The TruEffect Blog

The future of privacy is happening now

TruEffect recently joined the Future of Privacy Forum (http://www.futureofprivacy.org), a Washington, DC based think tank that focuses on the use of technology and its impact to our privacy within the online advertising industry. At TruEffect, we are active proponents of keeping the internet free by using advertising dollars to support its development – that’s our business.  But, in the same breath we believe consumers have fundamental rights and expectations that their privacy be assured, and the data they share online be used only for the purpose intended and only by the entities with whom the consumer believes they are interacting.

In a trip to Washington this week, I had the opportunity to participate in a meeting at the Federal Trade Commission to discuss the recent FTC White Paper entitled “Protecting Consumer Privacy in an Era of Rapid Change.” It was a chance to hear first-hand the FTC’s intentions to gather feedback, conduct hearings and propose actions during this calendar year. As Chairman Jon Leibowitz made clear in his opening remarks,  the purpose of drafting these papers is two-fold: a.) encourage business to develop best practices and b.) guide lawmakers. It became clear that the FTC believes the status quo is not acceptable, and that we will see new mechanisms in place soon that provide consumers more clarity, more choice, and more protection. The determination of whether to establish a universal “Do Not Track” capability will not languish for seven years like the “Do Not Call” legislation did.

Although the group meeting with the FTC was small, representatives from some of the largest corporations in the world were present. That said, those most conspicuous by their absence were some of the largest and most recognizable advertisers and advertising agencies on the internet. Change is inevitable, and it will affect the ability of these companies to grow their online relationships with consumers. I would strongly encourage any advertiser or agency that believes interactive media will play a significant part in their business over the next decade (which means every advertiser or agency) to engage now.  Visit http://www.futureofprivacy.org to learn more. And as always, let me know what you think.

– Scott Nelson

Scared straight?

Today, The Wall Street Journal finished its 3-part series on internet privacy. Part 1 last week was greeted with skepticism from the online ad community, and accusations of being "alarmist."  But according to WSJ's instant poll, over 60% of people are "very alarmed."

Part 2 featured an in-depth look at private browsing, specifically focusing on the in-fighting at Microsoft between the InPrivate IE browser team and the Microsoft Advertising Group.  You mean ad interests and consumer privacy are at odds? Nothing new here.

Part 3, written by Emily Steel and Julia Angwin, takes a scary, microscopic look at the data compilation industry and how it intersects the consumer's online experience. The WSJ research study covers data handler [x+1] and how their technology benefits clients like Capital One. They take us step by step through exactly how many bits of data are passed to Capital One in an instant, merging what [x+1] has already gleaned, with back end data modeling enabled by Nielsen. Once the user is sufficiently silo-ed, Capital One knows which credit card offer to serve up.

If consumers and industry folks are "alarmed" that the data that passes between third party data aggregators and their clients is just a few bits short of enough information to go from "anonymous" to knowing your name, they've obviously not paid much attention to internet consumer privacy arguments that have been raging for years.  But [x+1], while acknowledging the possibility of de-anonymization, says its unlikely to happen because it's not worth the effort. "It would be a massive undertaking," says John Nardone, CEO of [x+1], "and it is hard enough to make money." OK. I'm sleeping better already?

We talk a lot about privacy here at TruEffect. Is it crazy to believe in the possibility of productive and engaging internet ad encounters, that don't abuse a consumer's right to privacy. We think not.

– Layne Salter

OMB unleashes new privacy guidelines for Government

Two weeks ago the Government Office of Management and Budget (OMB) issued two new memoranda, M 10-22 and M 10-23, regarding web measurement and the utilization for 3rd party technology for government websites. The new guidelines are part of the OMB’s “Open Government Directive” and seek to promote transparency, participation, and collaboration while protecting individual privacy.

Although the new memoranda reverse a number of previous mandates, what bears scrutiny is that while there appears to be some easing of restrictions around 3rd party technology use on government sites, most current 3rd party ad tracking serving and measurement technologies still cannot comply with the new requirements. For instance, new guidelines allow for retention of data for only as long as deemed necessary, but not to exceed 12 months. Most ad server cookies are set for a minimum of 24 months, while others range up to 10 years. And data is commonly retained for more than 18 months.

Last summer, the Future of Privacy Forum, in their reply comments to the Federal Government Websites cookie policy, recommended that “Only ‘first party’ domains should be used, rather than ‘third party’ domains, to avoid potential for unwanted correlation across unrelated Web sites.” Likewise the Center for Democracy and Technology recommended that Federal Government Agencies serve and measure advertising from their own first-party Web domain. We agree. That’s why “first-party” solutions, like our own TruConnect technology, are still the safest bets going forward in an industry whose privacy practices are increasingly being called into question.

– Martin Smith

A newer, sexier version of P3P?

A start-up called Better Advertising kicks off its public campaign this week to become the reference standard technology for online advertising industry self-regulation.  The technology manifests itself as an icon (the “Power I”) located in the upper-right corner of a participating advertiser’s display ad.  When a consumer mouses over the icon, they're presented with the data being used to perform behavioral targeting in the delivery of the ad, and have the option to opt out of future targeting.  The company says they enable advertisers to be more accountable to consumers.  Basically, it’s a way to expose what data is being used by what advertisers to force some restraint through transparency.

Previous attempts to disclose the use of consumer data for targeting haven’t fared too well.  For example, the Platform for Privacy Preferences project was a noble attempt to force advertisers to state in unequivocal terms how they used consumer data.  Those terms were actually embedded in a “compact policy” facility built into web browsers since 2002.  The organization supporting P3P was not a commercial entity like Better Advertising, and it's been dormant for three years. 

Another attempt, the Network Advertising Initiative, has been more successful, but today's regulatory and legislative circles that work on privacy matters suggest it's insufficient. The NAI is the organization behind the cookie-based opt out, long established as the vehicle for consumers to exert preferences over how their data is used.  But unlike the NAI, Better Advertising will actually provide details about how data is used before providing the opt out choice.

Draft legislation from Congressman Rick Boucher (D-VA), has thrown down the gauntlet to the industry, and FTC Chairman Jon Leibowitz has been rattling his sword at the industry for a year now.  If we collectively fail to act, swift and significant restrictions will be placed on advertisers' ability to leverage consumer information to improve media performance and deliver the most relevant advertising available.  Will the "Power I" get the job done?  A lot of media heavyweights support the effort, so it has as good a chance as any.  Transparency will be key, and the belief within legislative and regulatory circles that consumers will be satisfied with the options available to them. 

– Scott Nelson

Dead internet ideas

Doug Weaver, founder and CEO of Upstream, and frequent speaker at iMedia Summit series gives a great, uncensored look at the truths we tell ourselves in the online ad biz in his presentation on “12 Dead Internet Ideas.” We talk a lot about consumer privacy and "relationship advertising" here at TruEffect, and how internet advertising hasn’t really changed much in 10 years. We should know – we were there in late 20th century, developing technology to serve the first ad. But Weaver, in Steve Jobs keynote fashion, puts it ever so much more eloquently than a PowerPoint ever could.

Weaver’s dead internet idea called "The Right to Target" calls into question the industry’s never ending quest to pull out all the stops on targeting technology, while lulling consumers into complacency around their privacy concerns by ensuring them that they are exchanging their data for really cool candy – like better and more relevant ads that keep the internet free. Weaver says "We think because we can, we assume that we may."

But by downplaying the relevance of context, we just provide more of the same –thousands of meaningless impressions that nobody is clicking on. To understand what will actually reach, and impact, the consumer has been the illusive grail of advertising since Madmen wrote the Brylcreem jingle.

But Weaver cautions that "the landscape we're destroying is the one we'll need to live in, and profit from, for years to come."  Even though it looks as if the "cookie opt-in" clause will not make it into the Boucher bill - for us to "celebrate dodging that bullet is like whistling past the graveyard."  He reminds us that if we think that consumers and government don't decide how it goes, one only has to take a look at how the "Do Not Call Legislation" put phone marketing out of business in 48 hours. 

But, it’s just a presentation, right?

– Layne Salter

Is the FTC getting superpowers?

I know, I know. At TruEffect we like to talk about online consumer privacy – a LOT. We’ve talked, sometimes ad nauseam, about the Federal Trade Commission’s Staff Report on Behavioral Advertising, and have closely followed the debate on the state of industry self-regulation.  While the FTC’s report is quite clear, the industry has largely disagreed with the positions posited by the FTC, and ignored their not-so-thinly veiled threats of government regulation – believing that the industry can certainly regulate itself long before a need arises for the government to do it for us. Well, it’s not that we take pride in saying, “I told you so,” but……

Yesterday Wendy Davis from MediaPost wrote about the online industry having their panties in a bunch around the new legislation before Congress that will make it much easier for the FTC to create rules and bring civil law suits. She writes “The current House version creates a new consumer protection commission while also beefing up the FTC's power in a few key ways. The bill removes administrative hurdles to the FTC's rulemaking ability, makes it easier for the agency to pursue civil litigation, and allows the FTC to target ad companies that aid and abet unfair practices.”

And if you want to know what the FTC considers unfair practices, you need only to read their aforementioned “Self-regulatory principles on behavioral advertising.”  I keep remembering FTC Chairman Jon Leibowitz’s comment, “A day of reckoning may be fast approaching.” If the IAB feels the need to lobby against this current legislation, does that mean self-regulation has failed? Will third-party data models like those used by behavioral targeting companies and third-party ad servers be at risk?

– Layne Salter

The Cookie Controversy

I went to Boston a few weeks ago week to present at the International Association of Privacy Professionals Academy (IAPP Academy). I was armed with data on how 500 advertisers leverage their cookie space across First-Party, Third-Party and Flash cookies.

The recent positioning papers on Behavioral Targeting from the FTC, "Self-Regulatory Principals for Online Behavioral Advertising," and IAB, "Self Regulatory Principals for Online Behavioral Advertising," started a firestorm of additional articles from Business Week, "Is Regulation Coming" to Clickz's, "A Strong Nudge from FTC may lead to Draconian Measures."

The issue here is that Behavioral Targeting has become a major part of the online advertising industry, and data is transferred from the Advertiser to a third-party Behavioral Targeting company for analysis and profiling. At that point in time, the data is anonymous but still becomes owned by the Behavioral Targeting Company where it can be resold as targets back to the originating company and other Advertisers.

There are two issues that are fueling the controversy:
1)    Data Transfer
2)    User Notification

The FTC is arguing that there is limited transparency and notice that the users are being tracked by the third-party. The data transfer is usually mentioned in a passive mode in the Advertisers’ privacy policy and it's up to the user to go to either the National Advertising Initiative (NAI) site or to the BT company site to opt-out of the tracking. The FTC would like to see a more active opt-in notification where the users have to take action to be included.

The Industry response has been for increased self regulation which would enable the users to easily get to their data so they can make an informed decision as to whether they stay in a program or chose to opt-out. These options are good for users as long as there is education to help them understand how they are being tracked, and how to take action to prevent this tracking if they feel compelled to do so.

The next big firestorm surrounds something that has been flying under the radar, but used at an accelerating rate, is Flash Cookies. They are not cookies, rather Local Shared Objects which closely resemble a traditional cookie in function. The problem arises because the Flash Cookie is not controlled by the browser, it’s controlled by the flash player and is significantly more difficult to view and delete. Two articles came out the day before my presentation. One from the Behavioral Targeting Insider,  "Moving Flash Cookies into Direct Response BT" and the Daily Online Examiner "Hidden Cookies Privacy Landmines". The articles are from completely different ends of the spectrum. One encourages their use because they bypass browser security features, and the second alerts privacy professionals to the fact that they bypass browser security features.

The overriding factor is that users build relationships on the web by going to their favorite sites for products and information. When the user builds that relationship, who owns the data? Does the site (Advertiser/Publisher) or a third-party, engaged by the site to help drive deeper relationships, own the data?

An article written by Ben Edelman, "Towards a Bill of Rights for Online Advertisers," highlights the heart of the issue. Advertisers are the ones spending the money to fund the web, and deserve the rights to know where their ads are shown and use their data as they see fit.

It seems logical that the Advertisers should have the right to control and use their own data. I wouldn’t be surprised to find that Advertisers push for Advertiser cookies as an option for the future. There would be no controversy as to who owns the cookie and the data and where you need to go to opt-out.

– Greg Neal

Data mining in the media economy

It seems things always come in threes. This also holds true in Privacy News. Over the past holiday week, the US saw a series of pieces related to the on-going privacy/targeting debate in the media.  Stories percolated into Business Week and The New York Times related to the regulation/self-regulation discussion of behavioral targeting, while in the UK it was announced that British Telecom was terminating its controversial trials of the Phorm targeting service. What’s different this week? Just maybe the industry trade bodies are finally taking seriously the threat of external regulation? With that there is an escalated need to aggressively pursue a self-regulatory path.

A cross-section of industry groups have now produced 7 guiding principles for behavioral targeting and taken a passable stab at defining it:
“The collection of data online from a particular computer or device regarding Web viewing behaviors over time and across non-affiliate Web sites for the purpose of using such data to predict user preferences or interests to deliver advertising to that computer or device based on the preferences or interests inferred from such Web viewing behaviors. The Principles do not apply to a Web site’s collection of viewing behavior solely for its own uses” ¹

The specificity of the definition is very interesting in that it draws some very specific data practices into question. These relate to specialist companies that aggregate data across sites such as NextAction, Acerno, and data aggregators such as Blue Kai. However it may exclude companies such as Media6Degrees, that makes inferences based on your association to users you are connected to via social media. While such companies are very familiar to interactive advertisers, they are practically anonymous to the consumer and are, as such, clearly in the target area of regulators because they hold an ambiguous and undefined role.  Do we want to go this route and call out companies?

How does this apply and does it also challenge re-targeting and other practices related to data collection?  Re-targeting shares data from advertiser sites with media networks to allow the re-solicitation of visitors to an advertiser site.  You may have experienced this when you visit a site and then almost immediately start to receive ads from that company. A recent article by Wendy Davis in Mediapost shed light on this practice when she reviewed AT&T’s data sharing activities. Greg Neal , VP of Product Strategy at my company, TruEffect, observed in his analysis of the top 500 advertisers that, on average, data is shared through cookies 7-20 times, depending upon the industry.  

“AT&T is by no means unique" said Neal. "In fact they are better than many and have a very clearly articulated privacy statement related to these practices.  We typically see data being shared with between 3 and 10 companies.” What is more concerning for Neal is companies that do not understand how their sharing of data impacts their business and the brands they support.

“When reviewing client data practices it is not unusual to see data they have shared for specific re-targeting to be driving advertisements for competitive advertisers. I think advertisers often over-estimate the control they have of their data. When they share that data with another party, there is little control or regulation over the specific purposes and re-purposes for which the data may be used. It’s also extremely difficult to monitor or track. When the data is gone, it’s gone!”

This is a view shared by Match.com’s Jim McDonald who said, “We have rationalized the range of networks with whom we work based on compliance to our data standards. We have also begun investigating other methodologies such as managing all media within our domain. Users have a relationship with Match not any third party company they’ve never heard of.” Research supports this view with 61% of users expecting their interactions to be private, but nearly the same number also want advertising to be relevant.

Chris Ahrens of agency Draft/FCB reiterated this sentiment saying, “Draft/FCB has taken a pragmatic approach to the BT area and deployed different technologies when most appropriate.  We were the first to use ad serving without cookies as well as supporting the use of the advertiser option when appropriate”.

Given advertisers have options, is the industry’s response really getting ahead of the issue or simply acknowledging a changed reality?  Behavioral Targeting comprises less than 9.5% of all display media sales² although they do comprise a much larger part of media selection and retargeting.

Nielsen’s Marc Ryan believes that many consumers have already created their own opt-outs. “For quite some time we have been noticing an increasing trend in users managing their data more aggressively, this includes deleting or simply not accepting cookies. Typically we see more than 50% of media being managed in this way by better tools and options in the browser and use of security software.”

Webtrends, a leading web analytics company, saw similar trends.  “We believe about 28%-33% of users now manage how their data is used in media.  Consumers are ok with sharing data with companies they know (and trust).  They are often a little more savvy than the industry gives them credit for or wants to admit as it impacts measurement accuracy and performance.  In site-side analytics we saw this a number of years ago and made adjustments by working in the domain of the advertiser. We see the same trend in media and believe companies such as TruEffect offers solid alternatives to current practices.”

– Martin Smith
¹ Self Regulatory Principles for Online Behavioral Advertising
² eMarketer, June 2008

Would you want this job?

While "Terminator Salvation," sans "Governator" plays in theaters nationwide, President Obama declares that cyberspace is actually a real place, and gives it its own security force. To protect us from hackers, international terrorists, and even SkyNet Research, Obama announced today the creation of a new government post - Cybersecurity Coordinator. Sure, this is not a job most of us would want, but his speech announcing the post certainly underscores the importance of this virtual space we've created and adopted in droves over the past two decades.

He reminds us that the internet is not just about our growing personal communication and entertainment uses, saying "... make no mistake:  This world -- cyberspace -- is a world that we depend on every single day.  It's our hardware and our software, our desktops and laptops and cell phones and Blackberries that have become woven into every aspect of our lives. It's the broadband networks beneath us and the wireless signals around us, the local networks in our schools and hospitals and businesses, and the massive grids that power our nation.  It's the classified military and intelligence networks that keep us safe, and the World Wide Web that has made us more interconnected than at any time in human history. So cyberspace is real.  And so are the risks that come with it."

As geeks around the country rejoice at the administration's plans are to keep this virtual world "open and free," we wonder if the continued emphasis on technology and security will fuel even more government attention to consumer privacy concerns around online advertising and behavioral targeting?  Time will tell.

– Layne Salter

It's a Brave New World

It's easy to forget how new the internet actually is. A lot of recent coverage is devoted to following the ins and outs of the new presidential administration's use of the internet to build the national community it promised during the election. Not since Kennedy bested Nixon in the 1960 television debates, has the use of technology been so prominent in politics.

It's hard to imagine that it was only about a decade ago that Clinton ushered the White House into the online world with the creation of Whitehouse.gov, and a mandate that all federal agencies get online. David Almacy, Bush's Internet Director said, "Clinton was the first Web president. Bush is the first digital president, and Obama is the first online social networking president." Even Congress is tiptoeing in the waters of YouTube, though it may take better directing to 'whip' our representatives into a believable presentation. Maybe Oliver Stone is available.

Digital Technology - faster than the speed of....
uh, the latest fast thingy?
It's not surprising that technology leaders, advertisers, marketing professionals, and privacy officers around the globe seem to always be playing catch up. This week an eMarketer report showed the first Direct Mail drop in over 60 years - no big surprise here. But the prior week they also published a report showing that Google, for the first time, is losing, rather than gaining, share in Search. And the hits just keep coming. This week brought us a new Nielsen Report on Social Networking's New Global Footprint that shows "member communities have overtaken personal email." If that's not enough to raise your eyebrow, how about the fact that time spent on Facebook last year not only increased by 566%, its greatest global growth comes from people aged 35 - 49? Even the strongest advocates for social media must be astounded by this speed of adoption.

Couple all these lightning fast changes with a recession spawning massive budget cuts, and I'm sure many marketing professionals feel the need for a long vacation (of the paid variety of course). We've talked about simplifying a lot in the past, but with this schizophrenic environment, it's more imperative than ever. TruEffect does its part by continuing to help advertisers make sense of the digital advertising landscape. It's all about forging meaningful relationships with customers, while spending less time and money on it and, of course, keeping kosher with online privacy regulations.

– Layne Salter