The Privacy Debate Beyond Google-DoubleClick

With Google’s (NASDAQ: GOOG) acquisition of DoubleClick having won the final regulatory approval it needed, the debate over consumer privacy and behavioral targeting in online advertising is far from over.

Despite the vigorous lobbying efforts by privacy watchdogs like the Electronic Privacy Information Center (EPIC) and the Center for Digital Democracy (CDD) to make consumer data protection a part of the merger review, both U.S. and European regulators determined that their investigation would only consider how the combination would likely affect competition.

Those groups may have failed to convince regulators to block or attach conditions to the merger, but their relentless and public opposition has succeeded in ensuring that data collection, privacy and behavioral targeting will remain a front-burner concern in any governmental consideration of the Internet economy.

The same day that the Federal Trade Commission signed off on the DoubleClick purchase, it issued a separate list of self-regulatory principles for online behavioral advertising, calling on companies to educate consumers about the data they are collecting and what they are using if for.

Late last month, the industry association representing online marketers issued its own set of privacy guidelines, offering companies considerably more latitude than the FTC’s proposal. The FTC guidelines suggested that “companies should only collect sensitive data for behavioral advertising if they obtain affirmative express consent from the consumer.”

The Interactive Advertising Bureau (IAB) countered with the more nebulous assertion that “businesses should be responsive and accountable to consumers,” and offer consumers a “means to express concerns and complaints” about privacy.

The basic friction is the time-honored push and pull between government oversight and the unregulated free market. Privacy advocates claim that advertisers, left to their own devices, will not respect consumer privacy.

“If self-regulation protected privacy, we would support it. But it doesn’t,” EPIC Executive Director Marc Rotenberg told “Self-regulation has allowed the industry to do pretty much whatever it wishes with the personal data it collects. That’s the problem.”

Meantime, in championing self-regulation, Web marketers claim that it is in their own business interest not to violate consumer privacy.

“IAB members understand the relationship between consumers and companies is built on trust,” IAB President and CEO Randall Rothenberg said in announcing the industry group’s privacy guidelines.

“Based on the industry’s experience, we believe the FTC is too rigid on matters of notice and choice,” he said. “Our principles strike the appropriate balance between protecting consumers’ security and allowing industry to provide the free services and content they desire.”

The advertising payoff

It has become a truism of the Internet economy that advertising makes content free. Site owners can better afford to offer free news, videos and other content by placing targeted display advertisements on their site. That business line resulted in a $3.1 billion payday for DoubleClick’s owners after Google decided to make the purchase, hoping to beef up the counterpart to its search advertising.

Continued on Page 2.

Page 2 of 3

That acquisition last April preceded by a few weeks Yahoo’s purchase of Right Media and Microsoft’s acquisition of aQuantive. Then in July, AOL bought Tacoda, an online advertising company specializing in behavioral targeting technology.

Now concluded, these acquisitions to some degree were all meant to improve the Web giants’ abilities to improve the relevance of display ads by tracking consumers’ browsing histories.

If a person routinely visits Web sites about sports, he would be more inclined to react to an ad pitching a fantasy football league than to one offering a subscription to Oprah’s magazine, the reasoning goes.

More relevant ads mean higher clickthrough and conversion rates, which in turn increase advertisers’ return-on-investment (ROI) and enable Web sites to charge a higher premium for their advertising inventories. Internet companies further claim that users want to see ads for products that interest them, and that irrelevant placements are an annoyance.

When a person visits a Web site, a cookie is placed on the computer recording that action. The privacy issue arises from large Web companies aggregating the cookies and cross-referencing them with search histories to build composite profiles about people’s Internet habits, a proxy for their likes, dislikes, goals and dreams.

“Business practices have outpaced the law,” EPIC’s Rotenberg said. “There is a clear need to establish new privacy safeguards now that advertising involves the creation of detailed profiles on individual consumers.”

A recent comScore analysis commissioned by The New York Times hinted at just how much data Internet companies are collecting about their users. Yahoo, Google, AOL, Microsoft and MySpace each record at least 336 billion pieces of consumer data each month, the study found. comScore’s analysis looked at the searches, pages views and display ads that appeared on those sites, estimating how many ads were served throughout their networks, the Times reported.

“These things are happening below the radar for most Americans,” said Joseph Turow, professor at the Annenberg School of Communications at the University of Pennsylvania.

A whole new world

“The data collection at this point far outruns the analytical capabilities. Companies have far more ability to collect data than they do to analyze and serve results based on that data, Turow told

Once that happens, however, “we’re going to see a whole new world,” he said.

With consumer data becoming the gold standard for the Internet economy, and ownership of that data consolidating into the hands of a few powerful Web companies, privacy advocates are continuing to press for legislation to set boundaries on the collection and usage of personal information.

“Online advertising and data collection is finally breaking into the mainstream,” CDD Executive Director Jeff Chester told “The FTC is only going to go so far. It’s clearly going to be up to the Congress and the next administration.”

Chester said that his group and others have been lobbying U.S. and European lawmakers to enact stricter rules on data protection.

In Europe, Chester said that the Article 29 Working Group — the arm of the European Union dedicated to examining privacy policy — is expected to issue a statement classifying a computer’s IP address as personal information. Doing so could have serious implications for companies’ ability to make use of those addresses in building profiles.

No similar legislation is pending in the U.S. Congress, though Chester said he was heartened by a bill that Rep. Ed Markey (D-Mass.) introduced last month. Among other things, the bill would assure confidentiality of online medical records. Both Google and Microsoft have recently launched online services to store people’s medical histories.

Continued on Page 3.

Page 3 of 3

Many Web companies argue against legislating a still-nascent economy.

“AOL believes that behavioral targeting will only succeed if done in a transparent and trustworthy manner for consumer benefit,” Jules Polonetsky, AOL’s chief privacy officer, said in an e-mail to

“Given the breakneck changes in technology playing out as we speak, it would be quite challenging today to write legislation that could properly anticipate consumer expectations by the time the ink was dry,” he said.

Tune in to the privacy channel

Acknowledging that consumer privacy is a serious issue — and perhaps eager to stave off congressional inquiry — Web companies have begun educational campaigns to inform consumers about their data collection practices. Google has launched a privacy channel on its YouTube video site and drafted a booklet (PDF format) detailing its privacy policies.

In the next couple of weeks, AOL will launch a banner-ad campaign to educate consumers about how cookies work and about behavioral targeting. The ads, chronicling the Web activities of an animated penguin, will also instruct Web users about how to keep their behavior from being recorded — such as by disabling cookies in their browsers.

“The more transparent companies are, the better for consumers,” an AOL spokeswoman told, adding that the “Mr. Penguin” campaign wasn’t AOL’s first initiative aimed at educating consumers about behavioral targeting.

In part, these campaigns are Web companies’ attempt to convince the public that the information that allows them to target ads is anonymous computer code. IP addresses and cookies, they argue, give them no real ability to look into the personal identities of Internet users.

“It’s an education process; cookies are anonymous ways to give insight into [people’s] preferences,” Michael Barrett, chief revenue officer at Fox Interactive Media, told the audience at an advertising conference last fall.

But the potential of that data to coalesce around an image of a person’s identity is profoundly troubling, Turow said.

Still, he admits that the economic benefits of targeted advertising are hard to deny.

“The dilemma that the FTC has always been in is how do you retain an issue of privacy without killing the goose that lays the golden egg?” he said.

With Google-DoubleClick concluded, the fate of Yahoo will be the next flashpoint in the privacy debate, but Chester and Rotenberg have made it clear they consider the issue now bigger than any one merger.

News Around the Web