Web Code Offers New Ways To See What Users Do Online

(Samy Kamkar created software to show how thoroughly computers could be infiltrated by the latest Web technology)

Worries over Internet privacy have spurred lawsuits, conspiracy theories and consumer anxiety as marketers and others invent new ways to track computer users on the Internet. But the alarmists have not seen anything yet.

In the next few years, a powerful new suite of capabilities will become available to Web developers that could give marketers and advertisers access to many more details about computer users’ online activities. Nearly everyone who uses the Internet will face the privacy risks that come with those capabilities, which are an integral part of the Web language that will soon power the Internet: HTML 5.

The new Web code, the fifth version of Hypertext Markup Language used to create Web pages, is already in limited use, and it promises to usher in a new era of Internet browsing within the next few years. It will make it easier for users to view multimedia content without downloading extra software; check e-mail offline; or find a favorite restaurant or shop on a smartphone.

Most users will clearly welcome the additional features that come with the new Web language.

“It’s going to change everything about the Internet and the way we use it today,” said James Cox, 27, a freelance consultant and software developer at Smokeclouds, a New York City start-up company. “It’s not just HTML 5. It’s the new Web.”

But others, while also enthusiastic about the changes, are more cautious.

Most Web users are familiar with so-called cookies, which make it possible, for example, to log on to Web sites without having to retype user names and passwords, or to keep track of items placed in virtual shopping carts before they are bought.

The new Web language and its additional features present more tracking opportunities because the technology uses a process in which large amounts of data can be collected and stored on the user’s hard drive while online. Because of that process, advertisers and others could, experts say, see weeks or even months of personal data. That could include a user’s location, time zone, photographs, text from blogs, shopping cart contents, e-mails and a history of the Web pages visited.

The new Web language “gives trackers one more bucket to put tracking information into,” said Hakon Wium Lie, the chief technology officer at Opera, a browser company.

Or as Pam Dixon, the executive director of the World Privacy Forum in California, said: “HTML 5 opens Pandora’s box of tracking in the Internet.”

Representatives from the World Wide Web Consortium say they are taking questions about user privacy very seriously. The organization, which oversees the specifications developers turn to for the new Web language, will hold a two-day workshop on Internet technologies and privacy.

Ian Jacobs, head of communications at the consortium, said the development process for the new Web language would include a public review. “There is accountability,” he said. “This is not a secret cabal for global adoption of these core standards.”

The additional capabilities provided by the new Web language are already being put to use by a California programmer who has created what, at first glance, could be a major new threat to online privacy.

Samy Kamkar, a California programmer best known in some circles for creating a virus called the “Samy Worm,” which took down MySpace.com in 2005, has created a cookie that is not easily deleted, even by experts — something he calls an Evercookie.

Some observers call it a “supercookie” because it stores information in at least 10 places on a computer, far more than usually found. It combines traditional tracking tools with new features that come with the new Web language.

In creating the cookie, Mr. Kamkar has drawn comments from bloggers across the Internet whose descriptions of it range from “extremely persistent” to “horrific.”

Mr. Kamkar, however, said he did not create it to violate anyone’s privacy. He said was curious about how advertisers tracked him on the Internet. After cataloging what he found on his computer, he made the Evercookie to demonstrate just how thoroughly people’s computers could be infiltrated by the latest Internet technology.

“I think it’s O.K. for them to say we want to provide better service,” Mr. Kamkar said of advertisers who placed tracking cookies on his computer. “However, I should also be able to opt out because it is my computer.”

Mr. Kamkar, whose 2005 virus circumvented browser safeguards and added more than a million “friends” to his MySpace page in less than 20 hours, said he had no plans to profit from the Evercookie and did not intend to sell it to advertisers.