketing, to improving user experience or preventing unauthorized access.
Japanese hospitality brand APA Hotel says it uses device fingerprinting to improve its ad reach. "We made it so that people who have visited our site in the past will see APA's advertisement when they open a major search engine," said a representative from the chain.
Kirin Holdings says it deploys the practice to improve user experience depending on what device a person is using to read its website. "We find out if [site] access came from a computer or a smartphone so that we can improve the look of the website," said a respondent from the brewer.
For the majority of companies that say they tap fingerprinting to prevent unauthorized access, the approach is used to identify whether the device is the one a specific visitor regularly uses.
When the companies were asked whether they used device fingerprinting to analyze data at an individual level, such as a subject's preferences, 12 companies say they have not done so. The rest of the businesses either declined to respond or left the question unanswered.
None of the companies that use device fingerprinting have publicized that practice or the purposes through terms of services or other notices. Six businesses did not fully grasp the extent of the fingerprinting because outside contractors handled that function, among other reasons.
"This is the first time we've known about it," said an All Nippon Airways representative.
"We've known that a contractor used device fingerprinting, but we don't know the details," said a respondent from Oriental Land, the operator of Tokyo Disney Resort.
The lack of transparency on device fingerprinting, along with no rigorous monitoring of the practice, risks inviting misgivings from consumers. Fingerprinting, which could very well collect and analyze data about an individual, runs counter to the growing awareness of data privacy among users.
Fingerprinting can identify the tastes and preferences of a user through their browsing histories. Those who are looking for jobs or require hospitalization will be exposed as well.
There is also the hazard that outside contractors running fingerprinting programs can misuse the data or sell the information to a third party.
However, personal data rules concerning digital fingerprinting are inconsistent across national borders.
"The rules are so vague that we're not sure how to respond," said a source from a major apparel company.
The lack of risk awareness among Japanese companies regarding device fingerprinting, along with the checkered responsiveness to the issue, traces back to the way Japan lags behind crafting regulations.
The European Union's General Data Protection Regulation, along with California law, requires companies to gain user consent before engaging in data analysis using device fingerprinting.
Japan and India generally do not have rules governing the practice. These divergences occur due to differences of opinion on whether fingerprinting profiles can be called "personal data."
In Japan, the definition of personal data extends to data directly connected to an individual, such as a name or facial information. Meanwhile, the EU and other jurisdictions go further by requiring operators to safeguard information that provides clues to a person's identity, such as IP addresses.
It is still an unescapable fact that names and other identifying information dance around in cyberspace, often without people's knowledge. The business community faces pressure to be fully transparent about data practices that affect privacy.
Tetsuya Oi, an attorney well versed in data regulation, called for new rules that match advances in data technology.
"Japan doesn't include digital fingerprinting and similar data collection to personal information, which puts it behind global trends," Oi said.