Silicon Valley Insider has published a list of which ISPs were and are tracking consumers, whether they work(ed) with NebuAd, someone else, or are doing it through internal systems. Check out the list.
Thanks to SV Insider for compiling this list.
Thanks for reading, and don't forget to write.
Showing posts with label ISP targeting. Show all posts
Showing posts with label ISP targeting. Show all posts
Tuesday, September 2, 2008
Wednesday, August 20, 2008
Opt-In ISP Targeting: ATT Mulls a Different Route
As the NebuAd controversy has materialized, one of the principal criticisms of their agreements with ISPs -- and about BT in general, has been the reliance on an opt-out model. As you know, opt out requires the consumer to actively engage and tell the ISP and BT providers, "No, don't track me." The alternative, opt in, hasn't gotten a lot of traction, at least in the US, principally because there is an expectation that most people would not bother to opt in even if they were fine with the idea of targeted advertising.
Based upon the feedback provided by major ISPs in their responses to the House Energy and Commerce Committee, however, it appears that one major ISP is considering opt in as the right thing to do. This according to an analysis last week in the NY Times Here is an excerpt from Saul Hansell's analysis of ATT's vision:
While the company said it hadn’t tested such a system for monitoring display advertising viewing habits or committed to a particular technology, it expressed much more interest in the approach than the other big Internet providers who also responded to the committee’s letter.
AT&T did however promise that if it does decide to start tracking its customers online, it will “do so the right way.” In particular, the advertising system will require customers to affirmatively agree to have their surfing monitored. This sort of “opt-in” approach is preferred by privacy experts to the “opt-out” method, practiced by most ad targeting companies today, which records the behavior of anyone who doesn’t explicitly ask to not to be tracked.
The passage and entire article interested me greatly because ATT fully discloses their keen interest in participating in the online ad revenue boom, but their parallel determination to ensure that consumers are satisfied with their approach and choose to participate.
This is nothing short of gutsy. I have to admit that I have never seen opt in as a realistic solution for the current approaches to BT because while the consumer does receive value in the form of better online content paid through higher CPMs, they do not get something tangible in their hands for participation. I think this benefit is too abstract for most consuemrs to grasp and value. I do NOT subscribe to the theory that targeted advertising has significant consumer value to the average consumer, at least in the rational abstract.
Is ATT right? I hope so -- this is definiotely a situation in which I would be delighted to be wrong. And perhaps they are anticipating a different consumer value proposition for the solution they ultimately select. Is it possible that ATT is seeking a solution that provides real consumer value in exchange for participation? And I mean REAL consumer value, not their ersatz value trumped by companies like Phorm with their phish protector.
It's going to be interesting to see what happens.
Thanks for reading, and don't forget to write.
Based upon the feedback provided by major ISPs in their responses to the House Energy and Commerce Committee, however, it appears that one major ISP is considering opt in as the right thing to do. This according to an analysis last week in the NY Times Here is an excerpt from Saul Hansell's analysis of ATT's vision:
While the company said it hadn’t tested such a system for monitoring display advertising viewing habits or committed to a particular technology, it expressed much more interest in the approach than the other big Internet providers who also responded to the committee’s letter.
AT&T did however promise that if it does decide to start tracking its customers online, it will “do so the right way.” In particular, the advertising system will require customers to affirmatively agree to have their surfing monitored. This sort of “opt-in” approach is preferred by privacy experts to the “opt-out” method, practiced by most ad targeting companies today, which records the behavior of anyone who doesn’t explicitly ask to not to be tracked.
The passage and entire article interested me greatly because ATT fully discloses their keen interest in participating in the online ad revenue boom, but their parallel determination to ensure that consumers are satisfied with their approach and choose to participate.
This is nothing short of gutsy. I have to admit that I have never seen opt in as a realistic solution for the current approaches to BT because while the consumer does receive value in the form of better online content paid through higher CPMs, they do not get something tangible in their hands for participation. I think this benefit is too abstract for most consuemrs to grasp and value. I do NOT subscribe to the theory that targeted advertising has significant consumer value to the average consumer, at least in the rational abstract.
Is ATT right? I hope so -- this is definiotely a situation in which I would be delighted to be wrong. And perhaps they are anticipating a different consumer value proposition for the solution they ultimately select. Is it possible that ATT is seeking a solution that provides real consumer value in exchange for participation? And I mean REAL consumer value, not their ersatz value trumped by companies like Phorm with their phish protector.
It's going to be interesting to see what happens.
Thanks for reading, and don't forget to write.
ISP Targeting: In the EU The Gun Sights Are On Phorm
I'm not suggesting for a moment that the heat is off NebuAd, but in the EU at least the company in the sights of regulators is Phorm. You may recall that Phorm had a positively disastrous time in the UK last Summer when they quietly launched their version of an ISP based ad network with BT (nee British Telecom), Virgin Mobile, and TalkTalk. Well, quietly is not the right word. Secretly is actually the correct term. Or perhaps covertly.
Phorm is the new name developed by a spyware operation called 121Media, which used offers of free secondary utility applications to convince people to download their adware/spyware products. Tomato/tomahto. As with Gator, the early days of this business in particular were loaded with examples of people not understanding that they were allowing 121Media to track their behaviors and field targeted ads. 121Media claimed it was those pesky partners that distributed their software that were to blame for these atrocities. Several millions of Americans including myself will find the story rather familiar -- we downloaded apps that gave Gator permission to field ads to us based upon serving habits. Then, when we realized what we had done, we found Gator all but unremovable.
OK, so Phorm. They changed the name of the company and shifted their focus from getting people to download their offering to getting ISPs to sell them the non PII portion of the info that made ad targeting possible.
Only trouble is, they didn't tell the people that were being tracked in the test. Some 18,000 of them. I don't mean they buried the revelation. They didn't tell them AT ALL, even in an intentionally quiet way.
How was this all discovered? Well, by a reader of TheRegister.co.uk, as outlined in this post. Here's an excerpt:
In June 2007, Reg reader Stephen noticed his Firefox 2.0.0.4 installations making suspicious unauthorised connections to the domain dns.sysip.net every time he visted any website. Naturally worried his machines had contracted some kind of digital infection, Stephen performed a series of exhaustive malware scans, which all came back clean.
He wasn't the only BT subscriber to notice that his browser was making the mysterious contacts around July last year, as this thread archived at Thinkbroadband.com shows.
"I spent all weekend wiping my disks clean and reinstalling from backups (four PCs seemed to be affected). I spent a further two days researching and installing all kinds of anti-virus, anti-spyware and anti-rootkit utilities. But even after all that I still have this problem!" Stephen told us at the time.
Having failed to trace the source of the dodgy redirect in his own network, he contacted BT to suggest one of their DNS servers may have been hijacked. BT dismissed the idea, yet the browser requests were still making an unauthorised stop off at dns.sysip.net.
Worried that his business' financial data might be being monitored, Stephen continued to investigate. A Whois search for dns.sysip.net revealed the domain was registered by Ahmet Can, an employee of a new online advertising company called 121Media. The address is now registered through a third party private domaining agency. 121Media rebranded itself as - you guessed it - Phorm in May 2007.
This is, you'll be unsurprised to learn, indeed the same Phorm that BT, Virgin Media and Carphone Warehouse recently revealed they had agreed to sell their customer's browsing habits to, despite the questions over its links to spyware. For helping Phorm target advertising, the ISPs are set to bag a cut of click revenues.
So, throughout the test period Phorm and BT had a novel consumer communications system.
DENY DENY DENY!
BT actually called the hijack process by which the system worked a clear incidence of malware.
But then! On 2/14/2008, BT and two other companies announced they had a deal, and that the hijack process was
validated under best industry practices, both through an independent audit conducted by Ernst & Young (View report PDF) and a Privacy Impact Assessment undertaken by Simon Davies, MD of 80/20 Thinking and Director of Privacy International.
Malware...revolutionis[ing] current standards of online privacy and fully protect[ing] the identity of consumers. Tomato...tomahto.
Phorm was paired with an application called Web Wise which was supposed to make people feel OK about the tracking. It was and is a phishing detector.
The British government essentially decided not to deeply pursue whether laws had been broken in the BT test. They issued their opinion that things were okiedokie, but many European web experts disagreed, as outlined in this post on TheRegister.co.uk.
(Has the US started exporting Bush Administration officials? ;-) We've have loads more folks like this, UK, if you want them. 2 for 1 sale through November.)
Here's a morsel:
"The explicit consent of a properly-informed user is necessary but not sufficient to make interception lawful.
"The consent of those who host the web pages visited by a user is also required, since they communicate their pages to the user, as is the consent of those who send email to the user, since those who host web-based email services have no authority to consent to interception on their users' behalf."
And the EU earlier this summer insisted they do so. Here is the text of the letter that was sent to the Brits by Brussels:
Dear Sir,
I am writing to you in relation to certain issues arising from the past and future deployment by some major United Kingdom Internet Service providers of the technology provided by a company called 'Phorm' to serve their customers with targeted advertisements based on prior analysis of these customers' internet usage.
In March 2008, a number of news items appeared in the media concerning the planned use by United Kingdom ISPs of the Phorm technology. Many of these publications raised issues concerning the impact of this technology on the privacy of Internet users. The information published on the web also included an e-petition submitted to the Prime Minister and a complaint made to the Information Commissioner's Office (ICO). In addition, in early April 2008, BT published a briefing according to which it had performed trials of the Phorm technology in autumn 2006 and summer 2007. In a TV interview, a BT representative confirmed that these trials had been performed without informing the customers affected and obtaining their consent.
The European Commission has already been contacted by Members of the European Parliament from the United Kingdom who communicated the concerns of their constituents regarding the deployment of Phorm technology. The issue has also been the subject of several written parliamentary questions addressed to the Commission by MEPs asking the Commission to comment on the applicability of WU legislation and also to set out its intended action in relation to the previous trials. Finally, a number of individuals have also written to the Commission directly to express their concerns and invite it to intervene in the matter.
In order to provide the response that is expected from it, the Commission needs to base itself on a clear understanding of the position of the United Kingdom authorities. Several EU law provisions concerning privacy and electronic communications may be applicable to other activities involved in the deploment of Phorm technology by ISPs.
In particular, Directive 2002/58/EC on privacy and electronic communications, which particularises and complements for the electronic communications sector the general personal data protection principles defined in the directive 94/45/EC (Data Protection Directive), obliges Member States to ensure the confidentiality of communications and related traffic through national legislation. They are required to prohibit listening, tapping, storage or other kinds of interception or surveillance of communications and the related traffic data by persons other than the users without their consent (Article 5(1)). The consent must be freely given, specific and an informed indication of the user's wishes (Article 2(h) of Directive 95/46/EC). Traffic data may only be processed for certain defined purposes and for a limited period. The subscriber must be informed about the processing of traffic data and, depending on the purpose of processing, prior consent of the subscriber or user must be obtained (Article 6 of Directive 2002/58/EC).
In the light of the above, we would highly appreciate it if the United Kingdom authorities could provide us with information on (1) the current handling by the United Kingdom authorities of the issues arising from the past trials of the Phorm technology by BT and on (2) the position of the United Kingdom authorities regarding the planned deployment of the Phorm technology by ISPs.
As regards the first issue, according to applicable EU law the responsibility for investigating complaints concerning such trials and determining whether the national legal provisions implementing the requirements of the relevant EU legislation have been complied with lies with the competent national authority(-ies) in the United Kingdom. The Information Commissioner's Office (ICO), which is responsible for enforcing the United Kingdom Data Protection Act 1998 (DPA) and Privacy and Electronic Communications Regulations 2003 (PECR), has made a number of statements on Phorm. In its latest published statement of 18 April 2008, the ICO analyses the conformity of the deployment of the Phorm technology with the DPA and the PECR. At the same time, the ICO indicates that it does not have responsibility for enforcing the Regulation of Investigatory Powers Act 2000 (RIPA), which has been invoked by some individuals who question whether the use of Phorm entails an unlawful interception of communications under this Regulation. In this respect, the ICO refers to a statement by the Home Office, which says that it is questionable whether the use of Phorm's technology involves an interception within the meaning of RIPA and that it does not consider that RIPA was intended to cover such situations. The ICO concludes on the issue of RIPA by stating that it will not be pursuing this matter. At the same time, the ICO statement does not include any indication as regards the intentions of the ICO in relation to the investigation of possible breaches of other relevant legal provisions* in the past trials of the Phorm technology.
Second, as regards the issues arising with regard to the planned future deployment of the Phorm technology, there appears to be a certain discrepancy between how it is envisaged by the ICO, the ISPs and Phorm itself. One of the most significant issues in this regard is the way in which customers will express their consent to the application of Phorm technology in their case. While the ICO seems to suggest that the consent of users for the Phorm technology should be on an opt-in basis and also BT seems to confirm this approach, Phorm has indicated that it intends to tackle user consent through providing 'transparent meaningful user notice'.
I would therefore be grateful to receive the response of the United Kingdom authorities on the following questions:
1. What are the United Kingdom laws and other legal acts which govern activities falling within the scope of Articles 5(1) and 6 of Directive 2002/58/EC on privacy and electronic communications and Articles 6, 7 and 17(1) of Directive 95/46/EC?
2. Which United Kingdom authority(-ies) is (are) competent (i) to investigate whether there have been any breaches of the national law transposing each of the above-mentioned provisions of Community law arising from the past trials of Phorm technology carried out by BT and (ii) to impose any penalties for infringement of those provisions where appropriate?
3. Have there been any investigations about the past trials of Phorm technology by BT and what were their results and the conclusions of the competent authority(-ies)? Are there ongoing investigations about possible similar activities by other ISPs?
4. What remedies, liability and sanctions are provided for by United Kingdom law in accordance with Article 15(2) of the Directive on privacy and electronic communications, which may be sought by users affected by the past trials of the Phorm technology and may be imposed by the competent United Kingdom authority(-ies) including the courts?
5. According to the information available to the United Kingdom authorities, what exactly will be the methodology followed by the ISPs in order to obtain their customers' consent for the deployment of Phorm technology in accordance with the relevant legal requirements and what is the United Kingdom authorities' assessment of this methodology?
Given the urgency of this matter I would highly appreciate receiving your reply within one month of receipt of this letter.
Yours sincerely,
Fabio Colasanti
The EU has far stricter definitions of online privacy protections.
The Brits demured from responding, so the EU has since issued a "prewarning" followup letter.
This is beginning to become a rather significant embarassment for the UK government, BT, and Phorm. More as it develops.
If you are looking for more on Phorm, make sure you head over to TheaRegister.co.uk. They are clearly at the forefront of this investigation and issue. After all, they broke the story and typically break every significant development on the topic.
Thanks for reading, and don't forget to write.
Phorm is the new name developed by a spyware operation called 121Media, which used offers of free secondary utility applications to convince people to download their adware/spyware products. Tomato/tomahto. As with Gator, the early days of this business in particular were loaded with examples of people not understanding that they were allowing 121Media to track their behaviors and field targeted ads. 121Media claimed it was those pesky partners that distributed their software that were to blame for these atrocities. Several millions of Americans including myself will find the story rather familiar -- we downloaded apps that gave Gator permission to field ads to us based upon serving habits. Then, when we realized what we had done, we found Gator all but unremovable.
OK, so Phorm. They changed the name of the company and shifted their focus from getting people to download their offering to getting ISPs to sell them the non PII portion of the info that made ad targeting possible.
Only trouble is, they didn't tell the people that were being tracked in the test. Some 18,000 of them. I don't mean they buried the revelation. They didn't tell them AT ALL, even in an intentionally quiet way.
How was this all discovered? Well, by a reader of TheRegister.co.uk, as outlined in this post. Here's an excerpt:
In June 2007, Reg reader Stephen noticed his Firefox 2.0.0.4 installations making suspicious unauthorised connections to the domain dns.sysip.net every time he visted any website. Naturally worried his machines had contracted some kind of digital infection, Stephen performed a series of exhaustive malware scans, which all came back clean.
He wasn't the only BT subscriber to notice that his browser was making the mysterious contacts around July last year, as this thread archived at Thinkbroadband.com shows.
"I spent all weekend wiping my disks clean and reinstalling from backups (four PCs seemed to be affected). I spent a further two days researching and installing all kinds of anti-virus, anti-spyware and anti-rootkit utilities. But even after all that I still have this problem!" Stephen told us at the time.
Having failed to trace the source of the dodgy redirect in his own network, he contacted BT to suggest one of their DNS servers may have been hijacked. BT dismissed the idea, yet the browser requests were still making an unauthorised stop off at dns.sysip.net.
Worried that his business' financial data might be being monitored, Stephen continued to investigate. A Whois search for dns.sysip.net revealed the domain was registered by Ahmet Can, an employee of a new online advertising company called 121Media. The address is now registered through a third party private domaining agency. 121Media rebranded itself as - you guessed it - Phorm in May 2007.
This is, you'll be unsurprised to learn, indeed the same Phorm that BT, Virgin Media and Carphone Warehouse recently revealed they had agreed to sell their customer's browsing habits to, despite the questions over its links to spyware. For helping Phorm target advertising, the ISPs are set to bag a cut of click revenues.
So, throughout the test period Phorm and BT had a novel consumer communications system.
DENY DENY DENY!
BT actually called the hijack process by which the system worked a clear incidence of malware.
But then! On 2/14/2008, BT and two other companies announced they had a deal, and that the hijack process was
validated under best industry practices, both through an independent audit conducted by Ernst & Young (View report PDF) and a Privacy Impact Assessment undertaken by Simon Davies, MD of 80/20 Thinking and Director of Privacy International.
Malware...revolutionis[ing] current standards of online privacy and fully protect[ing] the identity of consumers. Tomato...tomahto.
Phorm was paired with an application called Web Wise which was supposed to make people feel OK about the tracking. It was and is a phishing detector.
The British government essentially decided not to deeply pursue whether laws had been broken in the BT test. They issued their opinion that things were okiedokie, but many European web experts disagreed, as outlined in this post on TheRegister.co.uk.
(Has the US started exporting Bush Administration officials? ;-) We've have loads more folks like this, UK, if you want them. 2 for 1 sale through November.)
Here's a morsel:
"The explicit consent of a properly-informed user is necessary but not sufficient to make interception lawful.
"The consent of those who host the web pages visited by a user is also required, since they communicate their pages to the user, as is the consent of those who send email to the user, since those who host web-based email services have no authority to consent to interception on their users' behalf."
And the EU earlier this summer insisted they do so. Here is the text of the letter that was sent to the Brits by Brussels:
Dear Sir,
I am writing to you in relation to certain issues arising from the past and future deployment by some major United Kingdom Internet Service providers of the technology provided by a company called 'Phorm' to serve their customers with targeted advertisements based on prior analysis of these customers' internet usage.
In March 2008, a number of news items appeared in the media concerning the planned use by United Kingdom ISPs of the Phorm technology. Many of these publications raised issues concerning the impact of this technology on the privacy of Internet users. The information published on the web also included an e-petition submitted to the Prime Minister and a complaint made to the Information Commissioner's Office (ICO). In addition, in early April 2008, BT published a briefing according to which it had performed trials of the Phorm technology in autumn 2006 and summer 2007. In a TV interview, a BT representative confirmed that these trials had been performed without informing the customers affected and obtaining their consent.
The European Commission has already been contacted by Members of the European Parliament from the United Kingdom who communicated the concerns of their constituents regarding the deployment of Phorm technology. The issue has also been the subject of several written parliamentary questions addressed to the Commission by MEPs asking the Commission to comment on the applicability of WU legislation and also to set out its intended action in relation to the previous trials. Finally, a number of individuals have also written to the Commission directly to express their concerns and invite it to intervene in the matter.
In order to provide the response that is expected from it, the Commission needs to base itself on a clear understanding of the position of the United Kingdom authorities. Several EU law provisions concerning privacy and electronic communications may be applicable to other activities involved in the deploment of Phorm technology by ISPs.
In particular, Directive 2002/58/EC on privacy and electronic communications, which particularises and complements for the electronic communications sector the general personal data protection principles defined in the directive 94/45/EC (Data Protection Directive), obliges Member States to ensure the confidentiality of communications and related traffic through national legislation. They are required to prohibit listening, tapping, storage or other kinds of interception or surveillance of communications and the related traffic data by persons other than the users without their consent (Article 5(1)). The consent must be freely given, specific and an informed indication of the user's wishes (Article 2(h) of Directive 95/46/EC). Traffic data may only be processed for certain defined purposes and for a limited period. The subscriber must be informed about the processing of traffic data and, depending on the purpose of processing, prior consent of the subscriber or user must be obtained (Article 6 of Directive 2002/58/EC).
In the light of the above, we would highly appreciate it if the United Kingdom authorities could provide us with information on (1) the current handling by the United Kingdom authorities of the issues arising from the past trials of the Phorm technology by BT and on (2) the position of the United Kingdom authorities regarding the planned deployment of the Phorm technology by ISPs.
As regards the first issue, according to applicable EU law the responsibility for investigating complaints concerning such trials and determining whether the national legal provisions implementing the requirements of the relevant EU legislation have been complied with lies with the competent national authority(-ies) in the United Kingdom. The Information Commissioner's Office (ICO), which is responsible for enforcing the United Kingdom Data Protection Act 1998 (DPA) and Privacy and Electronic Communications Regulations 2003 (PECR), has made a number of statements on Phorm. In its latest published statement of 18 April 2008, the ICO analyses the conformity of the deployment of the Phorm technology with the DPA and the PECR. At the same time, the ICO indicates that it does not have responsibility for enforcing the Regulation of Investigatory Powers Act 2000 (RIPA), which has been invoked by some individuals who question whether the use of Phorm entails an unlawful interception of communications under this Regulation. In this respect, the ICO refers to a statement by the Home Office, which says that it is questionable whether the use of Phorm's technology involves an interception within the meaning of RIPA and that it does not consider that RIPA was intended to cover such situations. The ICO concludes on the issue of RIPA by stating that it will not be pursuing this matter. At the same time, the ICO statement does not include any indication as regards the intentions of the ICO in relation to the investigation of possible breaches of other relevant legal provisions* in the past trials of the Phorm technology.
Second, as regards the issues arising with regard to the planned future deployment of the Phorm technology, there appears to be a certain discrepancy between how it is envisaged by the ICO, the ISPs and Phorm itself. One of the most significant issues in this regard is the way in which customers will express their consent to the application of Phorm technology in their case. While the ICO seems to suggest that the consent of users for the Phorm technology should be on an opt-in basis and also BT seems to confirm this approach, Phorm has indicated that it intends to tackle user consent through providing 'transparent meaningful user notice'.
I would therefore be grateful to receive the response of the United Kingdom authorities on the following questions:
1. What are the United Kingdom laws and other legal acts which govern activities falling within the scope of Articles 5(1) and 6 of Directive 2002/58/EC on privacy and electronic communications and Articles 6, 7 and 17(1) of Directive 95/46/EC?
2. Which United Kingdom authority(-ies) is (are) competent (i) to investigate whether there have been any breaches of the national law transposing each of the above-mentioned provisions of Community law arising from the past trials of Phorm technology carried out by BT and (ii) to impose any penalties for infringement of those provisions where appropriate?
3. Have there been any investigations about the past trials of Phorm technology by BT and what were their results and the conclusions of the competent authority(-ies)? Are there ongoing investigations about possible similar activities by other ISPs?
4. What remedies, liability and sanctions are provided for by United Kingdom law in accordance with Article 15(2) of the Directive on privacy and electronic communications, which may be sought by users affected by the past trials of the Phorm technology and may be imposed by the competent United Kingdom authority(-ies) including the courts?
5. According to the information available to the United Kingdom authorities, what exactly will be the methodology followed by the ISPs in order to obtain their customers' consent for the deployment of Phorm technology in accordance with the relevant legal requirements and what is the United Kingdom authorities' assessment of this methodology?
Given the urgency of this matter I would highly appreciate receiving your reply within one month of receipt of this letter.
Yours sincerely,
Fabio Colasanti
The EU has far stricter definitions of online privacy protections.
The Brits demured from responding, so the EU has since issued a "prewarning" followup letter.
This is beginning to become a rather significant embarassment for the UK government, BT, and Phorm. More as it develops.
If you are looking for more on Phorm, make sure you head over to TheaRegister.co.uk. They are clearly at the forefront of this investigation and issue. After all, they broke the story and typically break every significant development on the topic.
Thanks for reading, and don't forget to write.
Tuesday, August 12, 2008
New Revelations in DC ISP-Based "Deep Packet" BT Scrutiny
Early emanations from the House Energy and Commerce Committee's examination of privacy issues primarily related to ISP based BT are pretty interesting and revealing. Here are some highlights:
30 companies were asked about their Deep Packet BT and other tracking practices. Based upon the information provided to the committee, Chairman Markey has stated his intention to introduce opt-in privacy legislation next year. Reports WaPo:
Markey said he and his colleagues plan to introduce legislation next year, a sort of online-privacy Bill of Rights, that would require that consumers must opt in to the tracking of their online behavior and the collection and sharing of their personal data.
But some committee leaders cautioned that such legislation could damage the economy by preventing small companies from reaching customers. Rep. Cliff Stearns (R-Fla.) said self-regulation that focuses on transparency and choice might be the best approach.
But let's not get ahead of ourselves in this post. Here are some of the things that the inquiry uncovered.
On August 1, the committee wrote to a long list of companies (ISPs mostly) asking them to detail their "deep packet" and other tracking programs and policies. The list reads like a who's who of connectivity:
AOL LLC (ISP and Content Provider)
Bresnan Communications (ISP)
Cable One, Inc. (ISP)
Cablevision Systems Corporation (ISP_
CBeyond (ISP)
CenturyTel (ISP)
Charter Communications (ISP)
Comcast Cable (ISP)
Covad Communications Company (ISP)
Cox Communications, Inc. (ISP)
Earthlink (ISP)
Frontier Communications Corporation (ISP)
Google (Nuff said)
Insight Communications Inc. (ISP)
Knology, Inc. (ISP)
Mediacom Communications Corporation (ISP)
PAETEC Holding Corp. (ISP)
Qwest Communications (ISP)
Suddenlink Communications (ISP)
TDS Telecom (ISP)
Time Warner Cable (ISP)
TW Telecom, Inc. (ISP)
United Online, Inc. (ISP, among other things)
Verizon (ISP)
Windstream Corporation (ISP)
XO Communications (ISP)
Yahoo (Nuff Said)
All of their responses are available in pdf form here.
Check out a copy of the request here.
The 11 questions they asked each company to respond to were (paraphrased):
1. Do you or have you tailored ads to user web surfing patterns?
2. If so, how did you address sensitive health, financial, PII, and how were those policies developed?
3. In what communities have you engaged in these practices?
4. How many consumers were affected?
5. Did you do an analysis of privacy laws as you developed your programs?
6. Did you notify consumers? How? Provide a copy of the notification.
7. Did you do opt in or opt out, and if opt out, why?
8. If opt out, how many did so?
9. If opt out, did you do a legal analysis of the opt out procedure and notification?
10. What is the status of the data collected? Has it been destroyed? Is it periodically destroyed?
11. Do your systems and process allow for the tailoring of ads based upon behaviors?
If you read my recent post on Embarq and NebuAd, you will see a high degree of similarity between this list and the list Embarq was asked to complete a few weeks ago.
Here are my response summaries (I read each doc carefully but I am not a lawyer, so if in doubt click on over and read it yourself.):
AOL: Nothing surprising here. They do BT, privacy policy notification, opt out. Estimate that "tens of thousands" have opted out.
Bresnan: NebuAd Test 4/1-6/26, in Billings MT, 6000 customers, users notified by email and a web site page in addition to privacy policy. Opt out, 18 opted out (3/10ths of one percent.)
Cable One: Small test, beginning last year, undisclosed vendor. Based upon the description of the vendor, it is likely NebuAd. Tested in Anniston, AL for 180 days beginning 11/20/2007. 14,000 customers. Notification via inclusion in acceptable use and privacy policies. Opt out, no indication of the number of people who opted out. Says they would do opt-in if they we're going to deploy network wide.
Cablevision: Hasn't done it.
CBeyond: Hasn't done it.
CenturyTel: Small test in Kalispell MT - small numbers of people in Idaho and Wyoming, NebuAd, 20,000 person test. Sent email notification to users affected in the test. Email said changes were made to the privacy policy but did not specify what they were -- invited the user to click and read policy to figure it out. Says they also sent email notification and bill stuffer to people noting the change in policy. Opt out. 82 persons opted out (4 tenths of one percent.)
Charter: Cancelled plans for a test.
Comcast: Hasn't done it.
Covad: Hasn't done it.
Cox: Hasn't done it.
EarthLink: Hasn't done it.
Frontier: Hasn't done it.
Insight: Hasn't done it.
Knology: Tested via NebuAd in parts of Panama City FL, Columbus GA, Knoxville TN, Huntsville AL, and Augusta GA. Stopped test as a result of Congress raising concerns. Opt out, notification via customer service agreement change. Change unannounced. No info on number of households affected or opt outs/opt out rates.
Mediacom: Hasn't done it.
PAETEC: Hasn't done it.
QWEST: Hasn't done it.
Suddenlink: Hasn't done it.
TDS: Hasn't done it.
TimeWarner: Hasn't done it.
TW Telecom: Hasn't done it.
United Online: Has considered deep packet inspection based BT, but has not implemented.
Verizon: Hasn't done it.
Windstream: Hasn't done it.
XO: Hasn't done it.
Yahoo: Does use BT but not deep packet, over 75,000 opt outs in July 2008 (still a fairly low number given that Yahoo reaches several hundred million users a month.)
Of all the responses, Google's have so far received the msost attention, chiefly because of the tremendous reach and market power of the giant. Here is what WaPo had to say on the topic in a recent article:
Alan Davidson, Google's director of public policy and government affairs, stated in the letter that users could opt out of a single cookie for both DoubleClick and the Google content network. He also said that Google was not yet focusing on "behavioral" advertising, which depends on Web site tracking.
But on its official blog last week, Google touted how its recent $3.1 billion merger with DoubleClick provides advertisers "insight into the number of people who have seen an ad campaign," as well as "how many users visited their sites after seeing an ad."
"Google is slowly embracing a full-blown behavioral targeting over its vast network of services and sites," said Jeffrey Chester, executive director of the Center for Digital Democracy. He said that Google, through its vast data collection and sophisticated data analysis tools, "knows more about consumers than practically anyone."
Microsoft and Yahoo have disclosed that they engage in some form of behavioral targeting. Yahoo has said it will allow users to turn off targeted advertising on its Web sites; Microsoft has yet to respond to the committee.
Said Markey:
Increasingly, there are no limits technologically as to what a company can do in terms of collecting information . . . and then selling it as a commodity to other providers," said committee member Edward J. Markey (D-Mass.), who created the Privacy Caucus 12 years ago. "Our responsibility is to make sure that we create a law that, regardless of the technology, includes a set of legal guarantees that consumers have with respect to their information."
I am sure there'll be more to come, and the oldest living gumshoe reporter will be there to parse it all for ya. ;-)
Thanks for reading, and don't forget to write.
Wednesday, July 30, 2008
NebuAddendum
Well, while I was on vacation Embarq replied to Congress’s request for information about the test they conducted with NebuAd, the ISP targeting ad network that has lately felt Congressional heat on its little piggies.
Tom Gerke, the President and CEO of Embarq, signed the response, which answered nine committee questions clearly and succinctly. The full text of Embarq’s response to Congressman Markey and his committee appears on this page of Broadcast and Cable.
Here are some highlights to that response:
NOTIFICATION
How were subscribers notified?: As I expected, the notification was in the privacy policy, and the rationale for that was that that is how ad networks do it.
Why not Opt-In: Because the industry does it opt-out. Which if I may editorialize for jut a mo’, doesn’t actually answer the question. But then we ALL know the answer.
WHAT IS ROBUST
The big news – or perhaps the sound bite – of the disclosure memo was that 15 people availed themselves of the opportunity to opt out of tracking, which was announced in the privacy policy.
15 out of 26,000 represents .06%, rather a low percentage. I say rather low because, according to a recent eMarketer report, the percentage of people who dislike the concept of BT is rather high. Specifically, 45% of consumers, according to a recent Harris Poll, were uncomfortable with BT-style tracking. .06%/45% leads to the mathematical conclusion that only about 1% of the people who are concerned about BT opted out. A bit of a googly for anyone who thinks that privacy policy notification meets the spirit of the FTC’s robust notice requirement. I’m not saying 99% couldn’t find it. I am just saying…
RAMIFICATIONS
Meanwhile, it appears that Embarq has suffered little for their NebuAd test – according to this article from the Kansas City Business Journal, their stock price is faring nicely despite the unwanted publicity.
It’ll be interesting if the ISPs get to skate through this controversy unscathed.
Tom Gerke, the President and CEO of Embarq, signed the response, which answered nine committee questions clearly and succinctly. The full text of Embarq’s response to Congressman Markey and his committee appears on this page of Broadcast and Cable.
Here are some highlights to that response:
NOTIFICATION
How were subscribers notified?: As I expected, the notification was in the privacy policy, and the rationale for that was that that is how ad networks do it.
Why not Opt-In: Because the industry does it opt-out. Which if I may editorialize for jut a mo’, doesn’t actually answer the question. But then we ALL know the answer.
WHAT IS ROBUST
The big news – or perhaps the sound bite – of the disclosure memo was that 15 people availed themselves of the opportunity to opt out of tracking, which was announced in the privacy policy.
15 out of 26,000 represents .06%, rather a low percentage. I say rather low because, according to a recent eMarketer report, the percentage of people who dislike the concept of BT is rather high. Specifically, 45% of consumers, according to a recent Harris Poll, were uncomfortable with BT-style tracking. .06%/45% leads to the mathematical conclusion that only about 1% of the people who are concerned about BT opted out. A bit of a googly for anyone who thinks that privacy policy notification meets the spirit of the FTC’s robust notice requirement. I’m not saying 99% couldn’t find it. I am just saying…
RAMIFICATIONS
Meanwhile, it appears that Embarq has suffered little for their NebuAd test – according to this article from the Kansas City Business Journal, their stock price is faring nicely despite the unwanted publicity.
It’ll be interesting if the ISPs get to skate through this controversy unscathed.
Monday, July 7, 2008
Mediapost: Will It Be NebuAd Versus Publishers Next?
This report in Mediapost from last week indicates that they foresee some possibility of publisher backlash as Nebuad collects info from publishers without publisher permission.
While NebuAd would have the consent of publishers where it was serving ad, their model collects information from all (nonsecure)pages, including othe pages of publishers with whom they have no business relationship. It'll be an interesting second front for the company if it materializes as a threat.
Thanks for reading, and don't forget to write.
While NebuAd would have the consent of publishers where it was serving ad, their model collects information from all (nonsecure)pages, including othe pages of publishers with whom they have no business relationship. It'll be an interesting second front for the company if it materializes as a threat.
Thanks for reading, and don't forget to write.
NebuAd Loses ISPs
You may know that ISP targeting solution and ad network NebuAd was working with a number of small ISPs before the Charter Bruhaha. Well, it appears, according to this report on DSL Reports, that they've lost at least one. The following section of the CenturyTel Privacy policy was dropped:
CenturyTel partners with a third-party advertising firm to deliver or facilitate delivery of targeted online advertisements to our High Speed
Internet subscribers for the purpose of providing these subscribers with a richer, more relevant Web surfing experience. By observing anonymous,
non-personally identifying information regarding a subscriber's Web surfing and search behavior, the ad network can infer the subscriber's interests in certain
product or service categories (e.g., automobiles/sports or travel/Europe). The third-party advertising firm can then display advertisements that are more likely to
be related to a subscriber's interests. It should be noted that you will not receive any more ads than you would otherwise receive, nor will the targeted online ads
you receive be any more intrusive than the standard online ads you would otherwise receive. It should also be noted that these targeted online advertisements
are based on the subscriber's anonymous online surfing behavior, and no personally identifying information is collected or used to deliver these advertisements.
CenturyTel's High-Speed Internet subscribers who choose not to receive targeted online advertisements can opt out at any time by clicking here
or visiting http://www.nebuad.com/privacy/optout.php. The opt out is accomplished through the placement of an opt out cookie and applies only to the
computer and browser through which the opt out selection was made. If, after opting out, you obtain a new computer, use a different browser, or delete the opt
out cookie, you must complete the opt out process again in order to maintain your opt out status. If you choose to opt out, you will continue to receive online
advertisements; however, these advertisements will likely be less relevant to your interests.
The post stream reports that CenturyTel is sending out the following email text when queried about NebuAd:
CenturyTel is not currently using online behavioral advertising tools in any of its markets, and we are delaying our plans to move forward with the deployment of online behavioral advertising services - either through NebuAd or any other vendor - at this time. CenturyTel is delaying its implementation plans so that Congress can spend additional time addressing the privacy issues and policies associated with online behavioral advertising.
CenturyTel highly values our customers' personal privacy, and we are committed to protecting our customers' personal information. More detailed information about CenturyTel's data collection and use practices can be obtained by reviewing our Privacy Policy at »www.centurytel.com/Pages/PrivacyPolicy/.
MediaPost reports that Embarq has also dropped its relationship with NebuAd.
NebuAd issued the following statement from CEO Bob Dykes, according to the media Post article:
"We support CenturyTel's decision to delay its implementation plans so that Congress can spend additional time addressing the privacy issues and policies associated with online behavioral advertising," Dykes said. "NebuAd and its ISP partners are actively working together to refine a rollout plan tailored for each ISP that continues to set the standard for privacy protection in advertising online to consumers. NebuAd looks forward to a continued open dialogue with legislators, regulators, and the advocacy community."
Can't be fun to be working in PR for NebuAd at the moment. This is a company that needs a real PR plan, not this sort of reactive approach.They've got a lot of VC money, but the burn rate for a hardware and software solution that is losing partners must be quite high.
Thanks for reading, and don't forget to write.
CenturyTel partners with a third-party advertising firm to deliver or facilitate delivery of targeted online advertisements to our High Speed
Internet subscribers for the purpose of providing these subscribers with a richer, more relevant Web surfing experience. By observing anonymous,
non-personally identifying information regarding a subscriber's Web surfing and search behavior, the ad network can infer the subscriber's interests in certain
product or service categories (e.g., automobiles/sports or travel/Europe). The third-party advertising firm can then display advertisements that are more likely to
be related to a subscriber's interests. It should be noted that you will not receive any more ads than you would otherwise receive, nor will the targeted online ads
you receive be any more intrusive than the standard online ads you would otherwise receive. It should also be noted that these targeted online advertisements
are based on the subscriber's anonymous online surfing behavior, and no personally identifying information is collected or used to deliver these advertisements.
CenturyTel's High-Speed Internet subscribers who choose not to receive targeted online advertisements can opt out at any time by clicking here
or visiting http://www.nebuad.com/privacy/optout.php. The opt out is accomplished through the placement of an opt out cookie and applies only to the
computer and browser through which the opt out selection was made. If, after opting out, you obtain a new computer, use a different browser, or delete the opt
out cookie, you must complete the opt out process again in order to maintain your opt out status. If you choose to opt out, you will continue to receive online
advertisements; however, these advertisements will likely be less relevant to your interests.
The post stream reports that CenturyTel is sending out the following email text when queried about NebuAd:
CenturyTel is not currently using online behavioral advertising tools in any of its markets, and we are delaying our plans to move forward with the deployment of online behavioral advertising services - either through NebuAd or any other vendor - at this time. CenturyTel is delaying its implementation plans so that Congress can spend additional time addressing the privacy issues and policies associated with online behavioral advertising.
CenturyTel highly values our customers' personal privacy, and we are committed to protecting our customers' personal information. More detailed information about CenturyTel's data collection and use practices can be obtained by reviewing our Privacy Policy at »www.centurytel.com/Pages/PrivacyPolicy/.
MediaPost reports that Embarq has also dropped its relationship with NebuAd.
NebuAd issued the following statement from CEO Bob Dykes, according to the media Post article:
"We support CenturyTel's decision to delay its implementation plans so that Congress can spend additional time addressing the privacy issues and policies associated with online behavioral advertising," Dykes said. "NebuAd and its ISP partners are actively working together to refine a rollout plan tailored for each ISP that continues to set the standard for privacy protection in advertising online to consumers. NebuAd looks forward to a continued open dialogue with legislators, regulators, and the advocacy community."
Can't be fun to be working in PR for NebuAd at the moment. This is a company that needs a real PR plan, not this sort of reactive approach.They've got a lot of VC money, but the burn rate for a hardware and software solution that is losing partners must be quite high.
Thanks for reading, and don't forget to write.
Wednesday, June 25, 2008
NebuAd Responds, and Robb Topolski Responds to the Response
Last week I reported in this post on the latest troubles facing NebuAd in the area of privacy. Well, NebuAd responded to the report that characterized their data collection practices as problematic from a privacy standpoint.
NebuAd responded to the report, and you can read the highlights in Broadcasting and Cable.
For those that don't remember the name, Robb Topolski is the man who discovered Comcast's secret e of slowing downloads to customers using BitTorrent applications. Robb's blog is here. I did not identify him as the author in my previous post and I apologize to him for the omission.
If I understand it, the key issue is that according to Topolski NebuAd appends web pages with an extra packet that appears to come from the publisher, not NebuAd. This, according to Topolski, is forgery. The second issue is about notification and whether the notification processes of ISPs have been robust enough to ensure consumers are aware of the activity and its potential benefits to them.
NebuAd's response:
"NebuAd cookies do not contain specific information about a user," the company said. "All ad networks use a small piece of code that is temporary and operates only within the security framework of the browser to invoke the placement of ad network cookies. The code NebuAd uses is no different, and is clearly demarcated outside of and does not modify any publisher code."
Topolski responded to this statement on his blog with the following (excerpted):
As detailed in my report, NebuAd's code is appended to the web page code, in an extra packet that appears to come from servers owned by Google or Yahoo (not NebuAd). This is why you can claim any demarcation. However, there is no demarcation between the publishers code and your injected code that indicates that the code is not from the publisher and that NebuAd is the source of the injected script. The packet is a forgery and the reason is obvious -- if the injected packet would properly identify its source in the IP header, the customer's computer would properly ignore it. This is by intentional design, and is why I characterize NebuAd's programming as usurping the intentions of the application and operating system designers.
More technical minds than mind should and will debate this.
For me this battle is an indication of the kind of thing we are going to see much more frequently in the future. My earlier post on Google's use of toolbar data for targeting is another example of the complexities of data collection, usage, and concerns about privacy.
I hope that this issue can be addressed with reason. NebuAd is clearly filled with smart people who have made decisions based upon what they believe is responsible business practice and reasonable protection of privacy. So characterizing them as evil would be unproductive.
Similarly, I sincerely hope that the debate will focus on the issue rather than the author of the report. Robb Topolski is not a kook. A read of his report, his blog, and indeed his comment to the earlier post on THIS BLOG show he's very passionate. But passion is something we should be pleased to see in a debate about privacy. He demonstrates a comprehensive point of view and an orientation toward thorough review and specifically outlining his findings.
Thanks for reading, and don't forget to write.
Saturday, May 17, 2008
iMedia: United Online
I just finished my first iMedia event, a dinner hosted by United Online. The dinner itself was very low sell (a wise move for a Saturday night,) but the back of the invitation really got me to thinking. United Online, in case you live under a rock, is a collection of web businesses including:
Classmates.com: The site that can put you in touch with the people of your past. Built on a subscription model and an extensive email sponsorship program.
NetZero and Juno: Value-priced ISPs that essentially trade consumers lower dialup service for liberal privacy policies that enable marketers to get insights and precise BT.
MySite: A web hosting and site builder offering not unlike parts of register or GoDaddy, but less expensive.
Names Database: Classmates broadened into a searchable database to find people you know or want to know.
MyPoints: The loyalty cum marketing platform.
FTD: They of flowers fame.
At first glance, it seems an odd collection of businesses. But look closer, and you begin to see the essence of the new web – the database and behavioral marketing. United Online has, through its various businesses, a massive collection of people’s profiles that could prove extremely useful for marketers. Whether as a research platform or as BT-enabled ad and marketing platforms.
Naturally the amount and types of info that they have from these disparate businesses varies, but in sum you can see how their core is data. With MyPoints, they probably have access to people’s bloodtypes ( ;-) ) while with Classmates considerably less. But United Online is widely considered one of the richest database companies around that is marketer friendly. Definitely an option to consider next time you want research or BT.
One interesting aspect of their businesses is to consider the health and stage in the product life cycle. A look at their annual report demonstrates steady declines in dial-up ISPs, but very strong growth in selling premium subs to Classmates. And the recent acquisition of FTD adds another interesting layer to their operations. And I’m guessing that being a data delivery device for florists is about as profitable as would be printing money. Attract eyeballs, match orders to florists, get a big cut. Good eatin’.
United Online makes solid money too, so the model seems to have some merit.
Sort of a new definition of synergies in what otherwise looks like a mapcap collection of stuff. But perhaps Untied Online is like McDonalds, which is really a real estate company that sells burgers.
United Online is a data company that provides a variety of disparate ancillary services. They serve a nice bowl of chili, too, and for that and the thoughts their company has driven for me tonight, I am thankful.
Thanks for reading, and don't forget to write.
Friday, May 16, 2008
A09275 Third-Party Internet Advertising Consumers' Bill of Rights Act of 2008
Well, that is a seemingly dry title for a post on a blog that features lip syncs on Fridays. But this bill, currently before the Assembly of the State of New York, has some wide reaching implications for our industry. Though I have to say, upon reading the bill, it's a little less scary (to my nonlawyer eyes) than industry mavens would seem to believe.
Currently with 57 sponsors, this bill would seem to make law what the NAI is trying to do on a voluntary basis. The bill was inspired by the acquisition of DCLK by Google, and the justification submitted with the bill reads as follows:
Recent acquisitions of third party advertising companies by large Inter-net companies have raised serious and important privacy issues with respect to who is monitoring an individual`s online behavior for marketing and other purposes. While many companies have implemented rules and polices to protect consumers, other have not. It is the responsibility of the State to adequately protect and inform its citizenry of who is tracking their legal online activities and subsequently selling that information.
Assemblyman Richard Brodsky, who appears to be the force behind the bill, is, it should be noted, not without understanding of digital. He has written numerous internet related bills, and his concerns in this case appear to be related to the fact that while many of the ad networks out there are voluntary participants in NAI, some are not.
It won't surprise you that I hope the bill is not enacted. Though, it should be noted that state law regarding the Internet generally is toothless because the Internet is by its very nature Interstate, which makes it the purview of the Federal Government. But the bill is significant, and the number of sponsors should alert all of us to the fast that consumers are not comfy with the current state of affairs (or perceived state of affairs) as regards BT.
I think part of the challenge is that US communications law was almost entirely written before the Internet was even a gleam in Al Gore's eye, so rules and best practices regarding the space go forward in fits and starts. The FTC made a concerted effort to address the internet in the period 1998-2001, and held a major set of discussion on BT specifically not all that long ago, deciding at that time that opt-out was an acceptable way for us to go forward in the US. Their recommended privacy guidelines live here.
This post on Ars Technica outlines a lot of research on how consumers feel about BT, or what they believe BT to be. And based upon my reading, there really is a great deal of consumer discomfiture on the topic. Which brings us to what I think would be 5 ways we can begin to address consumer concerns going forward:
1. Be transparent. Every time someone tries to do something BT related without full disclosure or CLEAR AND CONSPICUOUS disclosure, the conspiracy theories start flying.
2. Be real about benefits to consumers. I accept that there are some benefits to consumers re targeted advertising. But being real, in my opinion, requires that we state the whole truth -- that that the real reason our industry needs the higher CPMs made possible via BT is to pay for the web. I read 35 newspapers a day (or at least the page one headlines) and I don't pay a nickel for any of them via subscription. I pay $25 for DSL a month. About the price for a subscription to ONE of those 35 papers. Something connected to me has to pay for that usage.
3. Give people a reasonable way to opt out. I think that if people know there is a way to opt out, that will satisfy them -- that they won't all go rushing to opt out. This isn't like getting telemarketing calls -- this won't be like the DNC registry. Making the opt out system voluntary as well as easy to find online wil head off a lot of legislative efforts.
4. Stop with the 35 page T&Cs. Check out the eBaum's World privacy policy. This is how it should be done.
5. Not be Chicken Littles every time anyone in government brings up the topic, but rather engage them and ensure we're on the same page. Hey, I am opposed to legislation, but the way to avoid it is for us to act responsibly, not to villify people with concerns.
Thanks for reading, and don't forget to write.
Currently with 57 sponsors, this bill would seem to make law what the NAI is trying to do on a voluntary basis. The bill was inspired by the acquisition of DCLK by Google, and the justification submitted with the bill reads as follows:
Recent acquisitions of third party advertising companies by large Inter-net companies have raised serious and important privacy issues with respect to who is monitoring an individual`s online behavior for marketing and other purposes. While many companies have implemented rules and polices to protect consumers, other have not. It is the responsibility of the State to adequately protect and inform its citizenry of who is tracking their legal online activities and subsequently selling that information.
Assemblyman Richard Brodsky, who appears to be the force behind the bill, is, it should be noted, not without understanding of digital. He has written numerous internet related bills, and his concerns in this case appear to be related to the fact that while many of the ad networks out there are voluntary participants in NAI, some are not.
It won't surprise you that I hope the bill is not enacted. Though, it should be noted that state law regarding the Internet generally is toothless because the Internet is by its very nature Interstate, which makes it the purview of the Federal Government. But the bill is significant, and the number of sponsors should alert all of us to the fast that consumers are not comfy with the current state of affairs (or perceived state of affairs) as regards BT.
I think part of the challenge is that US communications law was almost entirely written before the Internet was even a gleam in Al Gore's eye, so rules and best practices regarding the space go forward in fits and starts. The FTC made a concerted effort to address the internet in the period 1998-2001, and held a major set of discussion on BT specifically not all that long ago, deciding at that time that opt-out was an acceptable way for us to go forward in the US. Their recommended privacy guidelines live here.
This post on Ars Technica outlines a lot of research on how consumers feel about BT, or what they believe BT to be. And based upon my reading, there really is a great deal of consumer discomfiture on the topic. Which brings us to what I think would be 5 ways we can begin to address consumer concerns going forward:
1. Be transparent. Every time someone tries to do something BT related without full disclosure or CLEAR AND CONSPICUOUS disclosure, the conspiracy theories start flying.
2. Be real about benefits to consumers. I accept that there are some benefits to consumers re targeted advertising. But being real, in my opinion, requires that we state the whole truth -- that that the real reason our industry needs the higher CPMs made possible via BT is to pay for the web. I read 35 newspapers a day (or at least the page one headlines) and I don't pay a nickel for any of them via subscription. I pay $25 for DSL a month. About the price for a subscription to ONE of those 35 papers. Something connected to me has to pay for that usage.
3. Give people a reasonable way to opt out. I think that if people know there is a way to opt out, that will satisfy them -- that they won't all go rushing to opt out. This isn't like getting telemarketing calls -- this won't be like the DNC registry. Making the opt out system voluntary as well as easy to find online wil head off a lot of legislative efforts.
4. Stop with the 35 page T&Cs. Check out the eBaum's World privacy policy. This is how it should be done.
5. Not be Chicken Littles every time anyone in government brings up the topic, but rather engage them and ensure we're on the same page. Hey, I am opposed to legislation, but the way to avoid it is for us to act responsibly, not to villify people with concerns.
Thanks for reading, and don't forget to write.
Wednesday, April 23, 2008
BT WEEK POST 3: THE MECHANICS OF BT
The Mechanics of BT
The following is a simplified description of how a BT ad is served. When a user requests a page managed by a BT enabled ad server, the user’s PC also shares the cookie info. Because the behavioral targeting platform stores the user’s behavior with that cookie text on its servers, it can instantly know what sorts of ads would be most appropriate for you.
Imagine that your profile tells it that ads for real estate, financial services, travel, and auto are relevant to you. Based upon this info, the server could compare the revenue it could earn from serving you various ads. Perhaps the travel ads are worth a $12 CPM, while real estate is $15, financial services are worth $19, and auto are worth at least $20. The server selects auto and identifies the type of auto ad relevant to you. The ad is then served on the page as it loads for you. All this activity takes places in the milliseconds between the time you request a page and the time it appears on your screen. See below:
There’s a lot more to it than that. For example, an ad server might decide to serve the travel ad if the time limit for serving the travel impressions is about to run out. Or more than one BT provider might have the rights to sell a particular ad space. But what’s above? That’s the gist.
BT DEPENDENCIES
The system naturally depends on several things:
1. That the consumer has a cookie. Increasingly, consumers are eliminating cookies from their PCs periodically. Comscore research from 2007 reported that about 30% of consumers deleted their cookies at least monthly as a way to reducing their privacy concerns.
2. That the consumer has not opted out of BT. Partly as a way of avoiding federal regulation of BT, the BT industry has set up a voluntary opt out program that lets users choose not to participate in BT targeting. The jury is still out on whether this voluntary program will be deemed sufficient to avoid federal regulations or statutes. The Network Advertising Initiative website (http://www.networkadvertising.org) allows consumers to opt out of ad networks individually or collectively. See below:
Opting out doesn’t reduce advertising delivered, only the extent to which it is behaviorally targeted. When I opted out of all programs as an experiment, I appeared to get a lot more mortgage and other low CPM advertising. Which makes sense, of course.
3. That a BT enabled ad decision server is monitoring the ad placements on the requested page. Not every ad unit is served by a BT enabled server. But an increasingly large proportion are. After all, there is A LOT of money to be made. And advertisers LOVE this technology because it leads to tremendous results.
BT INFO WILL CONTINUE NEXT WEEK. BECAUSE FRIDAY, AS ALWAYS, WILL BE LIP SYNC DAY AT OLDMTA!
The following is a simplified description of how a BT ad is served. When a user requests a page managed by a BT enabled ad server, the user’s PC also shares the cookie info. Because the behavioral targeting platform stores the user’s behavior with that cookie text on its servers, it can instantly know what sorts of ads would be most appropriate for you.
Imagine that your profile tells it that ads for real estate, financial services, travel, and auto are relevant to you. Based upon this info, the server could compare the revenue it could earn from serving you various ads. Perhaps the travel ads are worth a $12 CPM, while real estate is $15, financial services are worth $19, and auto are worth at least $20. The server selects auto and identifies the type of auto ad relevant to you. The ad is then served on the page as it loads for you. All this activity takes places in the milliseconds between the time you request a page and the time it appears on your screen. See below:
There’s a lot more to it than that. For example, an ad server might decide to serve the travel ad if the time limit for serving the travel impressions is about to run out. Or more than one BT provider might have the rights to sell a particular ad space. But what’s above? That’s the gist.
BT DEPENDENCIES
The system naturally depends on several things:
1. That the consumer has a cookie. Increasingly, consumers are eliminating cookies from their PCs periodically. Comscore research from 2007 reported that about 30% of consumers deleted their cookies at least monthly as a way to reducing their privacy concerns.
2. That the consumer has not opted out of BT. Partly as a way of avoiding federal regulation of BT, the BT industry has set up a voluntary opt out program that lets users choose not to participate in BT targeting. The jury is still out on whether this voluntary program will be deemed sufficient to avoid federal regulations or statutes. The Network Advertising Initiative website (http://www.networkadvertising.org) allows consumers to opt out of ad networks individually or collectively. See below:
Opting out doesn’t reduce advertising delivered, only the extent to which it is behaviorally targeted. When I opted out of all programs as an experiment, I appeared to get a lot more mortgage and other low CPM advertising. Which makes sense, of course.
3. That a BT enabled ad decision server is monitoring the ad placements on the requested page. Not every ad unit is served by a BT enabled server. But an increasingly large proportion are. After all, there is A LOT of money to be made. And advertisers LOVE this technology because it leads to tremendous results.
BT INFO WILL CONTINUE NEXT WEEK. BECAUSE FRIDAY, AS ALWAYS, WILL BE LIP SYNC DAY AT OLDMTA!
Tuesday, April 22, 2008
BT WEEK POST 2 - PRIVACY
COOKIES, BT, PII, AND PRIVACY
Before we go on, it’s important to take a little detour into the topic of privacy online. The Internet was never designed to be an extremely anonymous or information secure environment. It is a medium of information sharing.
The Federal Trade Commission of the US Government has made it crystal clear that the owner of a PC or other connected device is the controller of what information is shared by that device with marketers and other organizations. Web sites essentially need your “permission” to place a cookie on the machine or extract cookie data or other information from you.
It is relatively easy to refuse to accept any cookies on your machine. It’s a simple setting change.
But here’s where the plot thickens. Most websites require that the information sharing between you and them be a two-way street. In order to view all of the content or use all of the functionality of a site, your PC must be set to accept cookies. The sites require it. If your PC refuses to accept cookies, then you will be refused some or all experiences and information on that site.
You must be willing to share SOME, BUT NOT ALL, information in order to use the web. Reputable comapnies that use cookies generally agree not to collect or store “personally identifiable information” (PII) about you in their data collection and usage efforts unless they get your permission. Your name, address, social security info, and other highly personal info are not fair game without your explicit permission. Anything that uniquely identifies you as a person is off limits. To a BT platform, you are simply an anonymous individual that clicked on a Lincoln Navigator ad. Among other things.
According to Wikipedia, the following types of info are PII, and cannot be collected or shared without permission:
• Full name (if not common)
• National identification number
• Telephone number
• Street address
• E-mail address
• IP address (in some cases)
• Vehicle registration plate number
• Driver's license number
• Face, fingerprints, or handwriting
• Credit card numbers
• Digital identity
Personal info that is generally NOT considered PII include:
• First or last name (if common)
• Country, state, or city of residence
• Age, especially if non-specific
• Gender or race
• Name of the school they attend or workplace
• Grades, salary, or job position
• Criminal record
Reputable sites don’t take your PII. Disreputable parties might. This is one way that identity theft occurs. A cookie sent by a reputable company (for example, a major ad network) is generally acceptable to PC protection software from McAfee and others. A program designed to take other information is blocked. Or usually is. ;-(
But of course the water here is a bit murky because if you collect enough non-PII, you can probably identify a single individual if you want to. For example, I am a single, Scion XB-driving, homeowning Oakland CA resident that buys 4 books per week online, generally buys green, travels 12 times a year for business and 6 for personal (tickets purchased online.) I use Colgate, have a Sonicare I bought online, prefer foreign language films and buy my tickets online, and have a penchant for purchasing DVDs of sit-coms from the 70s and 80s. I send flowers online about 8 times a year. I have a Facebook profile, a MySpace profile, and a Linked In connected to hundreds of people. That, I am guessing, describes exactly one person in the US.
But truth be told, if someone really wanted my identity, there are far easier ways to get it than exhaustive analysis of online behavior.
And companies active in BT ARE NOT collecting PII. In fact, the Network Advertising Initiative (NAI) has just proposed a set of voluntary guidelines that govern what can and cannot be collected. They are currently seeking public comment on these standards.
There are a few other issues to consider:
1. How long do companies keep my data? Does the consumer have the right to expect that their data expire after a reasonable space of time?
2. How well protected is my data? Can it be easily stolen? Again, not such a major problem if there is no PII
3. Is the privacy policy of sites that collect (or allow others to collect on their pages) BT data written in a manner that is compliant with FTC standards?
4. BT can be argued to be a customer service when it increases the relevance of advertising on a page. But what if the BT is used to vary prices, so that, for example, a person making $65,000 a year is charged more for a book than a person making $45,000 a year. Few would consider that a beneficial service.
5. What dangers are there in collecting certain kinds of BT, like health info? Can this info later be used to deny the consumer insurance? Or eliminate him from consideration for a job? Of course, given that PII is not being collected, these worries are probably unwarranted. But some people still have them, and that is an issue for the BT industry.
6. Are the BT data stored in your cookies correct? If I search for a cancer site on your computer, it’s not MY cookie that is getting credited with this search. Again, in a world where PII are not collected it won't make any difference to the consumer -- but it does point out a limitation of BT.
At the risk of passing the buck, it should be noted that these BT privacy questions are really part of a larger issue of privacy in America, and the extent to which Americans have a legal right to privacy. Do we? Jurists disagree strongly on the extent to which we do. The Fourth Amendment states:
The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
But privacy rights are going to be THE defining issue for the next several decades in US Courts given the rise of digital media and the ability of the government and other organizations to easily collect, analyze and use information about us.
In the EU, a single difference in the way BT is regulated creates a far different degree of privacy concern. In the EU, users must OPT-IN for BT, whereas in the US they must OPT-OUT of many forms of it. The new NAI standards actually change that a little -- some kinds of BT data are considered sensitive enough to warrant requiring consumers to opt-in. The rationale for the US decision is that the OPT-OUT method results in far higher potential ad revenues for US content providers, meaning that consumers get access to more and better content supported by this higher level of revenue. US sources argue that EU residents are disserved by the OPT-IN policy there because less content is available to them. Naturally many other US sources and EU sources disagree. But so far the FTC has stated that OPT-OUT is the right policy for the US.
I agree with that decision. Consumers have "free" access to trillions of pages of info. Somehow that needs to get paid for, and so long as there is a strong wall built around PII, I think any technique that improves online revenue is a good thing.
Let the flame mail begin!
Thanks for reading, and don't forget to write.
NEXT: THE PROPOSED NAI STANDARDS
Before we go on, it’s important to take a little detour into the topic of privacy online. The Internet was never designed to be an extremely anonymous or information secure environment. It is a medium of information sharing.
The Federal Trade Commission of the US Government has made it crystal clear that the owner of a PC or other connected device is the controller of what information is shared by that device with marketers and other organizations. Web sites essentially need your “permission” to place a cookie on the machine or extract cookie data or other information from you.
It is relatively easy to refuse to accept any cookies on your machine. It’s a simple setting change.
But here’s where the plot thickens. Most websites require that the information sharing between you and them be a two-way street. In order to view all of the content or use all of the functionality of a site, your PC must be set to accept cookies. The sites require it. If your PC refuses to accept cookies, then you will be refused some or all experiences and information on that site.
You must be willing to share SOME, BUT NOT ALL, information in order to use the web. Reputable comapnies that use cookies generally agree not to collect or store “personally identifiable information” (PII) about you in their data collection and usage efforts unless they get your permission. Your name, address, social security info, and other highly personal info are not fair game without your explicit permission. Anything that uniquely identifies you as a person is off limits. To a BT platform, you are simply an anonymous individual that clicked on a Lincoln Navigator ad. Among other things.
According to Wikipedia, the following types of info are PII, and cannot be collected or shared without permission:
• Full name (if not common)
• National identification number
• Telephone number
• Street address
• E-mail address
• IP address (in some cases)
• Vehicle registration plate number
• Driver's license number
• Face, fingerprints, or handwriting
• Credit card numbers
• Digital identity
Personal info that is generally NOT considered PII include:
• First or last name (if common)
• Country, state, or city of residence
• Age, especially if non-specific
• Gender or race
• Name of the school they attend or workplace
• Grades, salary, or job position
• Criminal record
Reputable sites don’t take your PII. Disreputable parties might. This is one way that identity theft occurs. A cookie sent by a reputable company (for example, a major ad network) is generally acceptable to PC protection software from McAfee and others. A program designed to take other information is blocked. Or usually is. ;-(
But of course the water here is a bit murky because if you collect enough non-PII, you can probably identify a single individual if you want to. For example, I am a single, Scion XB-driving, homeowning Oakland CA resident that buys 4 books per week online, generally buys green, travels 12 times a year for business and 6 for personal (tickets purchased online.) I use Colgate, have a Sonicare I bought online, prefer foreign language films and buy my tickets online, and have a penchant for purchasing DVDs of sit-coms from the 70s and 80s. I send flowers online about 8 times a year. I have a Facebook profile, a MySpace profile, and a Linked In connected to hundreds of people. That, I am guessing, describes exactly one person in the US.
But truth be told, if someone really wanted my identity, there are far easier ways to get it than exhaustive analysis of online behavior.
And companies active in BT ARE NOT collecting PII. In fact, the Network Advertising Initiative (NAI) has just proposed a set of voluntary guidelines that govern what can and cannot be collected. They are currently seeking public comment on these standards.
There are a few other issues to consider:
1. How long do companies keep my data? Does the consumer have the right to expect that their data expire after a reasonable space of time?
2. How well protected is my data? Can it be easily stolen? Again, not such a major problem if there is no PII
3. Is the privacy policy of sites that collect (or allow others to collect on their pages) BT data written in a manner that is compliant with FTC standards?
4. BT can be argued to be a customer service when it increases the relevance of advertising on a page. But what if the BT is used to vary prices, so that, for example, a person making $65,000 a year is charged more for a book than a person making $45,000 a year. Few would consider that a beneficial service.
5. What dangers are there in collecting certain kinds of BT, like health info? Can this info later be used to deny the consumer insurance? Or eliminate him from consideration for a job? Of course, given that PII is not being collected, these worries are probably unwarranted. But some people still have them, and that is an issue for the BT industry.
6. Are the BT data stored in your cookies correct? If I search for a cancer site on your computer, it’s not MY cookie that is getting credited with this search. Again, in a world where PII are not collected it won't make any difference to the consumer -- but it does point out a limitation of BT.
At the risk of passing the buck, it should be noted that these BT privacy questions are really part of a larger issue of privacy in America, and the extent to which Americans have a legal right to privacy. Do we? Jurists disagree strongly on the extent to which we do. The Fourth Amendment states:
The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
But privacy rights are going to be THE defining issue for the next several decades in US Courts given the rise of digital media and the ability of the government and other organizations to easily collect, analyze and use information about us.
In the EU, a single difference in the way BT is regulated creates a far different degree of privacy concern. In the EU, users must OPT-IN for BT, whereas in the US they must OPT-OUT of many forms of it. The new NAI standards actually change that a little -- some kinds of BT data are considered sensitive enough to warrant requiring consumers to opt-in. The rationale for the US decision is that the OPT-OUT method results in far higher potential ad revenues for US content providers, meaning that consumers get access to more and better content supported by this higher level of revenue. US sources argue that EU residents are disserved by the OPT-IN policy there because less content is available to them. Naturally many other US sources and EU sources disagree. But so far the FTC has stated that OPT-OUT is the right policy for the US.
I agree with that decision. Consumers have "free" access to trillions of pages of info. Somehow that needs to get paid for, and so long as there is a strong wall built around PII, I think any technique that improves online revenue is a good thing.
Let the flame mail begin!
Thanks for reading, and don't forget to write.
NEXT: THE PROPOSED NAI STANDARDS
Monday, April 21, 2008
BT WEEK BEGINS!!!
This week I will be discussing some of the nuts and bolts as well as noteworthy issues related to behavioral targeting (BT.) BT is hot, both as a marketing technique and as a topic for discussion, particularly among those who debate privacy issues. So let's get the ball rolling here at OLDMTA!
WHAT IS BT (IN ENGLISH)
Behavioral targeting is based upon the truism that what we do can help predict what we plan to do and will do in the future. The idea is that there are certain kinds of online (and other) actions that can improve the likelihood that an individual will respond to digital marketing activity.
An example: most people who are going to buy a car in the near future will not do so on impulse but rather will:
• Research cars online in car sites
• Research cars in car content on portals and other sites
• Search for cars and cars information
• Click on car ads
• Talk about cars on their personal pages, blogs and email accounts
Etc.
By monitoring the behaviors of car searcher individuals, companies can better understand what will interest them, making them more likely to respond to digital auto marketing activity.
So that's BT in a nutshell. BT collects that info and uses it to target marketing efforts to more likely responders.
WHY IS BT “HOT”?
The power of such information can be enormous. If you consider that about 150 Million Americans over 18 are online, but that only about 4.2 million Americans are “in market” for a car in any three month period, it’s natural that automakers would be interested in weeding out those individuals so as to concentrate their marketing efforts on these people.
Contextual targeting (meaning, placing your ads and other marketing activity in related online content) is a start. By placing a car ad on a page about cars, you have SIGNIFICANTLY increased your odds of finding the in-market shopper. The more precise the contextual targeting, the better. For example, placing a hybrid ad on a page about hybrid cars helps out a lot. It stands to reason.
Demographic targeting can also help. If you know that affluent Northern Californians are more likely to buy a hybrid, targeting ads to those individuals can further pinpoint a company’s ability to reach likely buyers.
Psychographic targeting can also help. If you place a hybrid ad on a hybrid car review that is published on a “green” site, you’re getting even closer to perfect targeting.
Context and demography and psychographics have been tools for marketers for decades. But the two way nature of the web has added an additional tool that appears to trump all of these classic approaches.
TWO WAY IP-BASED MEDIA
Every Internet connection is made from two ends – your ISP and a digital device, like your PC. Your PC has a distinct “address” that it shares with no other machine. That address is called an IP Address. Since your IP address is yours alone, the flow of information through that address reflects your online behavior.
As part of the effort to personalize your Internet experience, companies use “cookies” to “remember” who you are and what you like. Cookies were originally developed for sites to maintain “shopping carts”. They are now used for a much broader range of personalization and tracking purposes, among other things. A cookie is a small text file that is placed upon your hard drive when you visit a site. If you have a My Yahoo page, for example, when you request info from the My Yahoo server (e.g., to load your personal My Yahoo page,) your PC pairs your request with the contents of the cookie text file to tell the server what your preferences are. The My Yahoo server can then provide the content you selected for you’re my Yahoo page.
Another kind of “cookie” is a tracking cookie, which is placed on your computer when you take a certain action online. For example, when you click on a banner, a tracking cookie is placed upon your computer to record what you did. That way, if you do something that a marketer wants, like make a purchase, the marketer will know what marketing activity drove your action. The marketer wants to know what drove your action so she knows what works in the marketing plan. The banner that drove your action gets a “point” based upon your subsequent actions.
You might think that the cookie goes away if you click but don’t buy immediately. Usually it doesn’t because most people take action long after that first click. You see a Lincoln navigator ad, click, look at a video, and then go away. But perhaps two weeks later you decide to get a quote from a dealer and head back to the Lincoln site on your own. If you request that quote, the banner you originally click on will usually be credited for that action if you perform it within a certain period of time – often 30 days.
But there’s more to the story, because the company that served the ad can also record your action, and use it to better understand who you are and what you are interested in. Suppose, for example, that you clicked on that Lincoln Navigator ad, then later went about your business online. The company that served the ad could use the info to categorize you as a luxury SUV shopper, which would be important info both for Lincoln and any other car company that sells luxury SUVs. Since clicking on that Lincoln banner makes it FAR more likely that you are in-market for a luxury SUV, your eyeballs are worth more to Lincoln and any other car company than can purchase ad impressions in front of you. So the ad server can sell those ad impressions for far more money.
Naturally, the more info that a company has on your behavior, the more it will know about what interests you. And the more it knows, the more likely it can determine that you are a prime audience for a multitude of companies in a multitude of categories. That means your eyes are worth more to a variety of companies in a variety of contexts.
TOMORROW: THE TECHNICAL MECHANICS OF BT (FOR DUMMIES)
WHAT IS BT (IN ENGLISH)
Behavioral targeting is based upon the truism that what we do can help predict what we plan to do and will do in the future. The idea is that there are certain kinds of online (and other) actions that can improve the likelihood that an individual will respond to digital marketing activity.
An example: most people who are going to buy a car in the near future will not do so on impulse but rather will:
• Research cars online in car sites
• Research cars in car content on portals and other sites
• Search for cars and cars information
• Click on car ads
• Talk about cars on their personal pages, blogs and email accounts
Etc.
By monitoring the behaviors of car searcher individuals, companies can better understand what will interest them, making them more likely to respond to digital auto marketing activity.
So that's BT in a nutshell. BT collects that info and uses it to target marketing efforts to more likely responders.
WHY IS BT “HOT”?
The power of such information can be enormous. If you consider that about 150 Million Americans over 18 are online, but that only about 4.2 million Americans are “in market” for a car in any three month period, it’s natural that automakers would be interested in weeding out those individuals so as to concentrate their marketing efforts on these people.
Contextual targeting (meaning, placing your ads and other marketing activity in related online content) is a start. By placing a car ad on a page about cars, you have SIGNIFICANTLY increased your odds of finding the in-market shopper. The more precise the contextual targeting, the better. For example, placing a hybrid ad on a page about hybrid cars helps out a lot. It stands to reason.
Demographic targeting can also help. If you know that affluent Northern Californians are more likely to buy a hybrid, targeting ads to those individuals can further pinpoint a company’s ability to reach likely buyers.
Psychographic targeting can also help. If you place a hybrid ad on a hybrid car review that is published on a “green” site, you’re getting even closer to perfect targeting.
Context and demography and psychographics have been tools for marketers for decades. But the two way nature of the web has added an additional tool that appears to trump all of these classic approaches.
TWO WAY IP-BASED MEDIA
Every Internet connection is made from two ends – your ISP and a digital device, like your PC. Your PC has a distinct “address” that it shares with no other machine. That address is called an IP Address. Since your IP address is yours alone, the flow of information through that address reflects your online behavior.
As part of the effort to personalize your Internet experience, companies use “cookies” to “remember” who you are and what you like. Cookies were originally developed for sites to maintain “shopping carts”. They are now used for a much broader range of personalization and tracking purposes, among other things. A cookie is a small text file that is placed upon your hard drive when you visit a site. If you have a My Yahoo page, for example, when you request info from the My Yahoo server (e.g., to load your personal My Yahoo page,) your PC pairs your request with the contents of the cookie text file to tell the server what your preferences are. The My Yahoo server can then provide the content you selected for you’re my Yahoo page.
Another kind of “cookie” is a tracking cookie, which is placed on your computer when you take a certain action online. For example, when you click on a banner, a tracking cookie is placed upon your computer to record what you did. That way, if you do something that a marketer wants, like make a purchase, the marketer will know what marketing activity drove your action. The marketer wants to know what drove your action so she knows what works in the marketing plan. The banner that drove your action gets a “point” based upon your subsequent actions.
You might think that the cookie goes away if you click but don’t buy immediately. Usually it doesn’t because most people take action long after that first click. You see a Lincoln navigator ad, click, look at a video, and then go away. But perhaps two weeks later you decide to get a quote from a dealer and head back to the Lincoln site on your own. If you request that quote, the banner you originally click on will usually be credited for that action if you perform it within a certain period of time – often 30 days.
But there’s more to the story, because the company that served the ad can also record your action, and use it to better understand who you are and what you are interested in. Suppose, for example, that you clicked on that Lincoln Navigator ad, then later went about your business online. The company that served the ad could use the info to categorize you as a luxury SUV shopper, which would be important info both for Lincoln and any other car company that sells luxury SUVs. Since clicking on that Lincoln banner makes it FAR more likely that you are in-market for a luxury SUV, your eyeballs are worth more to Lincoln and any other car company than can purchase ad impressions in front of you. So the ad server can sell those ad impressions for far more money.
Naturally, the more info that a company has on your behavior, the more it will know about what interests you. And the more it knows, the more likely it can determine that you are a prime audience for a multitude of companies in a multitude of categories. That means your eyes are worth more to a variety of companies in a variety of contexts.
TOMORROW: THE TECHNICAL MECHANICS OF BT (FOR DUMMIES)
Subscribe to:
Posts (Atom)