75

OK, so I noticed that on every page load (at least here and on Stack Overflow but guess on any Stack Exchange site) there is request for that external JS file: http://b.scorecardresearch.com/beacon.js

(source)

Who are we signalling to? For what purpose?

Seriously now, this JS is generating a pixel aka Web bug but I couldn't find anywhere what Stack Exchange is doing with this information or who can access it.

I went through the Privacy Policy and found reference to Google Analytics which is totally fine, but the beacon or http://scorecardresearch.com (beacon host) are not mentioned there.

This is a sample of the data passed using the beacon:

The marked number is the same on all sites and doesn't change per page so it's either user based or machine based.

Can I get some details about this?

Update: following this comment I checked the page source and indeed c2 appears to be the Stack Exchange ID:

_comscore.push({ c1: "2", c2: "17440561" });

So from what I see, they just measure amount of page hits, without actually collect anything user or browser related.

Improve this question
17
  • 8
    I've installed Ghostery a few months ago, and I'm very happy with it. Here's a screenshot of SO's blocked content: i.imgur.com/o6IXTL8.png . Data: Ghostery - Full Circle Studies
    – Kobi
    Commented Dec 8, 2013 at 9:49
  • 4
    The registrar for that domain is markmonitor.com, "the global leader in online brand protection". I was not aware our brand required protection.
    – Frédéric Hamidi
    Commented Dec 8, 2013 at 9:49
  • 1
    Seems interesting to me. I was also able to notice this script being loaded and executed. It is pretty obfuscated.
    – Travis J
    Commented Dec 8, 2013 at 9:50
  • @Kobi thanks, don't want to block it just wonder what and why. :)
    – Shadow Wizard
    Commented Dec 8, 2013 at 9:53
  • 1
    @FrédéricHamidi yep, saw this too - interesting!
    – Shadow Wizard
    Commented Dec 8, 2013 at 9:56
  • @TravisJ obfuscation doesn't really matter actually, the generated pixel is visible in the network monitoring tab and I don't think it's doing anything other than that.
    – Shadow Wizard
    Commented Dec 8, 2013 at 9:57
  • 1
    That c2 value seems to be a constant. i.imgur.com/9YfmUgU.png
    – Stijn
    Commented Dec 8, 2013 at 11:42
  • 1
    @Stijn thanks, this led me to make a quick check and I've updated the post. :)
    – Shadow Wizard
    Commented Dec 8, 2013 at 11:58
  • 5
    They still assign a cookie. Mine is: Cookie:UID=2f481431-82.166.201.187-1365072703; UIDR=1365072703. With this cookie, they can (probably) track you in any site you visit that is using the same service. Even without a direct user ID, it is almost trivial to know who you are - it is probably the profile you visit most. They can also check pages like /users/edit/{ID}, which only you can open. I doubt they're just collecting page hits - the SE team can easily do that on server side. Either way I don't like these "services".
    – Kobi
    Commented Dec 8, 2013 at 12:21
  • @Kobi good points. Let's wait for official response, sometimes the team is quick to respond. :)
    – Shadow Wizard
    Commented Dec 8, 2013 at 12:31
  • But, @Kobi, given the (good) examples of possible tracking, why are you still allowing cookies from gravatar.com then? (True, even without the cookie it can still track the actual fetching of the images. But at least those have their caches set to 5 minutes, so its tracking is not as fine-grained as true cookies. Also, currently Gravatar does not play tricks using specific modification dates or Etags, so they don't seem to be tracking a lot without cookies.)
    – Arjan
    Commented Dec 8, 2013 at 12:56
  • 4
    @Arjan - Because I like the colorful icons, and SO is sad without them. At least Gravatar is doing something for me. I don't really get anything from Google analytics or Facebook Like buttons, which are on most pages I visit these days. (Also, technically, I didn't find any cookies from Gravatar) (Also, this is probably off topic)
    – Kobi
    Commented Dec 8, 2013 at 13:18
  • 1
    @Kobi, I agree with what you're saying, though I could argue we get something from Google Analytics too, as that helps the crew to decide on how to develop this site. Still then, the Gravatar cookies are not required to see the colorful icons, but I guess you know. As for those cookies: surely I've blocked them for a reason a long time ago, so after reading your comment I was surprised to not see attempts to set one when fetching avatars. I got a new Quantcast __qca cookie for gravatar.com when visiting www.gravatar.com directly though.
    – Arjan
    Commented Dec 8, 2013 at 14:28
  • 2
    Yet another reason to use AdBlock
    – John Dvorak
    Commented Dec 8, 2013 at 14:53
  • 1
    Phh, I never noticed that any site chased to work without scoreandsearch. So I just block it with NoScript.
    – Johannes Kuhn
    Commented Dec 8, 2013 at 15:31

1 Answer 1

Reset to default
51

Scorecardresearch.com is the tracking domain for Comscore, an advertising analytics company. We are testing their analytics package to see (a) what information it can give us that Google Analytics and Quantcast do not already, and (b) if their product is useful to ad customers. They're pretty standard for ad-supported sites (some other sites that use them: BBC, CNN, TechCrunch, Gawker, The Guardian, Wired, CNET).

Before enabling Comscore, we ensured that they are fully compliant with our Privacy Policy. They release data only in aggregate, and do not collect any personally identifiable information. As the OP and commenters have basically discovered, they're mostly just interested in pageviews.

You're free to block it and site functionality won't be affected since it's just a tracker. We don't go out of our way to get around Adblock etc., since people who enable Adblock are unlikely to click ads anyway. However, we really do appreciate the people who recognize that Stack Overflow is free for everyone because of those ads, and we go far out of our way to make sure those ads stay relevant and as non-intrusive as possible.

Improve this answer
10
  • I'm not sure I understand your last sentence; how are ads staying relevant (presumably per person targeted) while also having data released only in aggregate form?
    – Richard Tingle
    Commented Dec 9, 2013 at 17:44
  • 12
    @RichardTingle Our understanding of "relevant ads on Stack Overflow" is "things that might actually be interesting to programmers, not random groupon/punch the monkey/weight loss ads". We're basically leaving money on the table because we don't want crap like that. Comscore has nothing to do with per-person targetting of ads. David's point is that we work hard on making ads not suck on our sites.
    – balpha StaffMod
    Commented Dec 9, 2013 at 17:46
  • @balpha I think I see, the last paragraph is more general ad policy rather that specific to the tracking
    – Richard Tingle
    Commented Dec 9, 2013 at 17:59
  • @TheGrinch so if i've answered a question on javascript I'm more likely to recieve a javascript ad even on a C++ question?
    – Richard Tingle
    Commented Dec 9, 2013 at 18:04
  • 14
    @RichardTingle - absolutely not. We only target ads by: site, geo, tag and occasionally reputation.
    – Danny Miller Staff
    Commented Dec 9, 2013 at 18:07
  • 1
    Well said, thanks! But what about the cookie mentioned in this comment?
    – Shadow Wizard
    Commented Dec 9, 2013 at 18:39
  • 2
    @ShaWizDowArd like all trackers (including GA and Quantcast), they assign a cookie to count uniques. They are also (probably) tracking people across multiple sites to get demographic info. They still only ever release that information in aggregate.
    – David Fullerton
    Commented Dec 9, 2013 at 18:45
  • 3
    I'd just like to say I would prefer if ads did target me. That way they're more likely to be clicked by me and give revenue to you. I understand some people don't like being targeted so it should be a preference that can be set per user.
    – Mark Hurd
    Commented Dec 13, 2013 at 4:42
  • David, did they start using Flash now??
    – Shadow Wizard
    Commented Feb 16, 2015 at 14:54
  • 2
    @ShadowWizard Nope, not us. It's in an ad. meta.stackoverflow.com/a/286192/1618182
    – stevvve StaffMod
    Commented Feb 16, 2015 at 16:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .