April 22, 2008

"What sort of data should be off limits to ad placement systems"? Earlier this month the Federal Trade Commission closed its public comments period on behavioral advertising. Having followed this rather sad tragedy (3/4, 3/11, 3/18, 3/25 fillips), we are badly in need of some comic relief.

Reporting on the Network Advertising Initiative, Saul Hansell has kindly obliged us (*). Now we know warts are fair game but Bob Dole's dysfunction (1) is not to be touched with a ten foot pole. So is cancer, but not Parkinson's disease. The clercs behind the Initiative have had "heated discussions", we are told, as they devised these lists to better protect the common folk. Who thought the Middle Ages were a thing of the past? Although methinks Marx had it right. From the hope to achieve eternal salvation down to the lure of getting better ads, this repetition is a farce

At court as on stage, fools often used the indulgence of their audience to utter impolitic truths. While sharply critical of the FTC's lack of resolve facing Google and its gang, I compliment it for having at least open a public debate (2). It has had the merit of highlighting four important lessons.

First, the difference between so-called personally identifiable information (PII) and its contrary, non-PII, is highly misleading. By focusing exclusively on the merger of non PII with PII, documents (3) imply that, in the absence of PII, non PII is safe. This however is a conjurer's legerdemain which occults the real risk. Merge enough non personally identifiable data and a personally identifiable profile will emerge. This is the moral of the AOL debacle, two years ago. Given the scale at which it is aggregated, all consumer data must be considered identifiable.

Another sleight of hand is involved. Everybody is up in arms about personal data collection and the relative merits of consumer opt in versus consumer opt out. Though data collection is important in principle, what counts in practice is how it is used to target the "right" ad, i.e. the most lucrative. Even when too lazy to care about privacy notices, consumers wake up at display time, their attention caught by the ad and what its selection implies. Never mind how the data came to be collected, enable the consumer to check the profile used for targeting when and where targeting occurs. As the Facebook about face showed last year, make personalized advertising truly visible and collection will be tamed.

Mandating access to one's profile is indeed what makes New York Assemblyman Richard Brodsky's bill (4) so bold. But, as our second lesson suggests, focusing on data collection rather than targeting undermines the power of such a measure. At issue is how to ensure a consumer is entitled to access a particular profile as truly being his or her. The bill states that to find out what an ad network knows about you, you must first give it your most valuable identity information. We encountered such a Gribouille's scheme before. Notice how the paradox vanishes as soon as access is mandated at ad display time. To refuse a target access to the profile behind the ad here and now is to admit to the risk of a mistake. But at display time the responsibility for making sure a profile applies to a target lies squarely with the site presenting the ad and its subcontractors, not the user.

The last lesson illustrates the futility of self-regulation. I was puzzled as the Network Advertising Initiative kept insisting behavioral advertising is harmless to the consumer while making up a list of sensitive information, including cancer and sex-related conditions. If there is no risk, it does not matter whether some personal information is sensitive or not, does it? How naive of me. The Initiative is very concerned about risk, not to the consumers' privacy though, but to its members' reputation (5). What if some consumers were denied health insurance or expose to the trauma of public ridicule because of a mistake? Even Google can be bankrupted by consumers. The "heated discussions" reported by Saul Hansell are about whether the profits from each ad type are worth the risk of a boycott. Forget the sheep, the wolves are here to look after the wolves.

As the Titanic, marketing continues to hurtle towards the iceberg of privacy. Riveting but avoidable tragedy.

Philippe Coueignoux

• (*) .............. Tracking Diseases To Send Drug Ads, by Saul Hansell (New-York Times) - April 14, 2008
• (1) for readers outside America, Bob Dole is a former US political figure who appeared in Viagra commercials after his retirement.
• (2) the FTC site lists public contributions received during the initial and final consultation periods, including...
• (3) ... e.g. the Network Advertising Initiative comments to the FTC (#38 in the final feedback).
• (4) New York State Assembly bill 9275 "establishing the third party internet advertising consumers' bill of rights" (session 2007-2008, June 19, 2007)
  - note: the link will become obsolete at the end of the session
• (5) see page 27 of the document quoted in (3)