Balancing the needs for online advertising and privacy

Michael Kassner gets schooled on issues surrounding the advertising versus privacy debate. It's not as black and white as you might think.

I have spent considerable time researching and writing about the tug of war between purveyors of online advertising and privacy pundits. Others have as well, each making solid points for their chosen beliefs.

But, rhetoric helps no one.

Something needs to be done. If trust and cooperation disappear, the Internet -- as we know it -- is lost. Mulling that over during one of my swims at the Y, I had an epiphany: Instead of all or nothing, why not figure out:

What is needed for advertising and privacy to coexist on the Internet?

Based on the following definitions:

  • Internet advertising: Is a form of promotion that uses the Internet to deliver marketing messages to attract customers.
  • Internet privacy: Involves the exercise of control over the type and amount of information revealed about a person on the Internet and who may access said information.

And conditions:

  • If people want to visit websites for little or no cost, advertising is needed.
  • If websites are going to advertise, visitor privacy has to be insured.

I wrote an explanatory email, included my "question", and sent it to sources of mine I knew to be involved in this discussion. Feeling good, real good, about how I was going to solve this, I waited for all the responses. And waited. And waited.

My teaching moment

If you are thinking, "He must be nuts"; most of the people I sent the email to agree with you. I suspect the few that responded, did so in hope of this being a "teaching moment" for yours truly.

It was.

First lesson

Lenny Zeltser, good friend and well-known security researcher, started the ball rolling. He took me to task on my conditional statements. He pointed out that privacy as a concept is relative.

Zeltser: First, I'd like to comment on your statement: Privacy has to be insured. This implies that privacy is an absolute notion we must ensure. I'd argue that the notion of privacy is relative. It's relative with respect to the times and more importantly with respect to the community and context in which it's discussed.

It's fascinating to compare the privacy norms of Internet users that are in their teens and twenties to those who are older. One might want to simplify that teens' openness in sharing information that their parents believe should be private constitutes the "death" of privacy among the new generation.

In fact, the younger generation is developing elaborate behavioral norms to adjust to the increasingly open and inter-connected nature of the world in which they are growing up. I touched upon this in my post, "Learn the Future of Privacy and Social interactions from Teens."

Next, Lenny tackled my assumption that advertising is required:

Zeltser: Another premise that you state as a given is, ‘advertising is needed'. I agree that advertising isn't going away any time soon. But, let's not presuppose that advertising is the only way of providing a revenue stream to the entities offering content to consumers who expect to visit the sites without paying money.

The consumer might be willing to ‘pay' for content in many ways, one of which is advertising. Another might involve the visitor lending his systems CPU and battery to performing computations while reading the content. A consumer may also agree to a subscription fee.

Finally, Lenny got to my question:

Zeltser: I bring up these points to highlight the ever-changing nature of privacy norms and expectations. Keeping that in mind, my answer to the question -- What is needed for advertising and privacy to coexist on the Internet? -- is yes, even though I don't know what exactly such middle ground would entail.

Second lesson

To be honest, I had no previous contact with Dr. Aleecia M. McDonald -- renowned privacy expert. I have read many of her papers, all of them about this very subject. So, I was excited when I received a response from her.

Then I read the email.

Dr. McDonald wondered if I had a clue about online advertising and behavioral targeting. Okay. First Lenny's email, now this, I wisely responded that I didn't.

I'm guessing my confession wasn't expected. She graciously spent several hours on a busy Saturday explaining the current situation with regards to online advertising and privacy.

Kassner: Lenny Zeltser mentioned that privacy has different meanings for different people. You seem to be in agreement. Would you explain, please? McDonald: We tend to talk about user privacy as if users were all one uniform group. They are not. The research that I did with Lorrie Faith Cranor (published papers) found about 18% of study participants want the benefits of behavioral advertising.

They want ads that are relevant to them. In interviews in the lab, some people were quite eager. For them, the future cannot come fast enough. However, they do not typically understand the privacy implications and mistakenly think their privacy is protected by laws that do not exist.

On the other side, 20% of study participants were very concerned with privacy. They recoil from the idea of data about their web browsing going out to advertisers, and in the lab there were people very concerned and passionate about their right to privacy.

But again, they do not understand how much benefit they derive from personalization, even simple things like frequency capping.

Now, to the 62% in the middle, I think of them as the swing voters of behavioral advertising. What we heard was, "Why would we want better ads when ads are the things I ignore?" They do not see any benefit to data going to advertisers. Perhaps with more information they would change their minds--into either the pro-target or pro-privacy groups.

Kassner: I get the impression there is a disconnect between what people believe to be the case and what actually is. Did that come from your research? McDonald: Generally, people are happy with the idea of viewing ads to support seeing free content. They understand it, and like the trade-off. It is a familiar structure seen with TV, magazines, and newspapers.

Most people do not understand how much data and tailoring off-line advertisers currently work with. To make matters worse, people feel the online world is similar to the offline world: Ads for free content-not knowing that it's ads plus their data.

When they hear data is part of this equation, people typically feel this is not the deal they agreed to at a societal level. It violates their mental models of how advertising works.

In the lab, people argued with me and said behavioral advertising could not exist. One woman said it sounded like something her "paranoid friend" might dream up. That study was about two years ago, and people are better informed today, but many misconceptions still remain.

Kassner: You mentioned that behavioral advertising is not that big a deal. That surprised me, having written extensively about it. What did you mean by that? McDonald: Interestingly, it appears that behavioral advertising is not a large part of the online ad market today. Numbers overseas are around 4%. In the US, it is a little more, but less than 10% of online ads are behavioral. It is hard to get good numbers, but the Internet-advertising ecosystem is still predominately contextual ads.

Chris Hoofnagle makes a very good point about balance. Does it make sense to amass so much data about every uniquely-identifiable user in order to serve such a small percentage of ads? Is that a good trade at a societal level?

Kassner: You brought up something that really interests me. Advertisers are not in agreement about behavioral advertising? McDonald: Users are not the only non-uniform group. Advertisers are just as divided about behavioral advertising:
  • Some ad networks specialize in behavioral ads. For them, this is a fight for survival. Anything that changes behavioral ads looms as a threat.
  • Other ad networks specialize in contextual ads and those that do not require identifying users -- search ads. For them, if they curtail behavioral advertising, they improve their ability to compete in the market.
Kassner: Are websites serving content affected by this? McDonald: Most of the content on the Internet is not advertising. For a first-party website like TechRepublic, it may not matter if ads are targeted, contextual, or random. All that matters is that the money flows. And even there, first-party sites are not a monolithic block.
  • If a site is just me blogging in my basement, then there is no special value to my site and it is just like all the other blogs out there. Since my site is not special, I want to make money on the value of the visitors, which is what targeted ads do.
  • But if the first-party site is particularly prestigious, then I want to make money based on the value of having ads on my special site.
Kassner: Do you see a downside for content websites that offer behavioral advertising? McDonald: Behavioral advertising kills the value of brands for first-party sites. If an advertiser can show the same ad to a viewer on a basement blog for half the cost as on a top tier site like TechRepublic, how do you think that will end for TechRepublic? Here's how:
  • Short term: TechRepublic may get a boost from better click-through rates on behavioral ads leading to slightly-higher profits.
  • Long term: TechRepublic can expect to become a commodity, no better than any of millions of other sites out there.

The point to all of this is not that behavioral ads are good or bad for the economy. The point is:

  • Good or bad very much depends upon where you sit.
  • Behavioral ads are such a small component that we have not seen this all roll out.

It may not be possible to answer some of the larger financial questions yet.

Kassner: I've been saving Do Not Track (DNT) for last. You say it could play a significant role, helping both consumers and advertisers. How is that possible? McDonald: Much of the discussion around DNT is from the perspective of the FTC goals of transparency, choice, and control for users. That is great. I hope DNT will promote all of their goals.

If you turn it around and think about DNT from an advertiser's vantage point, DNT has the potential to make them more money. Right now there are far fewer behaviorally-targeted ads than available advertising slots.

That gives advertisers a choice. They can push behavioral ads to the consumers who want them, creating higher profits than without a DNT mechanism to help them know their customers better.

Meanwhile, users who are in the pro-privacy segment get a mechanism -- DNT -- to help them remain private.

Kassner: Any further thoughts, Aleecia? McDonald: As to your "question," the way we get benefits from targeted ads and privacy is when there is a system that is both profitable and transparent. Both are necessary. DNT has the potential to move both goals forward at once.

Final thoughts

Wow. I have lots to think about. Talk about being simplistic. Still, there is room for hope. And, my question seems to have merit.

I'd like to thank Lenny and Aleecia. I see only benefits from their instruction in the ways of the world.


Information is my field...Writing is my passion...Coupling the two is my mission.


Well done! Thank you very much for professional templates and community edition sesli chat sesli sohbet


Interesting that I don't see a hidden tracking notification icon on this site. Let's look at the servers THIS page is trying to contact, besides,,,, and (which are all CBS Interactive sites): Firefox's NoScript extension really lays it out: (interesting that they use a site that will gives them lots of data about those who click on that link - The article is about as self-serving as one can get, but that's not a surprise when it's published by a business. Where's the guarantee that they'll live up to their "responsibility"? Gee, there isn't any.). (interesting that WebOfTrust tells me the site has a "poor reputation", and that when doing a domain name lookup I get no information: the registrant is Domains by Proxy, Inc., and it's hosted on Amazon's EC2 cloud. Really trustworthy!) (aka Google. Interesting that nslookup of this domain fails. There's no site at this address, there's no reference to it in the HTML. Don't know the details; does anyone? Could it be related to...) (no comments needed for this audience, I believe) (from their site: "It's all bacon There's potential in every audience. Are you getting premium value from each? AUDIENCE MEASUREMENT AND TARGETING FOR PUBLISHERS, NETWORKS & BRANDS") (owned by From their site: "Your Data Performing at Scale. BlueKai's data-centric approach to audience targeting has made the marketer's dream of "reaching an audience anytime anywhere" a reality. Manage, analyze and activate your private data assets with the BlueKai Platform to ensure smarter and higher-performance marketing. Acquire anonymous 3rd party audience data from the world's largest marketplace, the BlueKai Exchange and reach more than 300M unique users across the entire marketing funnel. Most importantly, it's anchored by BlueKai Intent, the largest aggregation of in-market shopping data available on the Internet. BlueKai. Your platform for data management, acquisition and analytics." Add to that the fact that when this TR page loaded it tried to contact A. C. Nielsen Co. 35 times, which NoScript didn't see but other software blocked. Then there's this little bit from the html code: More tracking internally on the techrepublic servers, eh? Techrepublic needs my IP address FOUR TIMES? SO WHERE"S THAT ICON AGAIN, TR??? .


???With great power comes great responsibility??? - A closer look at online privacy and the handling of personal data


Should be "Balancing the wants of online advertisers and the need for personal privacy"


I have a grounding in thinking that my privacy is critical. But any agent in the cloud we interact with could be distributing information on us and those interactions. For me it leads to paranoia and extra time spent reducing my profile. What I worry about Do Not Track is that the terms of use for any arbitrary site may just claim as they do now that the information will be kept and shared only with their "Partners" otherwise known as whomever they feel like.


blocked A.C. Nielson Co. 35 times? Must be your firewall. I was already aware of the other things you mention, but if that is what it takes to keep TechRepublic going, I'm willing within reason. After all, just like you said, it can be controlled with No Script, Ad Block Plus, and a good UTM device. As inaccurate as Nielsen ratings have been in the past, I wouldn't pay them a dollar for anything they gathered!

Michael Kassner
Michael Kassner

I am working on a new article about Do Not Track with several privacy experts. Next, I am assuming that CBS Interactive is not a member of the organization. I was curious about this: "The article is about as self-serving as one can get, but that's not a surprise when it's published by a business. Where's the guarantee that they'll live up to their "responsibility"? Gee, there isn't any.)" Are you referring to the above article that I wrote?


to giving the public at least the feeling of transparency. It will take longer for them to learn about it and trust it. It has gotta be an improvement. Thanks for the link!

Michael Kassner
Michael Kassner

Having differences of opinion about it, reinforce my goal for this article. It is one complicated subject.


With your mind made up; whereas, the story comes wondering how to mind it.

Michael Kassner
Michael Kassner

The most interesting statistic from Aleecia was that of behavioral advertising being less than 10 percent. It could be just a momentary thing, due to its expense and privacy issues.


I wouldn't refer to your blog posting that way. I'm sorry if I was less than clear. My comment was regarding, one of the sites contacted by the original web page. They also posted a comment to your article, with this link: I was referring to that the article, not yours. DoubleVerify - and, by reference, all the other information scrapers and aggregators - claims that they have "great responsibility" because they have all this personal data. Sorry, but they're all humans, and to assume the people who work at these businesses and corporations will be "responsible" with our personal information is absurd. The only "responsibility" they may have is to their owners and customers. So they have a great "responsibility" to make profits and to serve the needs of those who buy their services (and data), like CBS. Web surfers aren't customers. The only way we can protect ourselves is to not allow them to have the information in the first place. Best to refer to Violet Blue's excellent postings: Think they're not related? Think again. They're all people trying to make money, and one way to make money is to sell your data. Referring to THIS comment response page that I'm currently on, writing this reply: Why would - "Glam: Fashion, Celebrity Fashion, Style Tips for Women, Fashion Week Models Photos" - be one of the sites NoScript is blocking, and DoubleVerify is gone from this page (

Michael Kassner
Michael Kassner

I and my story are wondering, while we wander through the mine field of advertising versus privacy.

Michael Kassner
Michael Kassner

I respect your opinion, and if I messed up I wanted to fix it.

Editor's Picks