Adam Thierer and I will be participating in two separate panels at the FTC’s December 7 “Exploring Privacy” workshop discussing, respectively, surveys & expectations and online behavioral advertising. Below is the cover letter I filed as part of my comments (PDF & Scribd), along with four past PFF publications and a working paper on the benefits of online advertising.

Privacy Trade-Offs:  How Further Regulation Could Diminish Consumer Choice, Raise Prices, Quash Digital Innovation & Curtail Free Speech

In general, we at PFF have argued that any discussion about regulating the collection, sharing, and use of consumer information online must begin by recognizing the following:

• Privacy is “the subjective condition that people experience when they have power to control information about themselves and when they exercise that power consistent with their interests and values.”^[1]
• As such, privacy is not a monolith but varies from user to user, from application to application and situation to situation.
• There is no free lunch:  We cannot escape the trade-off between locking down information and the many benefits for consumers of the free flow of information.
• In particular, tailored advertising offers significant benefits to users, including potentially enormous increases in funding for the publishers of ad-supported content and services, improved information about products in general, and lower prices and increased innovation throughout the economy.
• Tailored advertising increases the effectiveness of speech of all kinds, whether the advertiser is “selling” products, services, ideas, political candidates or communities.

With these considerations in mind, policymakers must ask four critical questions:

1. What exactly is the “harm” or market failure that requires government intervention?
2. Are there “less restrictive” alternatives to regulation?
3. Will regulation’s costs outweigh its supposed benefits?
4. What is the appropriate legal standard for deciding whether further government intervention is required?

We have addressed these questions in the PFF publications attached below, which I respectfully submit for the Commission’s consideration.  This executive summary highlights their findings.

• Online Advertising & User Privacy: Principles to Guide the Debate, Berin Szoka & Adam Thierer, Progress Snapshot 4.19, Sept. 2008.
• Targeted Online Advertising: What’s the Harm & Where Are We Heading?, Berin Szoka & Adam Thierer, Progress on Point 16.2, April 2009.
• Privacy Polls v. Real-World Trade-Offs, Berin Szoka, Progress Snapshot 5.10, Oct. 2009.
• The Benefits of Online Advertising & Costs of Privacy Regulation, Berin Szoka & Mark Adams, PFF Working Paper, Nov. 8, 2009. ^[2]
• Benefits of Online Advertising, Berin Szoka, Mark Adams, Howard Beales, Thomas Lenard, Jules Polonetsky, PFF Capitol Briefing, July 2009.

I. A Principled Pro-Consumer Alternative to Further Regulation

The “Privacy Wars” that have waged over how government should regulate online collection and use of data might better be referred to as the “Privacy Proxy Wars” because the most clearly demonstrated “harm” at issue seems to be from government itself, not the private sector.  The Fourth Amendment guarantees that “The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated…”  Americans have a legitimate expectation that this “security” extends to their digital “papers and effects,” yet that expectation is not given effect by current restraints on government access to consumer data in American law.  Thus, we have proposed the following layered approach to concerns about online privacy, focusing on restraining government access to data, rather than crippling the private sector uses of data that directly benefit consumers:

1. Erect a higher “Wall of Separation between Web and State” by increasing Americans’ protection from government access to their personal data—thus bringing the Fourth Amendment into the Digital Age.
2. Educate users about privacy risks and data management in general as well as specific practices and policies for safer computing.
3. Empower users to implement their privacy preferences in specific contexts as easily as possible.
4. Enhance self-regulation by industry sectors and companies to integrate with user education and empowerment.
5. Enforce existing laws against unfair and deceptive trade practices as well as state privacy tort laws.

Such a layered approach would not only be a “less restrictive” alternative to increased government regulation, but also potentially more effective in key respects than government data use/collection mandates.  In an ideal world, adults would be fully empowered to tailor privacy decisions, like speech decisions, to their own values and preferences (“household standards”).  Specifically, in an ideal world, adults (and parents) would have (1) the information necessary to make informed decisions and (2) the tools and methods necessary to act upon that information.  Importantly, those tools and methods would give them the ability to block the things they don’t like—annoying ads or the collection of data about them, as well as objectionable content.

A wide variety of self-help tools and “technologies of evasion” are readily available to all users and can easily thwart traditional cookie-based tracking, as well as more sophisticated tracking technologies such as packet inspection.  While cookie management tools that allow users to delete their cookies have been standard in browsers for some time, the latest generation of browsers incorporates far more advanced control over what kind of cookies browsers will accept from websites in the first place.  Furthermore, the extensible nature of modern browsers allows any freelance software developer who sees a way to improve a browser to do so by writing an add-on that “plugs in” to the browser using standard programming interfaces designed by each browser developer.  Many such add-ons are wildly popular, but even those users who never install a single one benefit from the acceleration of browser evolution made possible by add-ons.  We have documented examples of these tools in an ongoing series of blog posts about “Privacy Solutions,” available at www.pff.org/privacy-solutions/.

But a “layered approach” that relies on user empowerment and education need not be perfect to be “good enough,” because “privacy” is not an absolute good that trumps all other consumer interests, nor can “community standards” accommodate a diverse citizenry.  If we “make the best the enemy of the good” by insisting on perfection, consumers will be made worse off.  Advertising is indispensable to the future of online media, but it is also currently inadequate to sustain “Free” culture.  The advocates of regulation pay lip-service to the importance of advertising in funding online content and services but don’t seem to understand that this quid pro quo is a fragile one:  Tipping the balance, even slightly, could have major consequences for continued online creativity and innovation.  Something must give because there is no free lunch.[3]

II. Benefits to Users of Smarter Online Advertising

The attached working paper I co-authored with PFF Visiting Fellow Mark Adams identifies five broad categories of benefits to users from targeted advertising:

1. More relevant, and potentially less annoying/interruptive advertising for consumers;
2. Higher-quality content and services supported by advertising;
3. Better correlation between the production of content and services, and consumer preferences;
4. A more vibrant media and improved political discourse and communities; and
5. Lower prices for consumers and greater innovation throughout the economy.

The paper explains how better targeting of advertising delivers these benefits by:

• Increasing the informational value of advertising to consumers;
• Increasing advertising funding for content and services that might not be sustainable on an ad-supported basis with untargeted or less targeted advertising; and
• Reducing the costs of buying and selling (“transaction costs”).

In particular, we note that, with behavioral targeting, the value of a site’s viewers depends less on the content associated with that site (keywords) and more on the viewers themselves.  In this sense, behavioral advertising levels the playing field by allowing websites to sell access to viewers directly, rather than through the keywords associated with the website.  Better targeting democratizes the ad-supported economy by empowering consumers to direct advertising revenues to the sites they spend time on.  Targeting essentially increases the ability of Internet users to “vote with their clicks” for online content and services just as they “vote with their dollars” every time they make a purchase in the traditional economy.

Data on the precise “delta” between contextual and behavioral advertising is limited, but appears to indicate that behavioral advertising can produce significant increases in revenue for many publishers.  In particular, we note the following increased measures of effectiveness

• Increased Click-Through-Rates 94% to 225% and conversion rates up to 3,000% (2005);[4]
• Increased CTR of 670-1000% (2009);^[5] and
• Increased conversion rates of 400-900% (2008).[6]

There are a wide range of predictions on the potential value created by behavioral targeting.  As with previous innovations in online advertising, it seems likely that the performance of behavioral targeting will improve over time.  Professor Tracy Tuten, author of Advertising 2.0, predicts that a twelvefold increase in the value of page views, from $10 to $120 per thousand views.^[7] Rich Karpinski calculates that Blue Kai, an ad network, is currently selling behaviorally targeted ads a rate of $4-15 per thousand views^[8]—a significantly lower rate than Ryan suggests but higher than the current performance of print advertising ($5.50)^[9] and several times higher than the average price of non-premium display advertising ($0.60-$1.10).^[10] One experiment with re-targeting (showing users ads on one site based on actions taken towards making a purchase on one site but not completed) produced significantly higher returns:  “retargeted impressions represented only 7% of all the banner impressions delivered, [but] were responsible for over 50% of the revenue and 25% of the sales generated by the campaign as a whole.”^[11] Hallerman concludes that “Behavioral targeting is more than hype…. For publishers, it can mean making more money from undersold or unsold ad inventory.”[12]

III. The Quid Pro Quo behind “Free”

Traditionally, users “paid” for content by devoting part of their attention to ads, which have long funded the costs of generating content for radio, television, and newspapers (with subscriptions paying only for distribution).^[13] The basic reason is simple economics:  In competitive markets, prices tend to fall to the marginal cost of production, which quickly converges on zero for information.  The Internet has simply borne this theory out in full:

1. Producing the first unit of content (e.g., a news story or video) remains costly, so while the marginal cost of every additional unit is essentially zero, average cost is not.
2. The failure of micropayments online seems to confirm that, no matter how low the technological transaction costs are, the mental transaction costs involved combined with even tiny payments will exceed the perceived value of most content.
3. The world of media scarcity in which consumers could choose from only a few sources of content (e.g., news, entertainment) has given way to a world of staggering media abundance and the choices of users are no longer constrained by the tyranny of physical limitations like distance and printing costs.
4. Because pure information cannot be copyrighted (and fair use allows significant referencing and quotation), very little content is so unique that users cannot find a ready substitute elsewhere if a site (or even a group of sites) attempted to charge.

Thus, while policymakers should generally avoid preferring one business model over others, they must also recognize that the “economics of bits” will make advertising increasingly indispensable to the future of online content, services, media and culture. For that reason, they should take great care when tinkering with the economic engine that has made America the envy of the digital world as the fountainhead of online innovation and creativity.

IV. Consumer Attitudes & Expectations

While many consumers said, in a recent poll, that they don’t want ads, content and news “tailored” to their interests,[14] their actions in the real world speak louder than words: The increased click through rates and conversion rates mentioned above are evidence that consumers do, in fact, value more relevant advertising.[15] Whatever Americans tell pollsters about “tailored” ads, they also complain about irrelevant ads: A previous poll found that 72% of consumers “find online advertising intrusive and annoying when the products and services being advertised are not relevant to [their] wants and needs” and 85% say that less than 25% of the ads they see while browsing online are relevant to their wants and needs.^[16]

Until a proper experiment is conducted by trained behavioral economists that includes real-world trade-offs and makes users aware of privacy management tools, all we can say with confidence is the following:

1. Users don’t understand exactly how ads are tailored;
2. Users seem to be concerned about “tailoring” or “following” in the abstract;
3. Users are generally unwilling to pay for online content and services; and
4. Better tailoring of ads means more funding for content and services.

Only the layered approach outlined above can address all these concerns: educate users about how online advertising works and how they can implement their own privacy preferences, while constantly striving to further empower users to make privacy management easier.

Policymakers should avoid presuming they can divine the true preferences of users regarding the complex and multi-faceted trade-offs of the real world.  Instead of guessing what consumers might choose, the FTC and other law enforcement agencies should focus on holding companies to the “expectations” they set in their official privacy policies and other statements about their any use and collection practices.  In a sense, this is to approach the problem from the “supply” side rather than the “demand” side: If a browser manufacturer, for example, overstates the privacy protection offered by privacy management tools in the browser (e.g., cookie settings or a private browsing mode), this might well be considered an unfair and deceptive trade practice subject to FTC enforcement. The advantage of this approach is that the FTC can, using its existing authority, play a valuable role in ensuring consistency between theory and practice in what industry actually does— without sending into the intractable morass of subjective user preferences.  In other words, the FTC can help give effect to “household standards” without imposing “community standards” for everyone.

V. Underlying Fear of Advertising

On some level, this debate isn’t about user privacy at all, but about the common (though baseless) fear of advertising as inherently manipulative and wasteful—essentially: “Since people are stupid, ignorant and/or lazy, they’re easy to control and trick with shiny objects, pretty faces, memorable slogans, and catchy jingles.”  No better response to this sentiment has ever been made than was offered by the ad firm Young & Rubicam in this 1959 magazine ad:

There is no chestnut more overworked than the critical whinny:
“Advertising sells people things they don’t need.”

We, as one agency, plead guilty. Advertising does sell people things they don’t need. Things like television sets, automobiles, catsup, mattresses, cosmetics, ranges, refrigerators, and so on and on.

People don’t really need these things. People don’t really need art, music, literature, newspapers, historians, wheels, calendars, philosophy, or, for that matter, critics of advertising, either.

All people really need is a cave, a piece of meat and, possibly, a fire.

The complex thing we call civilization is made up of luxuries. An eminent philosopher of our time has written that great art is superior to lesser art in the degree that it is “life-enhancing.” Perhaps something of the same thing can be claimed for the products that are sold through advertising: They enhance life, to whatever degree they can.

VI. Conclusion

If misguided government regulation chokes off the Internet’s growth or evolution by starving content and service providers of much-needed advertising revenue, we would be killing the goose that laid the golden eggs.  Apart from a hardcore fringe who embrace the Marxist dogma that advertising is inherently deceptive and wasteful, most participants in this debate at least pay lip service to the economic importance of online advertising.  One might therefore be lulled into a false sense of complacency that “sensible” regulation (or government-led co-regulation) would surely avoid crippling this dynamo.  This widespread assumption calls to mind the famous quip of Chris Patten, last British Governor of Hong Kong, who paraphrased those who dismissed his concerns about the potentially negative effects of a Chinese take-over of the British colony in 1997, as follows:  “It is unimaginable that the Chinese would kill such a goose.”  To this, Patten responded, “Yet we wouldn’t need the metaphor of golden eggs and geese if history weren’t full of dead geese.”^[17] The dangers of regulation to the health of the Internet are real, but the ease with which government could disrupt the economic motor of the Internet (advertising) is not widely understood—and therein lies the true danger in this debate.

Depending on how regulation is structured, therefore, it is possible that new privacy mandates would severely curtail the overall quantity of content and services offered–and greatly limit the ability of new providers to enter the market with innovative offerings. Alternatively, or perhaps additionally, companies would change the character of their offerings and water-down sophisticated services that cater to consumer demand; in other words, the quality of service would deteriorate.

Bottom line: We live in a world of trade-offs, and regulation is not costless.  Indeed, regulation might best be understood as a giant game of economic whack-a-mole: Attempting to control one of the primary variables of price, quantity, or quality inevitably results in non-optimal adjustments in the other two variables. The absence of price as a variable in the context of “free” (i.e., ad supported) content and services means there is one less variable for the government to control in the first place. Simply stated, stifling the evolution of the online advertising marketplace will likely result in fewer free online services and less content, less high-quality online services and content, or some combination of both.

These observations are even more relevant to the online marketplace, where advertising has been shown to be the only business model with any real staying power. Walled gardens, pay-per-view, micropayments, and subscription-based business models are all languishing. Consequently, the overall health of the Internet economy and the aggregate amount of information and speech that can be supported online are fundamentally tied up with the question of whether we allow the online advertising marketplace to evolve in an efficient, dynamic fashion. Heavy-handed privacy regulation (or European-style “co-regulation,” where the government steers and industry simply rows) could, therefore, become the equivalent of a disastrous industrial policy for the Internet that chokes off the resources needed to fuel e-commerce and online free speech going forward.

[2].      Currently in draft form, pending further research quantifying the benefits of personalized advertising.

[3].      Berin Szoka & Adam Thierer, The Progress & Freedom Foundation, Targeted Online Advertising: What’s the Harm & Where Are We Heading?, Berin Szoka & Adam Thierer, Progress on Point 16.2, April 2009, www.pff.org/issues-pubs/pops/2009/pop16.2targetonlinead.pdf.

[4].      Scott Ferber, Stepping Up Search: How Behavioral Targeting Can Enhance ROI, MediaPost Publications, Jun 6, 2005, www.mediapost.com/publications/index.cfm?fa=Articles.showArticle&art_aid=30838.

[5].      Jun Yan, Ning Liu, Gang Wang, Wen Zhang, Yun Jiang & Zheng Chen, How Much Can Behavioral Targeting Help Online Advertising?, presented at World Wide Web Conference, Madrid, Spain, April 20–24, 2009, p. 262.

[6].      Erik Sherman, Want to Target Online? You Better Build Trust, Advertising Age, Apr. 14, 2008, http://adage.com/adnetworkexchangeguide/article?article_id=126242.

[7].      Id.

[8].      Rich Karpinski, Will Using Behavioral Data Lead to Smarter Ad Buys?, Advertising Age, April 20, 2009, http://adage.com/adnetworkexchangeguide09/article?article_id=136003 (subscription only).

[9].      Howard Beales, Public Goods, Private Information & Anonymous Transactions:  Providing a Safe & Interesting Internet, presentation given at the Law & Economics of Innovation Symposium at George Mason University School of Law, May 7, 2009 (copy on file with authors) at 17 (citing Media Dynamics data from 2008).

[10].    Id.

[11].    Id.

[12].    David Hallerman, Behavioral Targeting:  Marketing Trends, eMarketer, June 2008, at 2, http://www.emarketer.com/Reports/All/emarketer_2000487.

[13].    See, e.g., Walter Mossberg, Now You See ‘Em…, SmartMoney.com, June 15, 2000, available at web.archive.org/web/20061124235126/http://www.smartmoney.com/mossberg/index.cfm?story=20000615.

[14].    Joseph Turow, Jennifer King, Chris Jay Hoofnagle, Amy Bleakley & Michael Hennessy, Americans Reject Tailored Advertising and Three Activities That Enable It, Sept. 2009, http://graphics8.nytimes.com/packages/pdf/business/20090929-Tailored_Advertising.pdf.

[15].    See generally Berin Szoka, Privacy Polls v. Real-World Trade-Offs, The Progress & Freedom Foundation, Progress Snapshot 5.10, Oct. 2009, http://www.pff.org/issues-pubs/ps/2009/ps5.10-privacy-polls-tradeoffs.html.

[16].    TRUSTe, 2009 Study: Consumer Attitudes About Behavioral Targeting, March 4, 2009, at 2, 5, available at www.truste.com/about/bt_overview.php.

[17].  Tom Plate, Hong Kong Will Remain Very Much Alone After 1997, The Standard, Jan. 7, 1996, www.thestandard.com.hk/archive_news_detail.asp?pp_cat=&art_id=20783&sid=&con_type=1&archive_d_str=19960107

http://d1.scribdassets.com/ScribdViewer.swf?document_id=22384078&access_key=key-1jna9geastmkpu3z7hh&page=1&version=1&viewMode=list

The leading trade associations in the online advertising industry have just released their new self-regulatory principles—the first comprehensive self-regulatory principles industry has produced, which track closely with the suggested guidelines released by the FTC in February.

I commend the industry for setting a new standard in transparency, consumer control and data security. These Principles do much to empower Americans to make their own decisions about privacy, but I fear that many critics of so-called “targeted advertising” will never be satisfied, no matter how high industry raises the bar.

These critics have insisted that ordinary users can’t be trusted to make the “right decisions” about privacy and have insisted on imposing restrictive default “opt-in” rules for the online data collection that makes online advertising valuable to websites that rely on ad revenue.  Such pre-emptive privacy regulation would stunt the growth of revenue for the “Free” online content and services we’ve all come to take for granted.  During a time of economic recession, and as traditional media like newspapers struggle to make the transition from print to the Internet, it’s more important than ever that policymakers allow self-regulation to evolve.  Only by doing so can we expect continued innovation and creativity online. We must all remember:  There is no free lunch!

I’ll lead a panel discussion on July 10 on Capitol Hill about “Regulating Online Advertising: What Will it Mean for Consumers, Culture & Journalism?”  Please RSVP here.

Fred Vogelstein’s essay in Wired, “Great Wall of Facebook: The Social Network’s Plan to Dominate the Internet — and Keep Google Out” describes the intensifying clash between Google and Facebook—a clash that focuses on the ability to target advertising:

Like typical trash-talking youngsters, Facebook sources argue that their competition is old and out of touch. “Google is not representative of the future of technology in any way,” one Facebook veteran says. “Facebook is an advanced communications network enabling myriad communication forms. It almost doesn’t make sense to compare them.”

Apart from noting that Facebook directs users to Microsoft’s Bing as its default search engine for the Internet at large, the most interesting part of the article is Facebook’s “4-Step Plan for Online Domination”:

1. Build critical mass. In the eight months ending in April, Facebook has doubled in size to 200 million members, who contribute 4 billion pieces of info, 850 million photos, and 8 million videos every month. The result: a second Internet, one that includes users’ most personal data and resides entirely on Facebook’s servers. 2. Redefine search. Facebook thinks its members will turn to their friends—rather than Google’s algorithms—to navigate the Web. It already drives an eyebrow-raising amount of traffic to outside sites, and that will only increase once Facebook Search allows users to easily explore one another’s feeds. 3. Colonize the Web. Thanks to a pair of new initiatives—dubbed Facebook Connect and Open Stream—users don’t have to log in to Facebook to communicate with their friends. Now they can access their network from any of 10,000 partner sites or apps, contributing even more valuable data to Facebook’s servers every time they do it. 4. Sell targeted ads, everywhere. Facebook hopes to one day sell advertising across all of its partner sites and apps, not just on its own site. The company will be able to draw on the immense volume of personal data it owns to create extremely targeted messages. The challenge: not freaking out its users in the process.

Facebook can’t keep losing money forever.  Indeed, investors are willing to keep sinking money into Facebook during Phases 1-3 because they think it will pay off in Phase 4—when Facebook really threatens to be a fGoogle-killer.  But rather the fact that investors are willing to subsidize the creation of a wonderful platform now used by 200 million people (one fifth of all Internet users worldwide), or that Facebook might finally provide a counter-weight to the fearsome Google, the People for the Ethical Treatment of Data (PETD) are appalled.  One commenter on the Wired story put it best:

I find it amazing that people will willingly post personal information to websites that will only use it for data mining and advertising revenue. They lay their entire life open to a corporation that’s only looking to profit from the information said corporation can gather for itself or it’s affiliates. When the government reads our emails, listens to our phone conversations, reads our text messages and monitors what we do online people are outraged at the invasion of our privacy. But then they log in to Facebook or Myspace or Twitter and reveal all. The Facebook “community”. Please. It’s a way for Big Business to pry into our private lives and exploit us in any way they can for the money they can make.

Such arrogant entitlement is astonishing—but hardly atypical: What makes this person (or his PETD comrades) so certain that they really know what’s best for everyone else and that Facebook users are poor, ignorant suckers being victimized by corporate greed?  As Adam Thierer and I have been saying, there is no free lunch! Do the PETD folks expect investors to pour hundreds of millions into building innovative social networks like Facebook out of… love?  As Adam Smith put it, “It is not from the benevolence of the butcher, the brewer, or the baker that we expect our dinner, but from their regard to their own interest.”

While most in the PETD crowd are too young (or just historically deprived) to know the words to  The Internationale (my favorite line: “Masses, slaves, arise, arise!”), one can easily imagine them kicking off PETD meetings with a somewhat more recent anthem, Aquarius, from the hit 1967 rock musical Hair:

When the moon is in the Seventh House And Jupiter aligns with Mars Then peace will guide the planets And love will steer the stars This is the dawning of the age of Aquarius Harmony and understanding Sympathy and trust abounding No more falsehoods or derisions Golden living dreams of visions Mystic crystal revalation And the mind’s true liberation

Nothing better captures the spirit of that thankfully-bygone era of narcissistic self-indulgence than the beginning of the 1979 film version:

Yes, Virginia, the marijuana-induced socialist-utopian delusions of the Sixties live on in a new generation of Techno-Aquarians, who want to have their digital cake—and eat yours too.  Something for nothing, free lunch for everyone!  Down with profit, up with privacy!  The “vision” (as in “Golden living dreams of”) behind this frenzy of frustration with online capitalism and PETD’s demands for regulation is what Thomas Sowell has called the “Vision of the Anointed,” “the talented few” who consider themselves wiser than everyone else, and therefore seek to impose their preferences on others, as Adam Thierer and I have both discussed.

But back to Wired:

The drumbeat of controversy surrounding Facebook illustrates the catch-22 the social network faces: It has a massive storehouse of user data, but every time it tries to capitalize on that information, its members freak out. This isn’t an academic problem; the company’s future depends on its ability to master the art of behavioral targeting—selling customized advertising based on user profiles. In theory, this should be an irresistible opportunity for marketers; Facebook’s performance advertising program allows them to design and distribute an ad to as narrow an audience as they would like. (It has also developed a program to create ads that are designed to be spread virally.) But as the Beacon debacle showed, there is a fine line between “targeted and useful” and “creepy and stalkerish”—and so far, not enough advertisers have been willing to walk that line… In a way, Facebook’s dilemma extends from its success. Users see the site as sanctified space, a place to engage in intimate conversations with friends—not to be laser-beamed by weirdly personal advertising. But with initiatives like Connect and Open Stream, Facebook can sell ads beyond its own site. Just as Google’s AdSense program sells ads on any participating Web site, Connect and Open Stream will eventually push Facebook-brokered advertising to any member site or app. But unlike with AdSense, Facebook’s ads could be exquisitely tailored to their targets. “No one out there has the data that we have,” says COO Sandberg.

Better targeted ads?  More useful information for Internet users?  A strong competitor for Google that could provide an alternative channel for advertisers and help drive up advertising revenue for publishers of “free” content and services?  Sounds great for all concerned.  Oh, but some people find relevant advertising “creepy?”  Ah, well, let’s call the whole thing off!  I’m sure Facebook will get by just fine selling crudely targeted ads on its own site for pennies a click.  Maybe they could ask for donations or hold a digital bake-sale (including tie-dyed t-shirts, of course)? Or we could just have “the government” support the most popular social networks (along with newspapers, banks, hedge funds and car manufacturers). And while they’re at it, why not have wise bureaucrats use antitrust laws to cripple Google and thus make up for the lack of a competitive threat from Facebook and the other Google-killers-that-might-have-been?

Wired suggests that Facebook’s strategy played some role in causing Google to embrace Interest-Based (behavioral) Advertising, playing catch-up to No.2 Yahoo!:

Google has even shown a willingness to join Facebook in gingerly tapping the third rail of Internet marketing—behavioral targeting. The search giant has long assured its users that it would never use their personal information to deliver targeted advertising, relying instead on aggregate data or search activity that preserves anonymity. (“There is a line with users that you don’t want to cross,” Google CEO Eric Schmidt said in the wake of the Beacon controversy.) But in March, Google started its own behavioral targeting campaign—tracking users’ browsing to deliver more-customized ads. Users have the option to either edit their profiles or opt out entirely.

With Google in the game, the fight is on.  The grand prize is clear—tapping into the most lucrative advertising purchased by leading brands:

Today, global online brand advertising accounts for just $50 billion a year. Offline brand advertising, meanwhile, accounts for an estimated $500 billion.

But I doubt there will ever be any clear “winner” in this race.  Instead, we’re likely to see fierce competition and ongoing one-upsmanship over the coming decade (and beyond) for users, for user data, and for they ad dollars they bring, among a variety of paradigms for what the Internet of the future should look like.  Facebook has already started implementing its paradigm with  Connect (launched Dec. 2008) and  Open Stream API (launched April 2009):

Connect and Open Stream don’t just allow users to access their Facebook networks from anywhere online. They also help realize Facebook’s longtime vision of giving users a unique, Web-wide online profile. By linking Web activity to Facebook accounts, they begin to replace the largely anonymous “no one knows you’re a dog” version of online identity with one in which every action is tied to who users really are. To hear Facebook executives tell it, this will make online interactions more meaningful and more personal…  But you don’t build a competitor to Google with people alone. You need data. And Connect and Open Stream are intended to make Facebook a much more powerful force for collecting user information. Any time someone logs in to a site that uses Connect or Open Stream, they give Facebook the right to keep track of any activity that happens there—potentially contributing tons more personal data to Facebook’s servers. Facebook Connect and Open Stream are also designed to make each user’s friend network, which belongs to Facebook, even more valuable and crucial to the Web experience. Together, they aim to put Facebook users’ social networks at the center of all they do online.

I, for one, think this competition will create enormous value for users by driving innovation that improves the usefulness of the Internet and increases the amount of funding available for an ever-greater, ever-richer torrent of “free” (ad-supported) content and services.  But if the Techno-Aquarians at PETD succeed in imposing regulatory mandates on the collection and use of online data through legislation or creeping regulation at the FTC, the Internet of the future won’t look all that different from the Internet of today: online content and services will continue to attract a small share of all ad dollars (just 7% in 2008), search engines will reap the bulk of that (42% in 2008), and most online content-publishers and service-providers will continue to get literally pennies per click while only a few are able to meet evolving standards of quality with purely ad-supported business models.

Heaven forbid we should allow those who offer “free” content and services to extract… profit from the unwashed masses of helpless consumers who are either too stupid, too lazy or too ignorant to manage their own privacy, no matter how powerful the privacy management tools at their disposal! The better alternative is empower users to make their own decisions about privacy, rather than imposing top-down “Industrial Policy for the Internet” on the entire country through outright prohibitions or restrictive defaults concerning data collection and use for targeting advertising—as Adam and I have said:

The ideal state of affairs would be to create a system of tools and data disclosure practices that would empower each user to implement their personal privacy preferences while also recognizing the freedom of those who rely on advertising revenues to “condition the use of their products and services on disclosure of information”—not to mention the viewing of ads!

As Google and Facebook do battle with each other, Microsoft, Yahoo! and other upstart rivals as-yet-unknown, I only hope they all—particularly their government affairs departments—remember that their common enemy is the Techno-Aquarians who seek to impose their subjective preferences about privacy on everyone else, no matter the costs to innovation, consumers, culture or media. We’ll discuss these trade-offs at our upcoming PFF Capitol Hill Briefing on July 10.

by Berin Szoka & Adam Thierer

This morning, the House Energy & Commerce Committee will hold a hearing on “Behavioral Advertising: Industry Practices And Consumers’ Expectations.” If nothing else, it promises to be quite entertaining:  With full-time Google bashers Jeff Chester and Scott Cleland on the agenda, the likelihood that top Google officials will be burned in effigy appears high!

Chester, self-appointed spokesman for what one might call the People for the Ethical Treatment of Data (PETD) movement, is sure to rant and rave about the impending techno-apocalypse that will, like all his other Chicken-Little scenarios, befall us all if online advertisers were permitted to better tailor ads to consumers’ liking. After all, can you imagine the nightmare of less annoying ads that might actually convey more useful information to consumers? Isn’t serving up “untargeted” dumb banner ads for Viagra to young women and Victoria’s Secret ads to Catholic school kids the pinnacle of modern online advertising?  Gods forbid we actually make advertising more relevant and interest-based!  (Those Catholic school boys may appreciate the lingerie ads, but few will likely buy bras.)

Anyway, according to National Journal’s Tech Daily Dose, the hearing lineup also includes:

• Charles Curran, Executive Director, Network Advertising Initiative
• Christopher Kelly, Chief Privacy Officer, Facebook
• Edward Felten, Director, Center for IT Policy, Princeton University
• Anne Toth, Chief Privacy Officer & Vice President, Policy, Yahoo!
• Nicole Wong, Deputy General Counsel, Google

That’s an interesting group and we’re sure that they will say interesting things about the issue. Nonetheless, because four of them have a corporate affiliation that fact will inevitably be used by some critics to dismiss what they have to say about the sensibility of more targeted or interest-based forms of online advertising. So, we’d like to offer a few thoughts and pose a few questions to make sure that Committee members understand why, regardless of what it means for any particular online operator, targeting online advertising is very pro-consumer and essential to the future of online content, culture, and competition.  As Wall Street Journal technology columnist Walt Mossberg has noted, “Advertising is the mother’s milk of all the mass media.”  Much of the “free speech” we all cherish isn’t really free, but ad-supported!

Our Approach

We have previously set forth a framework for analyzing advertising policy issues in two PFF reports: “Online Advertising & User Privacy: Principles to Guide the Debate” and “Targeted Online Advertising: What’s the Harm & Where Are We Heading?” At root, our model depends heavily on two common-sense, and inter-related, principles:

1. We live in a world of trade-offs; and
2. There is no free lunch.

Their Approach

We are deeply concerned that too few people are talking about—or even understand the relevance of—those two principles in the debate over targeted online advertising. It seems that too many who wish to retard the further evolution of the advertising marketplace are living a lie based upon the antithesis of our model. Many privacy advocates seem to imagine that regulatory actions don’t have consequences and that Congress can simply mandate new privacy standards for the Internet without having any impact on the free flow of ideas supported by, and direct facilitated through, advertising.

Simply put, the privacy critics often imagine that their values are indicative of everyone’s values. Our blogging colleague Jim Harper of the Cato Institute has referred to this as “preference imposition” but we’ll use a simpler term: Elitism. In essence, privacy advocates seem to believe that:

1. People are too ignorant, busy or just plain stupid, and cannot be trusted to make wise decisions for themselves (or their children); and/or
2. Everyone shares the same values or concerns when it comes to privacy such that a national “baseline” regulatory standard (namely, mandatory “opt-in” regulations for data collection and use) should govern the entire online marketplace.

Let’s be clear: Such a mandate, and the thinking behind it, would greatly impoverish the future Internet economy. Too many people think of the Internet as a magic box that just keeps cranking out free goodies. But something powers that box of goodies: advertising.  More than anything else, it’s advertising that keeps the Internet “Free, Innovative & Open,” to borrow the slogan of our friends at CDT, which seems to flirt with joining the PETD movement, despite their well-earned reputation for pragmatic skepticism of government interference with the Internet.

The regulatory advocates complain that giving consumers the right to opt-out of data collection and use isn’t meaningful because very few consumers will exercise the opt-out.  Again, they presume that this must be because users just don’t know what’s good for them because of course if they really understood what was being done with “their data,” they would never choose to just “give it away” for a few scraps from the advertisers’ table.  It never occurs to them that (i) many, perhaps most, users just don’t care and that (ii) that their “ignorance” about the all specific details of “how the sausage is made” (online data collection and use practices for targeting advertising) may be completely rational.

But just as importantly, would-be privacy regulatory don’t seem to understand—or perhaps simply don’t care—that what’s true of opt-out is also true of opt-in:  in practice, few people will bother doing either.  In a world of perfect information and infinite time, of course, there would be no difference in outcomes with the two different rules.  But in the real world with real constraints on time, knowledge and everything else, mandating opt-in would make all the difference in the world by severely limiting the ability of advertisers to target advertising.

The Ignored Trade-offs

We’ve been assembling evidence on the real-world costs of restricting targeted advertising. Here are just a few data points we’ve seen to give you a sense of what’s at stake:

• Relevance to Users: The best evidence that users prefer seeing more relevant ads is their increased likeliness to actually click on an ad—instead of just ignoring it or trying to block it. The most recent study of this issue concluded that Click-Through Rates (CTR) can be improved by as much as 670% by using basic behavioral targeting as compared to simple contextual targeting—0r even more than 1000% using more sophisticated targeting. Conversion rates (the percentage of clicks that actually result in a sale) also strongly indicate that consumers find ads more interesting, and in one 2005 study, were estimated to increase up to 3000% with behavioral targeting.
• Macro: More Revenue to Fund All Services & Content: eMarketer (in June 2008) estimated that U.S. spending on behavioral targeting would grow from $.775 billion in 2008 to $4.4 billion in 2012—representing fully a quarter of display ad spending.  The total amount of money at stake is huge:  U.S. online ad revenues totaled $23.5 billion in 2008.
• Micro: More Revenue for Individual Publishers: Estimates on the increased profitability of behavioral targeting range as high as 1200% (eMarketer).

While these examples illustrate the broad outlines of the trade-offs ignored by privacy regulatory advocates, the key dilemma to understand is this: If, under an opt-in regime, publishers would be able to target advertising for webpages based on the keywords contained within those pages, and not on other content the user has looked at, the value of most Internet content will depend not on how many eyeballs it attracts but primarily on the economic value of the keywords that are directly associated with it. Pages with keywords related to products and services will fetch a fine price because advertisers will be able to make money off ads on those pages ( e.g., a site for digital camera reviews). But content with little commercial value will generate little revenue. Indeed, this is perhaps the single greatest problem faced by journalism sites. Who wants to advertise on a story about North Korea? How many users are going to be interested in taking a honeymoon in the DMZ?

But if such websites could target advertising to users’ user’s likely interests based on an anonymous profile of their interests created by collecting data about their browsing “behavior,” web content becomes valuable because of the audience it attracts, not just because the content itself serves as a rough proxy for a user’s interests. This democratization of Internet advertising revenue is essential for sustaining the future of journalism in particular, but also for “free” culture more generally.

As we noted in our response to the FTC’s proposed self-regulatory guidelines on data collection for advertising:

Depending on how regulation is structured, therefore, it is possible that new privacy mandates would severely curtail the overall quantity of content and services offered—and greatly limit the ability of new providers to enter the market with innovative offerings. Alternatively, or perhaps additionally, companies would change the character of their offerings and water-down sophisticated services that cater to consumer demand; in other words, the quality of service would deteriorate. Bottom line: Something must give because there is no free lunch. Regulation is a giant game of economic whack-a-mole: Attempting to control one of the primary variables of price, quantity, or quality inevitably results in non-optimal adjustments in the other two variables. The absence of price as a variable in this context means there is one less variable for the government to control in the first place. Simply stated, stifling the evolution of the online advertising marketplace will likely result in fewer free online services and less content, less high-quality online services and content, or some combination of both… We stand at an important crossroads in the debate over the online marketplace and the future of a “free and open” Internet. Many of those who celebrate that goal focus on concepts like “net neutrality” at the distribution layer, but what really keeps the Internet so “free and open” is the economic engine of online advertising at the applications and content layers. If misguided government regulation chokes off the Internet’s growth or evolution, we would be killing the goose that laid the golden eggs…. These observations are even more relevant to the online marketplace, where advertising has been shown to be the only business model with any real staying power. Walled gardens, pay-per-view, micropayments, and subscription-based business models are all languishing. Consequently, the overall health of the Internet economy and the aggregate amount of information and speech that can be supported online are fundamentally tied up with the question of whether we allow the online advertising marketplace to evolve in an efficient, dynamic fashion. Heavy-handed privacy regulation (or co-regulation) could, therefore, become the equivalent of a disastrous industrial policy for the Internet that chokes off the resources needed to fuel e-commerce and online free speech going forward.

Our Challenge to the Advocates of Privacy Regulation

For these reasons, we have repeatedly issued the following three-part challenge in our previous work to those who advocate the regulation of online advertising:

1. Identify the harm or market failure that requires government intervention.
2. Prove that there is no less restrictive alternative to regulation.
3. Explain how the benefits of regulation outweigh its costs.

We’re still waiting…

We’ve also made it clear that there is an alternative to the pre-emptive, one-size-fits-all regulation demanded by the regulatory advocates:  We’ve proposed a “layered approach” based on user education, user empowerment, self-regulation and FTC enforcement of privacy policies.  Our goal is as follows:

The ideal state of affairs would be to create a system of tools and data disclosure practices that would empower each user to implement their personal privacy preferences while also recognizing the freedom of those who rely on advertising revenues to “condition the use of their products and services on disclosure of information”—not to mention the viewing of ads! Self-regulatory efforts can be refined, especially through technological innovation to better satisfy the concerns of policymakers, privacy advocates, and average consumers. For example, if websites and ad networks participating in a self-regulatory framework supplemented their current “natural language” privacy policies with equivalent “machine-readable” code [ e.g., P3p], that data could be “read” by browser tools that would implement pre-specified user preferences by blocking the collection of information depending on whether the privacy policies of certain websites or ad networks met the user’s preferences about data-use. Such robust and granular disclosure, if implemented for behavioral advertising, would exceed the wildest dreams of those who argue that users currently do not read privacy policies—without disrupting the browsing experience or cluttering websites. But this system would only work if users had to make real choices about “pay*ing+ for ‘free’ content and services by disclosing their personal information.”

A Final Word About Advertising

On some level, this debate isn’t about user privacy at all, but about the alleged evils of advertising as inherently manipulative.  Jeff Chester straddles both camps.  His rantings about the use of “neuromarketing” boil down to the same simple idea that the Neo-Marxists have been pushing for decades:  Since people are stupid, ignorant and/or lazy (see above), they’re easy to control and trick with shiny objects, pretty faces, memorable slogans, and catchy jingles. No better response to this argument has ever been made than was offered in this 1959 magazine ad by the ad firm Young & Rubicam (emphasis added for Chester’s benefit):

There is no chestnut more overworked than the critical whinny: “Advertising sells people things they don’t need.” We, as one agency, plead guilty. Advertising does sell people things they don’t need. Things like television sets, automobiles, catsup, mattresses, cosmetics, ranges, refrigerators, and so on and on. People don’t really need these things. People don’t really need art, music, literature, newspapers, historians. wheels, calendars, philosophy, or, for that matter, critics of advertising, either. All people really need is a cave, a piece of meat and, possibly, a fire. The complex thing we call civilization is made up of luxuries. An eminent philosopher of our time has written that great art is superior to lesser art in the degree that it is “life-enhancing.” Perhaps something of the same thing can be claimed for the products that are sold through advertising. They enhance life, to whatever degree they can.

Google’s new “Interest Based Advertising” (IBA) program represents the company’s first foray into what is generally called “Online Behavioral Advertising” (OBA):  In order to deliver more relevant advertising, Google will begin tailoring ads delivered through AdSense on the Google Content Network (GCN) and YouTube.com (but not Google.com).  This tailoring will be based on a profile of each user’s interests created by tracking their browsing activity across sites that use AdSense-but not search queries or other user information.  Until now, (i) AdSense has delivered essentially “contextual” advertising by choosing which ad to display on a page based on an algorithmic analysis of keywords on that page; and (ii) Google has tracked users’ browsing only for analytics purposes-to limit the number of times a user sees a particular ad (to prevent overexposure) and to allow sequencing of ads in campaigns where one ad must follow another. 

Google is sure to be attacked for crossing a “line in the sand” drawn by some privacy advocates between contextual and behavioral advertising-even though Google’s closest competitor, Yahoo!, already offers a similar program, and the concept in general is hardly new.  Google’s position as the leading search engine and third party ad-delivery network will no doubt cause paroxysms of privacy hysteria among those who consider targeted advertising inherently invasive, unfair or manipulative.

But those whose first priority is advancing consumer privacy, not advancing a political or regulatory agenda, should applaud Google for excluding sensitive categories and for putting the new Ad Preference Manager at the core of the company’s new IBA program.  The Ad Preference Manager sets a new “gold standard” for implementing the principles of Notice and Choice, which have formed the core of both OBA industry self-regulation and the various regulatory proposals made in recent years.  Indeed, Google has done precisely what Adam Thierer and I have called for:  giving consumers more granular control over their own privacy preferences by developing better tools.

How Google’s Ad Preference Manager Works

For years, debates about how OBA should be regulated (whether by industry or by government) have revolved around two key questions: 

• Notice: How should consumers best be informed about the data that’s being collected about them, how it’s being used, by whom, and so on?
• Choice: How should consumers be given the ability to opt-out of tracking for OBA purposes?

While there are significant philosophical disagreements about some aspects of these debates-such as whether the default should be opt-in or opt-out-much of the debate has come down to questions of implementation that may seem trivial or easily-solved to lay people:  Where should notice be provided?  If notice is provided in ads themselves, what should the link say and how big should it be?  By what technological means should users be able to opt-out of tracking?  Google has provided an elegantly simple solution to these questions. 

Google provides “notice” to users in two ways:

• In the ads.  In the bottom left corner of each AdSense ad on sites in the GCN, users will see the URL for the advertiser’s website.  This is already the case for all text ads, but not for display ads.  In the bottom right corner of both display and text ads, users will see an “Ads by Google” link.  Thus, the ad itself provides the user notice of (i) who’s paying for the ad and (ii) who’s serving it. 
• In the Ad Preference Manager.  If the user clicks the “Ads by Google” link, they will see which of the ~20 categories and ~600 subcategories have been associated with the tracking cookie in their browser.  Thus, Google provides notice to the user of what’s in their so-called “digital dossier.”

Google provides “choice” to the user in two ways:

• Editing categories.  The Ad Preference manager not only shows the profile that has been algorithmically assembled of their likely interests, but it lets them decide for themselves which categories they’re really interested in.  If a user finds that they have been placed in the “Automotive > Motorcycles” category but actually owns a SUV, they could select “Automotive > Trucks & SUVs”-or no Automotive category at all.  
• A persistent opt-out.  Users can decide to opt-out completely from having their data collected for IBA purposes.  That choice will be respected in the future, and will therefore be “persistent.”

The Persistent Opt-Out Plug-in

For roughly a decade, the OBA industry has operated under a self-regulatory scheme developed by the Network Advertising Initiative (NAI).  NAI lets users opt-out of receiving ads based on OBA targeting.  But privacy advocates have objected on three grounds:

First, privacy advocates argue that it’s currently too hard for users to find the NAI opt-out tool since users don’t know which ad network is serving which ads and there’s no obvious way to get from an ad to the opt-out option.  Google moots this argument by making its opt-out easily accessible to anyone who clicks on the “Ads by Google” link that appears beneath every IBA-targeted ad.

Second and most importantly, privacy advocates decry NAI’s opt-out because it isn’t “persistent”- i.e., it requires the placement of a special “opt-out cookie” on the user’s computer, which may be inadvertently deleted when users delete all their cookies.  Indeed, many users do precisely that on a regular basis through either their browser or antivirus software-thus erasing their own opt-out choice.  Google moots this argument too:  While Google’s opt-out also relies on a special opt-out cookie, Google has created an easily installed plug-in for the two most common Web browsers, Internet Explorer and Firefox, that ensures that the opt-out cookie is automatically recreated even if a user deletes their cookies.  For the Chrome and Safari Web browsers (which do not support plug-ins), Google has outlined a simple procedure whereby users can achieve the same result.

Third, many critics worry that any cookie-based opt-out mechanism still involves sending data to ad networks that the ad networks could use to track users-despite promises in their privacy policies not to do so.  Even though the FTC can enforce such policies, it may be difficult for users to determine what the ad networks are doing with the data they receive from users that have opted out of tracking.  Although Google’s system seems to be no different in this regard from how other NAI member companies handle opt outs, truly privacy-sensitive users could easily address this concern by configuring their Web browser to not send any data to these networks and/or not allow any persistent cookies, as we’ve discussed in our Privacy Solutions Series.   

A Superior Solution to a “Do-Not-Track” Registry

The privacy advocates who lambaste the inadequacies of the NAI opt-out system have demanded the creation of a government-run “Do-Not-Track” registry loosely modeled on-but very different in practice from-the FTC’s Do-Not-Call registry, by which over 170 million Americans have opted out of receiving telemarketing calls.  Google’s Ad Preference Manager provides a better system.

First, it proves that the “persistency” problem can be solved.  In fact, since Google’s plug-in is open source, these privacy advocates may be able to use it to create a browser plug-in that works for opt-out cookies from other NAI member companies.  Indeed, given how simple Google’s plug-in is, one wonders why they didn’t do this when NAI’s Opt-Out Tool was first made available.  Perhaps the technologists at these organizations have spent a little too much time developing elaborate regulatory solutions and too little time focusing on empowering users.  Or perhaps these organizations simply decided that creating such a tool would undercut their argument that only government intervention could protect users’ privacy.  Ironically, some of the organizations pushing Do-Not-Track have joined us in emphasizing the effectiveness of user empowerment tools in other contexts-such as online child protection, where parental control software offers a more effective alternative to government regulation of Internet content that also does less to restrict constitutionally protected speech.  Even more ironically, their Do-Not-Track proposal specifically calls for the development of browser-based tools to implement the government-maintained Do-Not-Track database.  In an era when anyone can write a browser plug-in that can achieve wild popularity (such as the roughly 43 million downloads of the Firefox plug-ins AdBlock Plus and NoScript), these advocacy organizations have little excuse for not practicing what they preach. 

Second, Google has set a new standard in both Notice-by including a link to the opt-out in every ad-and Choice-by respecting user’s opt-out preferences.  Other ad networks now face intense pressure to catch up with, or outpace, Google by implementing the same kind of Notice and Choice.  Indeed, NAI will now be expected to improve its own opt-out system with a browser plug-in capable of preserving opt-out preferences for all of its members’ ad networks.  To the extent that this plug-in might work better with cooperation from the ad networks, that cooperation should now be more forthcoming than ever. 

Third, if these privacy advocates’ real objection to any cookie-based opt-out system-whether the NAI opt-out tool or Google’s plug-in-is uncertainty as to whether opt-out preferences would really be respected by ad networks that continue to collect tracking data (as discussed above), who better than Google to lead the market in setting higher standards for privacy protection?  Ultimately, these standards will be, and should be, enforced by the FTC under its existing authority to punish unfair and deceptive trade practices.

What This Episode Says About Google

Some privacy advocates will argue that Google is just too big-and therefore too “scary”-to be allowed to engage in OBA, and may try to paint Google’s entry in the OBA marketplace as a net loss to privacy, notwithstanding the extremely pro-privacy way in which Google has implemented its “IBA” service.  But if this incident demonstrates anything about Google, it’s the following:

First, it’s no accident that Google is now leading the pack of third party ad networks by developing innovative solutions that respect consumer privacy.  Unlike most third party ad networks, Google is directly focused on the demands of consumers:  In addition to the ad network they acquired from DoubleClick, of course, Google offers consumers a wide array of other online services (search, email, maps, etc.).  Because these services (and their competitors) are all free, Google has to compete in what economists call “non-price terms”-such as privacy.  So, Google has a lot to lose by alienating its users and a lot to gain by being seen as a leader in privacy protection.  Would an independent DoubleClick have taken so much care to address privacy concerns?  As the developer of a competing search engine once said about the Internet search industry, ”you earn your right to be in business every day, page view after page view, click after click.”  

Second, it’s no accident that Google was a late-comer to the OBA market, lagging behind Yahoo! in particular.  The most likely reason Google has taken its time in rolling out an OBA product is that Google is subject to a unique level of scrutiny by privacy advocates by virtue of its size.  Being the “big kid on the block,” Google has to be especially careful not to appear to be “Big Brother.”  This reputational check on Google should allay some concerns about Google’s size.

Third, this episode also demonstrates the advantages of having a player like Google large enough to be able to singlehandedly set a new paradigm in privacy protection.  Google risks alienating some advertisers and publishers with its bold empowerment of users, but was willing to take those risks because of its incentives as a consumer-facing company and able to do so because of its leadership in the marketplace.  Uncomfortable as this reality may be for those who fret about antitrust issues and indeed for Google itself, the simple reality is that sometimes it takes “big dogs” to make self-regulatory systems truly effective.  For example, the video game industry’s highly effective content rating system has worked because the titans in that field were big enough to push through a tough system and keep it working.  Similarly, Microsoft has led the way for years in empowering users by offering in Internet Explorer the most sophisticated cookie management tools available in any browser, as we’ve discussed.  In a nutshell, privacy leadership requires scale. 

Conclusion

Google’s Ad Preference Manager, with its persistent opt-out plug-in, offers precisely the kind of robust opt-out that privacy advocates have always demanded.  Google deserves a rousing “Amen!” from privacy advocates.  But those who respond to this program by insisting that “more needs to be done on how to educate people and tell them how to opt out,” are right in two senses.  First, Google has shown other ad networks how to do more to empower users.  I am confident that they will rise to that challenge by continuing to refine self-regulation through technological innovation.  Second, this is by no means the last word in privacy protection from Google, which operates in the midst of continually-evolving privacy standards.  I expect Google and competing ad networks will continue to innovate in developing technologies that empower users to manage their own privacy-and that this competitive “race to the top” will improve online privacy protection in a broader sense beyond just advertising by putting pressure on other online service providers to improve their privacy practices and policies.

But I fear that too many privacy advocates will instead see this as just another reason for the government to intervene-perhaps because of fear of Google engaging in OBA or  because they think the government, not Google, should be developing privacy solutions.  Or perhaps they think Google’s system shows that a system of government-mandated solutions really could work.  To the contrary, Google’s approach is precisely the kind of innovation that would be discouraged by pre-emptive government regulation.  Worse, those who would freeze privacy protection in place would also freeze in place much of the Internet itself, precluding development of new business models that would compete with Google, allaying concerns about competition and benefiting consumers.  Why preclude broadband providers, for example, from figuring out how to deploy ad-targeting technologies in a manner that does as much to empower users with better privacy controls as Google has-especially when this could create a new source of funding for “free” content and services and even discounts on broadband? 

I hope instead that the effectiveness of Google’s approach will shift the policy debate about protecting user privacy back to an emphasis on the layered approach Adam Thierer and I have outlined, supplementing consumer education, industry self-regulation, existing state privacy tort laws, and  FTC enforcement of corporate privacy policies with increasingly powerful technological “self-help” tools that allow privacy-wary consumers to take privacy into their own hands.

Statue at FTC Headquarters: “Man Controlling Trade” (We’re rooting for the horse!)

Adam Thierer and I have just released a new PFF paper entitled “Targeted Online Advertising: What’s the Harm & Where Are We Heading?” (PDF) about the FTC’s new “Self-Regulatory Principles for Online Behavioral Advertising.”  Adam lampooned some of the attitudes at play in this debate in a great rant yesterday.

But we give the FTC credit for resisting calls to abandon self-regulation, and for its thoughtful consideration of the danger in stifling advertising-the economic engine that has supported a flowering of creative expression and innovation online content and services.  That said, we continue to have our doubts about the FTC’s approach, however-well intentioned:

1. Where is this approach heading?  Will a good faith effort to suggest best practices eventually morph into outright government regulation of the online advertising marketplace?
2. What, concretely, is the harm we’re trying to address?  We have asked this question several times before and have yet to see a compelling answer.
3. What will creeping “co-regulation” mean for the future of “free” Internet services?  Is the mother’s milk of the Internet-advertising-about to be choked off by onerous privacy mandates?

We stand at an important crossroads in the debate over the online marketplace and the future of a “free and open” Internet. Many of those who celebrate that goal focus on concepts like “net neutrality” at the distribution layer, but what really keeps the Internet so “free and open” is the economic engine of online advertising at the applications and content layers. If misguided government regulation chokes off the Internet’s growth or evolution, we would be killing the goose that laid the golden eggs.

The dangers of regulation to the health of the Internet are real, but the ease with which government could disrupt the economic motor of the Internet (advertising) is not widely understood-and therein lies the true danger in this debate.  The advocates of regulation pay lip service to the importance of advertising in funding online content and services but don’t seem to understand that this quid pro quo is a fragile one: Tipping the balance, even slightly, could have major consequences for continued online creativity and innovation.

As we conclude:  Self-regulatory efforts can be refined, especially through technological innovation to better satisfy the concerns of policymakers, privacy advocates, and average consumers.  For example, if websites and ad networks participating in a self-regulatory framework supplemented their current “natural language” privacy policies with equivalent “machine-readable” code, that data could be “read” by browser tools that would implement pre-specified user preferences by blocking the collection of information depending on whether the privacy policies of certain websites or ad networks met the user’s preferences about data-use. Such robust and granular disclosure, if implemented for behavioral advertising, would exceed the wildest dreams of those who argue that users currently do not read privacy policies-without disrupting the browsing experience or cluttering websites.  But this system would only work if users had to make real choices about paying for”‘free” content and services by disclosing their personal information.

Truly privacy sensitive users should be free to opt out of whatever tracking they find objectionable-but not without a cost:  The less data they agree to share, the less content and services they can fairly expect to receive for free.  Concretely, this means that they might not be able to access certain sites, content, or functionality without watching extra (untargeted ads), or paying for that content or service (assuming such a micropayment model can be worked out).  Of course, there will always be ways to “cheat” in such a system, but Commissioner Harbour is exactly right on one point:  Each content creator and service provider must be “free to strike whatever balance it deems appropriate.” This freedom is vital to the Internet’s future because the easier we make it for some users to get “something for nothing,” the smaller will be the economic base for the content and services everyone else takes for granted.  Again, there is no free lunch.

You can download our paper in PDF form on the PFF website or view it below in Scribd.  (Click the rectangle-in-rectangle button at the top right to maximize the iPaper viewer.)

Jerry Yang’s departure as Yahoo! CEO opens the door to a renewed bid by Microsoft to buy Yahoo!’s search business (or Yahoo! itself).  Such a merger could produce a significantly stronger challenger to Google in the search market.  With this possibility in mind, the WSJ just ran a fascinating history of the “paid search” business—the placement of “contextually targeted” ads next to search engine results based on the search terms that produced those results.

In a nutshell, Microsoft failed to see (back in 1998-2003) the enormous potential of paid search—just as small start-ups (such as Google) were starting to develop the technology and business model that today account for a $12+ billion/year industry, which is  twice the size of the display ad market and which supports a great deal of the online content and services we have all come to take for granted online.  Microsoft first put its toe in the water of paid search with a small-scale partnership with Goto.com in 1999-2000.  But this partnership failed because of internal resistance from the managers of Microsoft’s display-ad program.  In 2000, Google launched Adwords and thus began its transformation from start-up into economic colossus.  By 2002, Microsoft realized that it needed to catchup fast, and approached Goto.com (by then renamed Overture) about a takeover.  But Microsoft ultimately chose in 2003 not to buy the startup because  Bill Gates and Steve Ballmer “balked at Overture’s valuation of $1 billion to $2 billion, arguing that Microsoft could create the same service for less.” 

Microsoft, meanwhile, spent the next 18 months deploying hundreds of programmers to build a search engine and a search-ad service, which it code-named Moonshot. The company launched its search engine in late 2004 and its search-ad system in May 2006.

But Microsoft’s ad system came too late:

Advertisers applauded Moonshot for its technical innovation. But Microsoft had trouble coaxing people to migrate to its search engine from Google; advertisers were unwilling to spend large sums on MSN’s search ads. By building a new system instead of buying Overture, Mr. Mehdi says, “we really delayed our time to market.”

What’s most fascinating about the piece is that it seems to suggest that Microsoft missed its opportunities to get into paid search not because it was “dumb,” “uninnovative” or a “bad” company, but for the same sorts of reasons that big, highly successful and even particularly innovative companies fail.  The reasons companies generally succeed in mastering “adaptive” innovation of the technologies behind their established business models are the very reasons why such great companies struggle to encourage or channel the “disruptive” innovation that renders their core technologies and business models obsolete.  This dynamic was described brilliantly in Harvard Business School professor Clayton Christensen’s classic 1997 book The Innovator’s Dilemma:  When New Technologies Cause Great Firms to Fail.  (Read chapter one here and Tim Lee’s recent discussion of the book here.)  

Whatever one thinks about the debate over whether antitrust intervention is necessary to restrain Google’s growth, I’m sure we’d all applaud the evolution of increased competition in the paid search market through market forces.  Let’s hope that Microsoft—as well as Yahoo!—have carefully studied the vast literature produced by business schools in the wake of Christensen’s book about how big companies can avoid the Innovator’s Dilemma by promoting—and capitalizing on—radical innovation from within.  Indeed, this seems to be precisely what has guided Google’s own strategy as it has grown from “disruptive innovator” to become the very sort of behemoth that cannot easily escape the Dilemma, even if corporate managers are fully aware of the problem on a theoretical level.  If Google can do it, Microsoft should be able to, too.  But let’s also not discount the possibility that, no matter how hard Google’s management might try to retain the innovative culture of a start-up, the giant  can’t do that well enough to prevent its own apparent market dominance from being disrupted by new upstart innovators in search and advertising technologies.  

The head of Google Research talked about some of these possibilities in July 2007 and the Google has recently covered other possibilities.  Here are my own bets—for what little they’re worth—as to what such “disruptors” might be:

• Semantic search and social search – whichever search engine masters these tools will likely dominate the market for search, and thus search advertising.
• Micro-payments to search users for using a search engine and discounts for clicking on ads – something Microsoft has pioneered with its Cashback system but which is probably still only in its infancy.
• Behavioral targeting that can make display ads competitive with search ads by making display ads as relevant to consumers as search ads (or even more so), rather than simply trying to target display ads based on the context of a page—which limits the economic value of the ad “display inventory” that websites try to fill with ads, especially for smaller websites in the Internet’s “long tail” whose subject matter might have little relevance to the keywords for products or services that are more highly valued by advertisers.  
• Technologies that allow contextual targeting of ads in or around videos based on the contents of the video (and associated discussion by viewers in comments). Even the imperfect ability to automatically create transcripts of a video, and then search for keywords, could hugely increased the value of advertising associated with video content.

I suspect we’d all be at least a little surprised if we could see what search engines—and online advertising—really looked like in, say, 2019.  But I won’t be terribly surprised if Google—for all its ingenuity—ends up making some of the same mistakes Microsoft made with Search 1.0 ( c. 1998-2005).

The Progress & Freedom Foundation has just launched the new Center for Internet Freedom.  CIF offers an alternative to the proliferation of advocacy groups calling for government intervention online by offering timely analyses and critiques of proposals that diminish the vital role of free markets, free speech and property rights.  We aim to drive the Internet policy debate in new directions by emphasizing a layered approach of technological innovation, user education, user self-help, industry self-regulation, and the enforcement of existing laws consistent with the First Amendment.  Such an approach is a less restrictive—and generally more effective—alternative to increased regulation.  

Here are some of the issues I’ll be working on as CIF’s Director in conjunction with my esteemed colleagues Adam Thierer, Adam Marcus, and adjunct fellows: 

• Defending online advertising as the lifeblood of online content & services, especially in the “Long Tail”;
• Emphasizing market solutions to problems of privacy protection, especially regarding the use of cookies and packet inspection data;
• Protecting online speech and expression both in the U.S. and abroad;
• Defending Section 230 immunity for Internet intermediaries;
• Opposing online taxation and legal barriers to e-commerce and digital payments, especially at the state and local levels; and
• Ensuring that Internet governance remains transparent and accountable without hampering the evolution of the Internet.

By Berin Szoka & Adam Thierer Progress Snapshot 4.19 (PDF)

Since the fall of 2008, a debate has raged in Washington over “targeted online advertising,” an ominous-sounding shorthand for the customization of Internet ads to match the interests of users.  Not only are these ads more relevant and therefore less annoying to Internet users than untargeted ads, they are more cost-effective to advertisers and more profitable to websites that sell ad space.  While such “smarter” online advertising scares some—prompting comparisons to a corporate “Big Brother” spying on Internet users—it is also expected to fuel the rapid growth of Internet advertising revenues from $21.7 billion in 2007 to $50.3 billion in 2011-an annual growth rate of more than 24%. Since this growing revenue stream ultimately funds the free content and services that Internet users increasingly take for granted, policymakers should think very carefully about what’s really best for consumers before rushing to regulate an industry that has thrived for over a decade under a layered approach that combines technological “self-help” by privacy-wary consumers, consumer education, industry self-regulation, existing state privacy tort laws, and Federal Trade Commission (FTC) enforcement of corporate privacy policies.

In an upcoming PFF Special Report, we will address the many technical, economic, and legal aspects of this complicated policy issue-especially the possibility that regulation may unintentionally thwart market responses to the growing phenomenon of users blocking online ads.

We will also issue a three-part challenge to those who call for regulation of online advertising practices:

1. Identify the harm or market failure that requires government intervention.
2. Prove that there is no less restrictive alternative to regulation.
3. Explain how the benefits of regulation outweigh its costs.

The Online Advertising Market

While there are other forms of targeted advertising based on who you are (“demographic”) or where you are (“locational”), the most important varieties are based on what you’re searching for, seeing or doing online at any particular moment (“contextual”) and the pattern of what you’re searching for, seeing or doing over time (“behavioral”). The bulk of Internet advertising falls into one or both of these last two categories, with behavioral advertising growing rapidly.

Search engines deliver contextual ads on search results pages based on the search keywords entered by a user, while third-party advertising networks (some of which also run search engines) deliver contextual ads on behalf of website operators who sell ad space to the network, with the ads displayed on each page chosen according to keywords on that page. Contextual advertising is far “smarter” than displaying the same “dumb” untargeted banner ads to every user, because the contextual ad uses keywords to “guess” what the user is interested in based on the context of each page. But the purely contextual ad network doesn’t “remember” what the user has looked at in the past, so its insights into what the user would find relevant are very limited, especially for some websites. Online behavioral advertising (OBA) solves this problem and increases the value of advertising space on all websites by targeting ads based on a “profile” of the user created by tracking websites the user has visited—as well as limiting the number of times a user is shown a particular ad.

The Perceived Harm Driving Calls for Regulation

For a decade, the basic technology behind OBA has changed little: When a user visits the typical webpage, they download not only the webpage contents but also a small piece of code that allows the website to distinguish that user’s browser from other browsers (a “cookie”)—without personally identifying the user. Some cookies are required to make sites work properly (“site cookies”) while others (“tracking cookies”) are used by the third party ad network in which that site participates to recognize that browser across multiple sites participating in the ad network, and thus create a “profile” of what the user might be interested in. Even though such profiles themselves are anonymous, many privacy advocates have pointed to four reasons why online profiling is becoming “too invasive:” (i) It is sometimes possible to infer the actual identity of the user; (ii) though all browsers allow users to opt-out of tracking by “cleaning out” their tracking cookies, a website may be able to restore deleted tracking cookies through the use of cookie alternatives such as “Flash cookies”; (iii) certain vulnerabilities in current browser design make it theoretically possible to “sniff” a user’s browsing history, cache or bookmarks; and (iv) the use of “packet inspection” by Internet Service Providers (ISPs) (instead of the use of cookies) to track online browsing amounts to illegal wiretapping.

The other concerns expressed by the advocates of regulation vary significantly. Some fear that browsing profiles could be captured by hackers, somehow associated with personally identifying information, and used for identity theft. These advocates demand limits on data retention as well as data security mandates. Others demand that users have access to their own profiles—a goal inherently in tension with data security. Most share a vague queasiness about “being tracked” and about advertising in general, while downplaying the effectiveness of self-regulation or user self-help.

Perhaps most legitimately, others fear that the real “Big Brother”—the government—will gain access to a “honeypot” of surveillance data that might be associated with individual users. A variety of other solutions have been proposed to what is, for the most part, a poorly defined problem, including a government-run “Do Not Track” registry to make it easier for users to block tracking cookies; mandating opt-in for some or all forms of profiling; and banning completely the collection of tracking data about sensitive subjects, cross-referencing of data sets, and use of packet inspection data for OBA.

The Less Restrictive Means: A Layered Approach

But how should policymakers decide which, if any, of these interventions are really necessary–or would even be effective? Ironically, those who demand immediate OBA regulation to protect user privacy are often the first to insist on less burdensome approaches whenever a policy “problem” involves purely non-commercial speech. For example, emphasizing personal and parental responsibility is often favored as the more sensible approach to dealing with free speech and child protection concerns. But, as Chapman University Law Professor Tom Bell has asked, why not apply the same standard across the board? Why not expect those especially privacy-sensitive users who object to OBA to do something about it? To the extent effective self-help privacy tools exist, they provide a means of solving policy problems that is not only “less restrictive” than government regulation but generally more effective and customizable as well. Why settle for one-size-fits-all solutions of incomplete effectiveness when users can quite easily and effectively manage their own privacy? Indeed, those who advocate personal responsibility and industry self-regulatory approaches to free speech and child protection issues should be advancing the same position with regards to privacy.

Fortunately, a wide variety of self-help tools and “technologies of evasion” are readily available to all users and can easily thwart traditional cookie-based tracking, as well as more sophisticated tracking technologies such as packet inspection. While cookie management tools that allow users to delete their cookies have been standard in browsers for some time, the latest generation of browsers incorporates far more advanced control over what kind of cookies browsers will accept from websites in the first place. Furthermore,  the extensible nature of modern browsers allows any freelance software developer who sees a way to improve a browser to do so by writing an add-on that “plugs in” to the browser using standard programming interfaces designed by each browser developer.  Many such add-ons are wildly popular, but even those users who never install a single one benefit from the acceleration of browser evolution made possible by add-ons.  We will be documenting examples of these tools in our upcoming Special Report and in an ongoing  series of blog essays.

The Benefits of Smarter Advertising

The “free” Internet economy is based on a simple value exchange: Users get access to an ever-expanding collection of content and services at no cost from websites that are able to generate revenue from “eyeballs” on their pages by selling space on their sites to advertisers, usually through ad networks. The smarter that advertising, the more free content and services it can support. This is the same value exchange that has supported free, over-the-air television and radio content for decades. The only difference is technological: Because websites can connect directly with the user, they need not rely on crude profiling tools such as Nielsen ratings.

There are larger economic benefits of smarter online advertising. First, it makes the overall economy more open and competitive by allowing small market entrants to reach consumers with messages about their products. Second, those who attack the use of packet inspection by ISPs for OBA fail to see that it is precisely the kind of “game-changer” that could disrupt Google’s currently dominant market position. Third, the involvement of ISPs in OBA could help defer broadband costs: Even if OBA revenue does not completely subsidize monthly service costs, smarter advertising could at least keep prices in check and potentially lower them significantly going forward.

But smarter advertising isn’t just about selling products or services. It is ultimately about making all kinds of speech more cost-effective. The ability to “target” listeners more narrowly also increases the ability of political and other not-for-profit speakers to communicate their messages. In short, smarter advertising means more voices, more choices, and more speech. The line between “advertising” and “content” is already blurring rapidly, as the technologies used to customize advertising are also used to customize webpages and ad networks themselves are used to deliver content.

The Larger Implications of Potential Regulation

As if reducing the advertising revenue generated by each web ad didn’t do enough to reduce the total amount of funding for free web content and services, government regulation of targeted online advertising could reduce advertising revenues even further by aggravating the problem of adblocking in two ways. First, the less relevant ads are, the more annoying users will find them, and the more likely users are to try to block them. Increased relevance is perhaps the most important remedy for adblocking and the best way to maintain the implicit value exchange that currently supports free Internet content and services

Second, regulation could short-circuit the eternal battle of technological one-upmanship between online advertisers and those users who rely on the technologies of evasion to “opt-out” of seeing ads or being tracked. Such privacy-conscious users are “free-riding” off of those users who don’t opt-out, since (at present) they generally don’t lose access to the free content and services supported by the targeted advertisements that other users do see. The user who blocks tracking, but not ads, is still free-riding off those users who don’t opt-out of tracking. On a large enough scale, such self-help has the potential to disrupt the value exchange of the Internet, just as automatic commercial-skipping has already disrupted the value exchange of television. As with all “Spy v. Spy” battles, this long-term trend is inevitable: As more sophisticated technologies of evasion are incorporated seamlessly into browsers and can be used without significantly degrading the browsing experience, their use will become increasingly mainstream. But ultimately, just as with television commercial-skipping, market forces can and will, if permitted, respond through technological means and the development of new business models. Today’s implicit quid pro quo may become, of necessity, explicit: Websites and ad networks will have to find increasingly creative ways to grant access to certain content and services for users who do not block ads or the tracking that makes ad space more valuable. Policymakers should take care not to ban such technologies or cripple such business models (e.g., through requiring opt-in), which may rely on more sophisticated forms of targeting such as the use of packet inspection data.

As users face an increasingly clear choice between (i) getting content and services for free supported by behavioral advertising and (ii) paying to receive those same services and content without tracking or even without ads altogether, policymakers will finally see whether users are really as bothered by profiling as the advocates of OBA regulation insist. Given the ongoing and widespread replacement of fee- or subscription-supported web business models with ad-supported models, it seems likely that the vast majority of consumers will continue to choose ad-supported models, including profiling.

Conclusion

The questions raised above—about the harm that supposedly requires intervention, the availability of less restrictive means, and the cost/benefit analysis of regulation—are vital considerations for the future of the Internet. Indeed, if smarter online advertising will not fund the Internet’s future, what will? As both the desire for “free” services and content and the need for bandwidth expand, OBA has the potential to offer important new revenue sources that can help support the entire ecosystem of online content creation and service innovation, while also providing a new source of funding for Internet infrastructure and making ads less annoying and more informative. That would certainly seem preferable to increased user fees or other “pay-per-view” pricing models for Internet content and services.

But looming legislative and regulatory action could stop all of that by replacing the current regime—in which the FTC merely enforces industry self-regulatory policies—with one in which the government preemptively dictates how data may be collected and used. The more enlightened approach is a “layered” approach to privacy protection that combines industry self-regulation, enforcement of industry-established privacy policies, consumer education, and user “self-help” solutions. These and other issues will be addressed in greater detail in our upcoming PFF Special Report.