Opt-in, First-and Third-Party sites: What CDD & PIRG Told the FTC

[First in a series based on our FTC filing from 18 Feb.  Excerpt]:

Consumers should be accorded the same kind of user opt-in control on first-party and third-party sites alike. First-party sites, it is clear, engage in a wide range of data collection and targeting approaches unknown even to their regular visitors, and user consent for these practices should be required. In addition, as first-party publishers increasingly engage in forms of data sales and sharing for the purposes of consumer tracking and targeting, the distinctions between first and third parties are eroding. …Turn, for example, operates a “data-driven” ad-targeting platform that “crunches 2000+ behavioral, contextual, inventory, and ad selection variables within 25 milliseconds… all to determine the right ad, right time, right price, and right audience.”  “Turn operates one of the largest marketing platforms on the Internet… ranked 6th in US audience reach, just behind companies like Google….”  A recent research paper by TURN discusses how its “data mining solution enables marketers to cost-effectively identify interactions and variables of thousands of data points. It also allows them to look at the entire user profile at the time of impression receipt and do a thorough analysis of the impact of all the variables on a campaign (including latent variables which go beyond the audience segmentation and are often times overlooked).”  Turn explains that its “secret sauce” is a “scalable infrastructure [that] enables us to read an individual user’s data profile from among hundreds of millions of profiles within a very small time frame, generally 2 or 3 milliseconds. And, we do this over 100,000 times a second (8+ billion times a day).” …

The company says in that statement that it “does not collect PII,” while saying that the following is only non-personal information: “…the IP address used to access the Internet, the type of browser used, which and how many Business Partner web pages have been viewed, search terms entered on Business Partner websites, referring/exit pages, and the date and time a Turn Ad was viewed.” In its discussion of the use of cookies and Web beacons, the company claims that such tracking and analysis isn’t personally identifiable. But the privacy policy and the claim that its targeting is all based on non-PII dta flies in the face of what its long list of “data partners” provide (let alone its own pronouncements on the ability to track and target an “entire user profile”). Its data partners include Bizo, IXI, TARGUSinfo, Polk, Datalogix, Almondnet, Bluekai and eXelate.

Bizo data provides “business demographics of a person which may include, but is not limited to job function, seniority, company size, industry, geography, etc.” IXI’s digital ad data enables online marketers to “target only the consumers that have the right financial profile for each offer and brand…. [with] real-time user classification capabilities…. [that] ranks online consumers based on their expected ability to pay their financial obligations… [and] provides a powerful, complete and accurate estimate of your prospects’ and customers’ total household income… [along with an] estimate of a household’s spending after accounting for the fixed expenses of life (housing, utilities, public transportation, personal insurance and pensions).”   TARGUSinfo’s data includes “names, addresses, landline phone numbers, mobile phone numbers, email addresses, IP addresses and predictive attributes” (continually updated “10 times daily”).  TARGUSinfo also facilitates the collection of “audience targeting data high-quality, offline attributes—including demographics, shopping behaviors, lifestyles, preferences and brand affinities—that are verified… to accurately identify Internet users and link them to attributes—such as demographics, buying behaviors and attitudes—in a real-time… manner…. enabling you to target the most relevant ad to every user regardless of location or media buying methodology.”  “AdAdvisor services use cookies that give you a window to rich, predictive data on over 50 million unique US users.”  Polk can provide “consumer detail (e.g., age, household income, gender), phone numbers, email addresses,” along with “comprehensive customer profiles with unique automotive variables…. The number of registered vehicles in a household, When a household will likely be in the market for their next vehicle purchase, How much will likely be spent on the next vehicle purchase,” and “reliable and extensive ethnic data including those with the highest levels of purchasing power—Hispanics and Asians.”  Datalogix, “a source for real-world data for online targeting” uses “tens of millions of …Affiniti Cookies to support online targeting.”  “DataLogix’ audience platform is powered by a database with over $1 trillion dollars in consumer spending behavior.”  “Available data spans hundreds of product categories and a host of recency, frequency and monetary value data elements.”  AlmondNet “partner(s) with Data-Owners & Media-Owners to facilitate the delivery of relevant, targeted (based on recently-conducted searches for products/services) ads to consumers wherever they go…,” “…based on their observed online behavior wherever they may be found.”  “[O]ur technology collects information about Users from our data partners, and from Users as they visit our partner web sites.”