Fred Vogelstein’s essay in Wired, “Great Wall of Facebook: The Social Network’s Plan to Dominate the Internet — and Keep Google Out” describes the intensifying clash between Google and Facebook—a clash that focuses on the ability to target advertising:

Like typical trash-talking youngsters, Facebook sources argue that their competition is old and out of touch. “Google is not representative of the future of technology in any way,” one Facebook veteran says. “Facebook is an advanced communications network enabling myriad communication forms. It almost doesn’t make sense to compare them.”

Apart from noting that Facebook directs users to Microsoft’s Bing as its default search engine for the Internet at large, the most interesting part of the article is Facebook’s “4-Step Plan for Online Domination”:

1. Build critical mass. In the eight months ending in April, Facebook has doubled in size to 200 million members, who contribute 4 billion pieces of info, 850 million photos, and 8 million videos every month. The result: a second Internet, one that includes users’ most personal data and resides entirely on Facebook’s servers. 2. Redefine search. Facebook thinks its members will turn to their friends—rather than Google’s algorithms—to navigate the Web. It already drives an eyebrow-raising amount of traffic to outside sites, and that will only increase once Facebook Search allows users to easily explore one another’s feeds. 3. Colonize the Web. Thanks to a pair of new initiatives—dubbed Facebook Connect and Open Stream—users don’t have to log in to Facebook to communicate with their friends. Now they can access their network from any of 10,000 partner sites or apps, contributing even more valuable data to Facebook’s servers every time they do it. 4. Sell targeted ads, everywhere. Facebook hopes to one day sell advertising across all of its partner sites and apps, not just on its own site. The company will be able to draw on the immense volume of personal data it owns to create extremely targeted messages. The challenge: not freaking out its users in the process.

Facebook can’t keep losing money forever.  Indeed, investors are willing to keep sinking money into Facebook during Phases 1-3 because they think it will pay off in Phase 4—when Facebook really threatens to be a fGoogle-killer.  But rather the fact that investors are willing to subsidize the creation of a wonderful platform now used by 200 million people (one fifth of all Internet users worldwide), or that Facebook might finally provide a counter-weight to the fearsome Google, the People for the Ethical Treatment of Data (PETD) are appalled.  One commenter on the Wired story put it best:

I find it amazing that people will willingly post personal information to websites that will only use it for data mining and advertising revenue. They lay their entire life open to a corporation that’s only looking to profit from the information said corporation can gather for itself or it’s affiliates. When the government reads our emails, listens to our phone conversations, reads our text messages and monitors what we do online people are outraged at the invasion of our privacy. But then they log in to Facebook or Myspace or Twitter and reveal all. The Facebook “community”. Please. It’s a way for Big Business to pry into our private lives and exploit us in any way they can for the money they can make.

Such arrogant entitlement is astonishing—but hardly atypical: What makes this person (or his PETD comrades) so certain that they really know what’s best for everyone else and that Facebook users are poor, ignorant suckers being victimized by corporate greed?  As Adam Thierer and I have been saying, there is no free lunch! Do the PETD folks expect investors to pour hundreds of millions into building innovative social networks like Facebook out of… love?  As Adam Smith put it, “It is not from the benevolence of the butcher, the brewer, or the baker that we expect our dinner, but from their regard to their own interest.”

While most in the PETD crowd are too young (or just historically deprived) to know the words to  The Internationale (my favorite line: “Masses, slaves, arise, arise!”), one can easily imagine them kicking off PETD meetings with a somewhat more recent anthem, Aquarius, from the hit 1967 rock musical Hair:

When the moon is in the Seventh House And Jupiter aligns with Mars Then peace will guide the planets And love will steer the stars This is the dawning of the age of Aquarius Harmony and understanding Sympathy and trust abounding No more falsehoods or derisions Golden living dreams of visions Mystic crystal revalation And the mind’s true liberation

Nothing better captures the spirit of that thankfully-bygone era of narcissistic self-indulgence than the beginning of the 1979 film version:

Yes, Virginia, the marijuana-induced socialist-utopian delusions of the Sixties live on in a new generation of Techno-Aquarians, who want to have their digital cake—and eat yours too.  Something for nothing, free lunch for everyone!  Down with profit, up with privacy!  The “vision” (as in “Golden living dreams of”) behind this frenzy of frustration with online capitalism and PETD’s demands for regulation is what Thomas Sowell has called the “Vision of the Anointed,” “the talented few” who consider themselves wiser than everyone else, and therefore seek to impose their preferences on others, as Adam Thierer and I have both discussed.

But back to Wired:

The drumbeat of controversy surrounding Facebook illustrates the catch-22 the social network faces: It has a massive storehouse of user data, but every time it tries to capitalize on that information, its members freak out. This isn’t an academic problem; the company’s future depends on its ability to master the art of behavioral targeting—selling customized advertising based on user profiles. In theory, this should be an irresistible opportunity for marketers; Facebook’s performance advertising program allows them to design and distribute an ad to as narrow an audience as they would like. (It has also developed a program to create ads that are designed to be spread virally.) But as the Beacon debacle showed, there is a fine line between “targeted and useful” and “creepy and stalkerish”—and so far, not enough advertisers have been willing to walk that line… In a way, Facebook’s dilemma extends from its success. Users see the site as sanctified space, a place to engage in intimate conversations with friends—not to be laser-beamed by weirdly personal advertising. But with initiatives like Connect and Open Stream, Facebook can sell ads beyond its own site. Just as Google’s AdSense program sells ads on any participating Web site, Connect and Open Stream will eventually push Facebook-brokered advertising to any member site or app. But unlike with AdSense, Facebook’s ads could be exquisitely tailored to their targets. “No one out there has the data that we have,” says COO Sandberg.

Better targeted ads?  More useful information for Internet users?  A strong competitor for Google that could provide an alternative channel for advertisers and help drive up advertising revenue for publishers of “free” content and services?  Sounds great for all concerned.  Oh, but some people find relevant advertising “creepy?”  Ah, well, let’s call the whole thing off!  I’m sure Facebook will get by just fine selling crudely targeted ads on its own site for pennies a click.  Maybe they could ask for donations or hold a digital bake-sale (including tie-dyed t-shirts, of course)? Or we could just have “the government” support the most popular social networks (along with newspapers, banks, hedge funds and car manufacturers). And while they’re at it, why not have wise bureaucrats use antitrust laws to cripple Google and thus make up for the lack of a competitive threat from Facebook and the other Google-killers-that-might-have-been?

Wired suggests that Facebook’s strategy played some role in causing Google to embrace Interest-Based (behavioral) Advertising, playing catch-up to No.2 Yahoo!:

Google has even shown a willingness to join Facebook in gingerly tapping the third rail of Internet marketing—behavioral targeting. The search giant has long assured its users that it would never use their personal information to deliver targeted advertising, relying instead on aggregate data or search activity that preserves anonymity. (“There is a line with users that you don’t want to cross,” Google CEO Eric Schmidt said in the wake of the Beacon controversy.) But in March, Google started its own behavioral targeting campaign—tracking users’ browsing to deliver more-customized ads. Users have the option to either edit their profiles or opt out entirely.

With Google in the game, the fight is on.  The grand prize is clear—tapping into the most lucrative advertising purchased by leading brands:

Today, global online brand advertising accounts for just $50 billion a year. Offline brand advertising, meanwhile, accounts for an estimated $500 billion.

But I doubt there will ever be any clear “winner” in this race.  Instead, we’re likely to see fierce competition and ongoing one-upsmanship over the coming decade (and beyond) for users, for user data, and for they ad dollars they bring, among a variety of paradigms for what the Internet of the future should look like.  Facebook has already started implementing its paradigm with  Connect (launched Dec. 2008) and  Open Stream API (launched April 2009):

Connect and Open Stream don’t just allow users to access their Facebook networks from anywhere online. They also help realize Facebook’s longtime vision of giving users a unique, Web-wide online profile. By linking Web activity to Facebook accounts, they begin to replace the largely anonymous “no one knows you’re a dog” version of online identity with one in which every action is tied to who users really are. To hear Facebook executives tell it, this will make online interactions more meaningful and more personal…  But you don’t build a competitor to Google with people alone. You need data. And Connect and Open Stream are intended to make Facebook a much more powerful force for collecting user information. Any time someone logs in to a site that uses Connect or Open Stream, they give Facebook the right to keep track of any activity that happens there—potentially contributing tons more personal data to Facebook’s servers. Facebook Connect and Open Stream are also designed to make each user’s friend network, which belongs to Facebook, even more valuable and crucial to the Web experience. Together, they aim to put Facebook users’ social networks at the center of all they do online.

I, for one, think this competition will create enormous value for users by driving innovation that improves the usefulness of the Internet and increases the amount of funding available for an ever-greater, ever-richer torrent of “free” (ad-supported) content and services.  But if the Techno-Aquarians at PETD succeed in imposing regulatory mandates on the collection and use of online data through legislation or creeping regulation at the FTC, the Internet of the future won’t look all that different from the Internet of today: online content and services will continue to attract a small share of all ad dollars (just 7% in 2008), search engines will reap the bulk of that (42% in 2008), and most online content-publishers and service-providers will continue to get literally pennies per click while only a few are able to meet evolving standards of quality with purely ad-supported business models.

Heaven forbid we should allow those who offer “free” content and services to extract… profit from the unwashed masses of helpless consumers who are either too stupid, too lazy or too ignorant to manage their own privacy, no matter how powerful the privacy management tools at their disposal! The better alternative is empower users to make their own decisions about privacy, rather than imposing top-down “Industrial Policy for the Internet” on the entire country through outright prohibitions or restrictive defaults concerning data collection and use for targeting advertising—as Adam and I have said:

The ideal state of affairs would be to create a system of tools and data disclosure practices that would empower each user to implement their personal privacy preferences while also recognizing the freedom of those who rely on advertising revenues to “condition the use of their products and services on disclosure of information”—not to mention the viewing of ads!

As Google and Facebook do battle with each other, Microsoft, Yahoo! and other upstart rivals as-yet-unknown, I only hope they all—particularly their government affairs departments—remember that their common enemy is the Techno-Aquarians who seek to impose their subjective preferences about privacy on everyone else, no matter the costs to innovation, consumers, culture or media. We’ll discuss these trade-offs at our upcoming PFF Capitol Hill Briefing on July 10.

I’ve already laid out my own reactions to Google’s roll-out of an “interest based advertising” (IBA) program here.  In a nutshell, I applauded Google setting a new “gold standard” in user empowerment by providing:

• Notice in their IBA-targeted ads of who’s paying for the ad and the fact that Google is serving it; and 
• A link to a powerful “Ad Preference Manager” that allows users to:
  • See and modify the “digital dossier” (to use the fearmonger’s term) of interests associated with the cookie on their computer; and 
  • Opt-out of tracking for IBA purposes.    

But as I predicted, despite these pro-privacy features (and despite the fact that other major companies such as Yahoo! and Microsoft already have IBA programs), a number of privacy advocacy organizations are attacking Google for daring to enter the IBA (or “online behavioral advertising”) business at all.   I’ll have much more to say about the criticism of Google’s new Ad Preference Manager soon, especially coming from Marc Rotenberg of EPIC (a “disaster“) and Jeff Chester of CDD—precisely the sort of the “paroxysms of privacy hysteria” I predicted.  

But first, the criticism from Ari Schwartz of the Center for Democracy & Technology requires a response today.  At its best, CDT plays a vital role in calling corporations to continually raise the bar on privacy.  My own think tank, the Progress & Freedom Foundation, works closely with CDT on many issues, such as advocating user empowerment through technological means as a constitutionally “less restrictive” way of protecting children than government censorship.

 Here’s what Ari had to say:

[T]he opt-out is based on a failed premise. The truth of the matter is that the industry needs to work together to move beyond the discredited cookie opt-out model….  Google claims to have improved upon the old model by creating a plug-in for users to keep their opt-out cookie while deleting the rest of their cookies. While as a technical matter that may be true, without an industry-wide solution these plug-in options just serve to confuse users about what they need to do to protect themselves. If this plug-in approach catches on, will users need to download a plug-in from every network advertiser and every analytics company to stop the tracking? That model just isn’t sustainable.

Ari is setting up a straw man when he suggests that users are going to have to download a separate plug-in for every ad network.  The obvious solution, as Ari points out, is an industry-wide plug-in. But if it’s so obvious, why can’t CDT just write it themselves?  Indeed, why didn’t they write it years ago?

These aren’t rhetorical questions.  I  really  want to know what would be required to create a plug-in that does what Google’s plug-in does for every other ad network’s opt-out cookie in the Opt-out tool developed by the Network Advertising Initiative (NAI):  Maintain “persistent” user choice by checking to see whether a user has deleted whatever their opt-out cookies and, if so, restoring those cookies.  

CDT will probably insist that, if it’s really so easy to create such an industry-wide plug-in, NAI should have done so years ago.  Maybe so.  Perhaps if the industry had moved faster to innovate in privacy protection, they would be in a stronger position right now politically.  Of course, if the industry moves slowly in this regard, maybe that’s because they’ve got their hands full trying to keep advertising, the economic engine that funds the Internet’s “free” content and services, working-a reality Ari ignores.  Or perhaps it wouldn’t matter:  It seems that no matter what industry might do, it’s just not good enough for Ari.  Under the banner of “Keeping the Internet Open, Innovative and Free,” Ari is in fact leading CDT in a full-on attack on the Internet, pushing for regulation that will make the Internet:

• Less “Open” to competition among service providers and the diversity of voices and choices produced by online content creators who depend on advertising;
• Less “Innovative” in terms of new content, new services, new online personalization technologies, and new advertising business models that could broaden the base of economic support for the entire Internet; and
• Less “Free” both in political terms—“free” from government regulation and controls—and in financial terms—“free” to users because advertisers foot the bill.

CDT ignores these very real costs to crippling online advertising, which will ultimately be borne by the very consumers whom CDT claims to be protecting.  This is precisely why Adam Thierer and I have argued so strongly for a layered approach (and here at page 7) to privacy concerns about online advertising that combines self-regulation and tough FTC enforcement of privacy policies with a recognition that only by empowering individual users to make their own choices can we balance inherently subjective concerns about privacy with the need to fund the Internet’s future:

We stand at an important crossroads in the debate over the online marketplace and the future of a “free and open” Internet.  Many of those who celebrate that goal focus on concepts like “net neutrality” at the distribution layer, but what really keeps the Internet so “free and open” is the economic engine of online advertising at the applications and content layers.  If misguided government regulation chokes off the Internet’s growth or evolution, we would be killing the goose that laid the golden eggs. 

Back to the plug-in…  CDT argues that the opt-out cookie system is flawed in respects other than ensuring the persistence of user opt-outs.  We can debate that question.  But I’d just like to get a clear answer once and for all about why CDT hasn’t already developed this plug-in themselves.

Here‘s the NAI opt-out, Ari, and here‘s the code for Google’s plug-in—it’s open source! How much easier could Google have made this for you?  Quit yapping and start coding! 

Since CDT doesn’t seem up to the task, we’ve already modified the Google plug-in to preserve another ad network’s opt-out cookie (download our beta plug-in here) and are currently working to expand the plug-in to work for multiple cookies—which is simply a matter of coding.  We’d welcome help from anyone with experience in writing Firefox plug-ins. 

NAI could (and probably should) do this, themselves.  But if CDT wants to start being philosophically consistent about empowering consumers across in the board —on privacy issues as well as child protection issues—writing this plug-in themselves is a great way to shame the rest of the advertising industry into picking up where Google left off.   I suspect CDT’s failure to do so thus far reflects a crass political calculation that anything they does to empower users to manage their own privacy through technical solutions simply undermines their arguments that only government can protect users—thus weakening their push for regulation.  So much for CDT’s declared mission of “seek[ing] practical solutions to enhance privacy!”

Google’s new “Interest Based Advertising” (IBA) program represents the company’s first foray into what is generally called “Online Behavioral Advertising” (OBA):  In order to deliver more relevant advertising, Google will begin tailoring ads delivered through AdSense on the Google Content Network (GCN) and YouTube.com (but not Google.com).  This tailoring will be based on a profile of each user’s interests created by tracking their browsing activity across sites that use AdSense-but not search queries or other user information.  Until now, (i) AdSense has delivered essentially “contextual” advertising by choosing which ad to display on a page based on an algorithmic analysis of keywords on that page; and (ii) Google has tracked users’ browsing only for analytics purposes-to limit the number of times a user sees a particular ad (to prevent overexposure) and to allow sequencing of ads in campaigns where one ad must follow another. 

Google is sure to be attacked for crossing a “line in the sand” drawn by some privacy advocates between contextual and behavioral advertising-even though Google’s closest competitor, Yahoo!, already offers a similar program, and the concept in general is hardly new.  Google’s position as the leading search engine and third party ad-delivery network will no doubt cause paroxysms of privacy hysteria among those who consider targeted advertising inherently invasive, unfair or manipulative.

But those whose first priority is advancing consumer privacy, not advancing a political or regulatory agenda, should applaud Google for excluding sensitive categories and for putting the new Ad Preference Manager at the core of the company’s new IBA program.  The Ad Preference Manager sets a new “gold standard” for implementing the principles of Notice and Choice, which have formed the core of both OBA industry self-regulation and the various regulatory proposals made in recent years.  Indeed, Google has done precisely what Adam Thierer and I have called for:  giving consumers more granular control over their own privacy preferences by developing better tools.

How Google’s Ad Preference Manager Works

For years, debates about how OBA should be regulated (whether by industry or by government) have revolved around two key questions: 

• Notice: How should consumers best be informed about the data that’s being collected about them, how it’s being used, by whom, and so on?
• Choice: How should consumers be given the ability to opt-out of tracking for OBA purposes?

While there are significant philosophical disagreements about some aspects of these debates-such as whether the default should be opt-in or opt-out-much of the debate has come down to questions of implementation that may seem trivial or easily-solved to lay people:  Where should notice be provided?  If notice is provided in ads themselves, what should the link say and how big should it be?  By what technological means should users be able to opt-out of tracking?  Google has provided an elegantly simple solution to these questions. 

Google provides “notice” to users in two ways:

• In the ads.  In the bottom left corner of each AdSense ad on sites in the GCN, users will see the URL for the advertiser’s website.  This is already the case for all text ads, but not for display ads.  In the bottom right corner of both display and text ads, users will see an “Ads by Google” link.  Thus, the ad itself provides the user notice of (i) who’s paying for the ad and (ii) who’s serving it. 
• In the Ad Preference Manager.  If the user clicks the “Ads by Google” link, they will see which of the ~20 categories and ~600 subcategories have been associated with the tracking cookie in their browser.  Thus, Google provides notice to the user of what’s in their so-called “digital dossier.”

Google provides “choice” to the user in two ways:

• Editing categories.  The Ad Preference manager not only shows the profile that has been algorithmically assembled of their likely interests, but it lets them decide for themselves which categories they’re really interested in.  If a user finds that they have been placed in the “Automotive > Motorcycles” category but actually owns a SUV, they could select “Automotive > Trucks & SUVs”-or no Automotive category at all.  
• A persistent opt-out.  Users can decide to opt-out completely from having their data collected for IBA purposes.  That choice will be respected in the future, and will therefore be “persistent.”

The Persistent Opt-Out Plug-in

For roughly a decade, the OBA industry has operated under a self-regulatory scheme developed by the Network Advertising Initiative (NAI).  NAI lets users opt-out of receiving ads based on OBA targeting.  But privacy advocates have objected on three grounds:

First, privacy advocates argue that it’s currently too hard for users to find the NAI opt-out tool since users don’t know which ad network is serving which ads and there’s no obvious way to get from an ad to the opt-out option.  Google moots this argument by making its opt-out easily accessible to anyone who clicks on the “Ads by Google” link that appears beneath every IBA-targeted ad.

Second and most importantly, privacy advocates decry NAI’s opt-out because it isn’t “persistent”- i.e., it requires the placement of a special “opt-out cookie” on the user’s computer, which may be inadvertently deleted when users delete all their cookies.  Indeed, many users do precisely that on a regular basis through either their browser or antivirus software-thus erasing their own opt-out choice.  Google moots this argument too:  While Google’s opt-out also relies on a special opt-out cookie, Google has created an easily installed plug-in for the two most common Web browsers, Internet Explorer and Firefox, that ensures that the opt-out cookie is automatically recreated even if a user deletes their cookies.  For the Chrome and Safari Web browsers (which do not support plug-ins), Google has outlined a simple procedure whereby users can achieve the same result.

Third, many critics worry that any cookie-based opt-out mechanism still involves sending data to ad networks that the ad networks could use to track users-despite promises in their privacy policies not to do so.  Even though the FTC can enforce such policies, it may be difficult for users to determine what the ad networks are doing with the data they receive from users that have opted out of tracking.  Although Google’s system seems to be no different in this regard from how other NAI member companies handle opt outs, truly privacy-sensitive users could easily address this concern by configuring their Web browser to not send any data to these networks and/or not allow any persistent cookies, as we’ve discussed in our Privacy Solutions Series.   

A Superior Solution to a “Do-Not-Track” Registry

The privacy advocates who lambaste the inadequacies of the NAI opt-out system have demanded the creation of a government-run “Do-Not-Track” registry loosely modeled on-but very different in practice from-the FTC’s Do-Not-Call registry, by which over 170 million Americans have opted out of receiving telemarketing calls.  Google’s Ad Preference Manager provides a better system.

First, it proves that the “persistency” problem can be solved.  In fact, since Google’s plug-in is open source, these privacy advocates may be able to use it to create a browser plug-in that works for opt-out cookies from other NAI member companies.  Indeed, given how simple Google’s plug-in is, one wonders why they didn’t do this when NAI’s Opt-Out Tool was first made available.  Perhaps the technologists at these organizations have spent a little too much time developing elaborate regulatory solutions and too little time focusing on empowering users.  Or perhaps these organizations simply decided that creating such a tool would undercut their argument that only government intervention could protect users’ privacy.  Ironically, some of the organizations pushing Do-Not-Track have joined us in emphasizing the effectiveness of user empowerment tools in other contexts-such as online child protection, where parental control software offers a more effective alternative to government regulation of Internet content that also does less to restrict constitutionally protected speech.  Even more ironically, their Do-Not-Track proposal specifically calls for the development of browser-based tools to implement the government-maintained Do-Not-Track database.  In an era when anyone can write a browser plug-in that can achieve wild popularity (such as the roughly 43 million downloads of the Firefox plug-ins AdBlock Plus and NoScript), these advocacy organizations have little excuse for not practicing what they preach. 

Second, Google has set a new standard in both Notice-by including a link to the opt-out in every ad-and Choice-by respecting user’s opt-out preferences.  Other ad networks now face intense pressure to catch up with, or outpace, Google by implementing the same kind of Notice and Choice.  Indeed, NAI will now be expected to improve its own opt-out system with a browser plug-in capable of preserving opt-out preferences for all of its members’ ad networks.  To the extent that this plug-in might work better with cooperation from the ad networks, that cooperation should now be more forthcoming than ever. 

Third, if these privacy advocates’ real objection to any cookie-based opt-out system-whether the NAI opt-out tool or Google’s plug-in-is uncertainty as to whether opt-out preferences would really be respected by ad networks that continue to collect tracking data (as discussed above), who better than Google to lead the market in setting higher standards for privacy protection?  Ultimately, these standards will be, and should be, enforced by the FTC under its existing authority to punish unfair and deceptive trade practices.

What This Episode Says About Google

Some privacy advocates will argue that Google is just too big-and therefore too “scary”-to be allowed to engage in OBA, and may try to paint Google’s entry in the OBA marketplace as a net loss to privacy, notwithstanding the extremely pro-privacy way in which Google has implemented its “IBA” service.  But if this incident demonstrates anything about Google, it’s the following:

First, it’s no accident that Google is now leading the pack of third party ad networks by developing innovative solutions that respect consumer privacy.  Unlike most third party ad networks, Google is directly focused on the demands of consumers:  In addition to the ad network they acquired from DoubleClick, of course, Google offers consumers a wide array of other online services (search, email, maps, etc.).  Because these services (and their competitors) are all free, Google has to compete in what economists call “non-price terms”-such as privacy.  So, Google has a lot to lose by alienating its users and a lot to gain by being seen as a leader in privacy protection.  Would an independent DoubleClick have taken so much care to address privacy concerns?  As the developer of a competing search engine once said about the Internet search industry, ”you earn your right to be in business every day, page view after page view, click after click.”  

Second, it’s no accident that Google was a late-comer to the OBA market, lagging behind Yahoo! in particular.  The most likely reason Google has taken its time in rolling out an OBA product is that Google is subject to a unique level of scrutiny by privacy advocates by virtue of its size.  Being the “big kid on the block,” Google has to be especially careful not to appear to be “Big Brother.”  This reputational check on Google should allay some concerns about Google’s size.

Third, this episode also demonstrates the advantages of having a player like Google large enough to be able to singlehandedly set a new paradigm in privacy protection.  Google risks alienating some advertisers and publishers with its bold empowerment of users, but was willing to take those risks because of its incentives as a consumer-facing company and able to do so because of its leadership in the marketplace.  Uncomfortable as this reality may be for those who fret about antitrust issues and indeed for Google itself, the simple reality is that sometimes it takes “big dogs” to make self-regulatory systems truly effective.  For example, the video game industry’s highly effective content rating system has worked because the titans in that field were big enough to push through a tough system and keep it working.  Similarly, Microsoft has led the way for years in empowering users by offering in Internet Explorer the most sophisticated cookie management tools available in any browser, as we’ve discussed.  In a nutshell, privacy leadership requires scale. 

Conclusion

Google’s Ad Preference Manager, with its persistent opt-out plug-in, offers precisely the kind of robust opt-out that privacy advocates have always demanded.  Google deserves a rousing “Amen!” from privacy advocates.  But those who respond to this program by insisting that “more needs to be done on how to educate people and tell them how to opt out,” are right in two senses.  First, Google has shown other ad networks how to do more to empower users.  I am confident that they will rise to that challenge by continuing to refine self-regulation through technological innovation.  Second, this is by no means the last word in privacy protection from Google, which operates in the midst of continually-evolving privacy standards.  I expect Google and competing ad networks will continue to innovate in developing technologies that empower users to manage their own privacy-and that this competitive “race to the top” will improve online privacy protection in a broader sense beyond just advertising by putting pressure on other online service providers to improve their privacy practices and policies.

But I fear that too many privacy advocates will instead see this as just another reason for the government to intervene-perhaps because of fear of Google engaging in OBA or  because they think the government, not Google, should be developing privacy solutions.  Or perhaps they think Google’s system shows that a system of government-mandated solutions really could work.  To the contrary, Google’s approach is precisely the kind of innovation that would be discouraged by pre-emptive government regulation.  Worse, those who would freeze privacy protection in place would also freeze in place much of the Internet itself, precluding development of new business models that would compete with Google, allaying concerns about competition and benefiting consumers.  Why preclude broadband providers, for example, from figuring out how to deploy ad-targeting technologies in a manner that does as much to empower users with better privacy controls as Google has-especially when this could create a new source of funding for “free” content and services and even discounts on broadband? 

I hope instead that the effectiveness of Google’s approach will shift the policy debate about protecting user privacy back to an emphasis on the layered approach Adam Thierer and I have outlined, supplementing consumer education, industry self-regulation, existing state privacy tort laws, and  FTC enforcement of corporate privacy policies with increasingly powerful technological “self-help” tools that allow privacy-wary consumers to take privacy into their own hands.