Behavioral Targeting Regulation

8/8/2019 Behavioral Targeting Regulation

1/16


2/16


3/16


4/16


5/16

Searching For a Behavioral Targeting Regulation Xurxo Martnez

COM 558 U.S. Digital Media Law and Policy MCDM Summer 2010

- Sensitive information or personally identifia b leinformation : To the effects of BTand privacy, any piece of data that is likely to identify one web user: from the name toan email address, a telephone, financial account number, or persistent onlineidentifiers as the Internet Protocol address (IP address). It applies also to data that canreveal racial or ethnic origin, political opinions, sex, or religious beliefs.

- IP address: Numerical label, which identifies a computer or group of networkedcomputers that use the Internet Protocol to connect to the public Internet. Its functionis to identify the computer that is asking for a web site or document, and then to

provide the requested information. Depending on the ISP, the address can be static always the sameor dynamicchanges with each Internet session.

- Browser : Application that allows any user to retrieve and present informationlocated in the World Wide Web. That information can be either a web page or a file audio, video, image, and pdf.... In order to perform its tasks, the browser not onlygets information from web servers, but also sends informationmainly petitions,including the web identityIPfrom the user. Most browsers host cookies bydefault, enabling the tracking of the users activity.

- Pub lisher : The owner of the web page, video, or document that the user accessesthrough the browser. Usually this publisher will get money from the display of webads. Usually collects permission from the user to use their information for advertisement purposes.

- M iddlemen: It would include tracking companies, data brokers and advertisingnetworks. All of them would be included, with the advertisers and the publishers inwhat the Boucher bill calls Covered entities. Those are defined as any person or companyexcluding government agenciesengaged in interstate (web) commercethat collects data containing sensitive or personal information from more than 5,000individuals.

- Profile : The package of data stored by a middlemen, publisher or advertiser aboutan Internet user.

- Op t-in: the process through which a web user is offered the option to receive somespecific advertisement, or have his or her personal information shared with a third

party. That means that there wont be any kind of advertisement delivering without a previous consent.

- Op t-o ut: here the user has the option to stop receiving unsolicited advertisement. It puts the burden on consumers to learn how the privacy polices work, how the data is

collected and shared, and decide if they are ok with that.

- T he Gu idelines : It refers to the Self-Regulatory Principles For Online BehavioralAdvertising , created by the advertisement industry after proposals by the FTC. Inthose both first party BT and contextual advertisement are excluded 2.

2 http://goo.gl/ta3g (National Law Review)


6/16



G roups looking for a regulation

Energy Subcommittee on Communications, Technology , and the InternetThe chairman of this U.S. House Subcommittee, Rep. Rick Boucher, and the alsomember Rep. Cliff Stearns, presented last May a bill on privacy issues. Boucher is awell-known advocate of consumers rights in the Internet and against intrusiveadvertisement. He created the Digital Media Consumer's Rights Act (DMCRA)legislation and co-authored the CAN-SPAM Act of 2003 3.

The main points the bill wants to regulate are:y Privacy policy disclosures: the websites that collect sensitive data should

make it clear, as the use they will make of such information.y Opt-in for sensitive data, and easy opt-out for any kind of data.y Option for the users to modify their profiles and opt-out the sharing of their

data with third parties.y Ensure the security and control of the data stored.y

The FTC as implementer and enforcer of the rules.

FTC The Federal Trade Commission has as a principal mission to promote the consumer

protection. In the last years the agency has lobbied for the online advertisementindustry to self-regulate BT practices and respect the users expectancy of privacy.FTC Chairman Jon Leibowitz has warned the industry that it is facing the last clear chance to avoid specific governmental regulation 4.

Right now the FTC is not only thinking about a Do not track listsimilar to the donot call for telemarketers, but even to force each site to show a brief summary of their privacy policy to each user during their first visit. This option would clearlydisclose each site policy, but also become extremely annoying for a new user, or evenone that has changed of ISP 5.

Among their main concerns, we can talk about:y Give more informationand in a transparent wayto the user, who should be

able to easily opt-out. In the Guidelines, the FTC dont choose between opt-inand opt-out. They just say that those should be clear, easy-to-use, andaccessible to consumers.

y Obtain permission from the users when their information or profile is going to be shared with a third party or it is going to be used in a way not reflected inthe original privacy policy.

y The use of sensitive datarelated to heath, financial statesand what kind of data do the advertisers collect from minors.

y Prohibit ISPs to collect personal data through DPI.

3 http://en.wikipedia.org/wiki/Rick_Boucher4 http://goo.gl/4SSS (Privacy & Security Law Blog)5 http://goo.gl/c45x (Ars Technica)


7/16



The FTC has focus their efforts in BT, considering that both contextual advertisingand first party behavioral targeting raise far less privacy issues.A dvertising IndustryThis refers to a cross-industry coalition of web advertisers that try to complain withsome of the FTC requisites.

Members include the American Association of Advertisers Agency, the Associationof National Advertisers, the Interactive Advertising Bureau, the Direct MarketingAssociation and the Council of Better Business Bureaus. This coalition has created aseries of guidelines named Self-Regulatory Principles For Online BehavioralAdvertising.

The intention of this set of principles is double:y Avoid the option of a Federal regulation of BT. They fear a conservative

legislation, based on the principles of classic marketing, which woulddiscourage innovation and progress.

y Convince the users that their tactics do not violate their intimacy. And eventhat BT is positive for them, as they will only receive relevantadvertisement.A study ofninety online marketers released in May 2010 by thePonemon Institute indicated that despite an acknowledged return oninvestment from behavioral ads, hundreds of millions of dollars are being held

back from online behavioral ads due to privacy concerns 6.

Among the measures the advertisers have already introduced or are willing to, we canhighlight these:

y Disclosure data collection and the kind of use that will be done on thewebpage where the ad is displayednon on the web of a middlemen, as theuser would never know where to look for it. Some advertisers are starting todisplay a behavioral ad icon with a blue square with a lowercase "i" in a circle,

making clear that the ad has been selected through BT.y Let consumers decide whether their data can be transferred or user by another

entity. Some advertisers are even willing to give the users access to their profile, in order to modify itand, so, get more accurate ads, or to decidewhat kind of data do they want the advertiser to know about. One example isthe Seattle-based middlemen BlueKai, through their registry 7.

Even more, the advertisers have said that they are even willing to cooperate with theFTC in order to enforce the observance of their rules. An article in Wire explainedthat the Council of Better Business Bureau is seeking software to detect targeted adsthat lack these mechanisms, and report non-complying ad networks to the FTC 8.

P rivacy A dvocatesA group of entities and privacy watchdogs have lobbied for a strong regulation of BT,arguing that is an invasion of privacy, can be used to take advantage of vulnerable

6 http://goo.gl/spKg (Tech IT News)7 http://tags.bluekai.com/registry8 http://goo.gl/ezXw (Wired)


8/16



consumers, or even discriminate them, and that the profiles may be used for purposes beyond commercial ones 9.

Here we present their main proposals:y Personal and behavioral data should be relevant to the purposes for which they

are to be used. Any change in the use of the data should include a new consentfrom the user.

y No behavioral data should be collected or used from children and adolescentsunder 18 to the extent that age can be inferred.

y Sensitive information should not be collected or used for behavioral trackingor targeting. Sensitive information should be defined by the FTC and shouldinclude data about health, finances, ethnicity, race, sexual orientation, personalrelationships and political activity.

y The FTC should establish a Behavioral Tracker Registry.y Use of behavioral targeting for individual redlining activities should be illegal.y Websites should only initially collect and use data from consumers for a 24-

hour period. After that they should ask the user for consent. Data collected on

users who gave consent must not be retained beyond a period of three months.

Among the members of the coalition we can highlight the Center for DigitalDemocracy, the Consumer Federation of America, Electronic Frontier Foundation,Privacy Lives, or the World Privacy Forum. In September 2009 the groups delivered alegislative primer to the Congress.

9 http://www.democraticmedia.org/book/export/html/409


9/16



O ther key playersAlthough the discussion is focused on advertisers, regulators, and consumer rightsadvocates, the global issue is more complex, and a complete overview of the main

players should include also:

y The providers of content in the Internet Pub lishers , who many times arenot transparent about how the visitors of their sites are being tracked, usuallyas a way of profiting from their personal information.

y T he we b b rowser vendors . The browsers allow the action of potentiallyintrusive cookies. During the design of the Internet Explorer 8, thedevelopment team created a product that prioritized users privacy over commercial interests, considering that the default should be some private

browsing 10 . That means that if the user wanted to receive/install the cookiesshe or he should give consent.

That would have turned the acceptance of cookies from a kind of Opt-out toan Opt-in model. After some discussion, the final version of the popular Microsoft browser didnt make the swift and the users concerned with the useof their data via cookies need to turn the security options on.

y The M edia plays a big role in the public perception of privacy and the threatsof Behavioral Targeting. On one side the Media voices out practices that can

be unknown for many Internet users. On the other side they can create alertover a number of practices.

A recent series of articles by the Wall Street Journal under the generic title of What They Know 11 , have been highly controversial. In one of the infographicsthey showed how some of the most popular U.S. websites give data about anyindividual who visits their site to advertisers 12 . Some influential bloggers, likeJeff Jarvis 13 , have argued that theres nothing new about advertisers trackingus, while tracking companies say that portraying cookies as some kind of spying is misleading 14 .

y T he ISP s. The companies that provide access to the Internet obviously alsohave control over how their customers browse through the Net. ISPs arewaiting to see what happens with BT and the public privacy concerns beforestarting to use the profiles they own to make businessthrough DPIandoffer the best potential clients to both advertisers and Publishers.

10 http://goo.gl/cIyi (Wall Street Journal) 11 http://online.wsj.com/public/page/what-they-know-digital-privacy.html12 http://blogs.wsj.com/wtk/13 http://www.buzzmachine.com/2010/07/31/cookie-madness/14 http://www.bluekai.com/president20100804.html


10/16



NOTORIOUS C A SE SNow I will review some publicly notorious cases regarding Internet privacy, that have raised concerns on the general public about the way the data they considerprivate can be treated. I ll also review what can be the next privacy big case: webcoupons and their match of online and offline information on the client.

G mailThe free email service by Google was, in 2007 15 , one of the very first places whereusers could experiment Google Ad words, a contextual advertising service thatscanned the mails in order to find keywords and select automatically a series of textadvertisements. That means that if the text of the mails talks about someone namedMichael from Jordan who likes strawberry Jam, the ads will offer to buy the SpaceJam DVD.

While opening someone elses letter or postcard is a Federal offense 16 , email

providers can read the content of electronic correspondence. As a private provider,Google has set a series of terms and conditions regarding this issue, which should beaccepted by the user before starting to receive the service.

But even though users have accepted the terms and conditions, those still expect their communications to be safe and private. Google has stated repeatedly that their work islimited to scan for words that can help to display related advertisement, not literallyreading the content. And will not keep a log of which ads went to which users, nor will it keep a record of keywords that appear often in an individuals email 17 .

In the case of case of U.S. v. Warshakone of the first ones regarding emailcommunicationsthe Sixth Circuit ruled that the user has a right to privacy that isonly diminished if the subscriber or user agrees to the ISPs terms of service 18 . Finallythe subscriber is receiving a free service that pays through the reception of advertisement.

G oogle BuzzIn February 2010 Google launched a new application tied to the Gmail service, calledGoogle Buzz. In short it was a social networking tool that allowed Gmail users toshare items with all or part of their network, vote on them, or comment. Google failedat explaining the users how the information about their network would be shared andhow to modify their preferences.

The basic problem was the auto-follow function that Google used to createautomatically a list of followers for Google Buzz user, based on the most emailedcontacts list. That made that many users were sharing content inadvertently with

15 http://goo.gl/BBfT (Information Week)16 http://goo.gl/HoKu (Legal Information Institute)17 http://www.wired.com/news/business/0,1367,62917,00.html 18 http://goo.gl/pzqr (Law Journal Library)


11/16



people with whom they had mail relationship but they didnt necessarily consider friends, at the time that disclosure to their entire network the mail relationship.

The users of the Gmail who accepted to try Google Buzz never thought that their contact list would be made public, or that anyone related to, say, their ex-boss, would

be able through Google Buzz to reach their personal e-mail. They expected that

personal data to be something locked in their Gmail account and that wouldnt be public through that new networking feature. The company was forced to change theauto-follow system for one based on recommendations just days after the launch 19 .

Other than the contacts issue, another of the problems during the early days of theservice was the difficulty for the users to understand and change their default settings.

Facebook BeaconStarting in November 2007, Facebook allowed information about their users collectedvia a beacon to be transmitted from affiliated retailers to Facebook, and even show

this information to the users network. Most of the times this happened without theuser being aware. Several newspapers and blogs told the story of a man who bought aring online for his wife. The website was affiliated to Facebook, and the news aboutthe purchase were published in his profile, making it possible for all his network,including his wife, to know about the supposedlysurprise gift 20 .

After a series of articles in press and blogs attacking the beacon, Facebook changedits operation for an Opt-in system. But a class action was presented in California,alleging that the company didnt sought after the users approval before implementingthe beacon 21 .

Facebook ConnectFacebook has more than 500 million users worldwide. Near one third of themround160 millionare in the United States. That means 160 million Americans that havegiven them their names, likes, email, list of friends, and interests.

Through their application Facebook Connect they offer a trusted authenticationmethod for any website. For a regular Publisher, that means that Facebook will do the

job of identify any web user. For the social media company it means two things:y They will get even more information about the user, as they control her or his

activity in other web sites, being able to deliver even more precise advertising.y Facebook become a kind of ID regulator of the Internet. In a way, their

authentication system becomes an online version of a government releasing IDcards for their citizens.

19 http://www.nytimes.com/2010/02/15/technology/internet/15google.html20 http://goo.gl/ZCTC (Washington Post)21 http://goo.gl/rgnn (TechCrunch)


12/16



Facebook P rivacy P olicy Another of the main privacy complaints against Facebook is related to the continuouschanges in their privacy policy. It would be reasonable to ask for a system that would

be clear, easy-to-use and simple. Instead, as a graphic from the TheNew York Timesshowed 22 , Facebook released in May 2010 a version with 50 settings, more than 170

options, and 5,830 wordsmore than the United States Constitution, and more thanthis paper.

W eb CouponsDuring 2009, in part due to the economic crisis, the redemption of coupons grew a27% v. 2008 23 . Internet coupons still represent a small portion of the whole

business0.5% of the total number of coupons and 1.5% of the redemptions, butredemption rates for Internet coupons are by far the fastest growing in the business,up 263% from 2008 to 2009. The site Groupon.com grew from 238,000 u niquevisitors in July 2009 to 6,491,554 in July 2010, according to Compete.com 24 . Thatmeans that we are facing a fast growing marketing segment, one that also uses BTtactics in order to retrieve information about the users.

The issue with this new breed of couponsas the ones that are sent to mobiledevicesis that when matching the physical person that comes into the shop with thedata provided with regular BT, the retaileror whichever middleman who can haveaccess to the data the retailer gets while the redemption of the couponcan connectthe actual name with the supposedly anonymous online data.

A The New York Times article 25 explained recently how a company named RevTraxoperates: they are a third party who displays the coupon ads on the retailers site or any other web page. As they are just middleman they dont need to have a privacy

policy, even when they are the ones who collect the personal information of the users,including the keywords they used before getting to the couponi.e. cheap trekking boots.

After the user prints the coupon and redeems it, RevTrax get the information back from the retailer and can complete the user profile. That way they can also get to theconclusion that people from, say, Kirkland, is more likely to buy equipment for outdoor activities through coupons than those in Seattle. The following step would beto make a better offer to Seattle usersas they are harder to convincethan to thosein Kirkland. This is called online redlining, and the advocates of online privacydefine it as a form of discrimination.

22 http://goo.gl/3lyo (The New York Times)23 http://goo.gl/3a5I (Nieman Journalism Lab)24 http://siteanalytics.compete.com/groupon.com/25 http://www.nytimes.com/2010/04/17/business/media/17coupon.html


13/16



PRIV A C Y A S SOURC E OF CONC E RNSome of the cases reviewed in the previous sectionmainly those related to Googleand Facebookhave made regular Internet users more aware of their online privacy,and more worried about how much these service companies use their data, and how

much advertisers know about them.

In an Annenberg poll conducted between June and July 2009, 66 percent of Americanadults indicated they did not want websites or networks targeting advertisements tothem. Even a majority (54%) of younger consumers (18-24) "rejected" behavioraladvertising. In addition, 92% of the respondents said there should be a law requiringwebsites and advertising companies to delete stored information if asked to 26 .

Is very interesting to see that young people is also worried about how their information is being used. The digital natives are supposed to be far less worriedabout privacy. On this vein, a research published in August 2010 shows that youngFacebook users are more interested in privacy issues than what it was believed 27 . Thestudy examines "the attitudes and practices of a cohort of 18- and 19-year-oldssurveyed in 2009 and again in 2010 about Facebook's privacy settings". The resultsshow how even most the occasional Facebook users79% modified at least twicetheir settings during 2010. This data opposes to the idea that young people is lessconcerned about online privacy.

On the other hand, while all the articles and negative buzz about Facebooks privacyissues have made them scored pretty low in the 2010 American Consumer Satisfaction Indexin the lower 5% of all measured private sector companies 28 ,the company is continuously growing in number of users. Maybe the concerns of theusers are less important than the benefits they get from the service.

Advertisers and middlemen collect information that isincreasingly more specific. Onecompany, Clearsight has announced that it has enough information to link 65 millionIP addresses to actual email and post mail addresses 29. Even more, some companiesare starting to match offline and online data, being able to put name and yearlyincome to the users that have a certain cookie installed 30 .

And if advertisers use that data, could someone else do the same? Family law attorneyBrad LaMorgese thinks so, and plans to use it as evidence in lawsuits:"It's a great, ready-made source, almost puts the investigation together for you,"LaMorgese said, noting that how much money spouses spend online and what sitesthey visit are crucial details in a divorce case. "If someone is doing all sorts of things

online, why wouldn't a court want to know that?"31

.

26 http://goo.gl/ZdQQ (Broadcasting & Cable)27 http://goo.gl/CZ4W (UIC)28 http://goo.gl/971T (Foresee Results)29 http://goo.gl/K4jb (Mediapost)30 http://adage.com/digital/article?article_id=14290331 Advertiser tracking of Web surfing brings suits. The National Law Journal(March 2, 2009). Gale Document Number: A195138320


14/16



LIK E LY R E GUL A TOR Y OUTCO ME SAs we have seen when reviewing the main players in search of a regulation, there is ahuge tension between two different positions:

y The Advertising industry position is to let the market and the industry self-regulate, and see the profits rise.

y On the other side, the sectors concerned about privacy issues think thatconsumer privacy must be given special and priority consideration whengovernment measures the economic benefits related to any data collectionactivity.

The representatives of both positionsthe advertisers on one side; and the privacyadvocates, and the Energy Subcommittee on Communications on the otheraretrying to advance each one on their side in order to get a solid regulation. Both knowthat time is crucial and are tying to play with that. Now Ill expose the three morelikely resolutions:

1. Self-reg ulation by the advertisers o The advertisers need to implement the most urgent improvements

collected in the Guidelinessuch as the behavioral ad iconand conducta PR campaign in order to explain users that advertising is a fair trade for the free content they are gettingas TV, explaining how users aretracked and how to decide about what is done with their data.

o And they need to do it before the Boucher bill is voted. Because even if itdoesnt go on but gets a significant amount of support, there will be for

sure some kind of Federal legislation soon.o Other challenges they need to overcome are the huge privacy crisis that

services as Facebook or Google create, and to make sure that not only themain advertisers, but also middlemen as RevTrax or even the ISPs, followthe Guidelines.

2. Strong Federal reg ulation o Either the Boucher bill passes or a new proposal comes later and gets

enough support. Here we would see the FTC as main enforcer of the newrules. The more restrictive the legislation comes to be, the more

advertising companies and middlemen will struggle.

3. T he C ongress doesnt pass new legislation, bu t the FTC obtains power to im pose a series of minim u m standards o That would bea compromise where the advertisers would accept to be

sanctioned by the FTC, create some kind of database in order tocontrol thedifferent companies who engage in BT, and how they use the data; andfollow strictly the Guidelines.


15/16



In any of the aforementioned scenarios, what will happen for sure is that the internetuser will be able to have a broader control over the information that advertisingcompanies compile on them.

Also Opt-out formulas will become clearer and more accessible, so those individuals

really worried about how advertisers manage their data will be able to avoid BT andget the regular non-personalized advertisements.

But if Federal regulation passes, or if the FTC is allowed to regulate tightly the BT practices, we can face a situation in which consumer privacy measures will be takenin advance, as prevention. A situation where the FTC would allow a newdevelopmentbased on its potential ability to threat the privacy rights, more than on itscommercial or inventive values. That will, for sure, decrease the innovation speed inthe industry, and would even threaten the growth of this kind of advertising.

That last possibility raises another question: BT is designed to provide users withmore relevant ads. That should translate in higher profits. Right now the onlinecontent industrymainly news-related sitesis unable to become profitable offeringfree content that is paid just with the money they receive from regular advertising. If now BT dont replace the classic random ads system and provides them with more

profits, the Publishers will be likely to start charging for the content, or at least for theexperience of browsing their content without seeing any kind of ad, damaging theecommerce sector.


16/16


COM 558 U S Digital Media Law and Policy MCDM Summer 2010

CONCLUSSIONSAs technology guru Tim OReilly has stated, personal data collection can be key for anumber of good purposes, foster invention and help to solve complex problems 32 . His

point is that, in todays world, technology is driving us to collaborate in ways that

were previously impossible. And the sharing of data is one of the main ways in whichthis collaboration can really happen.

Is important to find a balance between innovation and the privacy concerns, becausethe later can even prevent some users to buy online or surf freely the Internet.

The users should be aware of how the bargain worksthe advertising pays for thefree content, and the advertisers be more transparent about their activities.Also the

publishers should be clear about whom do they track information for, or whom dothey permit to track users from their websites.

Regarding the debate about the Opt-in and the Opt-out, it seems clear that any user should be able to easily and effectively Opt-out from receiving behavioraladvertisement. The same way, there should be some kind of acceptance when anyoneis about to gather from the user the kind of information that we have defined assensitive or personally identifiable information.

Another restriction for the advertisers should be to use that sensitive and personal dataonly for the purposes that it was given by the user. A different use of the data should

be subject to a new consent.

Is dangerous to offer a Do not track list, at least with that denomination. And isdangerous because there is a big difference between BT and the telemarketing

practices that the Do not call list tried to avoid: in BT the individual who would ask to be in that list wont receive less advertisement because of that, but just will seerandom ads when browsing. Even more, it is possible that, as BT ads are more

profitable, this person will get more ads than a web user who wont sign for the list.

Regarding privacy policies, companies should be clear and simple. The user shouldntface such an amount of choices that would cause paralysis. The policies should beappropriate for the average user of the site. That means that a site for teenagers shouldhave a privacy policy much simpler than a Forum for Linux programmers.

The alternative to BT will be probably to pay in order not to have ads at all or tosuffer more regular ads when browsing the web, as the profit advertisers and

Publishers get for todays banners is decreasing, and even contextual advertising isstuck and not growing.

Summarizing, the privacy concerns should provoke some kind of regulation of BT, but always keeping in mind the advantages that this kind of advertisement brings.

32 http://goo.gl/bRiN (Readwriteweb)

Documents

Behavioral Targeting Regulation