Tracking You Offline for Better Targeting You Online: Why both the FTC and Congress Need to Protect Consumers

There is growing evidence daily about threats to consumer privacy online–all of which have real life consequences for the decisions we make when we buy products.   As the public relies more on using online to apply for credit cards, mortgages, explore health concerns or issues affecting their children and teenagers, it’s absolutely essential the individual–not the business–have full control over their data.  In a trade article on the “profiling” of consumers for online targeting, here’s how they describe linking your offline data with your digital experience.  It shows how the current definition of Personally Identifiable Information, PII, is out of date and fails to protect consumers.  Marketers don’t need your name or address to know your behaviors and target you [excerpt]:

How do marketers get access to the offline purchase data? More importantly, how do they marry it to your online identity without using PII? Usually, this involves the cooperation of several parties. The first might be an online retailer that links a credit card used in an ecommerce transaction with a third-party cookie. The second party is a data partner who owns that particular cookie and pulls in additional purchase history to augment the profile associated with that cookie, and then rents the profile to a marketer. The third is an online ad exchange, which will allow ad hoc purchasing of inventory against a particular cookie across inventory sold on the exchange.

source:  Where do we draw the line on consumer profiling?  Tom Hespos.  imediaconnection.com.  May 21, 2009

Google’s Retention of Search Data–tied to selling ads [Google Connects Offline Behavior To Digital Marketing]

This excerpt from an online ad news report illustrates perhaps a more compelling reason for Google to retain user data for longer periods, so it can better analyze the decision-making process for consumer purchasing for its ad businesses:

“We now understand the types of keywords people use at specific points prior to purchase,” says Davang Shah, head of automotive marketing at Google. “Six months prior to the purchase, we see roughly 56% of the auto searches buyers conducted were on non-branded search terms such as fuel efficient or hybrid sedan.”…Search plays a critical role throughout the purchase process…The data, related to paid, organic and display advertising as well as online marketing, includes the facts that 68% of buyers visit a manufacturer’s site in the six months prior to purchase, and 77% visit a third-party site. In aggregate, 84% visit at least one or the other…Shah says Google will cut the data by brand and provide the information to manufacturers, dealers and third-party companies…”

source:  Google Connects Offline Behavior To Digital Marketing.  Laurie Sullivan.  Online Media Daily.  May 22, 2009.  

Google’s Larry Page says, reports the BBC, the less Google can hold data the “more likely we all are to die”

At a Google-sponsored UK meeting called European Zeitgeist 2009, Google-co-founder Larry Page said that deleting user data by the six-month maximum period recommended by the EU privacy expert Article 29 Working Party could harm the public. According to a BBC report:  The European Commission wants data ditched after six months but Mr Page said there were benefits to users.  “More dialogue is needed [with regulators],” he [Mr. Page] told UK journalists at a Google event in Hertfordshire.  He said Google’s ability to plot and predict potential pandemics would not be possible if the firm had to delete search data after six months…Mr Page said deleting search data after six months was “in direct conflict” with being able to map pandemics…Mr Page said the less data companies like Google were able to hold the “more likely we all are to die”.  The European Commission has argued that holding on to search data runs the risk of third parties being able to build profiles of individuals even when some identifying information is deleted.

There is clearly a critical role for data in our society to be analyzed for many reasons–especially public health.  But for Mr. Page to not acknowledge how Google’s businesses are also tied into such data collection and analysis is unfortunate.  It underscores how Google’s top managers have failed to effectively recognize their own role in diminishing individual privacy around the world.  Nor should it go unmentioned that the products they sell on their own advertising platforms may also threaten or challenge the public health–including contributing to the global obesity crisis.

Alain Heureux, IAB Europe, and the Battle Over Online Marketing and Privacy: Worried about Article 29 Working Party and Calls for Regulation

We recently met Mr. Heureux in Brussels at a EU conference on consumers in the digital age.  He is a most capable representative of the European online advertising industry.  But Alain’s job is also to help prevent the enactment of privacy safeguards that would protect European consumers and citizens when they use digital and interactive media.  Here are excerpts from a recent article on Mr. Heureux in New Media Age [26 March 2009]:

In the battle to protect online advertising from intervention by politicians, Alain Heureux is on the front line. The president and CEO of IAB Europe spends half his time on what he calls public affairs, concentrating on the regulatory agenda in Brussels.  “The three main concerns are privacy, targeting and social media, and all the links between…“We’re very worried,” he admits. “At the moment, the revenues from targeting and profiling are not so big, so if you damage them you might not damage the entire industry immediately. But marketers want to move away from traditional techniques to targeted, efficient forms of marketing, and that shift can only happen with the use of technology and data. So there is a risk of damaging the future of marketing and media.”

Heureux’s concerns include the Article 29 working party which, although it has no power to introduce legislation, carries considerable weight in Brussels. It’s currently working on a paper which would define a person’s IP address as personal data, making it subject to the same data protection regime as other personal information. He’s also worried about the upcoming EU elections, wondering if one of the current commissioners might campaign on a privacy and data protection platform.

“Someone could position themselves as the messiah of data protection,” he says. “You’d get a lot of sympathy from consumers’ associations and citizens who are a little bit scared about all this data stuff, so it would be easy to take that great role and use it politically. That’s why these elections are dangerous, the threat is very much present.”…

Heureux takes the view that the only way to stop regulators passing new laws is for the industry to regulate itself. And while he acknowledges that Brussels is open to the idea of self-regulation, he sees one of his biggest problems as managing its expectations.

“Regulatory affairs take time, but the regulator wants everything now, not in a year’s time.” …“We need to create room for self-regulation but I’m worried about who will take care of enforcement. It’s not clear that the SROs [self-regulator organizations] will do it, because they’re under-resourced and under-funded, so it won’t be easy to extend self-regulation to include new techniques and practices.”

Despite these concerns, Heureux acknowledges with a smile that the current economic situation is helping the cause of self-regulation. He sees companies becoming more pragmatic and open to compromise with their competitors, while regulators are more concerned about the effect of new legislation on jobs and business.

Annals of Branded Social Media–Ford Chooses 100 Bloggers to Serve as “Fiesta Agents”

Anyone tracking social media marketing recognizes that major brands and ad agencies are playing a highly influential role shaping the new medium.  It’s something we are closely observing.  Here’s an excerpt from Ad Age’s “Ford is Counting on Army of 100 Bloggers to launch new Fiesta [Eric Tegler.  April 20, 2009.  sub required].

“…the automaker is counting on 100 bloggers to introduce its new Fiesta, which is set to reach U.S. dealers in early 2010. The idea behind Fiesta Movement is to get the model’s target audience to drive and, hopefully, chatter about the car for months to come…Ford is loaning 100 German-built Fiestas to social-media trendsetters for six months. The 100 “Fiesta agents,” chosen from 4,000 who applied online, will share their experiences behind the wheel, completing monthly, themed missions from travel to social activism; posting videos; and updating their friends and followers on YouTube, Facebook, Twitter and elsewhere…Early signs indicate a ripple effect from simply signing agents to the Fiesta Movement… several of those selected have already gotten interviews with regional newspapers or TV stations based on their acceptance into the program…JWT will undertake the bulk of reviewing/posting online content generated by Fiesta agents, while mining data with the new metrics made possible through social media.”

Google Tells Advertisers it has the “Largest Global Network” for “Pinpoint targeting”

Google says that in the Ad Age Ad Networks and Exchanges Guide.  Here are some excerpts:

The Google Content Network can efficiently and effectively meet your advertising needs. Not only do we have the largest global network,1 but our product and engineering teams have developed a range of solutions—from contextual targeting to real-time reporting—that help you and your clients create, launch and optimize campaigns that deliver results.

Connect with your audience, large or small
  • Consumer behavior is shifting toward niche sites.3 With sites spanning broad and premium niche, the Content Network gives you access to hundreds of thousands of sites and millions of consumers.
  • Select your audience based on their interests—whether they’re sports enthusiasts or social activists—and our targeting technology will find them across the Content Network.
  • We give users the ability to edit the interests we think they have, providing a new level of transparency for users and better targeting for you…Broad reach. Pinpoint targeting. Efficient prices. Better ROI. The Google Content Network…

    Network Reach

    As the largest ad network in the world, and fourth largest in the U.S., the Google Content Network reaches 75 percent of international Internet users and 76 percent of the U.S. online audience.*
    *Source: comScore, February 2009

An Example of Why Online Marketing Requires Public Scrutiny: An Ad Network that will “find the individuals that matter”

The vast system of online marketing has implications for how we define ourselves and are viewed by others.  It’s simplistic to say that online marketing is really only about sending the “right” ad to the right person  at the right time.  The tremendous amount of data and consumer tracking raises fundamental questions about the kind of society we are creating.  Here’s how a relatively new ad network–Rocket Fuel--describes what they do.  It’s an excerpt and not meant to single them out for criticism.  But it’s emblematic of a philosophy that must be vetted for its direction and implications:  “Our technology focuses on finding desirable audience characteristics rather than mere impressions. Through rapid automated testing and user-level targeting we find the individuals that matter…An ad server makes billions of decisions per day, tens of thousands of decisions per second, about which ad to serve for a given online impression…”


Facebook’s COO: “There aren’t that many places where an advertiser can connect with users and do so as a part of their experience”

An excerpt from a Businessweek interview with Facebook COO Sheryl Sandberg:

“…our business is advertising…What we do is we enable connections. We enable people to connect with users and provide advertising in such a way that it’s not obtrusive at all, but it’s part of the advertising experience and part of the user experience… We believe advertising needs to blend into the experience…There aren’t that many places where an advertiser can connect with users and do so as a part of their experience and as part of the sharing. We actually offer that ability.

from:  “BusinessWeek Editor-in-Chief Stephen J. Adler talked with Facebook Chief Operating Officer Sheryl Sandberg”

A Mobile Marketer explains how they build a profile, including operator, geographic, demographic, search query data [Annals of Mobile Marketing]

Here’s an excerpt from an video interview we transcribed with Paran Johar, CMO of Jumptap (a mobile marketing company).  The interview was done at the Mobile World Congress, Barcelona 16-19 February, 2009:

“Journalist: You have a lot of intelligence built in to your engines in the back. How is that working together? How far down can you deep-dive in the targeting? How granular can you get?
PJ: Number one; Targeting is only important as long as you have scale and reach. So we need to kind of frame that out. Number two; we take inputs from various sources. So, we take operator data, whatever they want to pass to us, they can pass us. Certainly with AT&T we get geographic data from them, in some cases we get demographic data, we get search word query data, whether we are the search engine or if it is Google, Yahoo or Microsoft, that can get passed to us, contextual data and behavioral data. We take all that together and we score it, build a taxonomy to build a profile that will serve a relevant ad. We believe mobile phone is the most personal devices…
Journalist: … How much of an issue is the analytics now and are you positive and upbeat now that you feel that maybe mobile operators are getting their head around this to deliver it?
PJ: That’s a great point. A couple of things with the GSMA-Comscore UK trials. Number one, was absolutely wonderful that it fostered collaboration among operators for various audience segments. Number two, it was wonderful that they looked beyond just geographic, demographic, but they also include behavioral profiles in terms of their audience assessment. I also think it is very interesting that they are moving forward without actually being able to monetize this and building a platform so advertisers can participate in this. I think from a metric standpoint, the next thing that we are gonna look for is really standardization of post clip metrics and how to integrate that into
advertising campaigns.
Journalist: That’s an interesting idea. How do you envision that? How should it be?
PJ: It gets a little complicated but it shouldn’t be. In it’s simplest form you just have post-click, like a click to action. You click on the ad unit, you perform some action and it calls a pixel and you register that. But with mobile you obviously have different actions that can occur. It could be click to a map, it could be click to call, click to SMS. How do you track those actions? How do you then integrate them into a reporting structure, which is key. And we are building the tools to make it easy for media planners, agencies and clients to actually track all their actions holistically and then optimize their campaigns so that they are reaching their maximum ROI.”

IAB UK’s “Good Practice Principles” on Behavioural Targeting: Alice in Wonderland Meets Online Data Collection

Last week in Brussels at a EU Consumers Summit, Google and other interactive ad companies pointed to the new Interactive Advertising Bureau/UK “Good Practice Principles for online behavioural advertising” as a model for meaningful self-regulation.  The companies that have endorsed the principles include  AOL/Platform A, AudienceScience, Google, Microsoft Advertising, NebuAd, Phorm, Specific Media, Yahoo! SARL, and Wunderloop.   The message sent to EU regulators was, in essence, don’t really worry about threats to privacy from online profiling and behavioural targeting.  But a review of the Principles suggest that there is a serious lack of “truth in advertising” when it comes to being truly candid about data collection and interactive marketing.  These Principles are insufficient–and are really a political attempt to foreclose on meaningful consumer policy safeguards.

Indeed, when one examines the new online “consumer guide” which accompanies the Principles,  one has a kind of Alice in Wonderland moment.  That’s because instead of being candid about the real purpose of behavioral advertising–and the system of interactive marketing it is a part of–the IAB paints an unreal and deliberately cheery picture where data collection, profiling, tracking, and targeting are just harmless techniques designed to give you a better Internet experience.   UK consumers–and policymakers–deserve something more forthright.

First, the IAB conveniently ignores the context in which behavioural targeting is just one data collection technique.  As they know, online marketers are creating what they term a “media and marketing ecosystem.”  A truly honest “Good Practice Principles” would address all the principal ways online marketers target consumers.  That would include, as IAB/UK knows well, such approaches as social media marketing, in-game targeting, online video, neuromarketing, engagement, etc.  A real code would address issues related to the use of behavioural data targeting and other techniques when used for such areas as finance (mortgages, loans, credit cards); health products; and targeting adolescents.

The IAB/UK also fails to reconcile how it describes behavioural targeting to its members and what it says to consumers and policymakers.  For example, the group’s glossary defines behavioural targeting as:  “A form of online marketing that uses advertising technology to target web users based on their previous behaviour. Advertising creative and content can be tailored to be of more relevance to a particular user by capturing their previous decision making behaviour (eg: filling out preferences or visiting certain areas of a site frequently) and looking for patterns.“  But its new “Good Practice” consumer guide says that “Online behavioural advertising is a way of serving advertisements on the websites you visit and making them more relevant to you and your interests. Shared interests are grouped together based upon previous web browsing activity and web users are then served advertising which matches their shared interests. In this way, advertising can be made as relevant and useful as possible.”

Incredibly, the IAB/UK claims that “the information used for targeting adverts is not personal, in that it does not identify you – the user – in the real world. Data about your browsing activity is collected and analysed anonymously.”  Such an argument flies in the face of what the signatories of the “Good Practice Principles” really tell their online ad customers.  For example, Yahoo in the UK explains that its “acclaimed behavioural targeting tool allows advertisers to deliver specific targeted ads to consumers at the point of purchase.”  Yahoo has used behavioural targeting in the UK to help sell mortgages and other financial products.  Microsoft’s UK Ad Solutions tells customers it can provide a variety of behavioural targeting tools so it “can deliver messaging to the people who are actively looking to engage with what you’re offering…With Re-messaging we can narrow our audience by finding the people who have already visited you. It means we can ensure they always stay in touch and help create continual engagement with your brand…Profile Targeting can help you find the people you’re looking for by who they are, where they are and when you want to be seen by them.”  Time Warner’s Platform A/AOL says Through our Behavioural Network, we can target your most valuable visitors across our network, earning you additional revenues, or simply fulfil your own campaign obligations.  By establishing certain user traits or demographics within your audience, we are able to target those individuals with the most relevant advertising (tied into their common characteristics), or simply reach those same users in a different environment.”  Or Audience Science’s UK office that explains “While other behavioural targeting technologies simply track page visits, the AudienceScience platform analyzes multiple indicators of intent:

•  Which pages and sections they have visited

•  What static and dynamic content they have read

•  What they say about themselves in registration data

•  Which search terms they use

•  What IP data indicates about them, including geography, SIC code, Fortune 500 rank, specific Internet domains,   and more

Because AudienceScience processes so many indicators of intent, it enables you to create precisely targeted audience segments for advertisers.”  And Google, which knows that the UK is “arguably the most advanced online marketplace in the world” has carefully explained to its UK customers all the data they collect and make available for powerful online targeting.

The Notice, Choice and Education “Good Practice” scheme relies on an ineffective opt-out.  Instead of real disclosure and consumer/citizen control, we have a band-aid approach to privacy online.  The IAB also resorts to a disingenuous scare tactic when it suggests that without online marketing, the ability of the Internet to provide “content online for free” would be harmed.  No one has said there shouldn’t be advertising–what’s been said is that it must be done in a way which respects privacy, the citizen, and the consumer.   Clearly, the new IAB/UK code isn’t a model that can be relied on to protect the public.  UK regulators must play a more proactive role to ensure privacy and consumer welfare online is meaningfully protected.