Privacy and the Private Sector

-- By AndreiVoinigescu

Privacy advocates are up in arms about the recent explosion in the monitoring, recording and analysis of people's online activities. The private sector, meanwhile, is investing heavily in compiling behavioral profiles of Internet users: In 2007, AOL, Yahoo and Google spent $3.6 billion to purchase behavioral targeting firms Tacoda, BlueLithium? and DoubleClick? , while Microsoft spent $240 million for a 1.6% share of Facebook. In the wake of senate hearings into web privacy, a number of large ISPs have backed away from partnerships with behavioral advertising networks which would have seen them deploying deep packet inspection to snoop on users' surfing habits, stressing that any future monitoring for advertising purposes will be on an opt-in basis with express consent from the users being watched. So what is all the fuss about?

The All-Seeing Eye

Monitoring and analyzing user's online activities is not new. Behavioral advertising companies like NebuAd? and Phorm track keywords on visited websites and search engine queries (with ISP cooperation), creating profiles (linked to individual computers) used to infer likely purchase interest in each of the rougly 1000 "useful but innocuous" product categories. NebuAd? and Phorm can categorize users quite narrowly. They can identify users interested in a vacation to a particular destination, or in buying a particular brand of used car. But while the ISP-Ad Network partnership allows for unprecedented comprehensiveness in monitoring a user's online behavior, individual e-commerce websites have been analyzing visitor's behavior at a high level of granularity for years now. Amazon.com, for instance, tracks clickstream data--the pages users visit, the time they spend there, and how they interact with each page--down to the level of individual scrolls, clicks and mouse-overs.

An alarming erosion of privacy and autonomy?

Should we be worried that the private sector may soon know us better than we know ourselves? That depends on how the data being collected about our online behavior is used--whether our online nakedness harms our interests or merely allows the market to better cater to our needs and desires.

Behavioral advertising networks use the profiles they generate to facilitate more nuanced audience segmentation. Where ads before were often targeted based on crude demographics like location, age or gender, NebuAd? and Phorm allow advertisers to carve out their audience according to temporally salient interests. While this is a clear win for marketers, a recent survey reveals that 57% of internet users are uncomfortable with advertisers using their browsing history--even if anonymized--to serve relevant ads. Can this result can be attributed to luddite fear-mongering?

It is hard to make a case that targeted ads themselves are a threat to privacy or autonomy. While there is something offensive about the push nature of advertising in general--a reaction potentially exacerbated when you know an unsolicited ad is directed specifically at you--internet advertising is easily blocked. And whatever the actual empirical effect of advertising on purchase decisions, most people believe that they retain full control over whether or not to buy. In their current categorical classification based form, the NebuAd? and Phorm ad networks don't really provide much finer-grained audience segmentation than specialty magazines have been providing for years. Perhaps consumer unease reflects underlying doubts about how useful the targeted ads actually are. After all, consumers seem quite willing to trade away privacy in return for valuable services like free webmail and storage.

Behavioral Profiling and the Pocketbook

While targeted advertising might be of dubious value to consumers, corporations are now exploiting the wealth of behavioral for ends that can far less plausibly be explained as mutually beneficial. In the past, marketing was largely the domain of 'common-sense' knowledge. Although business-focused academics were certainly influenced by findings in the social sciences and even conducted their own research, the limitations and cost of traditional experimentation and field research meant that much of their insight into persuasion was often generalized rather than specific. This is no longer the case. Companies like Amazon.com are increasingly relying on data mining techniques to identify trends in the detailed behavioral data they collect from visitors. Dynamic website content allows online retailers to directly and cheaply test specific hypothesis about effective marketing techniques, increasing their ability to profit from the behavioral trends they observe.

E-commerce websites contend that they use automatic monitoring and analysis of clickstream data to provide customized shopping experiences tailored around the user's interests. Leaving aside research that suggests users often find such customization inaccurate or misleading, there is evidence that websites use prior behavioral data for price discrimination. While practices like offering new customers lower prices might be easily uncovered and outed once awareness of them spreads, other, more subtle uses of targeted content to maximize profits probably are not. Suppose Amazon.com's automatic recommendation system recommends hardcover versions of a book to customers identified as less price sensitive based on prior purchase history, and the paperback to everyone else. Would anyone notice?

Loyalty programs from brick and mortar establishments show just how creative the private sector can be in exploiting even relatively sparse data about how customers have behaved in the past. Harrah's Entertainment--the world's largest gaming company--deploys member reward cards and specialized software in its casinos to identify each member's personal loss threshold based on previous gambling sessions. The system alert casino staff when a patron is approaching a level of losses at which she usually quits for the night, allowing them to take action. Frustrated patrons are often offered free meals or show tickets to keep them happy and keep them in the casino, increasing the amount they ultimately spend.

A loss for everybody?

Successes like Harrah's tend to inspire imitation. And as more businesses collect or purchase data for predictive analytics, it is not just the success of their behavioral models that raises concerns. While the worst a flawed predictive model employed Phorm or NebuAd? can do is bombard web-surfers with irrelevant ads, shoddy predictive models in other areas can be downright dangerous: poor modeling of borrowers ability to repay mortgages played an important role in the current recession. The effects of a corporation's mistakes are not always limited to its bottom line.

It is hard to know what to make of behavioral data being used to subtly nudge people towards more spending and consumption. Is intervening to keep patrons happy so that they spend more time--and ultimately more money--in your casino or on your website deplorable exploitation, or are all parties ultimately better off? As disputes over the desirability of subprime lending indicate, there is little societal consensus on where the line between acceptable and unacceptable commercial behavior should be drawn. Concern with preserving the generative qualities of the net may advocate against heavy-handed ex-anti restrictions on data collection, but there are certainly uses of that data which should be prohibited. Unfortunately, the very market creativity we want to foster makes such undesired uses hard to anticipate.