Commentary

What Should I Tell the FTC?

by Dave Morgan , Featured Contributor, December 3, 2009

Monday is going to be a big day for the digital marketing industry. In Washington, D.C., The Federal Trade Commission, led by Chairman Jon Leibowitz, is hosting "Exploring Privacy," the first in a series of public roundtable discussions "to explore the privacy challenges posed by the vast array of 21st century technology and business practices that collect and use consumer data." [http://www.ftc.gov/bcp/workshops/privacyroundtables/index.shtml] The FTC wants to better understand how consumer privacy is being impacted by the online ad and marketing industries and wants to learn what people think that they should do -- or should not do -- to best ensure the protection of consumer privacy in this dynamic and data-intensive world.

It should be an interesting day, with a lot of different opinions being expressed, since the speaker list ranges from consumer advocates to academics to industry folks to public policy experts to technologists to regulators -- and me. I'm among the invited speakers and am looking forward to this unique chance to help shape public policy in such a critical area for our industry, and for consumers at large. So, I'm using today's column to solicit some ideas and advice on issues and points that you would like me to share with the commission and its staff. First, let me tell you some of the areas that I expect to be asked questions about:

Online behavioral advertising industry background. Online behavioral advertising is the topic of my panel. Having founded an early ad serving and ad network company and started one of the first behavioral ad companies, I've been around this space for a long time, but would certainly welcome sharing any unique insights or information on the general topic from your comments below.

Ad network "daisy chain." To best optimize each and every online ad avail, publishers, ad networks and ad exchanges frequently set up "daisy chains" of ad server calls -- where a number of different entities get to conditionally take over the delivery of an ad impression and then "hand it off" to another network if they don't have an appropriate ad for the site and/or user. This is complicated, and not well understood by many, but very important since each of the entities in the "daisy chain" usually sets its own cookies on the users' browsers.

Economic imbalances in the online ad ecosystem. Over the past several years, we have seen an explosion in the growth of online ad impressions. More users browse more pages more often, and social media generates exponentially more impressions than more traditional content-oriented pages. This has caused online impressions to grow much faster than online ad budgets, which has significantly cheapened the value of an individual, undifferentiated impression. This makes it very important for some publishers to work with data-driven companies that can increase the value of their impressions, which has changed the balance of economic power among a number of the companies in the online ad world.

Role of analytics. We've seen enormous advances in the power and complexity of the Web analytics used by publishers and commerce companies. Many are powerful behavioral marketing platforms in their own right. Many can interoperate with ad networks and network-based ad servers.

Importance of industry self-regulation. As the chair of the Interactive Advertising Bureau's public policy council, I have a particular perspective on the enormous efforts that have gone into the recently adopted and announced self-regulatory guidelines adopted by the IAB, DMA, AAA, ANA and others. Spurred to action by FTC chair Leibowitz, the industry is finally taking responsibility and much more comprehensive control for the protection of consumer privacy.

TV & mobile applications. As the Internet moves from the PC to mobile devices and the TV, so will data-intensive marketing services The rules that the FTC and others promulgate today for the PC will have to anticipate application to these platforms as well.

Value of the FTC in the process. We've been lucky that the actual tangible harm caused by abuses of consumer privacy by online companies have been few and limited so far. However, the prospect for abuses to become significant and substantial is very real. I think it's a great sign that the FTC has been proactive in this area -- from its original profile-based targeting guidelines almost a decade ago, to its Tech-Ade and online ad Town Hall events. We need their continued leadership here.

What do you think? Please use the comments below to tell me what you would like to tell the FTC about online privacy. What issues and points of view do you think are important?

commentary, regulation

6 comments about "What Should I Tell the FTC?".

Check to receive email when comments are posted.

Jeffrey Chester from CDD, December 3, 2009 at 7:46 p.m.
Dear Dave: You have provided a great outline for discussion at next week's panel, mirroring many of my concerns--inc. daisy chains ( CDD/USPIRG raised many of these issue in comments filed for this proceeding). I hope you can also discuss what you said in 2007: "What makes behavioral targeting special is the data, what makes behavioral targeting dangerous is the data."
Reply

Dave Morgan from Simulmedia, December 3, 2009 at 9:06 p.m.

Jeff ... I do plan to address the very issue you raise. As you know, while I am very passionate about the extraordinary power of the Internet and technology to improve people's lives, I am also quite cognizant of the need to be vigilant for abuses, particularly in the area of privacy.

Paula Lynn from Who Else Unlimited, December 3, 2009 at 10:03 p.m.

I really do not believe in self regulation of any industry, the BT industry most of all. It represents and devours power as it automatically attracts misuse and those who devour power. Whatever can be done now, will become more intense and devastating. And if you believe even a smigeon of history repeating itself, check out what powerful people and their cohorts have done to control before they eliminate/extinguish populations. No one/no company is entitled to know everything about everyone. Without a third party interloper to legislate limitations, one day those who desired to know all will desire to go back to paying multiple times what they will be paying for less directives. Another cost of freedom.

Robert Zager from iconix, inc., December 4, 2009 at 12:04 a.m.

The most important thing the industry needs to do is stop being sneaky. At one of the Town Hall Meetings, one of the Commissioners observed that good customer service needs data collection. He used the example of going into a store and the salesman knows your preferences. In that example, the customer knows what is going on. On the web, the customer doesn’t have a clue – and the BT industry likes it that way. Moreover, the Commissioner's saleman isn't being sneaky. That same Commissioner asked, "What harm is being done?" Being spied upon is a per se harm.

If the industry stopped being sneaky and viewed their data services as a customer service in which giving control to the consumer resulted in more trust and better customer service, that would be a great leap forward. Websites that track activity should allow the consumer to control what is being tracked. Why not engage the consumer in the profiling process and explain the benefits derived from the data that is retained? BT allows for the creation of a customer profile. Let the customer edit or delete that profile. Let the customer choose how long to retain purchase history and let the customer delete history at the customer’s whim. Let the consumer edit or delete his browsing history if that is retained.

The technical means to track people across the web are bounded only be creativity and sneakiness. Privacy disclosures are intentionally written to be incomprehensible. There are two ways to address this. First, there should be a limited number of plain English standard privacy provisions that are common across the industry. Not unlike the Creative Commons approach to copyright. If a site wants to use non-standard clauses, it should be required to use a standardized plain English warning followed by whatever incomprehensible misleading “disclosure” its lawyers care to write.

Second, the privacy mode of browsers should truly be private so that when a consumer believes he has taken measures not to be tracked, he isn't being tracked. And when he wants to be tracked, he can turn off private mode. If a website wants to deny its content to people using real privacy, that allows the consumer decide if the content is worth the compromise of privacy.

Ari Rosenberg from Performance Pricing Holdings, LLC, December 4, 2009 at 8:35 a.m.

Dave,

Robert Zagar's point is dead on -- our medium has a negative cloud over it because of our "sneaky practices" we have all accepted as "well that's online advertising" --

Case in point -- I use Firefox. In the upper right hand corner is my "search bar" which is set for Google. I use Yahoo! as my default home page. So when I type in a search query into my browser search bar and I don't hit the letters on my keyboard squarely, my search query drops down from the search bar in my browser right into the Yahoo search bar on my Yahoo page.

That's sneaky -- that's deplorable, and that's just another example of how we as a medium take control of users instead of allowing them to control us.

I understand the inherent benefits of targeting but they have created a gateway for practices like this.

Good luck in DC!

Ari

Joe Kutchera, December 6, 2009 at 11:23 p.m.

One possible solution to the "sneaky practices" mentioned by Ari and Robert in the previous comments here could be to have a greater and clearer brand connection for consumers regarding who is collecting the data, how they are using it and the services the publisher offers in return to consumers. For example, Gmail users see the ultra-personalized ads on the side of their email and while it makes a few people uncomfortable, the vast majority of users know that Google does this and in exchange consumers receive unlimited email storage. It's not a face-less company collecting their data, it's Google.

Another example could be Facebook connect, which offers customized, easier log-ins across different sites and in exchange can serve ads based upon a user's profile.