Retailers have long struggled to determine whether online ads fuel sales in their bricks-and-mortar stores. Now, Google Inc. GOOGL -1.63% is testing a way to solve that puzzle.

A pilot program launched by the Internet giant is helping about six advertisers match the anonymous tracking cookies on users’ computers to in-store sales information collected by data providers like Acxiom Corp. ACXM -2.99% and DataLogix Holdings Inc., according to people familiar with the test.

Online advertising has grown into a $117 billion-a-year business, and Google is the industry’s leader, with ad revenue of $50.5 billion last year.

Google’s new pilot program, dubbed In-Store Attribution Transaction Reporting in AdWords

Google rival Facebook Inc. FB -1.06% has been tapping data on physical-store sales since late 2012 to demonstrate the effectiveness of advertising on its site.

Back in December, documents revealed the NSA had been using Google’s ad-tracking cookies to follow browsers across the web, effectively coopting ad networks into surveillance networks. A new paper from computer scientists at Princeton breaks down exactly how easy it is, even without the resources and access of the NSA. The researchers were able to reconstuct as much as 90% of a user’s web activity just from monitoring traffic to ad-trackers like Google’s DoubleClick. Crucially, the researchers didn’t need any special access to the ad data. They just sat back and watched public traffic across the network.

With online tracking on the rise and Do Not Track efforts moving ahead slowly, users and browser vendors have been taking matters into their own hands.

You’ve heard it a zillion times by now: if an online service is free, you are the product.

A New York company called Datacoup is trying to turn that notion on its head a bit, by paying you if you let it monitor your online activities and also let it tap into a stream of information about your credit and/or debit card.

In return, the company will give you eight whole US dollars a month.

Businesses should be allowed to process part-anonymised, or pseudonymised, data without the consent of individuals whose data it is in certain circumstances, a senior EU official has said.

Neelie Kroes, the EU Commissioner responsible for the Digital Agenda, said that companies should be able to process pseudonymised data without consent where they have a ‘legitimate interest’ in doing so. In a speech at a data protection congress held by the International Association of Privacy Professionals Europe in Brussels, Kroes said she supported proposed reforms to the EU’s existing data protection framework that were backed by a committee of MEPs in October.

Under those plans, businesses would have the right to use data that they collect from individuals more freely, and in accordance with the data protection regime, if they pseudonymised the information. If data was fully anonymised then data protection laws would not apply to the information at all, but Kroes said that some of the benefits that can be gleaned from making use of personal information can be lost if data is anonymised. She said she backed plans that would permit the use of pseudonymised data without consent if certain criteria were met.

Ever wonder why most e-mail clients hide images by default? The reason for the “display images” button is because images in an e-mail must be loaded from a third-party server. For promotional e-mails and spam, usually this server is operated by the entity that sent the e-mail. So when you load these images, you aren’t just receiving an image—you’re also sending a ton of data about yourself to the e-mail marketer.

Loading images from these promotional e-mails reveals a lot about you. Marketers get a rough idea of your location via your IP address. They can see the HTTP referrer, meaning the URL of the page that requested the image. With the referral data, marketers can see not only what client you are using (desktop app, Web, mobile, etc.) but also what folder you were viewing the e-mail in.

But Google has just announced a move that will shut most of these tactics down: it will cache all images for Gmail users. Embedded images will now be saved by Google, and the e-mail content will be modified to display those images from Google’s cache, instead of from a third-party server. E-mail marketers will no longer be able to get any information from images—they will see a single request from Google, which will then be used to send the image out to all Gmail users.

The National Security Agency is secretly piggybacking on the tools that enable Internet advertisers to track consumers, using “cookies” and location data to pinpoint targets for government hacking and to bolster surveillance.

The agency’s internal presentation slides, provided by former NSA contractor Edward Snowden, show that when companies follow consumers on the Internet to better serve them advertising, the technique opens the door for similar tracking by the government. The slides also suggest that the agency is using these tracking techniques to help identify targets for offensive hacking operations.

For years, privacy advocates have raised concerns about the use of commercial tracking tools to identify and target consumers with advertisements. The online ad industry has said its practices are innocuous and benefit consumers by serving them ads that are more likely to be of interest to them.

The revelation that the NSA is piggybacking on these commercial technologies could shift that debate, handing privacy advocates a new argument for reining in commercial surveillance.