Baby Steps for Online Privacy: Why the FTC Self-Regulatory Principles For Online Behavioral Advertising Fails to Protect the Public

Statement of Jeff Chester, Exec. Director, Center for Digital Democracy:

The Federal Trade Commission is supposed to serve as the nation’s leading consumer protection agency.  But for too long it has buried its mandate in the `digital’ sand, as far as ensuring U.S. consumer privacy is protected online.    The commission embraced a narrow intellectual framework as it examined online marketing and data collection for this proceeding.  Since 2001, the Bush FTC has made industry self-regulation for privacy and online marketing the only acceptable approach when considering any policy safeguards (although the Clinton FTC was also inadequate in this regard as well).  Consequently, FTC staff—placed in a sort of intellectual straitjacket—was hampered in their efforts to propose meaningful safeguards.

Advertisers and marketers have developed an array of sophisticated and ever-evolving data collection and profiling applications, honed from the latest developments in such fields as semantics, artificial intelligence, auction theory, social network analysis, data-mining, and statistical modeling.  Unknown to many members of the public, a vast commercial surveillance system is at the core of most search engines, online video channels, videogames, mobile services and social networks.  We are being digitally shadowed across the online medium, our actions monitored and analyzed.

Behavioral targeting (BT), the online marketing technique that analyzes how an individual user acts online so they can be sent more precise marketing messages, is just one tool in the interactive advertisers’ arsenal.  Today, we are witnessing a dramatic growth in the capabilities of marketers to track and assess our activities and communication habits on the Internet.  Social media monitoring, so-called “rich-media” immersive marketing, new forms of viral and virtual advertising and product placement, and a renewed interest (and growing investment in) neuromarketing, all contribute to the panoply of approaches that also includes BT.  Behavioral targeting itself has also grown more complex.  That modest little “cookie” data file on our browsers, which created the potential for behavioral ads, now permits a more diverse set of approaches for delivering targeted advertising.

We don’t believe that the FTC has sufficiently analyzed the current state of interactive marketing and data collection.  Otherwise, it would have been able to articulate a better definition of behavioral targeting that would illustrate why legislative safeguards are now required.  It should have not exempted “First Party” sites from the Principles; users need to know and approve what kinds of data collection for targeting are being done at that specific online location.

The commission should have created specific policies for so-called sensitive data, especially in the financial, health, and children/adolescent area.  By urging a conversation between industry and consumer groups to “develop more specific standards,” the commission has effectively and needlessly delayed the enactment of meaningful safeguards.

On the positive side, the FTC has finally recognized that given today’s contemporary marketing practices, the distinction between so-called personally identifiable information (PII) and non-PII is no longer relevant.  The commission is finally catching up with the work of the Article 29 Working Party in the EU (the organization of privacy commissioners from member states), which has made significant advances in this area.

We acknowledge that many on the FTC staff worked diligently to develop these principles.  We personally thank them for their commitment to the public interest.  Both Commissioners Leibowitz and Harbour played especially critical roles by supporting a serious examination of these issues.  We urge everyone to review their separate statements issued today.  Today’s release of the privacy principles continues the conversation.  But meaningful action is required.  We cannot leave the American public—now pressed by all manner of financial and other pressures—to remain vulnerable to the data collection and targeting lures of interactive marketing.

Facebook researching “sentiment” engine: “looking to figure out if people are having a good day or bad day”

Via scobleizer.com [excerpt from interview with Facebook CEO Mark Zuckerberg.  My bold]:
Facebook is, he told me, studying “sentiment” behavior. It hasn’t yet used that research in its public service yet, but is looking to figure out if people are having a good day or bad day. He said that already his teams are able to sense when nasty news, like stock prices are headed down, is underway. He also told me that the sentiment engine notices a lot of “going out” kinds of messages on Friday afternoon and then notices a lot of “hungover” messages on Saturday morning. He’s not sure where that research will lead. We talked about how sentiment analysis might lead to a new kind of news display in Facebook. Knowing whether a story is positive or negative would let Facebook pick a good selection of both kinds of news, or maybe even let you choose whether you want to see only “happy” news.” 

source: Zuckerberg: Facebook’s “intense” year.  scobleizer.com

New AT&T-funded “Future of Privacy” Group: Will it Support Real Privacy Protection or Serve as a Surrogate for Self-regulation and Data Collection?

A new group co-directed by former DoubleClick and AOL chief privacy officer Jules Polonetsky, called the “Future of Privacy Forum,” has been announced. It is connected to the law firm representing AT&T–Proskauer Rose–which has a considerable practice in the online marketing and data collection area. Other backers include Intel, General Electric, IBM and Wal-Mart.

We are concerned, however, that the role of the Forum is to help discourage Congress from enacting an opt-in regime for data collection. Both ISPs–such as AT&T, Verizon, Comcast and Time Warner–as well as online advertising companies such as Google/DoubleClick, Yahoo, and Microsoft must be governed by privacy laws which empower and protect consumers. The role of ISPs in any data collection for targeted online marketing, in particular, requires serious analysis and stringent safeguards. AT&T, Google, Microsoft, Comcast, the online ad networks, and social media marketers (to name a few) must be required to provide meaningful disclosure, transparency, accountability and user control (with special rules governing health, financial and data involving children and youth). Self-regulation has failed. If the Future of Privacy group is to have any legitimacy, it will work to support serious federal rules. But if it trots out some sort of voluntary code of conduct as a way to undermine the growing call for real privacy safeguards, this new group may soon be viewed as beholden to its funders and backers.

Facebook ad targeting system is using the “keywords in people’s status messages”–Tales of Behavioral Targeting

Fresh proof that Congress has to prohibit behavioral targeting unless consumers opt-in appears in the new issue of Brandweek. Facebook is “experimenting” with the targeting by “keywords in people’s status messages,” according to “Tim Kendall, director of monetization at Facebook.” Here are some other choice excerpts from the article:

“Advertisers are extremely interested in all new developments in the behavioral targeting space,” said Emily Riley, senior analyst at Forrester Research, Cambridge, Mass. “We’re seeing a big uptick in the use of [these] tactics.” According to Forrester data, 24% of advertisers used behavioral targeting in 2008. Last year it was only 16%…Almost half of advertisers say, ‘Even if I didn’t use behavioral last year, I definitely want to this coming year…”…

“…said Jeff Berman, president of sales and marketing at MySpace. “… the more data you have, the smarter you can be with your media… but if you want to focus on . . . 25-40-year-old mom Nascar fans who love romantic comedies and live in 12 specific zip codes, we can do that.”

…”as BT becomes more invasive at social networking sites, the technology should improve and thus serve up more relevant ads based on our true site behavior…Revenue Science, one of the biggest independent BT networks, is using forward-to-friend behavior to allow advertisers to target virally oriented people. Bebo, the social networking site AOL bought earlier this year, works with Elkridge, Md.-based Lotame, an agency that helps brand advertisers target unique users, such as new moms, who spend a lot of time on social sites.”

source: Behavioral Targeting: A Tricky Issue for Marketers. Becky Ebenkamp. Brandweek. Oct. 21, 2008

MySpace, Social Networks, Massive Data-Mining, Privacy & Interactive Advertising

Policymakers–including state attorneys-general, the FTC and EU officials– are failing to examine how social networks such as MySpace are utilizing advanced data mining techniques to track, analyze, and target millions of unsuspecting users (including, likely, adolescents). For example, MySpace (and other Fox Interactive Media properties, FIM) are using data warehouse and parallel computing techniques that “is enabling a new set of applications and services that previously were simply neither possible nor practical at this scale.”

MySpace and other FIM entities are engaged in daily “real-time” analysis of massive data sets from its 190 million active users. Such data analysis is driving FIM’s “advanced targeted advertising systems.” So all the MySpace “user-generated content” becomes fodder for the analytical ad-targeting. Such data collection must be under the full control of the user–they need to know how and what is being collected, how its used, what inferences are made, the range of ad and marketing targeting linked to the data, etc. It’s time social media marketing, as the industry calls it, draws the attention of policymakers, including the U.S., Canada, and in the EU.

Interactive Ad Bureau to Congress and Public: If Your Privacy is Protected, The Internet Will Fail Like Wall Street!

It’s too disquieting a time in the U.S. to dismiss what a lobbyist for the Interactive Advertising Bureau said as merely silly. The IAB lobbyist is quoted in today’s Washington Post saying: “If Congress required ‘opt in’ today, Congress would be back in tomorrow writing an Internet bailout bill. Every advertising platform and business model would be put at risk.” [reg. required]

Why is the IAB afraid of honest consumer disclosure and consumer control? If online ad leaders can’t imagine a world where the industry still makes lots of money–while simultaneously respecting consumer privacy–perhaps they should choose another profession (say investment banking!).

Seriously, online ad leaders need to acknowledge that reasonable federal rules are required that safeguard consumers (with meaningful policies especially protecting children and adolescents, as well as adult financial, health, and political data). The industry doesn’t need a bail-out. But its leaders should `opt-in’ to a responsible position for online consumer privacy protection.

Google studies the online behavior of tweens (10-14 year olds) with message to target them via search advertising

When Google acquired DoubleClick last year, they also took over its search marketing division called Performics. A new study commissioned by Performics focuses on the media behaviors of 10-14 year olds, so-called tweens. The aim of the study is basically to get more online targeted marketing aimed at young people. The senior VP of search operations at Performics–Stuart Larkins–recently wrote an article on the new study that appeared in Chief Marketer. Here are some excerpts.

At DoubleClick Performics, we sought to better understand the online search and purchase behaviors of seven influential demographic segments and commissioned ROI Research to study these habits across 10 different product categories. Results just arrived for one of the most dynamic segments – Tweens, consumers between the ages of 10 and 14…Tweens consume information through many channels, but the Internet leads. When asked how much time they spent with various media types, 83% said they spend at least an hour per day online, and 68% reported at least an hour per day watching TV. Radio, magazines and newspapers came in much lower…

Nearly half of respondents go online many times per day (more than three), and 87% usually spend at least a half hour each time. Looking closer at this time spent online, the survey found:

72% have a profile on at least one social networking site
· 54% have a MySpace profile
· 35% have a Facebook profile…

For search engines, Google was the overwhelming choice among tweens, with 78% indicating they use Google most frequently…

Tweens reported varying levels of involvement across product categories…

To capture the demand generated in complementary channels, marketers should incorporate search ads into other online and offline marketing campaigns. While a nice rule of thumb for any marketing program, this golden rule is especially true when targeting tweens.”

A story on the Performics study in today’s Marketing Daily noted the research came just as kids were getting ready to get their back- to- school gear. As reporter Tameka Kee explained, the study showed that “search marketing in the media mix is crucial to snagging the attention and influence of tweens, as they are increasingly using search to make product recommendations and find pricing info for their parents...Peformics also found that tweens were using search to find specific product information and store locations across multiple product categories. Nearly half of all respondents said that they used search to find product Web sites in the electronics, telecom, apparel and CPG categories, while nearly half said that they used search to find out where to purchase said products online.”

Marketing is a fundamental part of our lives–and will be increasingly so with digital media. But researching the online media behaviors of young people so they can be targeted with interactive digital marketing raises a number of policy issues, as well as parental concerns. We know that Google has announced plans to sell Performics, although it will incorporate some of its activities within its business operations. But Google’s senior executives should play a leadership role in addressing how to ensure the healthy development of young people. Consumer and childrens’ advocates in the U.S. and the EU-among other places–will be watching closely.

Update. The announcement just came from the Google press office that global ad giant Publicis will acquire Performics. Of course, Google and Publicis are also working together and announced an alliance earlier this year.  Here’s an excerpt from today’s email to the press: “Publicis Groupe and Google (NASDAQ: GOOG) announced today that Publicis Groupe has agreed to acquire the Performics search marketing business (Performics) from Google. Chicago-based Performics, one of the leading search marketing services providers, helps to improve the performance of advertisers’ investments and maximize
client campaign effectiveness. Its profit-driving suite of marketing solutions includes Performics’ reporting platform, local platform, advanced market expertise and active account management….Publicis Groupe has been a leader in the advertising industry for decades, and we believe Performics’ growing business will benefit from being part of it,” said Eric Schmidt, Chairman and CEO, Google. “We look forward to working with Performics as a partner.”

The IAB (US) “mobilizes” to Fight Against Consumer Protections for Online Media

Watch this online video of Randall Rothenberg speaking before a June Federated Media Publishing event. In Mr. Rothenberg’s worldview, demon critics of advertising (such as myself) are deliberately trying to undermine democratic digital media. This would be absurd, if it wasn’t so sad. Mr. Rothenberg is using scare tactics to whip up his members into a frenzy-all so they can fight off laws and regulations designed to provide consumers real control over their data and information. Luckily, Mr. Rothenberg will be on the losing side of this battle to protect consumers in the digital era. Regulators on both sides of the Atlantic understand how the digital marketing ecosystem raises serious concerns about privacy and consumer welfare. We have to say we are disappointed in John Battelle, the CEO of Federated (who wrote a very good book entitled The Search: How Google and Its Rivals Rewrote the Rules of Business and Transformed Our Culture). Mr. Battelle should know that the online marketing system requires a series of safeguards which protects citizens and consumers. There is a balance to be struck here. Online advertisers have unleashed some of the most powerful tools designed to track, analyze, and target individuals–whether on social networks, or watching broadband video, or using mobile devices. We have never said there shouldn’t be advertising. We understand the important role it must play, including for the underwriting of online content. But the online ad system should not be designed and controlled solely by ad networks, online publishers, trade groups and online ad lobbying groups. It must be structured in a way which promotes as much freedom for individuals.

ATT: DoJ, EC and Congress: Yahoo!’s own claims should raise alarms about a Google or Microsoft deal

No one should sit by and let either Google or Microsoft carve-up or take-over Yahoo! without a serious examination of the competition, privacy, and other consumer protection issues. This week, Yahoo! ran a four-page ad inserted in Advertising Age. Here’s some of Yahoo!’s own copy for regulators and the public to ponder:

“Yahoo! delivers the largest audience in the U.S.-the most 18-34 year olds, the most 35-54 year olds, the most women….Today, Yahoo! reaches over half the world’s Internet users. And with our growing network of premium publishing partners, including over 625 leading newspapers, we’re working with the other half…Our insights and understanding of our users lead to smarter targeting, so we can connect the right audience with the most relevant message–yours…With more ways to connect to your customers more deeply than ever, the future is wide open.”

From Yahoo! Advertising Age insertion. June 2. 2008 entitled: “What Happens When You Can Connect To More Than 550 million People From Over 170 countries Who Spend 2 Billion Hours Each Month In One Place?”

Facebook Fails to Address Privacy Concerns, as Powerful Canadian Complaint Documents

They ought to change the name of a corporate position entitled chief privacy officer to chief data collection protector. That’s our response to the comment from Facebook’s Chris Kelly, who serves as its chief privacy officer. According to the Associated Press, Mr. Kelly responded to the privacy complaint filed by the Canadian Internet Policy and Public Interest Clinic (CIPPIC) with the following comment: “We’ve reviewed the complaint and found it has serious factual errors — most notably its neglect of the fact that almost all Facebook data is willingly shared by users…”

We find such a remark incredibly revealing about Facebook, and it raises questions about how well they have structured the role of its “chief privacy officer.” For example, does Mr. Kelly believe that Facebook users understand, as pointed out in the very important CIPPIC complaint on page 22, that outside developers are given access to a wide range of user information. As the complaint notes:

“(a) Information That May Be Provided to Developers. In order to allow you to use and participate in Platform Applications created by Developers, Facebook may from time to time provide Developers access to the following information: (i) any information provided by you and visible to you on the Facebook Site, excluding any of your Contact Information, and
(ii) the user ID associated with your Facebook Site profile.
(b) Examples of Facebook Site Information. The Facebook Site Information may include, without limitation, the following information, to the extent visible on the Facebook Site: your name, your profile picture, your gender, your birthday, your hometown location (city/state/country), your current location (city/state/country), your political view, your activities, your interests, your musical preferences, television shows in which you are interested, movies in which you are interested, books in which you are interested, your favorite quotes, the text of your “About Me” section, your relationship status, your dating interests, your relationship interests, your summer plans, your Facebook user network affiliations, your education history, your work history, your course information, copies of photos in your Facebook Site photo albums, metadata associated with your Facebook Site photo albums (e.g., time of upload, album name, comments on your photos, etc.), the total number of messages sent and/or received by you, the total number of unread messages in your Facebook in-box, the total number of “pokes” you have sent and/or received, the
total number of wall posts on your Wallâ„¢, a list of user IDs mapped to your Facebook friends, your social timeline, and events associated with your Facebook profile.”

Whoa! Do users really know this and give away their data consciously? We think not. Our friends from Up North have ignited a campaign which will grow throughout the world.