I used to work in this space, and you could only buy retargeting ads based on cookies. Adwords/doubleclick don't let you specify target IPs: https://support.google.com/adwords/answer/6322?hl=en

If you really wanted to you could do cookie syncing based on IP, but does anyone actually do that?

What about multiple "users" in Chrome? If you go to the settings page, you can add additional "users" and then open a window as another "user" using the icon in the upper right corner.

Each user gets their own profile: cache, cookies, history, saved data, extensions, etc. The only thing shared should be IP address and user agent. (Unless the user infects the profile with a url that identifies them.)

I use this for testing, isolating my facebook profile, and isolating all of my banking sessions from my main browsing window. (Just in case they have a CSRF issue.)

You can do the same thing with Firefox if you pass the -ProfileManager argument. This functionality goes back all the way to Netscape: http://www.netfaqs.com/macintosh/mail/Classic/Netscape/4/pro...

It's just been hidden (and there's no need to set up email).

Well if I were Google, I would make sure that the Incognito mode of Chrome prevents targeting except for adwords/adsense. Pretty easy to do when you control the browser...

Good you aren't Google. That would be evil, drive away Chrome users, be quite possibly illegal, and not possible unless it had something like AdBlock. Once the browser -- any browser -- is communicating with a server, the server can panopticlick-identify it.

How does retargeting work through Incognito mode?

Incognito mode doesn't hide the IP address.

Anyway, the solution to this problem is dead simple: Do your shopping at work, or at a library.

I don't believe ads get retargeted by IP address very often. The miss rate is far too high when you have multiple people behind the same IP, and it only serves to subvert people who use incognito mode - which creates an angry user rather than a sale.

How do those track you then? Do they only use ip address? Seems like that would really fail for any offices that use NAT.

how is it supposed to retarget you without cookies then?

By fingerprinting you based your other identifying information, including things like your OS, browser version, screen resolution, installed fonts, computer host name, list of browser plugins and extensions, IP address and ISP, and possibly the sites you've visited.

Do you know for a fact that any retargetting companies are actually doing that, or just that it is possible?

After the Facebook Beacon[1] and Google Safari cookie control bypass[2] settlements I would have thought legitimate companies would be a little reluctant to push the envelope so far as to explicitly bypass privacy controls.

[1] http://en.wikipedia.org/wiki/Facebook_Beacon

[2] http://www.informationweek.com/security/compliance/google-se...

> From the IWeek article: The FTC and 37 states have taken action only against Google, likely because Google's privacy policy stated that the company would comply with Safari users' tracking choices.

> legitimate companies

Google is both an advertising company and a product company (and big and famous), and also uses Don't Evil as part of its brand; this why it has a user-friendly privacy policy to keep it honest.

B2B advertising companies, which is, like, all of them, have no need for privacy policies, unless their customers (website owners) demand them. And what website needs to have a privacy policy that impresses users? Googe, Facebook, sure, but cheapdiamondsonline.com?

There is at least one company doing this. I sat through a pitch a couple of weeks ago from a company touting that as their primary function. They couldn't explain how or if they dealt with users that don't have static ips, use proxies, are NATed or any other technical issue of course but it was a sales guy with a deck so not too surprising. I've asked my partner that was also on the call, and was actively being solicited, for the name and will update this post if he gets back to me tonight.

If I were a retargeting company which did that, I'd probably keep it a secret.

So basically, disable javascript.

Bingo!

I use NoScript (most sites disabled) with Firefox. I also clear everything whenever Firefox closes. I exit Firefox quite often. So the best way to track me would be using IP address. And if they don't use those very often, then ... no problem!

I'm not sure why more people don't do this. On any newer computer and decent broadband connection, Firefox startup is almost instant, even if cache cleared, etc. There's very little penalty for restarts, even between individual websites. Certainly easy to do in the scenario in the article, i.e. between visits to online retailers.

About my only reason to trust Chrome for browsing is for the built-in Flash, which St. Steven wisely eschewed. So I only switch to Chrome when I absolutely want to view some silly video in Flash. Which isn't very often.

Maybe another way to deal with this is to set up some sort of Squid-like proxy on a firewall computer?

No, your browser sends all that crap in the HTTP headers.