(The September issue of MediaPost / OMMA ran an version of this piece that I penned I am posting the longer version below)
Age of Consent - Data Privacy: Behavioral Targeting + Social Media
The Price of ‘Free’ Media I Will Pay - Mark Ghuneim
Just because you can do something does not mean you should.
Behavioral targeting is expected to surpass search advertising by 2202. Industry estimates that about 24% of online advertisers now use behavioral targeting, with that proportion expected to swell to 85% by 2010. There are many layers of data; behavioral, demographic, contextual.
I started off in writing this wanting to address how trendrr.com chose to use data that is not personally identifiable, but instead anonymous, and ended up doing a deep dive on behavioral targeting issues and social media.
I am not against contextually targeted advertising or even behavioral targeting if it is done correctly.
By taking a look at two specific uses of data for advertising and analytics, we can best understand the rich nature of data and how a little bit of it can mean more than you think.
- Social Media + Behavioral Targeting Advertising
- Social Media + Measurement of Media Behaviors
Social Media + Behavioral Targeting Advertising
Currently, the trend in measuring media and consumer behavior for social media has led to non-permission based, hyper-targeting and PII (Personal Identifiable Information) harvesting.
In this piece, I am going to use the IAB Self-Regulatory Principles as the framing point to explore the issues surrounding BT. By taking a critical eye to these principles we can flesh out the important underlying issues and see if they lead to real (and trusted) market place or merely attempts to assuage privacy concerns.
While I acknowledge the immense pressures to meet quarterly goals and convert digital dimes to dollars during these times of disintermediation, we must be aware of the consequences of our actions and be prudent to maintain standards and practices in line with the level of trust we want to establish with our users and consumers.
With these principles, the industry is getting out in front of potential government legislation and posting best practices for behavioral targeting
Involved organizations include the (DMA) Direct Marking Association, the Internet Advertising Bureau (IAB), American Association of Advertising Agencies (4A’s), Council of Better Business Bureaus (BBB) and the Association of National Advertisers (ANA) as well as representatives across a diverse and broad cross section of the industry including Advertisers, agencies, ISPs, Social Networks and Portals
The “Transparency Principle” requires the deployment of multiple mechanisms for clearly disclosing and informing consumers about data collection and use practices associated with online behavioral advertising.
In all likelihood the ‘Transparency Principle’ will only result in new links to privacy policies and disclosure of data collection, but no significant change in what’s being collected and how. It does not provide access to what is being collected or the ability to edit, delete, or otherwise have any control over your own data.
Some privacy advocates have been pushing for more stringent rules by saying, for instance, that consumers must explicitly approve all data collection.
Stuart P. Ingis, a partner at the Venable law firm and a lawyer for the trade groups, said that was not feasible. He claims “If you had that as a default, you would wind up undercutting significantly the economic underpinnings for all the stuff the public loves. The way, operationally, that would work is every time a consumer’s doing their Web surfing, you’d be requiring them to click through all these options. Consumers would hate that.”
Giving consumers access to the data is “an interesting concept,” Mr. Ingis said, noting that what the companies collect shows up as, “a bunch of ones and zeros.” The industry’s take is that it’s a burden to provide clarity and that the data is non-decipherable gibberish which is of little value to users.
“The data is in computer wording, programming speak, and to the consumer would mean nothing,” he said.
However, contrary to Mr. Ingis’ point, a handful of online companies, including Google, have translated a small portion of this data and have said they will give consumers access. A much more comprehensive level of visibility is required even in those cases of partial access.
I support giving users access to this data. They will write the rendering mechanisms and applications to explore this data, there is no doubt in my mind. We may be surprised at the transparency and clarity as it relates to these consumers and data points.
A simple example of the value of this to both consumer and company is Amazon, who is all about the sale. Amazon allows you to remove gifts and other purchases from shaping your profile and what is suggested for you.
The value of the data set and users acceptance of its usage depends on this level of access, editorial approval and transparency for it to work at all. Even then it would have to be opt-in and would still border on acceptable usage.
In an AdWeek story, “Connect the Thoughts”, they addressed the possibility of consumers having to opt-in by saying,
“The worst-case scenario is that legislators may dictate that all third-party cookies need to be opt-in.”
AOL’s ‘data Valdez’ (the loss of massive amounts of “anonymized” AOL user data that led to easily tracking personally identifiable information in 2006) showed how fast non-personal information could become identifiable.
The amount of data being collected is not trivial and the information is often merged or appended with offline information (more on this practice further on).
We know there is a serious disconnect between what is being said and what is being done when the people who have the capabilities to exploit such data come out for regulation.
Chaos Computer Club, Europe’s largest hacker group, published an opinion on data retention declaring (rough German to English translation, unfortunately):
“There is absolutely no reason to believe that telecommunications companies, service providers or agencies are able to operate in automated mass obtained connection data of the entire population to keep safe,” said CCC spokesman Frank Rieger.
“Sensitive data is constantly in recent times stolen, accidentally or intentionally released abused. Such losses and abuses of connection and location data can only be achieved through a single means to prevent the collection and storage must be prohibited by law rather than be prescribed.”
There are smarter, more elegant alternatives (that do not depend on the same costly data) which have yet to be explored. What it really comes down to is, are consumers appropriately aware of what is being done? Is the exchange of information for contextual offers of commerce appropriate? Immoral? Just fine and no problem at all?
Looking at the brand and advertiser POV, is there not concern that at the most basic level, that violation of trust will do a disservice to brand’s message. The right message, at the right time, the right way only works if you want to accept it coming from a basic foundation of trust.
Some behavioral targeting practices have an even more aggressive approach to the market place. I am speaking of identity and social graph harvesting for push marketing purposes and companies who append offline and online info for a stunningly deep and impressive dossier on individuals’ lives and behaviors.
From the New York Times article, “Ads Follow Web Users, and Get More Personal,”
“Companies like Acxiom and a competitor, Datran Media, make the connection between online and offline data when a person registers on a Web site or clicks through on an e-mail message from a marketer.
Datran’s cookies include 50 to 100 pieces of information. Both companies say cookie data is anonymous and generalized. Datran and Acxiom then sell advertising on Web sites like NBC.com, Facebook and Yahoo to companies that use their data.”
Do we really believe that this is a need to meet the end? When the quid pro quo is made clear, I venture a new conversation and debate will emerge.
The appending offline and online data is not a joke – it almost makes the other potentially disturbing trend look marginal. While it may turn out to be successful for some, I feel that it has certain implications which make it an inopportune approach.
Specifically, companies that create or use tools that search for an instance of someone mentioning a brand or topic and save that contact to a group to be targeted with a ‘contextual’ message.
It is like crashing a party and because you brought a bottle of wine or a gift, you think you have permission to enter and engage. You do know know them, they don’t know you, and you have not earned the right to dialogue just because you forced your way in.
As far I am concerned, this type of non-permission based, hyper-targeting and PII (Personal Identifiable Information) harvesting is not in-line with what we want to do as an industry is reprehensible. Consumers need to understand in real terms what exactly is taking place, then consent and have access to view, delete, edit, and own their data. There needs to be clear and sufficient “notice and choice”.
The “Sensitive Data Principle” recognizes that certain data collected and used for online behavioral advertising purposes merits different treatment. (Only applies to children’s data and financial, health and social security data.)
While we can appreciate the effort to secure data, especially intrinsically sensitive data, the report still does not recognize the possibility that non-sensitive data can become sensitive data when combined with other, seemingly unassuming data, a la AOL. Again, they seem to be out of touch with the way data collection actually works.
In the same Ad Week story I mentioned earlier, “Connect the Thoughts”, they looked at behavioral targeting practices and really helped to bring clarity to the points I wanted to illustrate around passive data mining. This will help me to explain some of the important distinctions around suggested practices and actual realities.
The key for me in looking at behavioral targeting is you need to view it from a consumer advocate point of view for it to work as an advertiser. With this in mind, we should ask the following questions:
Are consumers appropriately aware of what is being done? Are the self-regulation principles adequate? Do consumers have “notice and choice”, and taking it a step further, do they consent and have access and visibility into the data being collected? Is the quid pro quo balanced?
The AdWeek story reads:
“Hanging in the balance of all these efforts is the issue of privacy. Companies like Media6°, Lotame and 33across all comply with industry standards and do not collect personally identifiable information. Yet the advertising industry is bracing for tighter regulation of its data practices under a new administration in Washington.”
If you go to Lotame’s website and read the FAQ they clearly state:
“Data We Collect and Use:
To deliver our services, we collect, organize, and use data reflecting your interactions with a variety of Web sites. The information we use includes items such as the date and time you visited a Web site, your browser information, your IP address, your browsing behavior, and interests you express or imply at social networking sites or other Web sites you visit. We recognize your computer over time by setting a unique browser cookie which your browser relays to our servers when you visit Web sites that are our customers. We analyze this non-personal information and organize it into anonymous user profiles, groups, and audiences, based on factors such as age, gender, geography, interests and online actions. We and our customers then use these anonymous user profiles, groups, and audiences to design and deliver targeted advertising campaigns or other relevant content. We and our customers also use this data for other related purposes …”
In other words, Lotame collects your IP among other things and uniquely identifies your computer “by setting a unique browser cookie” as well as several other methods.
All of this is made crystal clear by them and may even adhere to the author of Ad Week article’s statement that they meet industry standards regarding collecting PII.
Despite a recent court ruling saying IP addresses are not personally identifiable information, the fact of the matter is a third grader could find you with your IP address and any other part of the targeting information collected.
The reality: This information can be personally identifiable and used in ways unintended when collected.
In essence, all this is really is a well-written privacy statement, which does not address the realities of what is taking place.
To get an idea of the scope of the amount of data collected, a 2008 New York Times story on behavioral targeting stated that five U.S. companies alone — Yahoo, Google, Microsoft, AOL, and MySpace — recorded at least 336 billion data “events” each month. Add the emergent social network behaviors on Twitter and Facebook into the mix and the amount of one’s personal data that can be collected is stunning.
The Center for Digital Democracy addressed the larger view of self regulatory behavior in “Behavioral Targeting and the Online Assault on Personal Privacy.”
The paper reads, “The principles are inadequate, even beyond their self-regulatory approach that condones, in effect, the ‘corporate fox guarding the digital data henhouse.’”
It seems all the arguments against notice, access and consumers’ visibility to what exactly is taking place with their information speaks to regulation as a nuisance and something that will hold back the industry. Only when this data is used in ways unintended and in a harmful manner will the significant and serious implications of it as personally identifiable information come to the forefront.
Again. Do we really need to see the right contextual advertisement this badly?
The “Accountability Principle” calls upon entities representing the wide range of actors in the online behavioral advertising ecosystem to develop and implement policies and programs to further adherence to these Principles.
While probably viewed as a concession, this type of “self-regulation” calls for businesses to self-report problems to the government.
“Development of programs to further advance these principles, including programs to monitor and report instances of uncorrected non-compliance with these principles to appropriate government agencies.”
I am sure there will be a big red button next to all the hidden information collected on individuals that goes immediately to the right person at the FTC and as soon as you can say ‘learning moment’ clarity and data privacy will be bestowed.
Pardon my sarcasm but even the most ardent portion of these guidelines will likely prove ineffective until a clear and acceptable use policy is matched against fines, which are actively enforced.
The “Education Principle” calls for entities to participate in efforts to educate consumers and businesses about online behavioral advertising.
How much and what kind of information they plan on making available, and how extensive of a campaign they plan on implementing is left out. To be effective, the curriculum must clearly lay out what is being collected, how it is being used, and show users actual case scenarios.
Educating as a concept is never wrong. It cannot be in lieu of clarity and transparency at the point of contact though (i.e. where it means the most). Once you cross that line you
cannot go back and after you have already done so would be useless.
As each sector wrestles with ways to qualify their KPI in this new social and distributed media landscape; to monetize it, analyze it, or create applications, it is important to know that we have to do it with imperatives that build trust from the start.
There is a digital ancestral responsibility that we can still embrace while we remain close to an online information zero year. (2010)
Social Media + Measurement of Media & Behaviors
The challenge the Trendrr team took on was quantifying and qualifying metrics in the social space while keeping in-mind our particular standards and practices.
For us, our approach to data mining for advertising, marketing or metrics is passive and does not identify PII.
We want to look at the behaviors, not the person.
In order to satisfy my personal information security standards, Trendrr tracks data that is not personally identifiable, but instead anonymous. We do not collect any PII and we do not believe it is needed to gain key performance insights and business intelligence.
We face challenges as we incorporate semantic filters (less so) and influence layers (more so) but I trust a continued respectful approach to privacy and personally identifiable information will prevail.
When I signed up to The Well (the legendary SF BBS/ISP) the first thing I saw was a prompt, immediately followed by the phrase: “You own your own words”. On Twitter you own your own tweets.
This ethos needs to evolve into “you own your own meta-data” (which includes the unique makeup of your social graph).
It is from me and my uniqueness. It is unique to me and thus mine. If the marketplace determines there is value, then that currency is mine, not yours, to monetize.
This is much bigger than being able to serve up a contextually relevant advertisement and allowing media empires to stay afloat. There are ways to be there and be square, as we illustrated with our marketplace approach to analytics.
This is unwitting participation by consumers in a game of commerce that they are fully not aware of the impact of; both to their bottom line and to their privacy.
It is about assembling deep user profiles that coupled with some data, and in the wrong hands, could be a big bag of hurt for individuals who do not fully understand the implications of their click stream profile.
Last month in the UK behavioral targeting at the ISP level got a market place reality check. Phorm, a behavioral targeting service in the U.K., was not deployed as intended. Internet service provider, BT Group, is now backing off plans to deploy Phorm’s platform. In the US, NebuAd went out of business last year after privacy issues were focused on.
The new set of guidelines and perceived go-ahead in the US, which unites all the disparate business, and industry verticals, makes that kind of game stoppage far more unlikely.
All of this data can still provide very useful information as to how much chatter there is about your company, product, or brand, as well as the success of a marketing campaign, and even what adds should be displayed. The point is there are ways to accomplish this without being intrusive or potentially damaging to the consumers or brands (neither seem to perceive these practices as problematic at this point)
There are increasingly new and elegant solutions, which more effectively reach and measure consumers and their new digital behaviors and do so in a less intrusive and costly fashion. It is time to start exploring them.
Reference Links