What is Behavioral Advertising?

Behavioral Advertising is when advertisers use information gathered from cookies placed on a user’s website and information gathered from user’s public profiles to target a user with a specific advertisement. Numerous websites sell their user’s public information or place cookies on user’s computers to track users and their buying behavior. Advertisers claim behavior advertising provides readers with better targeted ads and helps users get what they want.

For example, assume I create the following profile on a social networking site:

“My favorites musicians are the Kings of Leon and Michael Jackson.”

I can expect an advertisement will pop up displaying the “unheard album of the late and great Michael Jackson” for purchase or concert tickets for next time the Kings of Leon are in Chicago. The likelihood I might be interested in these sorts of advertisement is high because I’ve already revealed “I love the Kings of Leon” and “Michael Jackson, may he RIP was the greatest artist to ever live!” in my online profile.

It doesn’t seem so bothersome that the websites users visit gather information on them and sell it to third party advertisers when advertisers are providing users with information they want.  But what about private information that users don’t want to share or don’t know they are sharing? For example, private emails?

3 Geeks and a Law Blog wrote an article not too long ago about free email accounts targeting their users with advertisements based on the subject of the emails. Does this mean providers of free email service can share the private content of my emails to third party advertisers even when the content is protected by a confidentiality notice?

For example, three weeks ago I was sick and I went to the doctor’s office. I had some tests run and I checked the “email me my results” box on the forms. My doctor emailed me back the results a few days later with a confidentiality note attached. I was shocked to realize that that email had advertisements for doctors, hospitals, and even plastic surgeons advertised on the side of my inbox.

At first I thought my free email service was only reading the subject lines, but I opened an email from my mom with the subject line “Also…” and realized that that private email had also been scanned for content and the appropriate advertisements were displayed at the side of my inbox to match the subject matter of the email. I’m sure many of you, like me have often thought that your email is safe and secure, but it seems it’s not. I’ve had my email account for years and when I think about the massive amounts of information my free email account has probably scanned and sent off to third party advertisers, I get worried. How much of that information gets stored? Kept? Sold? Re-used? Who has read the content of my very private emails?

How do advertisers get this information?

Professor Edward W. Felten a professor of Computer Science and Public Affiars at Princeton University recently spoke before the Energy and Commerce Committee on this topic and was among Privacy People from Google, Inc., Facebook, Yahoo, Inc., The Network Advertising Initiative, Precusor LLC, and The Center for Digital Democracy. Professor Felten explained that there are three main ways advertisers gather this information: (1) Content Providers, (2) Linking Activities Across Multiple Sites, and (3) Third Party Commercial Databases.

(1) Content Providers

Content Providers like Google, Facebook, Yahoo, and all other providers of free services collect data from us when we sign up for their services. Think about how many times you’ve entered your name, age, sex and email address into a form field when signing up for a free service. Think about how many times you’ve changed your marital status on Facebook throughout the years (commonly done as a joke by those not actually married) or how many times you’ve updated your favorite music on MySpace. What about how many times you’ve entered in your zip code to Weather.com to get the latest updates? What about checked the Terms and Conditions without reading them on a website? Ever actually read a Privacy Policy? Ok, I’ll admit it – I had never until I took a class last semester where we were required to read one in class. Now that I’ve painted a picture for you of the numerous ways content providers can, and do, collect your data maybe you will see how this information gets collected.

(2) Linking Activities Across Multiple Sites

A web cookie is a way for content providers, web advertisers, and websites to keep track of who you are when you’re surfing their site. Have you ever typed in Amazon.com and been magically signed in like they remembered you!? That’s called a cookie. Your information is stored on a cookie (usually in number form) and when you visit a website it “remembers” what you last browsed, the last items you purchased, your name and account information. It’s not magic, unfortunately.

“Once a website gathers this information through a cookie, it can link the information to other information about you (like the content you voluntarily provided when you set up your account) such as your credit card number, your age, sex, zip code, and email address. These cookies can also track other websites you visit and provide information as to what content you shared with other websites. For example, say I log into my Google account and search for plane tickets to Austin, Texas. I then decide to write my best friend a message on a social networking site to double check if she’s going to be in town before I book my flight, web cookies can transmit this information to online advertisers who can now build a more complete understanding of my “customer profile” or who I am. Customer profiles provide advertisers with an understanding of what you and I like and want and are seeking. (My friend and mentor, John Merritt, spent a great deal of time explaining “Customer Profiles” to me. Here is a great graphic he created to help me understand – hopefully it will help you as well!)

(3) Third Party Commercial Databases

Third party databases provide data to online advertisers through customer information databases that collect information that can’t be easily found through just web cookies. Third party databases can provide information as in depth as demographics, family information, credit history, etc. This information is then used to create a much more complex “customer profile”. From this information and the information its purchased from content providers and linking activities across multiple sites, an advertiser has a very clear picture of who you are.

The Overall Picture

In case you are a visual learner, I created this flow chart.

Aren’t there laws to protect me from this?

It seems that the Electronic Communications Privacy Act, 18 U.S.C. 2510-2521 should prevent users from having their information bought and sold to advertisers, especially their email content. So how is it that free internet services are getting away with selling user information to third parties?

The ECPA states that an interference with a wire transmission must be willful and with intent. The ECPA protects against the interception of content by an individual during the communication of a wire transmission. In the online world, a physical entity does not sit behind a desk and inspect a user’s free email account for content and then select appropriate advertisements. Rather, an advertiser often utilizes software or an algorithm that actually reads the content, or cookie attached to a user’s computer, and displays the appropriate advertisements.

To combat the behavioral advertising’s lack of transparency, the House of Representative’s Energy and Commerce Committee heard testimony from the heads of advertising at Google, Facebook, and Yahoo, as well as, representatives from the Network Advertising Initiative (NAI), Precursor, LLC, the Center for Digital Democracy, and Edward W. Felten a Professor of Computer Science and Public Affairs at Princeton University, . All of the speakers prepared both oral and written statements defining and expression concerns pertaining to behavioral advertising works and what steps Congress should take to protect user’s privacy. Here’s some testimony if you’re interested:

Facebook, Google and Yahoo all claimed their services were transparent and users had the option to opt out of sharing any private content made available to online advertisers. The NAI also stated that it worked hard to hold advertisers to high self regulation standards and recognized that it believed in an idea of consumer choice when involving behavioral advertising.

However some of the most shocking testimony came from Scott Cleland, the President of Precursor, LLC. In his testimony, Cleland identified that Consumer Reports from September 2008 demonstrated that:

61% of consumers are confident that what they do online is private and not shared without their permission

57% incorrectly believe that companies must identify themselves and indicate why they are collecting data and whether they intend to share it with other organizations

48% incorrectly believe their consent is required for companies to use the personal information they collect from online activities.

If advertisers and content providers are truly transparent in their methods of gathering information on users, why are so many consumers naive to what really happens to their content? The reality is, there really are no laws to prevent the collection of online data concerning consumers. Thus, the Center for Digital Democracy along with a whole host of other groups have posted a primer containing 20 recommendations, ideas and possible solutions for the gap between consumer protection and consumer privacy online.

In the primer the privacy groups identified several legislative recommendations including:

Preventing collection of data on minors

Sensitive information should be defined and protected including health data, finances, ethnicity, races, sexual orientation, and political activity

Behavioral targeting for individual redlining activities should be illegal

The government should create and enforce a baseline to guarantee consumer privacy

The primer also includes several options for implementing and protecting the privacy of users while online.

Conclusion

What does all of this mean for consumers, for content users, for people who just love free email services? It means there aren’t many laws out there yet to protect you.  If you don’t want to share your content, you should opt out, change your settings and clear your cookies. Realize that nothing is truly free and if you are using something like a free email service, it’s probably free for a reason.

With that said, please feel free to click on the Google Ads displayed below and to the right of this article!

Related posts:

1. Digital Life after Death: Social Media and Your Digital Content Post Mortem
2. School Sues Student for Facebook Comments
3. Google Docs in Plain English
4. FTC Guidelines on New Media and Disclosure Won’t Just Affect Bloggers
5. New iPhone App Gives You The Legal Edge
6. ACLU Weighs in on Facebook’s Privacy Issues
7. Advertise With Yodle?
8. Twitter Party Is Just Beginning
9. Two Complete Google Wave Guides Available
10. New Jersey Judiciary Now Tweeting