Inside Google

When the online advertising industry recently issued seven principles to protect consumer privacy, you could see the lines being drawn.

This Wired piece concludes the industry offered nothing new to the debate and in effect is begging for government regulation. Meanwhile, according to BusinessWeek, requiring Web surfers to opt-in to third-party cookies, as many privacy advocates would require, would destroy the whole online advertising industry.

Consumer backlash recently prompted BT to back away from the Phorm tracking plan in the UK and the FTC called Sears to task for its efforts to track consumer behavior, so it’s apparent the government will step in, if necessary.

Indeed, the seven principles were issued in response to an FTC report telling the industry that the agency would require self-regulation or government would take action.

In a nutshell, the principles are these:

   1. Education
   2. Transparency
   3. Consumer Control
   4. Data Security
   5. Changes to Existing Online Behavioral Advertising Policies and Practices
   6. Sensitive Data (what kinds of data will require consent)
   7. Advertiser Accountability

David Young, a partner at Goodwin Procter who handles cases in privacy, intellectual property and advertising law, sees the industry move as a way to buy time. In an industry where there’s little agreement, he calls the move, “impressive that they got so many players together on it.” But as he points out, nothing has actually been implemented “and to some extent the devil’s always in the details.” It remains to be seen how these principles will work.

So we asked three privacy proponents how, exactly, consumer privacy should actually play out on your screen. Though by no means a comprehensive summary of their views, three points stood out in the conversations.

Show Me the Value

John Simpson, consumer advocate for California-based nonprofit Consumer Watchdog, doesn’t believe this industry will be able to regulate itself. It seems intent on keeping the consumer uninformed, and it can only succeed if it provides more transparency, he says.

“If online advertising is this wonderful thing that brings a clear benefit, I don’t see why it has to be done in stealth mode,” he says.

He believes opting in should be consumers’ choice, not the current model where they have to work to opt out of having their Web-surfing habits monitored. He says that if advertisers clearly explain their programs and how that benefits customers, those users are likely to be willing to be part of it.

“With certain kinds of business models, if people understand it, they’re perfectly comfortable with it,” he says. “What upsets people is when they discover that they haven’t been told truthfully what’s going on and their personal data is being used in ways that they had no idea.”

What if it were like your supermarket’s loyalty program, he asks. You agree to be tracked and get something in exchange. At the supermarket, it’s often lower prices and coupons tied to your actual buying habits. People understand that program and agree to it.

And what if they could choose the ads they’d like to see? If he were planning to buy a car in six months, Simpson said he’d like to be able to sign up for more car ads for that period, he said.

Make it Easy to Opt Out

Like Simpson, Christopher Soghoian, who created a Firefox add-on for a single opt-out from online advertising tracking, has real problems with the idea that it’s so difficult to say you don’t want your online behavior tracked.

Soghoian is a doctoral student at Indiana University’s School of Informatics and a student fellow at Harvard’s Berkman Center for Internet and Society. He’s pushing for a single way for consumers to opt out, much like the federal Do Not Call list.

He recently updated the Targeted Advertising Cookie Opt-Out, (TACO), to provide a single way to opt out of targeted advertising on some 84 advertising networks.

Though the Network Advertising Initiative provides a single opt-out for its 34 members, Soghoian says people would have to visit about 50 other Web sites to opt out of all the advertising networks. Most Web users, he says, don’t even know the names of most of the companies tracking them online, so they have no idea where to even go. And figuring out how to opt out at all those sites is no easy task, he says.

The sites send a cookie to your computer saying not to track you. If you delete your cookies, you have to opt out at all those sites again. But worse, he says, is that there is no standard expiration date for those opt-out cookies. Google’s opt-out cookies expire after three years, provided you don’t visit another Google site in that period. But he says some opt-out cookies expire after six months. He’s found one that expired after one month and one that lasted only 10 days.

“These companies are not telling consumers, ‘Oh, by the way, even under ideal circumstances you’ll need to come back to our Web site every 30 days or every six months and opt out again,’” he said. “This is just an industry that time and time again has just been digging its heels in. Ten years ago there were hearings on cookies and tracking on the Web and there were hearings again last month. And it was basically the same arguments being trotted out in many cases by the same people. Things haven’t changed except that now people are tracked by even more companies.”

He points to the junk mail industry, which has provided a single place for consumers to opt out and, as he puts it, has “sucked the air out” of any arguments that government needs to step in.

Soghoian considers his opt-out tool, which he is working with Mozilla on to make part of the browser, only an interim solution.

“My tool is cool, but people shouldn’t have to download software to do this,” he said.

Show Me the Value, Part II

Another concern advertisers voice in the blogosphere is that consumers don’t understand the difference between behavioral advertising, which is based on a person’s surfing habits, and contextual advertising, which is based on the person’s search terms or the topic of the page that person is reading at the time. Paid search, of course, ties in to specific search terms. Market tracking firm eMarketer estimates $1.1 billion will be spent this year on behavioral advertising, with that market growing to $4.4 billion by 2012. At the same time, though, it expects $12.29 billion to be spend on search and contextual advertising in 2009, neither of which requires third-party cookies. And it expects that market to grow to $17.69 billion by 2012, a pretty healthy market on its own.

So what is the problem with making the opt-out the default and letting people choose to be part of behavioral advertising efforts?

Young explains that advertisers fear people just won’t do it – even if they have no qualms about it. He explains it this way:

“The problem that you wind up with is that you end up with the Tivo problem, which is that if we make it so easy and people have to opt-in, then nobody’s going to do it. [The industry worries] there’s not going to be all this advertiser support for all this free content that we enjoy on the Internet, that the basic business model supporting the Internet is going to crumble.”

He said that’s where the education component of the industry’s initiative comes in. He says it has to better explain to consumers that advertising is what supports free content.

“I think part of that should be them explaining that we want this data because this is why advertisers come in and support the free content that you want. So they’ve got to make that case. They’ve got to explain why there’s two sides to this,” he said.