• by Wendy Davis , Staff Writer @wendyndavis, October 28, 2009

It's no secret that the Federal Trade Commission, elected officials and industry observers are vocally questioning whether behavioral targeting -- or tracking people online and serving ads based on sites visited -- is worth the privacy tradeoff.

But now some academics are asking whether behavioral targeting has to compromise users' privacy. In a new paper, "Privads: Privacy Preserving Targeted Advertising," they propose a model for behavioral advertising that might not raise as many privacy concerns as cookie-based methods.

The Privads model involves storing information about sites visited on users' own browsers, without ever sending that data to anyone else. Instead, the browser would use an algorithm to choose which ads to display from a variety of possibilities sent by an ad network.

"The selection is never communicated outside the browser and consequently no information about the user's behavior is leaked," states the report. The researchers, including academics from Stanford and NYU, also propose using cryptographic techniques for accounting purposes.

Users would also be able to modify their profiles to control the types of behaviorally targeted ads that are served; some companies, including Google, already offer this ability.

The researchers acknowledge the browser-based system has a few potential pitfalls -- including the significant possibility that ad companies will get around the built-in privacy constraints.

Here's one potential scenario they envision: "A malicious advertiser who wishes to learn user interests could provide an ad whose topic tag is 'wrist watches,' but the ad itself says 'click here to get five dollars.' A user who is fooled into clicking on the ad reveals to the advertiser that he is interested in wrist watches."

Even if the drawbacks can be overcome, it doesn't seem likely that the online ad industry will embrace this technology. Consider, some companies appear to have an almost unlimited appetite for data about consumers. Even Google -- which allows people to access and revise their profiles for behavioral ads -- stores IP logs with records of search queries for 9 months and doesn't allow consumers to delete that data.

Eric Goldman, director of the High Tech Law Institute at Santa Clara University, adds that the basic concept of Privads has been around since the 1990s, but that it never gained traction in the market. What's more, he says, ad platforms that reside on consumers' computers face more regulations than cookie-based behavioral targeting. Utah and Alaska both have anti-adware laws on the books that restrict users' ability to install certain types of ad programs, even if the users want those programs. Those laws were largely driven by complaints about adware by trademark owners.

On the other hand, whether marketers turn to Privads or not, the proposal alone could make it harder for companies to argue that they need to track people online to serve them targeted ads, says Ed Felten, director of the Center for Information Technology Policy at Princeton. "If the Privads approach succeeds, demonstrating that behavioral advertising does not require tracking, this doesn't mean that companies will stop wanting to track you -- but it does mean that they won't be able to use advertising as an excuse to track you," he writes.