By Ryan Radia & Berin Szoka

Today a broad array of civil liberties groups, think tanks, and technology companies launched the Digital Due Process coalition. The coalition’s mission is to educate lawmakers and the public about the need to update U.S. privacy laws to better safeguard individual information online and ensure that federal privacy statutes accurately reflect the realities of the digital age.

Over 20 organizations belong to the Digital Due Process coalition, including such odd bedfellows as AT&T, Google, Microsoft, the Center for Democracy & Technology, the American Civil Liberties Union, the Electronic Frontier Foundation, The Progress & Freedom Foundation (where Berin works), the Competitive Enterprise Institute (where Ryan works), the Internet Technology & Innovation Foundation, Citizens Against Government Waste, and Americans for Tax Reform. The full member list is available at the coalition’s website.

Amidst the heated tech policy wars, it’s not every day that such a diverse group of organizations comes together to endorse a unified set of core principles for legislative reform. Over two years in the making, the Digital Due Process coalition, spearheaded by the Center for Democracy & Technology, is a testament to the broad consensus that’s emerged among business leaders, activists, and scholars regarding the inadequacies of the current legal regime intended to protect Americans’ privacy from government snooping and the need for Congress to revisit decades-old privacy statutes. It also represents a revival of a bipartisan consensus on the need for reform reached back in 2000, when the Republican-led House Judiciary Committee voted 20-1 to approve very similar reforms (HR 5018).

Today, in the digital age, robust privacy laws are more important than ever. That’s because U.S. courts have been unwilling to extend the Fourth Amendment’s protection against unreasonable search and seizure to individual information stored with third parties such as cloud computing providers. Thus, while government authorities must get a search warrant based on probable cause before they can lawfully rifle through documents stored in your desk, basement, or safe deposit box, information you store on the cloud enjoys no Constitutional protection. (Some legal scholars argue this interpretation of the Fourth Amendment, referred to as the Third Party Doctrine, is outdated and deficient. See, for example, Jim Harper’s excellent 2008 article in the American University Law Review.)

To be sure, this doesn’t mean that data stored in the cloud is completely without legal protection. In 1986, Congress enacted the Electronic Communications Privacy Act (ECPA), a then-forward-looking law that established several new privacy protections limiting governmental access to consumer data stored or transmitted by “remote computing service providers” and “electronic communications service providers.” Thanks to this law, along with earlier statutes such as the Wiretap Act, most electronic communications transmitted today enjoy some degree of legal protection. Unfortunately, the law’s provisions don’t reflect the reality of modern digital communications, nor do they offer sufficient protections for sensitive items like emails, mobile device locational information, and instant messages.

To remedy these deficiencies, the Digital Due Process coalition has offered four principles for Congress to consider as it revisits ECPA. In essence, they would require that government obtain:

• A search warrant from the court, upon the showing of “probable cause” required by the Fourth Amendment, before compelling “cloud” providers to disclose most kinds of private communications or mobile location information;
• A court order subject to meaningful judicial review before compelling providers to disclose dialed number information or email to and from information; and
• Judicial approval, rather than a mere subpoena, before compelling providers to disclose non-particularized information about individual accounts.

These proposed reforms, if enacted, would go a long way toward ensuring that individuals enjoy the same legal protections online that the Fourth Amendment has long provided in the offline world. The principles would also empower cloud computing and mobile service providers to offer more robust privacy assurances to users. Such assurances will help strengthen user trust in of cloud computing and, consequently, may spur innovation in cloud computing services that involve highly sensitive data like health information.

This call to action is also a reminder that restricting the power of government, not the private sector, is the solution to the privacy challenges of the digital age. Privacy advocates and zealots alike often focus on the risks of private data collection. Yet the greatest, and most demonstrable, of these risks comes not from private firms but from the real Big Brother: the risk that government will get its hands on private data without meaningful judicial oversight.

As we’ve long argued (see Ryan’s essay with Wayne Crews, “Selling Out Online Advertising,” and Berin’s comments to the FTC’s Exploring Privacy Roundtable last November), the consumer benefit of individualized data collection and use is nothing short of spectacular. Without it, services like Gmail, Google search, and Facebook likely wouldn’t exist. (And it’s only 2010—the best is yet to come!) Simply put, there is no free lunch!

But data collection has a real downside: As long as sensitive information remains stored on a provider’s server, there’s a risk that it will end up in the wrong hands. Through smart information security practices and privacy policies enforced both by the FTC and strong reputational forces, the private sector has generally done a good job of safeguarding individual data, with rare exceptions. Yet, today, no amount of security or legalese or good intentions can protect against a government subpoena issued in compliance with ECPA’s outdated, inconsistent and downright byzantine legal standards—which vary widely depending on whether messages have been opened, how long they’ve been on the server, etc.

The reforms proposed by the Digital Due Process Coalition would fix this gaping hole in America’s privacy laws, allowing individuals to rest assured that their personal information won’t end up in the hands of government unless probable cause is shown before a court of law. That’s the promise enshrined in the Fourth Amendment—a promise we seek to restore.

Today’s Online Safety Technical Working Group (OSTWG) meeting included some heated debate about whether online intermediaries should be doing more to assist law enforcement to help track down child predators and those producing and distributing child pornography. (It’s not clear whether or when NTIA will actually put the archived video or a transcript online at this point).

Most interesting was the third panel of the day (agenda), which devolved into a shouting match as Dr. Frank Kardasz (resume) of the Arizona Internet Crimes Against Children (ICAC) Task Force basically accused Internet intermediaries of being willing accomplices in crimes of sexual abuse against children—and suggested that they could be charged as co-defendants in child porn prosecutions. A few industry folks in the room expressed their outrage at such slander. A retired law enforcement officer perhaps put it best when he said that he had never dealt with an ISP that didn’t sincerely want to help law enforcement stop this monstrous crime.

Apart from those pyrotechnics, and a superb morning presentation by the Pew Internet Project’s Amanda Lenhart about “Social Media & Young Adults,” the most interesting part of the day concerned data retention mandates. Even as a debate rages in Washington about how much collection and use of online data should be permitted, Dr. Kardasz suggested online service providers should be required to hold user data for 5 years. A number of attendees noted the staggering costs of such a mandate given the sheer volume of information shared every day by use, especially for startups for whom building monitoring and compliance infrastructure can be a significant barrier to entry. Of course, practical objections are always answered with practical counter-solutions—in this case, several attendees asked why we couldn’t just provide tax incentives or stimulus money to defray such costs. One attendee joked that we’d have to devote the entire state of Montana just to house all the necessary server farms.

But the strongest objection came from John Morris of the Center for Democracy & Technology, who rightly noted that no amount of government subsidies for data retention could prevent leakage of sensitive private data. For this reason and because of the basic civil liberties at stake whenever the government has access to large pools of data about its citizens, Morris argued that we need to strike a balance between how we protect children & the values of free society. Dave McClure of the US Internet Industry Association (USIIA) seconded this point powerfully: If such vast data is retained, it will be abused.

Then the riposte from advocates of data retention mandates: Aren’t online intermediaries already retaining huge amounts of consumer information? If they can do that, why can’t they retain the data we need to track down child predators and child porn distributors?

John Morris and the ACLU’s Chris Calabrese patiently explained just how different these two kinds of data retention really are. Advertisers don’t care who you are—just what you’re likely to be interested in. So it simply isn’t worth the cost for them to retain the massive logs of data tracking every site a user has been to and when, or even tying that information to an IP address. All the advertiser wants is to be able to correlate information about likely interests with a cookie that uniquely identifies a computer (which likely, but not necessarily, corresponds to a user). I couldn’t have explained this difference better myself!

They didn’t specifically get into this example, but even a company like Phorm, which offers behavioral advertising based on inspecting packets sent back and forth by an Internet user doesn’t actually retain the kind of “digital dossier” of a user’s browsing activity that some advocates of increased data regulation fear–or that law enforcement wants. Instead, Phorm examines certain kinds of pages visited by users (e.g., no HTTPS or email) and looks for keywords (excluding sensitive things like phone numbers, social security numbers and credit card numbers) that suggest the user might be interested in a particular marketing category. The data about where the user has visited is then discarded, leaving only the marketing categories matched to that user’s unique ID (e.g., dog-owner, fly-fisher).

So even when it comes to the much-feared “Deep Packet Inspection,”what advertisers want is profoundly different from the kind of data retention mandates proposed by Kardasz and others in law enforcement. Moreover, given the costs entailed in data storage and processing, the mere fact that something is theoretically possible doesn’t mean advertisers are willing to pay for it just to try to tell you about their product! That critical point has been missing from most of the ongoing conversation about regulating “targeted” advertising, which tend to focus on the theoretical possibility of a particular data collection/use/aggregation practice rather than whether it’s actually being done or even whether it would make economic sense to do so. So I’m glad to see John Morris and Chris Calabrese making these vital points.

I don’t mean to pull a “gotcha!” on them as representatives of two organizations that have also been outspoken in calling for restrictions on the private use of data (especially since I can’t do justice them by quoting them precisely here without a transcript of the event or the ability to go back and listen to this fascinating exchange again). I’m sure they would respond that the potential for abuse still exists when private companies collect data about users for advertising purposes: Some companies might collect so much data that it could be tied back to a particular user and cause actual harm if released, which is always a possibility. That would be a fair response, but it would at least place us in a constructive debate between reasonable people about the costs and benefits of data sharing and whether government regulation is really the best way to address privacy concerns.

The important point is that they recognize the difference in kind between the collection of limited amounts of data for advertising purposes and the kind of comprehensive data mandates proposed by Kardasz and others. If nothing else, that difference means that one can take a principled stance—as I do—against data retention mandates as a governmental invasion of our privacy but also in favor of reliance on user empowerment, education, targeted enforcement of existing laws, etc. as less restrictive alternatives to government regulation of private data use, just as with parental control and empowerment over parentalist censorship.  As Adam Thierer and I have argued, because there are significant costs to regulation for consumers, free speech and culture, any government mandates should be narrowly tailored to addressing real, demonstrable harms rather than vague, unsubstantiated fears or amorphous concepts like “dignity interests.”

The other critical part of our “layered approach” to privacy concerns is building a higher “Wall of Separation Between Web and State.” Concretely, that means opposing such onerous data retention mandates and reforming ECPA—a subject mentioned only at the end of today’s meeting. In the comments I filed recently on the Notice written by CDT for the FCC, I praised CDT’s work in this area and look forward to working with them (and the ACLU and groups like EFF) on that cause in the future, despite our differences on private data use regulation.

What are the consumer protection issues of online social media sites and what’s the right regulatory balance? That was the focus of today’s Northern Virginia Technology Council (NVTC) event called “Social Media and Consumer Protection: Finding a Balance.” The breakfast event featured Tim Sparapani of Facebook, Pablo Chavez of Google, and Ari Schwartz of the Center for Democracy and Technology (CDT).

But the event wasn’t about consumer protection (in the traditional sense), it was about privacy. Privacy online is today’s issue du jour, whether it is marketing to children or collecting and sharing data for targeted ads. The FTC has devoted a series of roundtable discussions toward privacy, with the first one beginning Dec. 7.

Privacy’s getting so hyped-up that I believe it to be the next “online safety” sort of issue where isolated and particularized incidents become sensationalized in the media and among regulators, creating counterproductive techno-panics that other commentators have described. This shift is apparent as many policymakers and advocacy groups become increasingly hostile toward targeted online advertising.

But are social media and privacy at odds such that there needs to be a “balance”–whatever that entails? While this question was never explicitly asked, it is clear that Ari Schwartz would say yes because he asserts that consumers don’t know what information is being collected and that users need help to gain control over their own data.Ari acknowledged that when it comes to privacy, lawsuits would be filed and that the courts might rule differently on whether social media sites or their advertiser would be liable, depending on the circumstances. The case-by-case approach in the courts is something that many pro-market advocates would support–but it flies in the face of CDT’s public comments for next week’s FTC Privacy Roundtable.

A cornerstone recommendation in CDT’s comment is that “[t]he FTC should encourage Congress to pass general consumer privacy legislation that is based on a full set of Fair Information Practices. Self-regulation cannot adequately protect consumer privacy when it is not girded by legal standards and more direct oversight from the FTC.” It’s a sweeping statement that ignores the unintended consequences of a general, one-size-fits-all privacy law.

The Maine law regulating “predatory” marketing to children that passed this year is a great case study on the pitfalls of general privacy regulation. The law prohibits the collection of personal and “health-related” information from minors without parental permission, and bans outright its use in marketing to teens.

Because the law was not specific to a particular harm, it was way overbroad. Legitimate advertising and information sharing was now illegal, violating the free speech rights of both advertisers and teenagers. Thankfully, a legislative committee voted in October to recommend repeal of the law.

You often hear privacy advocates rail against the sectoral approach of the U.S. toward privacy, where we have particular laws specific to financial and health care information. They’d rather see a European model of general consumer privacy regulation. But there’s no one-size-fits-all to something that is as highly contextual and personal as one’s privacy.

At the event we heard Pablo Chavez say how hard it is to convince consumers to click on display ads. Online publishers and service providers are constantly thinking of new ways to show relevant and compelling advertising to consumers. It is this experimentation and innovation that, by making ads more relevant, keep paying for the free services we all use on the ‘Net. When this experimentation goes too far and some consumers get harmed–which will undoubtedly happen as it does in any other commercial context–consumers can sue and the FTC can enforce.

Perhaps I’m reading too much into Ari’s acknowledgment that litigation and FTC enforcement will likely figure this out. CDT is an influential and respected organization, so it would be nice to see them acknowledge the pitfalls of a one-size-fits-all solution and talk more about how targeted enforcement can help to weed out any bad actors in targeted advertising. I hope CDT might agree that we need more FTC enforcement and private lawsuits, not new legislation.

Adam Thierer and I will be participating in two separate panels at the FTC’s December 7 “Exploring Privacy” workshop discussing, respectively, surveys & expectations and online behavioral advertising. Below is the cover letter I filed as part of my comments (PDF & Scribd), along with four past PFF publications and a working paper on the benefits of online advertising.

Privacy Trade-Offs:  How Further Regulation Could Diminish Consumer Choice, Raise Prices, Quash Digital Innovation & Curtail Free Speech

In general, we at PFF have argued that any discussion about regulating the collection, sharing, and use of consumer information online must begin by recognizing the following:

• Privacy is “the subjective condition that people experience when they have power to control information about themselves and when they exercise that power consistent with their interests and values.”^[1]
• As such, privacy is not a monolith but varies from user to user, from application to application and situation to situation.
• There is no free lunch:  We cannot escape the trade-off between locking down information and the many benefits for consumers of the free flow of information.
• In particular, tailored advertising offers significant benefits to users, including potentially enormous increases in funding for the publishers of ad-supported content and services, improved information about products in general, and lower prices and increased innovation throughout the economy.
• Tailored advertising increases the effectiveness of speech of all kinds, whether the advertiser is “selling” products, services, ideas, political candidates or communities.

With these considerations in mind, policymakers must ask four critical questions:

1. What exactly is the “harm” or market failure that requires government intervention?
2. Are there “less restrictive” alternatives to regulation?
3. Will regulation’s costs outweigh its supposed benefits?
4. What is the appropriate legal standard for deciding whether further government intervention is required?

We have addressed these questions in the PFF publications attached below, which I respectfully submit for the Commission’s consideration.  This executive summary highlights their findings.

• Online Advertising & User Privacy: Principles to Guide the Debate, Berin Szoka & Adam Thierer, Progress Snapshot 4.19, Sept. 2008.
• Targeted Online Advertising: What’s the Harm & Where Are We Heading?, Berin Szoka & Adam Thierer, Progress on Point 16.2, April 2009.
• Privacy Polls v. Real-World Trade-Offs, Berin Szoka, Progress Snapshot 5.10, Oct. 2009.
• The Benefits of Online Advertising & Costs of Privacy Regulation, Berin Szoka & Mark Adams, PFF Working Paper, Nov. 8, 2009. ^[2]
• Benefits of Online Advertising, Berin Szoka, Mark Adams, Howard Beales, Thomas Lenard, Jules Polonetsky, PFF Capitol Briefing, July 2009.

I. A Principled Pro-Consumer Alternative to Further Regulation

The “Privacy Wars” that have waged over how government should regulate online collection and use of data might better be referred to as the “Privacy Proxy Wars” because the most clearly demonstrated “harm” at issue seems to be from government itself, not the private sector.  The Fourth Amendment guarantees that “The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated…”  Americans have a legitimate expectation that this “security” extends to their digital “papers and effects,” yet that expectation is not given effect by current restraints on government access to consumer data in American law.  Thus, we have proposed the following layered approach to concerns about online privacy, focusing on restraining government access to data, rather than crippling the private sector uses of data that directly benefit consumers:

1. Erect a higher “Wall of Separation between Web and State” by increasing Americans’ protection from government access to their personal data—thus bringing the Fourth Amendment into the Digital Age.
2. Educate users about privacy risks and data management in general as well as specific practices and policies for safer computing.
3. Empower users to implement their privacy preferences in specific contexts as easily as possible.
4. Enhance self-regulation by industry sectors and companies to integrate with user education and empowerment.
5. Enforce existing laws against unfair and deceptive trade practices as well as state privacy tort laws.

Such a layered approach would not only be a “less restrictive” alternative to increased government regulation, but also potentially more effective in key respects than government data use/collection mandates.  In an ideal world, adults would be fully empowered to tailor privacy decisions, like speech decisions, to their own values and preferences (“household standards”).  Specifically, in an ideal world, adults (and parents) would have (1) the information necessary to make informed decisions and (2) the tools and methods necessary to act upon that information.  Importantly, those tools and methods would give them the ability to block the things they don’t like—annoying ads or the collection of data about them, as well as objectionable content.

A wide variety of self-help tools and “technologies of evasion” are readily available to all users and can easily thwart traditional cookie-based tracking, as well as more sophisticated tracking technologies such as packet inspection.  While cookie management tools that allow users to delete their cookies have been standard in browsers for some time, the latest generation of browsers incorporates far more advanced control over what kind of cookies browsers will accept from websites in the first place.  Furthermore, the extensible nature of modern browsers allows any freelance software developer who sees a way to improve a browser to do so by writing an add-on that “plugs in” to the browser using standard programming interfaces designed by each browser developer.  Many such add-ons are wildly popular, but even those users who never install a single one benefit from the acceleration of browser evolution made possible by add-ons.  We have documented examples of these tools in an ongoing series of blog posts about “Privacy Solutions,” available at www.pff.org/privacy-solutions/.

But a “layered approach” that relies on user empowerment and education need not be perfect to be “good enough,” because “privacy” is not an absolute good that trumps all other consumer interests, nor can “community standards” accommodate a diverse citizenry.  If we “make the best the enemy of the good” by insisting on perfection, consumers will be made worse off.  Advertising is indispensable to the future of online media, but it is also currently inadequate to sustain “Free” culture.  The advocates of regulation pay lip-service to the importance of advertising in funding online content and services but don’t seem to understand that this quid pro quo is a fragile one:  Tipping the balance, even slightly, could have major consequences for continued online creativity and innovation.  Something must give because there is no free lunch.[3]

II. Benefits to Users of Smarter Online Advertising

The attached working paper I co-authored with PFF Visiting Fellow Mark Adams identifies five broad categories of benefits to users from targeted advertising:

1. More relevant, and potentially less annoying/interruptive advertising for consumers;
2. Higher-quality content and services supported by advertising;
3. Better correlation between the production of content and services, and consumer preferences;
4. A more vibrant media and improved political discourse and communities; and
5. Lower prices for consumers and greater innovation throughout the economy.

The paper explains how better targeting of advertising delivers these benefits by:

• Increasing the informational value of advertising to consumers;
• Increasing advertising funding for content and services that might not be sustainable on an ad-supported basis with untargeted or less targeted advertising; and
• Reducing the costs of buying and selling (“transaction costs”).

In particular, we note that, with behavioral targeting, the value of a site’s viewers depends less on the content associated with that site (keywords) and more on the viewers themselves.  In this sense, behavioral advertising levels the playing field by allowing websites to sell access to viewers directly, rather than through the keywords associated with the website.  Better targeting democratizes the ad-supported economy by empowering consumers to direct advertising revenues to the sites they spend time on.  Targeting essentially increases the ability of Internet users to “vote with their clicks” for online content and services just as they “vote with their dollars” every time they make a purchase in the traditional economy.

Data on the precise “delta” between contextual and behavioral advertising is limited, but appears to indicate that behavioral advertising can produce significant increases in revenue for many publishers.  In particular, we note the following increased measures of effectiveness

• Increased Click-Through-Rates 94% to 225% and conversion rates up to 3,000% (2005);[4]
• Increased CTR of 670-1000% (2009);^[5] and
• Increased conversion rates of 400-900% (2008).[6]

There are a wide range of predictions on the potential value created by behavioral targeting.  As with previous innovations in online advertising, it seems likely that the performance of behavioral targeting will improve over time.  Professor Tracy Tuten, author of Advertising 2.0, predicts that a twelvefold increase in the value of page views, from $10 to $120 per thousand views.^[7] Rich Karpinski calculates that Blue Kai, an ad network, is currently selling behaviorally targeted ads a rate of $4-15 per thousand views^[8]—a significantly lower rate than Ryan suggests but higher than the current performance of print advertising ($5.50)^[9] and several times higher than the average price of non-premium display advertising ($0.60-$1.10).^[10] One experiment with re-targeting (showing users ads on one site based on actions taken towards making a purchase on one site but not completed) produced significantly higher returns:  “retargeted impressions represented only 7% of all the banner impressions delivered, [but] were responsible for over 50% of the revenue and 25% of the sales generated by the campaign as a whole.”^[11] Hallerman concludes that “Behavioral targeting is more than hype…. For publishers, it can mean making more money from undersold or unsold ad inventory.”[12]

III. The Quid Pro Quo behind “Free”

Traditionally, users “paid” for content by devoting part of their attention to ads, which have long funded the costs of generating content for radio, television, and newspapers (with subscriptions paying only for distribution).^[13] The basic reason is simple economics:  In competitive markets, prices tend to fall to the marginal cost of production, which quickly converges on zero for information.  The Internet has simply borne this theory out in full:

1. Producing the first unit of content (e.g., a news story or video) remains costly, so while the marginal cost of every additional unit is essentially zero, average cost is not.
2. The failure of micropayments online seems to confirm that, no matter how low the technological transaction costs are, the mental transaction costs involved combined with even tiny payments will exceed the perceived value of most content.
3. The world of media scarcity in which consumers could choose from only a few sources of content (e.g., news, entertainment) has given way to a world of staggering media abundance and the choices of users are no longer constrained by the tyranny of physical limitations like distance and printing costs.
4. Because pure information cannot be copyrighted (and fair use allows significant referencing and quotation), very little content is so unique that users cannot find a ready substitute elsewhere if a site (or even a group of sites) attempted to charge.

Thus, while policymakers should generally avoid preferring one business model over others, they must also recognize that the “economics of bits” will make advertising increasingly indispensable to the future of online content, services, media and culture. For that reason, they should take great care when tinkering with the economic engine that has made America the envy of the digital world as the fountainhead of online innovation and creativity.

IV. Consumer Attitudes & Expectations

While many consumers said, in a recent poll, that they don’t want ads, content and news “tailored” to their interests,[14] their actions in the real world speak louder than words: The increased click through rates and conversion rates mentioned above are evidence that consumers do, in fact, value more relevant advertising.[15] Whatever Americans tell pollsters about “tailored” ads, they also complain about irrelevant ads: A previous poll found that 72% of consumers “find online advertising intrusive and annoying when the products and services being advertised are not relevant to [their] wants and needs” and 85% say that less than 25% of the ads they see while browsing online are relevant to their wants and needs.^[16]

Until a proper experiment is conducted by trained behavioral economists that includes real-world trade-offs and makes users aware of privacy management tools, all we can say with confidence is the following:

1. Users don’t understand exactly how ads are tailored;
2. Users seem to be concerned about “tailoring” or “following” in the abstract;
3. Users are generally unwilling to pay for online content and services; and
4. Better tailoring of ads means more funding for content and services.

Only the layered approach outlined above can address all these concerns: educate users about how online advertising works and how they can implement their own privacy preferences, while constantly striving to further empower users to make privacy management easier.

Policymakers should avoid presuming they can divine the true preferences of users regarding the complex and multi-faceted trade-offs of the real world.  Instead of guessing what consumers might choose, the FTC and other law enforcement agencies should focus on holding companies to the “expectations” they set in their official privacy policies and other statements about their any use and collection practices.  In a sense, this is to approach the problem from the “supply” side rather than the “demand” side: If a browser manufacturer, for example, overstates the privacy protection offered by privacy management tools in the browser (e.g., cookie settings or a private browsing mode), this might well be considered an unfair and deceptive trade practice subject to FTC enforcement. The advantage of this approach is that the FTC can, using its existing authority, play a valuable role in ensuring consistency between theory and practice in what industry actually does— without sending into the intractable morass of subjective user preferences.  In other words, the FTC can help give effect to “household standards” without imposing “community standards” for everyone.

V. Underlying Fear of Advertising

On some level, this debate isn’t about user privacy at all, but about the common (though baseless) fear of advertising as inherently manipulative and wasteful—essentially: “Since people are stupid, ignorant and/or lazy, they’re easy to control and trick with shiny objects, pretty faces, memorable slogans, and catchy jingles.”  No better response to this sentiment has ever been made than was offered by the ad firm Young & Rubicam in this 1959 magazine ad:

There is no chestnut more overworked than the critical whinny:
“Advertising sells people things they don’t need.”

We, as one agency, plead guilty. Advertising does sell people things they don’t need. Things like television sets, automobiles, catsup, mattresses, cosmetics, ranges, refrigerators, and so on and on.

People don’t really need these things. People don’t really need art, music, literature, newspapers, historians, wheels, calendars, philosophy, or, for that matter, critics of advertising, either.

All people really need is a cave, a piece of meat and, possibly, a fire.

The complex thing we call civilization is made up of luxuries. An eminent philosopher of our time has written that great art is superior to lesser art in the degree that it is “life-enhancing.” Perhaps something of the same thing can be claimed for the products that are sold through advertising: They enhance life, to whatever degree they can.

VI. Conclusion

If misguided government regulation chokes off the Internet’s growth or evolution by starving content and service providers of much-needed advertising revenue, we would be killing the goose that laid the golden eggs.  Apart from a hardcore fringe who embrace the Marxist dogma that advertising is inherently deceptive and wasteful, most participants in this debate at least pay lip service to the economic importance of online advertising.  One might therefore be lulled into a false sense of complacency that “sensible” regulation (or government-led co-regulation) would surely avoid crippling this dynamo.  This widespread assumption calls to mind the famous quip of Chris Patten, last British Governor of Hong Kong, who paraphrased those who dismissed his concerns about the potentially negative effects of a Chinese take-over of the British colony in 1997, as follows:  “It is unimaginable that the Chinese would kill such a goose.”  To this, Patten responded, “Yet we wouldn’t need the metaphor of golden eggs and geese if history weren’t full of dead geese.”^[17] The dangers of regulation to the health of the Internet are real, but the ease with which government could disrupt the economic motor of the Internet (advertising) is not widely understood—and therein lies the true danger in this debate.

Depending on how regulation is structured, therefore, it is possible that new privacy mandates would severely curtail the overall quantity of content and services offered–and greatly limit the ability of new providers to enter the market with innovative offerings. Alternatively, or perhaps additionally, companies would change the character of their offerings and water-down sophisticated services that cater to consumer demand; in other words, the quality of service would deteriorate.

Bottom line: We live in a world of trade-offs, and regulation is not costless.  Indeed, regulation might best be understood as a giant game of economic whack-a-mole: Attempting to control one of the primary variables of price, quantity, or quality inevitably results in non-optimal adjustments in the other two variables. The absence of price as a variable in the context of “free” (i.e., ad supported) content and services means there is one less variable for the government to control in the first place. Simply stated, stifling the evolution of the online advertising marketplace will likely result in fewer free online services and less content, less high-quality online services and content, or some combination of both.

These observations are even more relevant to the online marketplace, where advertising has been shown to be the only business model with any real staying power. Walled gardens, pay-per-view, micropayments, and subscription-based business models are all languishing. Consequently, the overall health of the Internet economy and the aggregate amount of information and speech that can be supported online are fundamentally tied up with the question of whether we allow the online advertising marketplace to evolve in an efficient, dynamic fashion. Heavy-handed privacy regulation (or European-style “co-regulation,” where the government steers and industry simply rows) could, therefore, become the equivalent of a disastrous industrial policy for the Internet that chokes off the resources needed to fuel e-commerce and online free speech going forward.

[2].      Currently in draft form, pending further research quantifying the benefits of personalized advertising.

[3].      Berin Szoka & Adam Thierer, The Progress & Freedom Foundation, Targeted Online Advertising: What’s the Harm & Where Are We Heading?, Berin Szoka & Adam Thierer, Progress on Point 16.2, April 2009, www.pff.org/issues-pubs/pops/2009/pop16.2targetonlinead.pdf.

[4].      Scott Ferber, Stepping Up Search: How Behavioral Targeting Can Enhance ROI, MediaPost Publications, Jun 6, 2005, www.mediapost.com/publications/index.cfm?fa=Articles.showArticle&art_aid=30838.

[5].      Jun Yan, Ning Liu, Gang Wang, Wen Zhang, Yun Jiang & Zheng Chen, How Much Can Behavioral Targeting Help Online Advertising?, presented at World Wide Web Conference, Madrid, Spain, April 20–24, 2009, p. 262.

[6].      Erik Sherman, Want to Target Online? You Better Build Trust, Advertising Age, Apr. 14, 2008, http://adage.com/adnetworkexchangeguide/article?article_id=126242.

[7].      Id.

[8].      Rich Karpinski, Will Using Behavioral Data Lead to Smarter Ad Buys?, Advertising Age, April 20, 2009, http://adage.com/adnetworkexchangeguide09/article?article_id=136003 (subscription only).

[9].      Howard Beales, Public Goods, Private Information & Anonymous Transactions:  Providing a Safe & Interesting Internet, presentation given at the Law & Economics of Innovation Symposium at George Mason University School of Law, May 7, 2009 (copy on file with authors) at 17 (citing Media Dynamics data from 2008).

[10].    Id.

[11].    Id.

[12].    David Hallerman, Behavioral Targeting:  Marketing Trends, eMarketer, June 2008, at 2, http://www.emarketer.com/Reports/All/emarketer_2000487.

[13].    See, e.g., Walter Mossberg, Now You See ‘Em…, SmartMoney.com, June 15, 2000, available at web.archive.org/web/20061124235126/http://www.smartmoney.com/mossberg/index.cfm?story=20000615.

[14].    Joseph Turow, Jennifer King, Chris Jay Hoofnagle, Amy Bleakley & Michael Hennessy, Americans Reject Tailored Advertising and Three Activities That Enable It, Sept. 2009, http://graphics8.nytimes.com/packages/pdf/business/20090929-Tailored_Advertising.pdf.

[15].    See generally Berin Szoka, Privacy Polls v. Real-World Trade-Offs, The Progress & Freedom Foundation, Progress Snapshot 5.10, Oct. 2009, http://www.pff.org/issues-pubs/ps/2009/ps5.10-privacy-polls-tradeoffs.html.

[16].    TRUSTe, 2009 Study: Consumer Attitudes About Behavioral Targeting, March 4, 2009, at 2, 5, available at www.truste.com/about/bt_overview.php.

[17].  Tom Plate, Hong Kong Will Remain Very Much Alone After 1997, The Standard, Jan. 7, 1996, www.thestandard.com.hk/archive_news_detail.asp?pp_cat=&art_id=20783&sid=&con_type=1&archive_d_str=19960107

http://d1.scribdassets.com/ScribdViewer.swf?document_id=22384078&access_key=key-1jna9geastmkpu3z7hh&page=1&version=1&viewMode=list

Two recent trends evidence the importance of targeted Internet advertising–more money going toward Internet ads, and fewer people that click on display banner ads.

First, the good news is that Internet advertising is rebounding (or at least seeing a reversal in the the decline of ad $). Tough economic times has decreased ad dollars among all marketing mediums. But online ads will be the first to see new demand from marketers. And some online companies are weathering the bad economy just fine. Google’s ad revenue rose 7 percent in the third quarter.

Compare with McClatchy (the U.S.’s 3rd largest newspaper company), where according to the AP article print advertising plunged 32 percent in the third quarter, but its online ad sales increased 3 percent.

So ad dollars are increasing. Where will money be spent? On targeted ads.

comScore released a study earlier this month that showed most people don’t click on display advertisements. As someone who never does either, I don’t find this surprising. According to comScore:

“The act of clicking on a display ad is experiencing rapid attrition in the current digital marketplace,” said Linda Anderson, comScore VP of marketing solutions and author of the study. “Today, marketers who attempt to optimize their advertising campaigns solely around the click are assigning no value to the 84 percent of Internet users who don’t click on an ad.”

This is huge. Online companies rely on advertisements to pay the bills and will need to better target ads to their users if they want to stay in business.

If we want to see the next generation of online content and services, then we need to stay vigilant to convince members of Congress (Boucher) and the FTC not to impose more restrictions on interest-based advertising, such as opt-in requirements.

Progress Snapshot 5.10 from The Progress & Freedom Foundation

A recent telephone poll conducted by professors at Berkeley and the University of Pennsylvania concluded, “Contrary to what many marketers claim, most adult Americans (66%) do not want marketers to tailor advertisements to their interest.” The study’s authors claim that their poll is the “the first nationally representative telephone (wireline and cell phone) survey to explore Americans’ opinions about behavioral targeting by marketers.” They also assert that the poll indicates that “if Americans could vote on behavioral targeting today, they would shut it down.” Advocates of regulating online data collection have trumpeted this poll as evidence consumers demand legislation to protect their privacy. “This research gives the F.T.C. and Congress a political green light to go ahead and enact effective, but reasonable, rules and policies,” declared Jeff Chester, a leading critic of online advertising.

But what is most surprising about this poll is not that 66% of users said they do not want tailored online ads, but that 34% of users said they did! The key, initial question of “whether or not you want the websites you visit to show you ads that are tailored to your interests,” presents no trade-off. The fact that anyusers said “yes” indicates that many users paused to do the rough mental math about the unarticulated trade-off between the benefits of receiving tailored ads and the costs of that tailoring.

The methodology of opinion polls necessarily affects respondents’ mental calculations, rendering polls not just easily manipulated, but inherently unreliable as indicators of real preferences. Every poll reflects the bias of its authors to some degree by the way questions are worded, the order in which they are asked, the sample surveyed, etc. The easiest way to bias the results of a poll is to omit any mention of the trade-offs at issue. This poll simply buried the issue of trade-offs in a heavily loaded follow-up question: After telling respondents that marketers “often use technologies to follow the websites you visit and the content you look at in order to better customize ads,” the interviewer asked whether the respondent would allow advertisers to “follow [them] online in an anonymous way in exchange for free content.” Only 10% of users said they would allow this voluntary exchange.

What does this tell us about whether, and how, government should further regulate online advertising? Precious little: Not only does this poll overstate the costs of targeted advertising, understate its benefits, and ignore the tools available to users to address their privacy concerns but, like any opinion poll, this one tells us more about the psychology of decision-making under the artificial uncertainty of polls than about the choices users would actually make in the real world.

User Uncertainty About Concepts Like “Tailoring” and “Following”

Even the word “tailoring”—though benign compared to other words the study’s authors could have used ( e.g., “track,” “monitor,” “record”)—is so vague as to leave respondents wondering what it really entails. One can only speculate as to what users thought the word meant (since the poll did not ask), but it seems likely that some of these scarier words probably flashed through the minds of respondents in the instant before they answered the question. Indeed, the word “tailoring” conflates both the costs and benefits of personalized advertising in a single, vague word. Given this ambiguity, it’s hardly surprising that most users would say “no”—not just to receiving tailored advertising (66%), but also to receiving tailored discounts (49%) and news (57%). If users had been asked about receiving “relevant” (rather than “tailored”) ads, the responses probably would have turned out somewhat differently—just as an additional 17% of users agreed to receiving tailored “discounts,” whose value to users is more readily apparent: saving money on potential purchases.

The second set of questions asked users whether it “Would be OK… if these ads [discounts/news] were tailored for you based on following what you do on the website you are visiting… [24% said yes] OTHER websites you have visited… [34% said yes] and OFFLINE—for example, in stores? [25% said yes].” Again, the term “follow” was not defined. A third set of questions explained to respondents that marketers “often use technologies to follow the websites you visit and the content you look at in order to better customize ads.” The interviewer then asked whether the respondent would “definitely allow, probably allow, probably NOT allow, or definitely not allow advertisers” to “follow you online in an anonymous way in exchange for free content”—and only 10% of users said yes. Thus, it appears that users are more, not less, hostile to tailored advertising when reminded of the trade-offs involved (35% yes in the first set of questions, 10% yes in the third). What explains this paradox?

The most obvious explanation is that, by the time the respondent got to the critical question about “allowing” tailored advertising, they had heard the word “follow” at least five times: once in each of the three questions about whether tailoring was OK, once in the introduction about how marketers customize ads and once in the question itself—each time increasing uncertainty as to how “tailoring” really works and more than negating any suggestion of “anonymity.” Furthermore, asking users whether something should be “allowed” implies that there are undisclosed reasons why it should not be. This much is simple psychology—obvious to anyone who wanted to craft a poll that would support a particular regulatory agenda.

But behavioral economics research tells us something even more profound about the way our brains work: human beings hate making choices, and loathe uncertainty even more. Indeed, such “mental accounting” or “mental transaction” costs appear to be the primary reason why, after a decade of efforts to develop a micropayments system that can fund online content and services, no such system has emerged—and thus why Internet publishers instead rely primarily on advertising revenues ($23.5 billion in 2008) to fund “free” offerings for consumers. In this case, merely forcing consumers to consider the costs of “tailoring” and being “followed,” and decide whether these things are “OK” or should even be “allowed” strongly tips the scales in favor of the outcome desired by the study’s authors because these considerations and decisions are significant psychological costs in themselves, which likely outweigh the diffuse benefits of tailored advertising, which users simply do not appreciate.

Indeed, the scale tips so strongly that the study suggests that 73% of Americans object to having ads tailored based on “what you do on the website you are visiting.” Would not this objection apply to purely contextual advertising “tailored” to the keywords entered by a user in a search engine or to the keywords that appear on a particular page to which a user has navigated within a site? If so, this study isn’t just about the bogeyman of “behavioral” advertising, but about essentially all online advertising, which is to some degree “tailored.” Indeed, must lawmakers protect us from the tailoring of news (71%) and discounts (62%) within websites? Or, if data collection is the real harm to consumers, what about the fact that hundreds of millions of people happily share far more personal information every day on social networks or using grocery discount cards? Opinion polls simply cannot answer these questions.

The Direct Benefit of Tailored Ads: Relevance

Whatever Americans tell pollsters about “tailored” ads, they also complain about irrelevant ads: A previous poll found that 72% of consumers “find online advertising intrusive and annoying when the products and services being advertised are not relevant to [their] wants and needs” and 85% say that less than 25% of the ads they see while browsing online are relevant to their wants and needs. Real-world experiments confirm that users reveal a clear preference for more relevant advertising. In a 2004 experiment, click-through rates (CTR) for behaviorally targeted ads were between 94% and 225% higher than for contextually targeted ads. A 2009 study found that the difference could be between 670% and 1000% percent, depending on how well-tailored the ads were. In other words, users in the real world were two to eleven times more likely to click on highly-tailored ads. Truly, actions speak louder than words: Users clearly “vote with their clicks” for ads they find relevant—i.e., they vote for “tailoring.”

Further reinforcing this conclusion is the fact that better tailoring increases not only click-through rates but also “conversion rates”—the percentage of users who actually complete the action desired by the advertiser, whether that be making a purchase or signing up for a list. A 2008 experiment found increased conversion rates of 400-900% (2008). This indicates that relevant ads really do help consumers find things they like—and that they like the fruits of tailoring, however they respond when asked about “tailoring” as an abstract concept that conflates costs (“How are they following me?”) and benefits (“What’s in it for me?”).

The Indirect Benefit of Tailored Ads: Free Content & Services

Even less apparent to poll respondents than the direct benefit of tailoring (increased relevance) are the indirect benefits: In particular, greater relevance to the user means more effective communication for the advertiser, and increased ad revenue for most online publishers per ad on their sites. Thus, there exists a clear quid pro quo: in effect, users “pay” for content and services by sharing information about their interests. Even more fundamentally, users “pay” for content by seeing ads. But both quid pro quos are implicit: Users can simply choose not to “pay” by using readily available tools in their browser to blocking ads and/or tracking. In essence, today’s system allows users who don’t like ads—tailored or otherwise—to opt out at little or no cost, much as if they simply decided not to pay for a product they bought at their local grocery store.

This creates a serious dilemma, given that advertising increasingly stands alone as the lifeblood of online content and services. Indeed, ads have long funded the costs of generating content for radio, television, and newspapers (with subscriptions paying only for distribution). The basic reason is simple economics: In competitive markets, prices tend to fall to the marginal cost of production. The Internet has simply borne this theory out in full:

1. Producing the first unit of content (e.g., a news story or video) remains costly, so while the marginal cost of every additional unit is essentially zero,average cost is not.
2. The failure of micropayments online seems to confirm that, no matter how low the technological transaction costs are, the mental transaction costs involved combined with even tiny payments will exceed the perceived value of most content.
3. The world of media scarcity in which consumers could choose from only a few sources of content (e.g., news, entertainment) has given way to a world of staggering media abundance and the choices of users are no longer constrained by the tyranny of physical limitations like distance and printing costs.
4. Because pure information cannot be copyrighted (and fair use allows significant referencing and quotation), very little content is so unique that users cannot find a ready substitute elsewhere if a site (or even cartel of sites) attempted to charge.

These forces have given birth to the world of “Free,” where few (if any) users will pay for something they can get for nothing. While there are a number of ways to fund content and services, advertising is far and away the leading business model for the new economy: Indeed, overall advertising market is expected nearly to double its share of total U.S. ad spending from 8.7% in 2008 ($23.4 billion) to 15.2% ($37.2 billion). But with 44% of advertising revenue going to search engines (which show highly “tailored” ads simply based on search terms), hundreds of thousands of publishers—from the mightiest to the tiniest—rely on $7.6 billion (33% of the total) in “display” ad revenue. Yet this base is tiny: Most websites earn a fraction of the revenue generated by offline ads: roughly $0.60 to $1.10 per thousand impressions (CPM) online versus average CPMs of $4.54 (radio) to $10.25 (broadcast). This unprofitability of online advertising, and the fact that certain kinds of online content (e.g., video and online services) does not provide the textual keywords necessary for basic contextual targeting is driving publishers to ad networks that offer behavioral targeting, which is expected to grow from $525 million in 2007 to $4.4 billion in 2012—when it will represent 25% of all display ad spending.

In short, advertising is indispensable to the future of online media, but it is also currently inadequate to sustain “Free” culture. As Adam Thierer and I warnedearlier this year: “The advocates of regulation pay lip service to the importance of advertising in funding online content and services but don’t seem to understand that this quid pro quo is a fragile one: Tipping the balance, even slightly, could have major consequences for continued online creativity and innovation… Something must give because there is no free lunch.” In 2001, long before Google mattered and before he worked for them, Kent Walker (now Google’s general counsel) put it best in a seminal law review article:

Privacy is both an individual and a social good. Still, the no-free-lunch principle holds true. Legislating privacy comes at a cost: more notices and forms, higher prices, fewer free services, less convenience, and, often, less security. More broadly, if less tangibly, laws regulating privacy chill the creation of beneficial collective goods and erode social values… Such regulation would likely increase both direct and indirect costs to the individual consumer, reduce consumer choice, and inhibit the growing trend of personalization and tailoring of goods and services.

Thus, as Jim Harper and Solveig Singleton concluded in their 2001 paper With a Grain of Salt: What Privacy Surveys Don’t Tell Us:

privacy surveys in particular… suffer from the “talk is cheap” problem. It costs a consumer nothing to express a desire for federal law to protect privacy. But if such law became a reality, it will cost the economy as a whole, and consumers in particular, significant amounts that surveys do not and cannot reveal.

We Need a Behavioral Economics Experiment, Not Just Another Poll

The Berkeley-Penn poll could certainly have done more to present these trade-offs to respondents and less to color their responses by inflating mental transaction costs. But even the most “fair” poll cannot meaningfully simulate the trade-offs inherent in the real world. If we really want to know how muchsubjective value consumers place on a particular aspect of their privacy, we must look to the preferences they reveal in the process of making real choices.

Of course, the best experiment is the one being conducted in the real world every day. No laboratory experiment can ever fully replicate all of the conditions of the real world, but a behavioral economics experiment could tell us more about the revealed preferences of Internet users than any poll. Unlike the real world, an economist could vary certain conditions in a lab experiment to tell us how various changes to current industry practice, user empowerment, or user education might actually affect real consumer choices. At a minimum, any experiment would require the following to inform policymaking about online advertising and privacy.

First, the experiment should vary the mechanisms by which notice is provided to users as to how tailoring works ( e.g., placement, interface, wording) and what those notices actually say.

Second, test subjects must make real choices in real use of the Internet with trade-offs in real money and their own time between either paying for access to a particular site or getting access for free in exchange for receiving tailored ads based on at least the three variables presented as questions in the Berkeley-Penn study: (i) users’ browsing activity on that site; (ii) their browsing activity on other sites; and (iii) offline activity or demographic information.

The second variable is critical because it addresses the value created by behaviorally tailored ads, which could be wiped out by regulation. Search engines are able to sell highly effective advertising based solely on information provided directly to the site (search keywords, which are highly indicative of user interest), and some sites can sell lucrative advertising based on purely contextual targeting because their content contains keywords that advertisers value highly ( e.g., a site for digital camera enthusiasts). But the vast majority of websites, and especially non-commercial websites, would produce little ad revenue if advertisers could only guess at the likely interests of visitors based on the keywords on that site. This, in a nutshell, is why so many sites stand to gain so much from behavioral targeting—particularly in the Internet’s “Long Tail.” To be useful, an experiment must reflect this dynamic.

In the real world, of course, it might be possible for the user to opt-out of tracking without losing access to content because today’s quid pro quo is implicit and most sites operate on a “No Cost Opt-Out” basis for tracking and even seeing ads. But in order to tell us how much consumers really care about tracking, the experiment must place some value on access to content that is supported by free content and services.

Third, the experiment must examine the extent to which user empowerment affects user choice: If some users are uncomfortable with having their browsing activity tracked, is it because they are concerned about all tracking or only tracking of certain sensitive activities, such as researching medical issues or—everyone’s favorite—viewing pornography? How does the availability of privacy management tools change user choices about ad-tailoring? Do Americans really want tailoring banned, or do they just want the ability to exercise easy choice about when they want to participate? How would those choices change when they come at a cost (e.g., seeing more ads) and privacy-sensitive users cannot simply free-ride off the value created by users whodon’t opt-out of targeted advertising (and also don’t block ads)?

Such an experiment would, by its very nature, be imperfect—but far less imperfect than any poll about opinions on privacy. Until a proper experiment is conducted by trained behavioral economists, all we can say with confidence is the following:

1. Users don’t understand exactly how ads are tailored;
2. Users seem to be concerned about “tailoring” or “following” in the abstract;
3. Users are generally unwilling to pay for online content and services; and
4. Better tailoring of ads means more funding for content and services.

There is only one approach that can address all these concerns: educate users about how online advertising works and how they can implement their own privacy preferences, while constantly striving to further empower users to make privacy management easier.

The Tennis Channel and ESPN have teamed up to offer live coverage of the US Open online. Not only is this a wonderful thing for consumers, but it also demonstrates just how easily content creators (including traditional television programming networks) can completely bypass cable companies, who once supposedly used their “bottleneck” power to act as “gatekeepers” over the content Americans could receive. If this was ever true, it certainly isn’t true in the era of Internet video!

The venture will, of course, be ad-supported. But just how much content such a  model can support will depend  heavily on whether Internet video programming distributors like this venture (or Hulu.com) will be able to personalize the ads shown on their videos based on the likely interests of users.  Ad industry observer David Hallerman has predicted that spending on behavioral advertising:

is projected to reach $1.1 billion in 2009 and $4.4 billion in 2012 [a quarter of U.S. display advertising].The prime mover behind this rapid increase will be the mainstream adoption of online video advertising, which will increasingly require targeting to make it cost-effective.

The problem isn’t just the expense involved in streaming online video, it’s that contextually targeting advertising (based on keywords) is easy when the content is text but far more difficult when the content is video.

So if you’re hoping to cut the cord to cable and save the expense of a monthly cable subscription, you’d better hope the privacy zealots don’t wipe out advertising model necessary to make Internet video a true substitute for traditional subscription video sources!

A coalition of ten self-described “consumer and privacy advocacy organizations” today demanded legislation that would restrict the collection and use of data online for customizing advertising based on Internet users’ interests. I’ll have more to say on this but here are my initial comments:

These so-called “consumer advocates” are actually anti-consumer elitists.  Not only do they presume that consumers are too stupid or lazy to make their own decisions about privacy, but they ignore the benefits to consumers: more relevant advertising plus more and better content. Advertising has been the “mother’s milk” of media in America since colonial times and the future of media depends on the ability of publishers to replicate that revenue model online.  Micropayments, donations, subscriptions alone simply can’t fund a vibrant marketplace of ideas.  Only personalized advertising can sustain publishers through the Digital Revolution. Regulatory advocates haven’t demonstrated any harm to consumers that would justify such sweeping preemptive regulation.  By strangling funding for new media, such regulations would amount to an “Industrial Policy” for the Internet.  Instead, policymakers should focus on educating consumers and empowering them by promoting development of better privacy management tools.

The leading trade associations in the online advertising industry have just released their new self-regulatory principles—the first comprehensive self-regulatory principles industry has produced, which track closely with the suggested guidelines released by the FTC in February.

I commend the industry for setting a new standard in transparency, consumer control and data security. These Principles do much to empower Americans to make their own decisions about privacy, but I fear that many critics of so-called “targeted advertising” will never be satisfied, no matter how high industry raises the bar.

These critics have insisted that ordinary users can’t be trusted to make the “right decisions” about privacy and have insisted on imposing restrictive default “opt-in” rules for the online data collection that makes online advertising valuable to websites that rely on ad revenue.  Such pre-emptive privacy regulation would stunt the growth of revenue for the “Free” online content and services we’ve all come to take for granted.  During a time of economic recession, and as traditional media like newspapers struggle to make the transition from print to the Internet, it’s more important than ever that policymakers allow self-regulation to evolve.  Only by doing so can we expect continued innovation and creativity online. We must all remember:  There is no free lunch!

I’ll lead a panel discussion on July 10 on Capitol Hill about “Regulating Online Advertising: What Will it Mean for Consumers, Culture & Journalism?”  Please RSVP here.

The advocates of regulation pay lip service to the importance of advertising in funding online content and services but don’t seem to understand that this quid pro quo is a fragile one:  Tipping the balance, even slightly, could have major consequences for continued online creativity and innovation.

Who is this handsome young man and why does he have “Mr. Yogato Stamped Me!!!” on his forehead? More importantly, why does he look so darn happy?

Flashback: Earlier this week, my partner Michael (pictured) and I visited Mr. Yogato, a frozen yogurt shop in Washington’s Dupont Circle neighborhood which describes itself as “the FUNNEST yogurt experience you’ll ever have.”

Apart from serving exceptionally tasty frozen yogurt and letting customers play a vintage Nintendo, Mr. Yogato is famous for the eight “Rules of Yogato,” which offer discounts if users achieve certain feats, including:

• Answering devilishly difficult trivia (10% off—or extra if you fail)
• Reciting the Stirling battlefield speech from Braveheart in a great Scottish accent (20% off)

But the best discount, which Michael does every time (unless I’m there to help identify, say, countries that end in ‘L’), is offered for wearing the Yogato stamp on your forehead. Being stamped is, of course, almost as much fun as singing along to “Mr. Roboto” if you’re lucky enough to hear that played while you’re in the shop (10% off).  But the real fun is in engaging passersby on the street about the icy-sweet joys of Yogato. It’s also, of course, probably the most effective advertising Mr. Yogato could ever want.

So, the next time you hear Adam Thierer and I talk about the benefits of advertising, especially online, just remember that while there is no free lunch (nor free frozen yogurt), there is discounted frozen yogurt.  It’s a simple, obvious quid pro quo:  10% off in exchange for spreading the Gospel of Yogato.

The most obvious example of a  quid pro quos is the use of discount cards in grocery stores: Users receive discounts in exchange for having their purchases tracked, which allows advertisers to target advertising to them and the grocery store to better manage its inventory. Online, Microsoft’s Live search engine (now Bing) pioneered the use of rewarding users with “cashback” for purchases made through the search engine.

But the more significant quid pro quo online is indirect: users receive “free” content and services in exchange for seeing advertising and sharing data about their browsing habits, which makes advertising significantly better targeted, more effective for advertisers and therefore more profitable for online content publishers and service providers. As Adam and I noted in response to the FTC’s recently-released self-regulatory guidelines for “behavioral advertising” (now likely to be superseded by pre-emptive “privacy” legislation):

The advocates of regulation pay lip service to the importance of advertising in funding online content and services but don’t seem to understand that this quid pro quo is a fragile one: Tipping the balance, even slightly, could have major consequences for continued online creativity and innovation. [FTC] Commission Harbour talks about companies competing on privacy as a “non-price dimension”-and that is clearly a positive thing. In traditional economics, there are three primary variables that are considered when discussing industry competition and efforts to regulate market structures: price, quantity, and quality. But in the context of the Internet, where digital economics have relentlessly driven prices down to zero, and where advertising support has become the only viable business model for most providers of content and services, the price variable has largely been removed from the picture. This means-unless industry could somehow find a way to make pay-per-use, pay-per-view, or subscription-based models work in the future-that regulation of online advertising would have its most dramatic impact on the quantity and quality of content and services provided. Depending on how regulation is structured, therefore, it is possible that new privacy mandates would severely curtail the overall quantity of content and services offered-and greatly limit the ability of new providers to enter the market with innovative offerings. Alternatively, or perhaps additionally, companies would change the character of their offerings and water-down sophisticated services that cater to consumer demand; in other words, the quality of service would deteriorate. Bottom line: Something must give because there is no free lunch. Regulation is a giant game of economic whack-a-mole: Attempting to control one of the primary variables of price, quantity, or quality inevitably results in non-optimal adjustments in the other two variables. The absence of price as a variable in this context means there is one less variable for the government to control in the first place. Simply stated, stifling the evolution of the online advertising marketplace will likely result in fewer free online services and less content, less high-quality online services and content, or some combination of both…. Apart from a hardcore fringe who embrace the Marxist dogma that advertising is inherently deceptive and wasteful, most participants in this debate at least pay lip service to the economic importance of online advertising. One might therefore be lulled into a false sense of complacency that “sensible” regulation (or government-led co-regulation) would surely avoid crippling this dynamo. This widespread assumption calls to mind the famous quip of Chris Patten, last British Governor of Hong Kong, who paraphrased those who dismissed his concerns about the potentially negative effects of a Chinese take-over of the British colony in 1997, as follows: “It is unimaginable that the Chinese would kill such a goose.” To this, Patten responded, “Yet we wouldn’t need the metaphor of golden eggs and geese if history weren’t full of dead geese.” The dangers of regulation to the health of the Internet are real, but the ease with which government could disrupt the economic motor of the Internet (advertising) is not widely understood-and therein lies the true danger in this debate.

I think Mr. Yogato would understand this. Let’s hope Chairman Boucher and the folks on the Hill who seem to be so adamant about regulation do, too.

FTC Chairman Jon Leibowitz warned yesterday that companies involved in Web advertising face their “last chance” to “voluntarily” adopt stricter policies governing the use and collection of consumer information, Reuters reports. This isn’t the first time the FTC has threatened the advertising industry with regulation, but it signals a sense of immediacy that may pressure industry leaders to change their practices in coming weeks.

Leibowitz presumably wants to quell widespread concern that Internet companies like Google and AT&T have “excessive control” over consumer information. But what’s excessive about using information that individuals have voluntarily handed over for marketing purposes, subject to legally enforceable rules laid out from the get-go?

Users ultimately control their data, not firms. After all, only data that users transmit can be collected. When a user visits a website, their IP address may be recorded, and when a user submits a query to a search engine, the search term can be logged. This is how the Internet has always worked.

Not all consumers understand what information is gathered about them as they browse online. The best way to protect such users is not through regulation, but by educating — and, therefore, empowering — users. Volumes have been written on privacy and data security, and the ongoing TLF series “Privacy Solutions” offers a growing body of tips on how consumers can achieve the level of privacy that suits them.

Understandably, some people are uncomfortable with their queries being logged, and would prefer that websites simply not track any data. Some sites are willing to do just that — Cuil, a search engine launched in 2008, promises to never log IP addresses or even use cookies (as Jim has noted). Other anonymity solutions rely on secure virtual tunnels that can mask users’ actual IP addresses.

Still, no matter what the FTC does, transmitting data in plaintext over the Internet will never be truly “safe.” Robust end-to-end encryption is the only surefire method of ensuring information cannot be seen by anybody except the sender and the recipient. Even then, information is only as safe to the extent that the party at the other end of the line can be trusted.

Any new FTC mandates on data collection would almost certainly impose a privacy ceiling that would offer some, if not most, people too much privacy. This may sound impossible at first, but think of people who document their every move on Twitter, open for the world to see. Different people have wildly different privacy preferences, and there is no way a single set of rules-however well-conceived-could satisfy everyone.

Privacy mandates will place shackles on the still-young Internet advertising industry, stifling promising opportunities for making money from online content. Strict rules governing data collection will deprive publishers — especially small ones — of ad revenue at a time when it is sorely needed. Rigid mandates will also prolong “dumb” Web ads by delaying the evolution of targeting technologies capable of making advertisements more relevant and, therefore, more interesting to users.

Online advertising is the lifeblood of Web content, as Berin, Adam, and others have explained time and time again. The alternative to advertiser subsidies — charging consumers for access to content — has proven relatively unpopular with consumers. Who wants to take out their credit card when all content creators pine for is a pair of eyeballs?

Advertising will fuel the growth of online content, but only if regulators let the market work.

Google’s new “Interest Based Advertising” (IBA) program represents the company’s first foray into what is generally called “Online Behavioral Advertising” (OBA):  In order to deliver more relevant advertising, Google will begin tailoring ads delivered through AdSense on the Google Content Network (GCN) and YouTube.com (but not Google.com).  This tailoring will be based on a profile of each user’s interests created by tracking their browsing activity across sites that use AdSense-but not search queries or other user information.  Until now, (i) AdSense has delivered essentially “contextual” advertising by choosing which ad to display on a page based on an algorithmic analysis of keywords on that page; and (ii) Google has tracked users’ browsing only for analytics purposes-to limit the number of times a user sees a particular ad (to prevent overexposure) and to allow sequencing of ads in campaigns where one ad must follow another. 

Google is sure to be attacked for crossing a “line in the sand” drawn by some privacy advocates between contextual and behavioral advertising-even though Google’s closest competitor, Yahoo!, already offers a similar program, and the concept in general is hardly new.  Google’s position as the leading search engine and third party ad-delivery network will no doubt cause paroxysms of privacy hysteria among those who consider targeted advertising inherently invasive, unfair or manipulative.

But those whose first priority is advancing consumer privacy, not advancing a political or regulatory agenda, should applaud Google for excluding sensitive categories and for putting the new Ad Preference Manager at the core of the company’s new IBA program.  The Ad Preference Manager sets a new “gold standard” for implementing the principles of Notice and Choice, which have formed the core of both OBA industry self-regulation and the various regulatory proposals made in recent years.  Indeed, Google has done precisely what Adam Thierer and I have called for:  giving consumers more granular control over their own privacy preferences by developing better tools.

How Google’s Ad Preference Manager Works

For years, debates about how OBA should be regulated (whether by industry or by government) have revolved around two key questions: 

• Notice: How should consumers best be informed about the data that’s being collected about them, how it’s being used, by whom, and so on?
• Choice: How should consumers be given the ability to opt-out of tracking for OBA purposes?

While there are significant philosophical disagreements about some aspects of these debates-such as whether the default should be opt-in or opt-out-much of the debate has come down to questions of implementation that may seem trivial or easily-solved to lay people:  Where should notice be provided?  If notice is provided in ads themselves, what should the link say and how big should it be?  By what technological means should users be able to opt-out of tracking?  Google has provided an elegantly simple solution to these questions. 

Google provides “notice” to users in two ways:

• In the ads.  In the bottom left corner of each AdSense ad on sites in the GCN, users will see the URL for the advertiser’s website.  This is already the case for all text ads, but not for display ads.  In the bottom right corner of both display and text ads, users will see an “Ads by Google” link.  Thus, the ad itself provides the user notice of (i) who’s paying for the ad and (ii) who’s serving it. 
• In the Ad Preference Manager.  If the user clicks the “Ads by Google” link, they will see which of the ~20 categories and ~600 subcategories have been associated with the tracking cookie in their browser.  Thus, Google provides notice to the user of what’s in their so-called “digital dossier.”

Google provides “choice” to the user in two ways:

• Editing categories.  The Ad Preference manager not only shows the profile that has been algorithmically assembled of their likely interests, but it lets them decide for themselves which categories they’re really interested in.  If a user finds that they have been placed in the “Automotive > Motorcycles” category but actually owns a SUV, they could select “Automotive > Trucks & SUVs”-or no Automotive category at all.  
• A persistent opt-out.  Users can decide to opt-out completely from having their data collected for IBA purposes.  That choice will be respected in the future, and will therefore be “persistent.”

The Persistent Opt-Out Plug-in

For roughly a decade, the OBA industry has operated under a self-regulatory scheme developed by the Network Advertising Initiative (NAI).  NAI lets users opt-out of receiving ads based on OBA targeting.  But privacy advocates have objected on three grounds:

First, privacy advocates argue that it’s currently too hard for users to find the NAI opt-out tool since users don’t know which ad network is serving which ads and there’s no obvious way to get from an ad to the opt-out option.  Google moots this argument by making its opt-out easily accessible to anyone who clicks on the “Ads by Google” link that appears beneath every IBA-targeted ad.

Second and most importantly, privacy advocates decry NAI’s opt-out because it isn’t “persistent”- i.e., it requires the placement of a special “opt-out cookie” on the user’s computer, which may be inadvertently deleted when users delete all their cookies.  Indeed, many users do precisely that on a regular basis through either their browser or antivirus software-thus erasing their own opt-out choice.  Google moots this argument too:  While Google’s opt-out also relies on a special opt-out cookie, Google has created an easily installed plug-in for the two most common Web browsers, Internet Explorer and Firefox, that ensures that the opt-out cookie is automatically recreated even if a user deletes their cookies.  For the Chrome and Safari Web browsers (which do not support plug-ins), Google has outlined a simple procedure whereby users can achieve the same result.

Third, many critics worry that any cookie-based opt-out mechanism still involves sending data to ad networks that the ad networks could use to track users-despite promises in their privacy policies not to do so.  Even though the FTC can enforce such policies, it may be difficult for users to determine what the ad networks are doing with the data they receive from users that have opted out of tracking.  Although Google’s system seems to be no different in this regard from how other NAI member companies handle opt outs, truly privacy-sensitive users could easily address this concern by configuring their Web browser to not send any data to these networks and/or not allow any persistent cookies, as we’ve discussed in our Privacy Solutions Series.   

A Superior Solution to a “Do-Not-Track” Registry

The privacy advocates who lambaste the inadequacies of the NAI opt-out system have demanded the creation of a government-run “Do-Not-Track” registry loosely modeled on-but very different in practice from-the FTC’s Do-Not-Call registry, by which over 170 million Americans have opted out of receiving telemarketing calls.  Google’s Ad Preference Manager provides a better system.

First, it proves that the “persistency” problem can be solved.  In fact, since Google’s plug-in is open source, these privacy advocates may be able to use it to create a browser plug-in that works for opt-out cookies from other NAI member companies.  Indeed, given how simple Google’s plug-in is, one wonders why they didn’t do this when NAI’s Opt-Out Tool was first made available.  Perhaps the technologists at these organizations have spent a little too much time developing elaborate regulatory solutions and too little time focusing on empowering users.  Or perhaps these organizations simply decided that creating such a tool would undercut their argument that only government intervention could protect users’ privacy.  Ironically, some of the organizations pushing Do-Not-Track have joined us in emphasizing the effectiveness of user empowerment tools in other contexts-such as online child protection, where parental control software offers a more effective alternative to government regulation of Internet content that also does less to restrict constitutionally protected speech.  Even more ironically, their Do-Not-Track proposal specifically calls for the development of browser-based tools to implement the government-maintained Do-Not-Track database.  In an era when anyone can write a browser plug-in that can achieve wild popularity (such as the roughly 43 million downloads of the Firefox plug-ins AdBlock Plus and NoScript), these advocacy organizations have little excuse for not practicing what they preach. 

Second, Google has set a new standard in both Notice-by including a link to the opt-out in every ad-and Choice-by respecting user’s opt-out preferences.  Other ad networks now face intense pressure to catch up with, or outpace, Google by implementing the same kind of Notice and Choice.  Indeed, NAI will now be expected to improve its own opt-out system with a browser plug-in capable of preserving opt-out preferences for all of its members’ ad networks.  To the extent that this plug-in might work better with cooperation from the ad networks, that cooperation should now be more forthcoming than ever. 

Third, if these privacy advocates’ real objection to any cookie-based opt-out system-whether the NAI opt-out tool or Google’s plug-in-is uncertainty as to whether opt-out preferences would really be respected by ad networks that continue to collect tracking data (as discussed above), who better than Google to lead the market in setting higher standards for privacy protection?  Ultimately, these standards will be, and should be, enforced by the FTC under its existing authority to punish unfair and deceptive trade practices.

What This Episode Says About Google

Some privacy advocates will argue that Google is just too big-and therefore too “scary”-to be allowed to engage in OBA, and may try to paint Google’s entry in the OBA marketplace as a net loss to privacy, notwithstanding the extremely pro-privacy way in which Google has implemented its “IBA” service.  But if this incident demonstrates anything about Google, it’s the following:

First, it’s no accident that Google is now leading the pack of third party ad networks by developing innovative solutions that respect consumer privacy.  Unlike most third party ad networks, Google is directly focused on the demands of consumers:  In addition to the ad network they acquired from DoubleClick, of course, Google offers consumers a wide array of other online services (search, email, maps, etc.).  Because these services (and their competitors) are all free, Google has to compete in what economists call “non-price terms”-such as privacy.  So, Google has a lot to lose by alienating its users and a lot to gain by being seen as a leader in privacy protection.  Would an independent DoubleClick have taken so much care to address privacy concerns?  As the developer of a competing search engine once said about the Internet search industry, ”you earn your right to be in business every day, page view after page view, click after click.”  

Second, it’s no accident that Google was a late-comer to the OBA market, lagging behind Yahoo! in particular.  The most likely reason Google has taken its time in rolling out an OBA product is that Google is subject to a unique level of scrutiny by privacy advocates by virtue of its size.  Being the “big kid on the block,” Google has to be especially careful not to appear to be “Big Brother.”  This reputational check on Google should allay some concerns about Google’s size.

Third, this episode also demonstrates the advantages of having a player like Google large enough to be able to singlehandedly set a new paradigm in privacy protection.  Google risks alienating some advertisers and publishers with its bold empowerment of users, but was willing to take those risks because of its incentives as a consumer-facing company and able to do so because of its leadership in the marketplace.  Uncomfortable as this reality may be for those who fret about antitrust issues and indeed for Google itself, the simple reality is that sometimes it takes “big dogs” to make self-regulatory systems truly effective.  For example, the video game industry’s highly effective content rating system has worked because the titans in that field were big enough to push through a tough system and keep it working.  Similarly, Microsoft has led the way for years in empowering users by offering in Internet Explorer the most sophisticated cookie management tools available in any browser, as we’ve discussed.  In a nutshell, privacy leadership requires scale. 

Conclusion

Google’s Ad Preference Manager, with its persistent opt-out plug-in, offers precisely the kind of robust opt-out that privacy advocates have always demanded.  Google deserves a rousing “Amen!” from privacy advocates.  But those who respond to this program by insisting that “more needs to be done on how to educate people and tell them how to opt out,” are right in two senses.  First, Google has shown other ad networks how to do more to empower users.  I am confident that they will rise to that challenge by continuing to refine self-regulation through technological innovation.  Second, this is by no means the last word in privacy protection from Google, which operates in the midst of continually-evolving privacy standards.  I expect Google and competing ad networks will continue to innovate in developing technologies that empower users to manage their own privacy-and that this competitive “race to the top” will improve online privacy protection in a broader sense beyond just advertising by putting pressure on other online service providers to improve their privacy practices and policies.

But I fear that too many privacy advocates will instead see this as just another reason for the government to intervene-perhaps because of fear of Google engaging in OBA or  because they think the government, not Google, should be developing privacy solutions.  Or perhaps they think Google’s system shows that a system of government-mandated solutions really could work.  To the contrary, Google’s approach is precisely the kind of innovation that would be discouraged by pre-emptive government regulation.  Worse, those who would freeze privacy protection in place would also freeze in place much of the Internet itself, precluding development of new business models that would compete with Google, allaying concerns about competition and benefiting consumers.  Why preclude broadband providers, for example, from figuring out how to deploy ad-targeting technologies in a manner that does as much to empower users with better privacy controls as Google has-especially when this could create a new source of funding for “free” content and services and even discounts on broadband? 

I hope instead that the effectiveness of Google’s approach will shift the policy debate about protecting user privacy back to an emphasis on the layered approach Adam Thierer and I have outlined, supplementing consumer education, industry self-regulation, existing state privacy tort laws, and  FTC enforcement of corporate privacy policies with increasingly powerful technological “self-help” tools that allow privacy-wary consumers to take privacy into their own hands.

Jerry Yang’s departure as Yahoo! CEO opens the door to a renewed bid by Microsoft to buy Yahoo!’s search business (or Yahoo! itself).  Such a merger could produce a significantly stronger challenger to Google in the search market.  With this possibility in mind, the WSJ just ran a fascinating history of the “paid search” business—the placement of “contextually targeted” ads next to search engine results based on the search terms that produced those results.

In a nutshell, Microsoft failed to see (back in 1998-2003) the enormous potential of paid search—just as small start-ups (such as Google) were starting to develop the technology and business model that today account for a $12+ billion/year industry, which is  twice the size of the display ad market and which supports a great deal of the online content and services we have all come to take for granted online.  Microsoft first put its toe in the water of paid search with a small-scale partnership with Goto.com in 1999-2000.  But this partnership failed because of internal resistance from the managers of Microsoft’s display-ad program.  In 2000, Google launched Adwords and thus began its transformation from start-up into economic colossus.  By 2002, Microsoft realized that it needed to catchup fast, and approached Goto.com (by then renamed Overture) about a takeover.  But Microsoft ultimately chose in 2003 not to buy the startup because  Bill Gates and Steve Ballmer “balked at Overture’s valuation of $1 billion to $2 billion, arguing that Microsoft could create the same service for less.” 

Microsoft, meanwhile, spent the next 18 months deploying hundreds of programmers to build a search engine and a search-ad service, which it code-named Moonshot. The company launched its search engine in late 2004 and its search-ad system in May 2006.

But Microsoft’s ad system came too late:

Advertisers applauded Moonshot for its technical innovation. But Microsoft had trouble coaxing people to migrate to its search engine from Google; advertisers were unwilling to spend large sums on MSN’s search ads. By building a new system instead of buying Overture, Mr. Mehdi says, “we really delayed our time to market.”

What’s most fascinating about the piece is that it seems to suggest that Microsoft missed its opportunities to get into paid search not because it was “dumb,” “uninnovative” or a “bad” company, but for the same sorts of reasons that big, highly successful and even particularly innovative companies fail.  The reasons companies generally succeed in mastering “adaptive” innovation of the technologies behind their established business models are the very reasons why such great companies struggle to encourage or channel the “disruptive” innovation that renders their core technologies and business models obsolete.  This dynamic was described brilliantly in Harvard Business School professor Clayton Christensen’s classic 1997 book The Innovator’s Dilemma:  When New Technologies Cause Great Firms to Fail.  (Read chapter one here and Tim Lee’s recent discussion of the book here.)  

Whatever one thinks about the debate over whether antitrust intervention is necessary to restrain Google’s growth, I’m sure we’d all applaud the evolution of increased competition in the paid search market through market forces.  Let’s hope that Microsoft—as well as Yahoo!—have carefully studied the vast literature produced by business schools in the wake of Christensen’s book about how big companies can avoid the Innovator’s Dilemma by promoting—and capitalizing on—radical innovation from within.  Indeed, this seems to be precisely what has guided Google’s own strategy as it has grown from “disruptive innovator” to become the very sort of behemoth that cannot easily escape the Dilemma, even if corporate managers are fully aware of the problem on a theoretical level.  If Google can do it, Microsoft should be able to, too.  But let’s also not discount the possibility that, no matter how hard Google’s management might try to retain the innovative culture of a start-up, the giant  can’t do that well enough to prevent its own apparent market dominance from being disrupted by new upstart innovators in search and advertising technologies.  

The head of Google Research talked about some of these possibilities in July 2007 and the Google has recently covered other possibilities.  Here are my own bets—for what little they’re worth—as to what such “disruptors” might be:

• Semantic search and social search – whichever search engine masters these tools will likely dominate the market for search, and thus search advertising.
• Micro-payments to search users for using a search engine and discounts for clicking on ads – something Microsoft has pioneered with its Cashback system but which is probably still only in its infancy.
• Behavioral targeting that can make display ads competitive with search ads by making display ads as relevant to consumers as search ads (or even more so), rather than simply trying to target display ads based on the context of a page—which limits the economic value of the ad “display inventory” that websites try to fill with ads, especially for smaller websites in the Internet’s “long tail” whose subject matter might have little relevance to the keywords for products or services that are more highly valued by advertisers.  
• Technologies that allow contextual targeting of ads in or around videos based on the contents of the video (and associated discussion by viewers in comments). Even the imperfect ability to automatically create transcripts of a video, and then search for keywords, could hugely increased the value of advertising associated with video content.

I suspect we’d all be at least a little surprised if we could see what search engines—and online advertising—really looked like in, say, 2019.  But I won’t be terribly surprised if Google—for all its ingenuity—ends up making some of the same mistakes Microsoft made with Search 1.0 ( c. 1998-2005).

The Progress & Freedom Foundation has just launched the new Center for Internet Freedom.  CIF offers an alternative to the proliferation of advocacy groups calling for government intervention online by offering timely analyses and critiques of proposals that diminish the vital role of free markets, free speech and property rights.  We aim to drive the Internet policy debate in new directions by emphasizing a layered approach of technological innovation, user education, user self-help, industry self-regulation, and the enforcement of existing laws consistent with the First Amendment.  Such an approach is a less restrictive—and generally more effective—alternative to increased regulation.  

Here are some of the issues I’ll be working on as CIF’s Director in conjunction with my esteemed colleagues Adam Thierer, Adam Marcus, and adjunct fellows: 

• Defending online advertising as the lifeblood of online content & services, especially in the “Long Tail”;
• Emphasizing market solutions to problems of privacy protection, especially regarding the use of cookies and packet inspection data;
• Protecting online speech and expression both in the U.S. and abroad;
• Defending Section 230 immunity for Internet intermediaries;
• Opposing online taxation and legal barriers to e-commerce and digital payments, especially at the state and local levels; and
• Ensuring that Internet governance remains transparent and accountable without hampering the evolution of the Internet.

By Berin Szoka & Adam Thierer Progress Snapshot 4.19 (PDF)

Since the fall of 2008, a debate has raged in Washington over “targeted online advertising,” an ominous-sounding shorthand for the customization of Internet ads to match the interests of users.  Not only are these ads more relevant and therefore less annoying to Internet users than untargeted ads, they are more cost-effective to advertisers and more profitable to websites that sell ad space.  While such “smarter” online advertising scares some—prompting comparisons to a corporate “Big Brother” spying on Internet users—it is also expected to fuel the rapid growth of Internet advertising revenues from $21.7 billion in 2007 to $50.3 billion in 2011-an annual growth rate of more than 24%. Since this growing revenue stream ultimately funds the free content and services that Internet users increasingly take for granted, policymakers should think very carefully about what’s really best for consumers before rushing to regulate an industry that has thrived for over a decade under a layered approach that combines technological “self-help” by privacy-wary consumers, consumer education, industry self-regulation, existing state privacy tort laws, and Federal Trade Commission (FTC) enforcement of corporate privacy policies.

In an upcoming PFF Special Report, we will address the many technical, economic, and legal aspects of this complicated policy issue-especially the possibility that regulation may unintentionally thwart market responses to the growing phenomenon of users blocking online ads.

We will also issue a three-part challenge to those who call for regulation of online advertising practices:

1. Identify the harm or market failure that requires government intervention.
2. Prove that there is no less restrictive alternative to regulation.
3. Explain how the benefits of regulation outweigh its costs.

The Online Advertising Market

While there are other forms of targeted advertising based on who you are (“demographic”) or where you are (“locational”), the most important varieties are based on what you’re searching for, seeing or doing online at any particular moment (“contextual”) and the pattern of what you’re searching for, seeing or doing over time (“behavioral”). The bulk of Internet advertising falls into one or both of these last two categories, with behavioral advertising growing rapidly.

Search engines deliver contextual ads on search results pages based on the search keywords entered by a user, while third-party advertising networks (some of which also run search engines) deliver contextual ads on behalf of website operators who sell ad space to the network, with the ads displayed on each page chosen according to keywords on that page. Contextual advertising is far “smarter” than displaying the same “dumb” untargeted banner ads to every user, because the contextual ad uses keywords to “guess” what the user is interested in based on the context of each page. But the purely contextual ad network doesn’t “remember” what the user has looked at in the past, so its insights into what the user would find relevant are very limited, especially for some websites. Online behavioral advertising (OBA) solves this problem and increases the value of advertising space on all websites by targeting ads based on a “profile” of the user created by tracking websites the user has visited—as well as limiting the number of times a user is shown a particular ad.

The Perceived Harm Driving Calls for Regulation

For a decade, the basic technology behind OBA has changed little: When a user visits the typical webpage, they download not only the webpage contents but also a small piece of code that allows the website to distinguish that user’s browser from other browsers (a “cookie”)—without personally identifying the user. Some cookies are required to make sites work properly (“site cookies”) while others (“tracking cookies”) are used by the third party ad network in which that site participates to recognize that browser across multiple sites participating in the ad network, and thus create a “profile” of what the user might be interested in. Even though such profiles themselves are anonymous, many privacy advocates have pointed to four reasons why online profiling is becoming “too invasive:” (i) It is sometimes possible to infer the actual identity of the user; (ii) though all browsers allow users to opt-out of tracking by “cleaning out” their tracking cookies, a website may be able to restore deleted tracking cookies through the use of cookie alternatives such as “Flash cookies”; (iii) certain vulnerabilities in current browser design make it theoretically possible to “sniff” a user’s browsing history, cache or bookmarks; and (iv) the use of “packet inspection” by Internet Service Providers (ISPs) (instead of the use of cookies) to track online browsing amounts to illegal wiretapping.

The other concerns expressed by the advocates of regulation vary significantly. Some fear that browsing profiles could be captured by hackers, somehow associated with personally identifying information, and used for identity theft. These advocates demand limits on data retention as well as data security mandates. Others demand that users have access to their own profiles—a goal inherently in tension with data security. Most share a vague queasiness about “being tracked” and about advertising in general, while downplaying the effectiveness of self-regulation or user self-help.

Perhaps most legitimately, others fear that the real “Big Brother”—the government—will gain access to a “honeypot” of surveillance data that might be associated with individual users. A variety of other solutions have been proposed to what is, for the most part, a poorly defined problem, including a government-run “Do Not Track” registry to make it easier for users to block tracking cookies; mandating opt-in for some or all forms of profiling; and banning completely the collection of tracking data about sensitive subjects, cross-referencing of data sets, and use of packet inspection data for OBA.

The Less Restrictive Means: A Layered Approach

But how should policymakers decide which, if any, of these interventions are really necessary–or would even be effective? Ironically, those who demand immediate OBA regulation to protect user privacy are often the first to insist on less burdensome approaches whenever a policy “problem” involves purely non-commercial speech. For example, emphasizing personal and parental responsibility is often favored as the more sensible approach to dealing with free speech and child protection concerns. But, as Chapman University Law Professor Tom Bell has asked, why not apply the same standard across the board? Why not expect those especially privacy-sensitive users who object to OBA to do something about it? To the extent effective self-help privacy tools exist, they provide a means of solving policy problems that is not only “less restrictive” than government regulation but generally more effective and customizable as well. Why settle for one-size-fits-all solutions of incomplete effectiveness when users can quite easily and effectively manage their own privacy? Indeed, those who advocate personal responsibility and industry self-regulatory approaches to free speech and child protection issues should be advancing the same position with regards to privacy.

Fortunately, a wide variety of self-help tools and “technologies of evasion” are readily available to all users and can easily thwart traditional cookie-based tracking, as well as more sophisticated tracking technologies such as packet inspection. While cookie management tools that allow users to delete their cookies have been standard in browsers for some time, the latest generation of browsers incorporates far more advanced control over what kind of cookies browsers will accept from websites in the first place. Furthermore,  the extensible nature of modern browsers allows any freelance software developer who sees a way to improve a browser to do so by writing an add-on that “plugs in” to the browser using standard programming interfaces designed by each browser developer.  Many such add-ons are wildly popular, but even those users who never install a single one benefit from the acceleration of browser evolution made possible by add-ons.  We will be documenting examples of these tools in our upcoming Special Report and in an ongoing  series of blog essays.

The Benefits of Smarter Advertising

The “free” Internet economy is based on a simple value exchange: Users get access to an ever-expanding collection of content and services at no cost from websites that are able to generate revenue from “eyeballs” on their pages by selling space on their sites to advertisers, usually through ad networks. The smarter that advertising, the more free content and services it can support. This is the same value exchange that has supported free, over-the-air television and radio content for decades. The only difference is technological: Because websites can connect directly with the user, they need not rely on crude profiling tools such as Nielsen ratings.

There are larger economic benefits of smarter online advertising. First, it makes the overall economy more open and competitive by allowing small market entrants to reach consumers with messages about their products. Second, those who attack the use of packet inspection by ISPs for OBA fail to see that it is precisely the kind of “game-changer” that could disrupt Google’s currently dominant market position. Third, the involvement of ISPs in OBA could help defer broadband costs: Even if OBA revenue does not completely subsidize monthly service costs, smarter advertising could at least keep prices in check and potentially lower them significantly going forward.

But smarter advertising isn’t just about selling products or services. It is ultimately about making all kinds of speech more cost-effective. The ability to “target” listeners more narrowly also increases the ability of political and other not-for-profit speakers to communicate their messages. In short, smarter advertising means more voices, more choices, and more speech. The line between “advertising” and “content” is already blurring rapidly, as the technologies used to customize advertising are also used to customize webpages and ad networks themselves are used to deliver content.

The Larger Implications of Potential Regulation

As if reducing the advertising revenue generated by each web ad didn’t do enough to reduce the total amount of funding for free web content and services, government regulation of targeted online advertising could reduce advertising revenues even further by aggravating the problem of adblocking in two ways. First, the less relevant ads are, the more annoying users will find them, and the more likely users are to try to block them. Increased relevance is perhaps the most important remedy for adblocking and the best way to maintain the implicit value exchange that currently supports free Internet content and services

Second, regulation could short-circuit the eternal battle of technological one-upmanship between online advertisers and those users who rely on the technologies of evasion to “opt-out” of seeing ads or being tracked. Such privacy-conscious users are “free-riding” off of those users who don’t opt-out, since (at present) they generally don’t lose access to the free content and services supported by the targeted advertisements that other users do see. The user who blocks tracking, but not ads, is still free-riding off those users who don’t opt-out of tracking. On a large enough scale, such self-help has the potential to disrupt the value exchange of the Internet, just as automatic commercial-skipping has already disrupted the value exchange of television. As with all “Spy v. Spy” battles, this long-term trend is inevitable: As more sophisticated technologies of evasion are incorporated seamlessly into browsers and can be used without significantly degrading the browsing experience, their use will become increasingly mainstream. But ultimately, just as with television commercial-skipping, market forces can and will, if permitted, respond through technological means and the development of new business models. Today’s implicit quid pro quo may become, of necessity, explicit: Websites and ad networks will have to find increasingly creative ways to grant access to certain content and services for users who do not block ads or the tracking that makes ad space more valuable. Policymakers should take care not to ban such technologies or cripple such business models (e.g., through requiring opt-in), which may rely on more sophisticated forms of targeting such as the use of packet inspection data.

As users face an increasingly clear choice between (i) getting content and services for free supported by behavioral advertising and (ii) paying to receive those same services and content without tracking or even without ads altogether, policymakers will finally see whether users are really as bothered by profiling as the advocates of OBA regulation insist. Given the ongoing and widespread replacement of fee- or subscription-supported web business models with ad-supported models, it seems likely that the vast majority of consumers will continue to choose ad-supported models, including profiling.

Conclusion

The questions raised above—about the harm that supposedly requires intervention, the availability of less restrictive means, and the cost/benefit analysis of regulation—are vital considerations for the future of the Internet. Indeed, if smarter online advertising will not fund the Internet’s future, what will? As both the desire for “free” services and content and the need for bandwidth expand, OBA has the potential to offer important new revenue sources that can help support the entire ecosystem of online content creation and service innovation, while also providing a new source of funding for Internet infrastructure and making ads less annoying and more informative. That would certainly seem preferable to increased user fees or other “pay-per-view” pricing models for Internet content and services.

But looming legislative and regulatory action could stop all of that by replacing the current regime—in which the FTC merely enforces industry self-regulatory policies—with one in which the government preemptively dictates how data may be collected and used. The more enlightened approach is a “layered” approach to privacy protection that combines industry self-regulation, enforcement of industry-established privacy policies, consumer education, and user “self-help” solutions. These and other issues will be addressed in greater detail in our upcoming PFF Special Report.