Under the pressure of growing interest from the FTC and a cascade of ongoing lawsuits against companies who have leveraged an under-used portion of Flash technology, Adobe in a blog post has addressed a weakness in the implementation of “Flash cookies,” or as Adobe calls them “local shared objects” (LSOs) that allowed other websites — not Adobe itself — to track user behavior even after a user has cleared the traditional web “cookie,” thus violating their privacy.
Emmy Huang addressed the issue in an update on Adobe’s Flash blog, saying the company was “collaborating with browser vendors to integrate LSO management with the browser UI,” giving users an easier and locally-based way to clear LSOs of third-party information and prevent reoccurrence. An API called NPAPI ClearSiteData has already been approved for implementation in Firefox, and will be added to Chrome as well. Additionally, Huang promised that a system preference setting for Windows, Mac and Linux would give users local control over LSO management (including turning it off entirely) rather than the present Shockwave-based web panel control that few web users are aware of.
Huang did not elaborate on a timeline for the changes, and mentioned only Google and Mozilla by name as partners in the initiative. Apple’s Safari browsers running in Private Browsing Mode and using Flash 10.1 or higher already have the ability to clear LSOs, but most users do not implement Private Browsing a.
Lawsuits involving the misuse of LSOs have been filed against Clearsprint, Quantcast, the Walt Disney Company (Internet Group), Warner Brothers Records and Specific Media among others over the last year and a half for misusing LSOs to restore the ability to track customers who deliberately deleted “regular” cookies in order to protect their privacy. Researchers at the University of California Berkeley discovered last August that 50 percent of the websites they sampled were using LSOs to track users.
