Security

Balancing the needs for online advertising and privacy

Michael Kassner gets schooled on issues surrounding the advertising versus privacy debate. It's not as black and white as you might think.

I have spent considerable time researching and writing about the tug of war between purveyors of online advertising and privacy pundits. Others have as well, each making solid points for their chosen beliefs.

But, rhetoric helps no one.

Something needs to be done. If trust and cooperation disappear, the Internet — as we know it — is lost. Mulling that over during one of my swims at the Y, I had an epiphany: Instead of all or nothing, why not figure out:

What is needed for advertising and privacy to coexist on the Internet?

Based on the following definitions:

  • Internet advertising: Is a form of promotion that uses the Internet to deliver marketing messages to attract customers.
  • Internet privacy: Involves the exercise of control over the type and amount of information revealed about a person on the Internet and who may access said information.

And conditions:

  • If people want to visit websites for little or no cost, advertising is needed.
  • If websites are going to advertise, visitor privacy has to be insured.

I wrote an explanatory email, included my "question", and sent it to sources of mine I knew to be involved in this discussion. Feeling good, real good, about how I was going to solve this, I waited for all the responses. And waited. And waited.

My teaching moment

If you are thinking, "He must be nuts"; most of the people I sent the email to agree with you. I suspect the few that responded, did so in hope of this being a "teaching moment" for yours truly.

It was.

First lesson

Lenny Zeltser, good friend and well-known security researcher, started the ball rolling. He took me to task on my conditional statements. He pointed out that privacy as a concept is relative.

Zeltser: First, I'd like to comment on your statement: Privacy has to be insured. This implies that privacy is an absolute notion we must ensure. I'd argue that the notion of privacy is relative. It's relative with respect to the times and more importantly with respect to the community and context in which it's discussed.

It's fascinating to compare the privacy norms of Internet users that are in their teens and twenties to those who are older. One might want to simplify that teens' openness in sharing information that their parents believe should be private constitutes the "death" of privacy among the new generation.

In fact, the younger generation is developing elaborate behavioral norms to adjust to the increasingly open and inter-connected nature of the world in which they are growing up. I touched upon this in my post, "Learn the Future of Privacy and Social interactions from Teens."

Next, Lenny tackled my assumption that advertising is required:

Zeltser: Another premise that you state as a given is, ‘advertising is needed'. I agree that advertising isn't going away any time soon. But, let's not presuppose that advertising is the only way of providing a revenue stream to the entities offering content to consumers who expect to visit the sites without paying money.

The consumer might be willing to ‘pay' for content in many ways, one of which is advertising. Another might involve the visitor lending his systems CPU and battery to performing computations while reading the content. A consumer may also agree to a subscription fee.

Finally, Lenny got to my question:

Zeltser: I bring up these points to highlight the ever-changing nature of privacy norms and expectations. Keeping that in mind, my answer to the question — What is needed for advertising and privacy to coexist on the Internet? — is yes, even though I don't know what exactly such middle ground would entail.

Second lesson

To be honest, I had no previous contact with Dr. Aleecia M. McDonald — renowned privacy expert. I have read many of her papers, all of them about this very subject. So, I was excited when I received a response from her.

Then I read the email.

Dr. McDonald wondered if I had a clue about online advertising and behavioral targeting. Okay. First Lenny's email, now this, I wisely responded that I didn't.

I'm guessing my confession wasn't expected. She graciously spent several hours on a busy Saturday explaining the current situation with regards to online advertising and privacy.

Kassner: Lenny Zeltser mentioned that privacy has different meanings for different people. You seem to be in agreement. Would you explain, please? McDonald: We tend to talk about user privacy as if users were all one uniform group. They are not. The research that I did with Lorrie Faith Cranor (published papers) found about 18% of study participants want the benefits of behavioral advertising.

They want ads that are relevant to them. In interviews in the lab, some people were quite eager. For them, the future cannot come fast enough. However, they do not typically understand the privacy implications and mistakenly think their privacy is protected by laws that do not exist.

On the other side, 20% of study participants were very concerned with privacy. They recoil from the idea of data about their web browsing going out to advertisers, and in the lab there were people very concerned and passionate about their right to privacy.

But again, they do not understand how much benefit they derive from personalization, even simple things like frequency capping.

Now, to the 62% in the middle, I think of them as the swing voters of behavioral advertising. What we heard was, "Why would we want better ads when ads are the things I ignore?" They do not see any benefit to data going to advertisers. Perhaps with more information they would change their minds—into either the pro-target or pro-privacy groups.

Kassner: I get the impression there is a disconnect between what people believe to be the case and what actually is. Did that come from your research? McDonald: Generally, people are happy with the idea of viewing ads to support seeing free content. They understand it, and like the trade-off. It is a familiar structure seen with TV, magazines, and newspapers.

Most people do not understand how much data and tailoring off-line advertisers currently work with. To make matters worse, people feel the online world is similar to the offline world: Ads for free content-not knowing that it's ads plus their data.

When they hear data is part of this equation, people typically feel this is not the deal they agreed to at a societal level. It violates their mental models of how advertising works.

In the lab, people argued with me and said behavioral advertising could not exist. One woman said it sounded like something her "paranoid friend" might dream up. That study was about two years ago, and people are better informed today, but many misconceptions still remain.

Kassner: You mentioned that behavioral advertising is not that big a deal. That surprised me, having written extensively about it. What did you mean by that? McDonald: Interestingly, it appears that behavioral advertising is not a large part of the online ad market today. Numbers overseas are around 4%. In the US, it is a little more, but less than 10% of online ads are behavioral. It is hard to get good numbers, but the Internet-advertising ecosystem is still predominately contextual ads.

Chris Hoofnagle makes a very good point about balance. Does it make sense to amass so much data about every uniquely-identifiable user in order to serve such a small percentage of ads? Is that a good trade at a societal level?

Kassner: You brought up something that really interests me. Advertisers are not in agreement about behavioral advertising? McDonald: Users are not the only non-uniform group. Advertisers are just as divided about behavioral advertising:
  • Some ad networks specialize in behavioral ads. For them, this is a fight for survival. Anything that changes behavioral ads looms as a threat.
  • Other ad networks specialize in contextual ads and those that do not require identifying users — search ads. For them, if they curtail behavioral advertising, they improve their ability to compete in the market.
Kassner: Are websites serving content affected by this? McDonald: Most of the content on the Internet is not advertising. For a first-party website like TechRepublic, it may not matter if ads are targeted, contextual, or random. All that matters is that the money flows. And even there, first-party sites are not a monolithic block.
  • If a site is just me blogging in my basement, then there is no special value to my site and it is just like all the other blogs out there. Since my site is not special, I want to make money on the value of the visitors, which is what targeted ads do.
  • But if the first-party site is particularly prestigious, then I want to make money based on the value of having ads on my special site.
Kassner: Do you see a downside for content websites that offer behavioral advertising? McDonald: Behavioral advertising kills the value of brands for first-party sites. If an advertiser can show the same ad to a viewer on a basement blog for half the cost as on a top tier site like TechRepublic, how do you think that will end for TechRepublic? Here's how:
  • Short term: TechRepublic may get a boost from better click-through rates on behavioral ads leading to slightly-higher profits.
  • Long term: TechRepublic can expect to become a commodity, no better than any of millions of other sites out there.

The point to all of this is not that behavioral ads are good or bad for the economy. The point is:

  • Good or bad very much depends upon where you sit.
  • Behavioral ads are such a small component that we have not seen this all roll out.

It may not be possible to answer some of the larger financial questions yet.

Kassner: I've been saving Do Not Track (DNT) for last. You say it could play a significant role, helping both consumers and advertisers. How is that possible? McDonald: Much of the discussion around DNT is from the perspective of the FTC goals of transparency, choice, and control for users. That is great. I hope DNT will promote all of their goals.

If you turn it around and think about DNT from an advertiser's vantage point, DNT has the potential to make them more money. Right now there are far fewer behaviorally-targeted ads than available advertising slots.

That gives advertisers a choice. They can push behavioral ads to the consumers who want them, creating higher profits than without a DNT mechanism to help them know their customers better.

Meanwhile, users who are in the pro-privacy segment get a mechanism — DNT — to help them remain private.

Kassner: Any further thoughts, Aleecia? McDonald: As to your "question," the way we get benefits from targeted ads and privacy is when there is a system that is both profitable and transparent. Both are necessary. DNT has the potential to move both goals forward at once.

Final thoughts

Wow. I have lots to think about. Talk about being simplistic. Still, there is room for hope. And, my question seems to have merit.

I'd like to thank Lenny and Aleecia. I see only benefits from their instruction in the ways of the world.

About

Information is my field...Writing is my passion...Coupling the two is my mission.

Editor's Picks