I was digging in the old archives from when I was an analyst at Jupiter (1999 to 2003). Amazing stuff. Think back. It was August 17, 1999, the Jupiter Online Advertising Forum, and the keynote was Kevin O’Connor of Doubleclick. Thinking about the privacy debate, I thought his comments back then over 10 years ago were quite interesting. Here is the verbatim from part of the Q and A session:

The important thing about privacy policy is that you actually state what you do and you don’t do different things, because when you do that, it’s fraud. And that’s really, if you look at all the privacy cases that come up, it’s usually based on fraud. People say that I’m not going to take your data and sell it and they turn around and they sell it. That’s fraud. If you tell a consumer, look, we are going to take your data and sell it, maybe you’re a free ISP or something, that’s how you make money, that’s fine. Congress doesn’t have a problem with that.

The other one is, you know, really disclosure and that’s back to the privacy policy. But it’s giving people the choice, the chance to opt out. You know, we put a system in place two and a half years ago where people could opt out of the cookie at any time. And it’s a single click. It’s very, very easy. Most places, I don’t think anyone else has an opt-out system. It’s really, really bad. You’ve got to give consumers choice.

Now, people are afraid of giving consumers choice because they think that consumers, oh, geez, if they have a chance to opt out they’re all going to opt out. We have, we reach about 100 million consumers a month and about 10 a day opt out. The reality is that in many cases, privacy is more of a press issue - there’s probably press in here today and I’m going to regret this — and there are definitely some consumers that care, but the consumers that care want to have a choice. And once you give them that choice, it really takes the issue off the table.

Just a funny observation when reading this good Newsweek article about privacy, is that there are a lot of behavioral targeting pixels getting fired on that self-same page, including AudienceScience, Quantcast, and Doubleclick. Such is the world we live in:

http://pix04.revsci.net/B09806/b3/0/3/0902121/642641728.js?D=DM_LOC%3Dhttp%253A%252F%252Fwww.newsweek.com
http://pix04.revsci.net/B09806/b3/0/3/0902121/997357272.js?D=DM_LOC%3Dhttp%253A%252F%252Fwww.newsweek.com
http://pixel.quantserve.com/pixel;r=1520162946;fpan=0;fpa=P0-2043871114-1266555449664;ns=0;url=http%3A%2F%2Fwww.newsweek.com%2Fid%2F233773;ref=;ce=1;je=1;sr=1440×900x32;dg=P9940-W-MS-7;dst=1;et=1266555480477;tzo=480;a=p-1axiNKelAV3F-;labels=Business_Tech
http://pixel.quantserve.com/pixel;r=1991808241;fpan=1;fpa=P0-2043871114-1266555449664;ns=0;url=http%3A%2F%2Fwww.newsweek.com%2Fid%2F233773;ref=;ce=1;je=1;sr=1440×900x32;dg=P9940-W-MS-7;dst=1;et=1266555449664;tzo=480;a=p-1axiNKelAV3F-;labels=Business_Tech
http://core.insightexpressai.com/adServer/adServerESI.aspx?bannerID=155498&siteID=N2958.Newsweek&creativeID=35286945
http://core.insightexpressai.com/adServer/adServerESI.aspx?bannerID=157152
http://core.insightexpressai.com/adServer/GetInvite2.aspx?esi=true&bannerID=157152&referer=www.newsweek.com
http://core.insightexpressai.com/adserver/showInvite.aspx?ImageOnly=true&bannerID=157152&esi=true
http://ads.revsci.net/adserver/ako?activate&csid=B09806&ko=2010_2_18__0
http://ads.revsci.net/adserver/ako?activate&csid=B09806&ko=2010_2_18__1
http://b.scorecardresearch.com/b?c1=2&c2=6972086&rn=0.11742583378751214&c7=http%3A%2F%2Fwww.newsweek.com%2Fid%2F233773&c3=&c4=&c5=&c6=&c10=&c15=&c16=&c8=Lyons%3A%20How%20Google%20%26%20Facebook%20Violate%20Your%20Privacy%20-%20Newsweek.com&c9=&cv=1.7
http://b.scorecardresearch.com/b?c1=2&c2=6972086&rn=0.6740785767349728&c7=http%3A%2F%2Fwww.newsweek.com%2Fid%2F233773&c3=&c4=&c5=&c6=&c10=&c15=&c16=&c8=Lyons%3A%20How%20Google%20%26%20Facebook%20Violate%20Your%20Privacy%20-%20Newsweek.com&c9=&cv=1.7
http://b.scorecardresearch.com/beacon.js
http://b.scorecardresearch.com/beacon.js
http://b.scorecardresearch.com/p?c1=8&c2=6035585&c3=91900631&c4=autotag&c6=00000126655545776310180000106049048050
http://b.scorecardresearch.com/p?c1=8&c2=6035585&c3=91900631&c4=autotag&c6=00000126655548607223311000000106054051
http://b.scorecardresearch.com/p?c1=8&c2=6035585&c3=92068662&c4=autotag&c6=00000126655545933629473000000106050057
http://b.scorecardresearch.com/p?c1=8&c2=6035585&c3=92068662&c4=autotag&c6=00000126655548713221232000000106053050
http://b.scorecardresearch.com/p2?c1=8&c2=6035585&c3=91900631&c4=autotag&c6=00000126655545776310180000106049048050
http://ad.doubleclick.net/activity;src=2163259;met=1;v=1;pid=45108152;aid=221548926;ko=0;cid=35286945;rid=35304763;rv=1;&timestamp=1266555475555;eid1=2;ecn1=0;etm1=2;eid2=12;ecn2=1;etm2=0;eid3=254307;ecn3=1;etm3=0;eid4=11;ecn4=1;etm4=0;eid5=254300;ecn5=1;etm5=0;

I’ve been seeing voicefive.com loading everywhere so wanted to see who this is — according to domaintools.com their nameservers are all .comscore.com - so it looks like this is another “unbranded” comscore domain. According to the voicefive.com website:

VoiceFive Networks is a leading global market research company that studies and reports on Internet trends and behavior. VoiceFive Networks is routinely commissioned to conduct research on numerous topics of concern to industry leaders in diverse fields, including travel, pharmaceuticals, and publishing.

The usual giveaways are their privacy policy address, and of course the nameservers. Then of course, the repetition of wording - if you do a google search you’ll see “a leading global market research company that studies and reports on Internet trends and behavior” also includes “Full Circle Studies” (http://www.fullcirclestudies.com) and their “ScorecardResearch … domain used by Full Circle Studies, Inc. to help with the collection of Internet web browsing data on specific websites that have enrolled in a broad market research effort to create reports on Internet behavior and trends.” We’ve seen b.scorecardresearch.com before which is the beaconing URL that comscore is using for reconciling its panel numbers with the higher site-measured figures.

Yahoo! just launched a page where you can manage how they classify your interests based on your search and other activity on the Yahoo! Network.

http://info.yahoo.com/privacy/us/yahoo/opt_out/targeting/

Mine was blank, and then I did two searches, one for “powerball” and one for “cars”. These are the categories I am now flagged as being interested in:

Interest Categories:

Automotive

Entertainment

Entertainment > Movies > Animation

Entertainment > Movies > Childrens

So I can see how that the lottery/entertainment categorization could go along with it being a move title etc. But what was odd was then the next list which was “Categories you search:”

At which point I have to say, “huh?” - this is really what I’m searching for with those two keywords? Categorization is dangerous - but it is really difficult to create an ad product that takes keywords as an input because you need tens or hundreds of thousands unless you’re only focusing on the “head” keywords and as we know people don’t only search that way. Fascinating though, now you can do some searches, clear your cookies and start again and see how Yahoo! classifies you. Or opt-out of it all of course.

I was trying to post a comment to this story on Mediapost about newspapers arguing for behavioral targeting online, but it crapped out on me. So i figured I’d post it here:

I believe there should be more disclosure around BT. I also believe if done properly it can provide a lot of lift for advertisers and the ability for publishers to make more money and have a more sustainable business online. There are, however, double standards as applied to online advertising versus what happens in the offline world. When I subscribe to the Wall Street Journal or the New York Times (or most publications), they make money on selling my name and address (PII) and the fact that I’m a subscriber to various third parties. When I get one of these third-party direct mailings sent to me at home based on my address and data-matched to other information about me in various databases out there, I don’t get to find out who gave it up and how.

Consumers already ignore irrelevant mailings offline and irrelevant ads online, and with silicon being cheaper than paper and BT being non-PII, why do we devote so much more attention it seems to this online side of the equation and make it extra hard for the publishers to stay in business?

I run a startup that has been building online ad optimization tools, a self-service ad buying system, integrating with various exchanges etc. etc. – there’s a lot going on! But amidst all of the excitement and goings on in the display advertising industry, it does appear that one particular constituency is taking a back seat and is little-discussed: the consumer.

I’ll spend some time on this blog talking about what the user wants, but in the meantime let’s see what the “ad industry” thinks the government thinks the user wants…

The AAAA, IAB, ANA, DMA and BBB (whew!) all came together and in July announced

“self-regulatory principles to protect consumer privacy in ad-supported interactive media that will require advertisers and Web sites to clearly inform consumers about data collection practices and enable them to exercise control over that information.”

So they came up with some principles; the implementation of which I don’t believe has really been delved into much detail just yet. Here they are (descriptions paraphrased):

• Education Principle: educate individuals and businesses about online behavioral advertising. Intention to run 500 million impressions over 18 months to explain this stuff to consumers.
• Transparency Principle: clearer, more accessible disclosures to consumers about data collection and use practices of behavioral advertising. New, enhanced notice “on the page where data is collected through links embedded in or around
• Consumer Control Principle: provides expanded ability to choose whether data is collected and used for online behavioral advertising purposes. This choice will be available through a link from the notice provided on the Web page where data is collected. Requires “service providers”, (includes Internet access service providers and providers of desktop applications software such as Web browser “tool bars” to obtain the consent of users before engaging in online behavioral advertising), and take steps to de-identify the data used for such purposes.
• Data Security Principle: reasonable security and limited retention of data, collected and used for online behavioral advertising purposes.
• The Material Changes Principle calls on organizations to obtain consent for any material change to their online behavioral advertising data collection and use policies and practices to data collected prior to such change.
• The Sensitive Data Principle requires parental consent for behavioral advertising to children and heightened protections to certain attributable health and financial data.
• The Accountability Principle calls for development of programs to further advance these Principles, report uncorrected non-compliance with these Principles to appropriate government agencies. The CBBB and DMA have been asked and agreed to work cooperatively to establish accountability mechanisms under the Principles.

A few thoughts here:

Education: It’s hard to explain behavioral targeting to people in the online marketing industry. At a recent conference I spoke at, I had the same conversation explaining retargeting to smart marketers who all did a lot of search and not so much display. What are we going to say to consumers to explain how this stuff works? How will saying what it is affect what consumers do about it? In my past life as an analyst for Jupiter and Nielsen NetRatings, I’ve seen the wide disparity between what people say they will do and what they actually do. 500 million impressions over 18 months? Average clickthrough rates on display ads are around 0.1 percent – let’s be generous and say that 10 times that number pay any kind of attention to these impressions and click on them (though I’m guessing these will be late-session impressions of lower value than the average). We’ll end up with 5 million users learning more about what is going on, over 18 months – or about 3.333 million users per year. Better than nothing? Yes, but not by much.

Transparency: This is a big one. Enhanced disclosure on the page where the data is gathered. Let’s look at the major sources of where data comes from:

• Publishers: A person lands on a web site and perhaps does something and is put into a behavioral bucket. There are more in-depth uses of data that occur when some sites take user registration information and use that to put a user into an audience bucket. The PII data doesn’t persist in the network per se, but it is there.

• Advertising campaigns: a user clicks on an ad and the ad network often flags that as interest of a user in a particular category. The data gathering happens within the entity who is serving the ad, and there is typically no communication channel between the entity and the consumer since they are directing the ad click to an advertiser’s page

• Advertisers: retargeting, typically for other advertiser campaigns. Really a subset of publishers, above.

Putting notice on the page where the data gathering is happening is going to be very difficult. It’s going to be much easier to enforce and to provide a fair trade-off to the user to ask them at the point at which the data is used…. So for example, I visit a site about baseball as I do every day (I don’t like baseball at all, for anyone keeping score at home BTW) and at some point later on I see an advertisement for baseball tickets for an upcoming game in my area. I would also see a little moniker attached on the bottom right corner of the ad with a question mark that I could click on to expand and see why this ad had targeted me specifically. It would then have an easy link for me to 1) opt-out of this instance of data use, 2) opt-out from the provider(s) involved and/or to 3) opt-out completely from the whole damn lot assuming I hadn’t already in which case I would not have seen this ad in the first place.

If we really want change we should have incremental steps. Data notice and choice at the point of use in the online display world, when combined with better policing of how and where data goes to in the middle in an industry-managed solution is the cheapest, least innovation-stifling and most effective way to get past the “of course I care about privacy” nonsense (everyone cares about it, but it’s not an interesting question unless you get specific) where someone has absolutely no context for knowing if that data is going to be of help to them.

I’ve been stuck in this world before as a research analyst trying to reconcile what consumers say they want vs. what they do (I spoke at an FTC workshop about this back in 2002 – here is some data that I presented then that is still quite relevant I think.

I encourage further discussion here as this market changes and develops, and hope to outline more of the consumer angle in coming posts.

OptMD.com serves a LOT of the popunder ads you may see on a variety of sites. Their website allows you to opt out of receiving their pops, which is laudable given the way many popunders have no regard for the wishes of users (even though, they still work for a lot of advertisers). What I found interesting on their opt-out page was the following language beneath:

WARNING: by choosing to opt out you are taking an active position not to support the publishers whose websites you visit and whose content you consume free of charge. In doing so you threaten the long term viability of their operations.

Also, if you were to choose to opt-out, you would see opt-out cookies being placed from a domain called “casalemedia.com” - which of course is one of the big ad networks. It appears they don’t want their name associated with delivering popunders, which is why they use an alternate adserving URL. You won’t find their name anywhere else on the OptMD.com website which is written as if it is a separate company. However, the address given in their privacy policy is the same as that of Casale Media’s LA office. Fun stuff indeed.