Privacy-preserving global customization

We present an architecture for global customization of web content, by which a web site can customize content for each visitor based on the activities undertaken by the same user on other, unrelated sites. Our architecture distinguishes itself in the privacy mechanisms it provides: each user controls what information a merchant can learn about her activities at other merchants, and each merchant controls to what other merchants the information it contributes is revealed. To achieve this we introduce novel data protection mechanisms for merchants and users. We further describe aspects of a prototype implementation of our architecture.