• by Steve Smith , Staff Writer @popeyesm, November 28, 2008

Formed last week in Washington, D.C, the  Future of Privacy Forum is a coalition of online ad industry executives, privacy advocates and regulators. According to Jules Polonetsky, former AOL Chief Privacy Office and co-founder of the group, the Forum will serve as a think tank on privacy issues embracing all stakeholders. AT&T is providing initial funding, and the Forum plans to work through roundtables, conferences, white papers, briefings for policy makers, and research reports to the industry. We explored with Polonetsky the state of the privacy discussion in online marketing and what role the Forum might take in moving the discussion forward.

 

Behavioral Insider: What makes this project necessary now?

Jules Polonetsky: I think there really is a middle ground that hasn't existed to date. There are industry groups that do a good job at working to get some consensus among lots of different kinds of companies and business models to come up with a common denominator that works for a wide range of companies. There are advocacy groups that drive a strong point of view about limiting use of consumer data. There really isn't a group that comes from the industry, appreciates the value of using data for personalization, in supporting the content eco-system, in relevant advertising for both advertisers and consumers, but who do think that there is a host of things that are business-practical but would move the privacy ball forward.

There are CPOs at lots of the ad networks and data companies that have wish lists they are hoping to get done but are very hard to get done. It is not necessarily the first project behind more revenue-generating projects. It can be hard to do it when the eco-system doesn't well support it. I don't know how many conversations I have had over the years over, wouldn't it be great if people came to the site and the publisher did X, Y, or Z? And our various product people would say they don't want to be the only ones who do that.

BI: Well, what about the current situation makes this Forum relevant?

Polonetsky: There is a chaotic, frenetic eco-system. People can buy through an ad exchange, and the buyer and the seller and analytics company and the third parties and the chain of multiple ad networks down the line end up being involved. It can be hard for any one responsible actor who has the relationship with the user to say here is what is truly going on.

And that was the challenge that I certainly faced overseeing ad network policies in my earlier roles. By stepping out of the fray, we can ask, if lots of the business-practical but privacy-minded CEOs or CPOs at various companies were starting day one and trying to do this right and in a clearer simpler way that gave users transparency, control and was clearly indicative of the value -- how would you do it?

Those are not the conversations that can easily happen in other forums. [There can be] a little leadership and willingness to step out of the comfort zone and a way to engage some of the good critics who are practical and get some of their thinking in. That is why our advisory board has some of the real good privacy advocacy thinkers who want to see businesses succeed but put the users in control.

BI: How do you execute on this plan?

Polonetsky: We are going to pull together some of the relevant players to talk about the positive things that we can throw up on the wall. What are people already doing and what can others propose that move the ball forward?

Let's talk about ad server log file data deletion. Nobody needs those forever. We know the privacy advocates don't think it is a good idea that it be there forever. No ad campaign lasts that long, no cookie lasts that long. Why does all the data get kept for such a long period of time? That ought to be a no-brainer to solve that. Let's not wait until that external pressure or a crisis ends up forcing the question. Let's be responsible and do some of things that won't even break the business model but will move the meter forward.

BI: What would progress be? Standards?

Polonetsky: Progress would be users who visit sites where robust activity is happening, personalization and sharing across networks, understanding and valuing and having some control over the way their data is used. How one gets there, I think that is where I would like the debate to be.

A lot of the debate now is whether there needs to be an opt-in, because no one will do it? Or how about bigger notice someplace? Step one -- I think that outside of a narrow insider niche in the industry there is little understanding of how the nuts and bolts actually work. The advocates don't come to the insider conferences and they aren't sitting there when folks come to pitch all the things we have all been briefed on over the years. There is a huge knowledge gap between the people who understand what is possible and feasible and the policy-makers and advocates and regulators.

BI: But one of the points of disagreement between advocates and the industry is whether this data is anonymous or if it can theoretically be linked back to an identity.

Polonetsky: The key focus for us will be examining what is meant by personal and what is meant by anonymous, and when it actually matters.

BI: But how much do you think the industry needs to learn from the privacy advocates about how people define their own privacy?

Polonetsky: There are lots in the industry who have thrown a cloak over it, saying 'it's anonymous, so let's not worry about it.'

But there is a really wide range of activity. There is a lot going on that is described as anonymous because at the end of the day there is no name and phone number for a user. But a wide range of offline specific user data can be brought in and correlated and anonymized.

Even within the industry, there is a wide range of what people even mean when they say anonymous. So helping the industry figure out if you go through these efforts and encryption and temporary memory and aggregation and this sort of process in place, sure go ahead and claim that is anonymous. So I think it would be valuable to have some clarity so that the business and data folks who rely on anonymity have a consistent understanding.

However, to argue that since it's anonymous it doesn't matter misses the point. Anonymous doesn't mean it doesn't matter. It means you have taken a step but there still are other rules.

BI: We often talk about privacy and personal data in terms of revealing information we don't think others have a right to know. But another connation is that personal information is personal property. Any plans on engaging the prospect of users bartering with their own data?

Polonetsky: When you talk to tech-savvy folks and say, put people in control to take their data with them and give them the ability plug it in, it does seem to have inculcated tech folks with the notion that user control is a feature. It is not just privacy compliance.

One of the problems is that this eco-system has been kludged together. So the idea of people's data being bartered creates a challenge of. who has accountability to the user for what is going on? Is data being sold and bartered by sites that say that they don't do so or sites that say nothing about it? Who is worrying about whether the user is being told? There are some eco-system problems and the challenge of getting all kinds of models that each have a little piece of the user interaction is a bear of an issue.

BI: But your goal is not to set industry standards.

Polonetsky: We don't intend to be a self -regulatory association. Our goal is to put out ideas and options and tools in the hope that others, policy-makers, industry groups or companies adopt those. We won't create a seal or be the ones to say here is the code of conduct. We will try to be an online think tank that teases out the good ideas, sets what is do-able on the privacy and business side of the equation, and can point to stimulating and leading progress forward.