Systems that track online behaviour to deliver targeted ads offer huge efficiencies, and raise serious privacy issues
By George Takach
TRADITIONAL mass-market advertisements in newspapers, radio and television are still highly effective (otherwise businesses wouldn't pay for them), but they are also notoriously inefficient — hence, the migration of billions of ad dollars to the Internet, where targeted ads are possible. These tailored ads, however, are not without their legal challenges.
> Inefficient Mass-Market Ads
To illustrate the shortcomings of the traditional advertising model, pretend you are an espresso coffee machine maker. You have developed what you believe is the best espresso machine ever. You want to get the word out. You want to drum up huge sales.
How about a billboard in the trendiest neighbourhood in town? Or an ad in the local paper. This is traditional, offline advertising. And it's proven to work. After spending lots of money on these advertising channels, your sales do indeed increase.
Yet questions linger. Thousands of the people who saw the billboard don't drink coffee … let alone espresso. The newspaper says it has a circulation of 100,000 copies, but how many of those readers are coffee drinkers? And of those who are, how many already have an espresso machine they are perfectly happy with?
These concerns remind you of the old adage: half of the money spent on advertising is wasted … the problem is, you don't know which half! The imprecision of advertising in traditional mass media (like newspapers, radio or television) is maddening.
> Tailoring Ads to the Audience
One response to the inefficiency of mass-market ads is to try to tailor the ad to a more specific occasion. So let's return to our espresso machine illustration. The “Find Food Festival” is coming to town. It attracts mainly people who like high-end food and drink. These folk often drink lattes, and many of them like the idea of being able to enjoy such a concoction at home. An ad for your espresso machine in the program of the Fine Food Festival is a more efficient use of your precious advertising dollars. But it's still not perfect — because a lot of the attendees are really only going for the wines and cheeses.
Many years ago, some credit card companies began to provide a service to advertisers that addressed the advertising inefficiency problem. Credit card companies know an awful lot about their customers, because they see where their customers do their shopping. But if the credit card company were to simply turn over the raw purchasing data to an advertiser, such a practice would be quickly condemned as a breach of privacy. So what some card companies did was to categorize their customers based on their overall spending habits. One American card company, for instance, would slot a customer who shopped a lot at designer stores into their “Rodeo Drive Chic” database, and then would make that specific database of names and addresses available to sellers of high-end luxury products — like fancy espresso makers.
But again, while this segmentation of the market helped advertisers, it wasn't perfect because, at the end of the day, not even everyone on the Rodeo Drive Chic list drinks coffee or, even if they do, wants to make espresso at home.
> Micro-targeting Ads
Enter the Internet, the most efficient advertising medium ever invented. Consider Harry, who is looking to buy an espresso maker. He gets home from work, sits in front of his computer and starts (as so many of us do) by entering into his favourite search engine “home espresso machines” and his city.
This search query causes the Internet to snap to attention. A motivated customer (Harry) is signalling that he is interested in buying an espresso machine. The search engine provider, and its network of advertisers, have an extremely valuable scenario on their hands — an interested customer, ready to buy an espresso machine.
When the search results for “home espresso machines” appear for Harry, they not only include instructional articles on how to use and care for these machines and consumer reports on them; the search results also include ads for their purchase. And advertisers pay big money to the search engine operator for the placement of these ads (though often the payment is based on whether Harry clicks through on their specific ad). Talk about an efficient advertising system!
> Cookies and Context
Harry takes the next step. He clicks on the espresso machine ad of a well-known e-tailer and lands on a page advertising several different espresso makers at various prices. Interestingly, this page also has an ad for a book on how to make exotic coffees; and there's also an ad from a supplier of high-end coffee beans.
Most intriguingly, when Harry returns to the same e-tailer's site to look for a small wine cooler unit, he is served an ad from a coffee connoisseurs magazine, and two more ads from exotic coffee bean suppliers. Harry marvels at the coincidence — he just happened to buy an espresso maker from this site a few days ago, and now he's seeing ads for coffee bean suppliers. What are the odds of that happening, he ponders.
Of course, it's not a coincidence. Rather, the first time Harry went to this e-tailer's website, the e-tailer sent Harry's computer a little bit of software called a “cookie,” which now sits permanently on Harry's computer (unless Harry takes the conscious step to delete it). Every time Harry returns to the e-tailer's website, the cookie reminds the e-tailer that Harry bought an espresso machine (and whatever else he buys from this site over the months and years), and so the e-tailer can serve Harry specific ads that are relevant to Harry.
Such an advertising system illustrates the enormous power of the Internet. But at the same time, it's kind of creepy. Especially when the core “consumer surveillance” system is expanded to include not only the tracking of your activity on a single e-tailer's website, but over the entire Internet (i.e., a system that logs the websites and webpages you visit for a lengthy period of time).
> The Google Case
This is exactly what happened in a recent case before Canada's Office of the Privacy Commissioner (OPC) involving the Google Adsense service. A gentleman had sleep apnea, a medical condition, and searched on Google for a CPAP (Continuous Positive Airway Pressure) device — essentially a tight-fitting mask that forces the user to take oxygen while sleeping.
The fellow's search results and browsing history – essentially, his user experience on the Internet – was tracked and made available to other advertisers through the search engine system's online behaviour tracking technology. The result was that the gentleman was served multiple ads for CPAP devices over different user sessions on the Internet. Beyond being creeped out, the fellow took exception to information relating to his medical condition being shared with third parties (in this case, various online vendors).
Keep in mind that medical information is perhaps the most sensitive type of personal information. I remember the sad story a number of years ago (in the pre-Internet era) when a young couple expecting their first child signed up for parenting classes with a medical clinic. The pregnant mom-to-be then suffered a miscarriage, which was tremendously sad. To make matters worse, however, the poor woman was over the next number of months continually harassed by advertisements from the makers of baby products. As it turns out, the clinic had shared her pregnancy news, and home address, with baby product suppliers, who presumably paid for such information. The young woman was enraged; the clinic learned an important lesson.
It was a similar sentiment that drove the CPAP user to complain about the Google advertising system to the Privacy Commissioner. The OPC had previously given thought to this form of online behavioural advertising (OBA) and had concluded that, when it came to certain sensitive types of information, such as medical information, OBA should only be done with the express consent of the relevant individual. As such consent was not obtained in this case, the OPC found Google had violated Canada's federal privacy law.
Ironically, Google itself had a policy similar to that of the OPC prohibiting e-tailers from using (among other types of sensitive information) medical information without express consent. What became clear from the OPC investigation is that enforcing these sorts of restrictions through the online advertising system operated by Google is quite a challenge.
As a result, in its resolution of the matter with the OPC, Google agreed to improve the training given to its own staff about the rules of the road for this sort of service. Equally, Google agreed to monitor its network of advertisers, and implement better screening where sensitive information is at issue. These are positive steps, and necessary if the promise of more efficient, more useful online advertising is to be realized in a way that doesn't creep out users.
In short, care is required when harnessing the power of targeted online advertising, especially when sensitive personal information is involved.
George Takach is a senior partner at McCarthy Tétrault LLP, the author of Computer Law, and an Adjunct Professor in Computer Law at Osgoode Hall Law School.
By George Takach
TRADITIONAL mass-market advertisements in newspapers, radio and television are still highly effective (otherwise businesses wouldn't pay for them), but they are also notoriously inefficient — hence, the migration of billions of ad dollars to the Internet, where targeted ads are possible. These tailored ads, however, are not without their legal challenges.
> Inefficient Mass-Market Ads
To illustrate the shortcomings of the traditional advertising model, pretend you are an espresso coffee machine maker. You have developed what you believe is the best espresso machine ever. You want to get the word out. You want to drum up huge sales.
How about a billboard in the trendiest neighbourhood in town? Or an ad in the local paper. This is traditional, offline advertising. And it's proven to work. After spending lots of money on these advertising channels, your sales do indeed increase.
Yet questions linger. Thousands of the people who saw the billboard don't drink coffee … let alone espresso. The newspaper says it has a circulation of 100,000 copies, but how many of those readers are coffee drinkers? And of those who are, how many already have an espresso machine they are perfectly happy with?
These concerns remind you of the old adage: half of the money spent on advertising is wasted … the problem is, you don't know which half! The imprecision of advertising in traditional mass media (like newspapers, radio or television) is maddening.
> Tailoring Ads to the Audience
One response to the inefficiency of mass-market ads is to try to tailor the ad to a more specific occasion. So let's return to our espresso machine illustration. The “Find Food Festival” is coming to town. It attracts mainly people who like high-end food and drink. These folk often drink lattes, and many of them like the idea of being able to enjoy such a concoction at home. An ad for your espresso machine in the program of the Fine Food Festival is a more efficient use of your precious advertising dollars. But it's still not perfect — because a lot of the attendees are really only going for the wines and cheeses.
Many years ago, some credit card companies began to provide a service to advertisers that addressed the advertising inefficiency problem. Credit card companies know an awful lot about their customers, because they see where their customers do their shopping. But if the credit card company were to simply turn over the raw purchasing data to an advertiser, such a practice would be quickly condemned as a breach of privacy. So what some card companies did was to categorize their customers based on their overall spending habits. One American card company, for instance, would slot a customer who shopped a lot at designer stores into their “Rodeo Drive Chic” database, and then would make that specific database of names and addresses available to sellers of high-end luxury products — like fancy espresso makers.
But again, while this segmentation of the market helped advertisers, it wasn't perfect because, at the end of the day, not even everyone on the Rodeo Drive Chic list drinks coffee or, even if they do, wants to make espresso at home.
> Micro-targeting Ads
Enter the Internet, the most efficient advertising medium ever invented. Consider Harry, who is looking to buy an espresso maker. He gets home from work, sits in front of his computer and starts (as so many of us do) by entering into his favourite search engine “home espresso machines” and his city.
This search query causes the Internet to snap to attention. A motivated customer (Harry) is signalling that he is interested in buying an espresso machine. The search engine provider, and its network of advertisers, have an extremely valuable scenario on their hands — an interested customer, ready to buy an espresso machine.
When the search results for “home espresso machines” appear for Harry, they not only include instructional articles on how to use and care for these machines and consumer reports on them; the search results also include ads for their purchase. And advertisers pay big money to the search engine operator for the placement of these ads (though often the payment is based on whether Harry clicks through on their specific ad). Talk about an efficient advertising system!
> Cookies and Context
Harry takes the next step. He clicks on the espresso machine ad of a well-known e-tailer and lands on a page advertising several different espresso makers at various prices. Interestingly, this page also has an ad for a book on how to make exotic coffees; and there's also an ad from a supplier of high-end coffee beans.
Most intriguingly, when Harry returns to the same e-tailer's site to look for a small wine cooler unit, he is served an ad from a coffee connoisseurs magazine, and two more ads from exotic coffee bean suppliers. Harry marvels at the coincidence — he just happened to buy an espresso maker from this site a few days ago, and now he's seeing ads for coffee bean suppliers. What are the odds of that happening, he ponders.
Of course, it's not a coincidence. Rather, the first time Harry went to this e-tailer's website, the e-tailer sent Harry's computer a little bit of software called a “cookie,” which now sits permanently on Harry's computer (unless Harry takes the conscious step to delete it). Every time Harry returns to the e-tailer's website, the cookie reminds the e-tailer that Harry bought an espresso machine (and whatever else he buys from this site over the months and years), and so the e-tailer can serve Harry specific ads that are relevant to Harry.
Such an advertising system illustrates the enormous power of the Internet. But at the same time, it's kind of creepy. Especially when the core “consumer surveillance” system is expanded to include not only the tracking of your activity on a single e-tailer's website, but over the entire Internet (i.e., a system that logs the websites and webpages you visit for a lengthy period of time).
> The Google Case
This is exactly what happened in a recent case before Canada's Office of the Privacy Commissioner (OPC) involving the Google Adsense service. A gentleman had sleep apnea, a medical condition, and searched on Google for a CPAP (Continuous Positive Airway Pressure) device — essentially a tight-fitting mask that forces the user to take oxygen while sleeping.
The fellow's search results and browsing history – essentially, his user experience on the Internet – was tracked and made available to other advertisers through the search engine system's online behaviour tracking technology. The result was that the gentleman was served multiple ads for CPAP devices over different user sessions on the Internet. Beyond being creeped out, the fellow took exception to information relating to his medical condition being shared with third parties (in this case, various online vendors).
Keep in mind that medical information is perhaps the most sensitive type of personal information. I remember the sad story a number of years ago (in the pre-Internet era) when a young couple expecting their first child signed up for parenting classes with a medical clinic. The pregnant mom-to-be then suffered a miscarriage, which was tremendously sad. To make matters worse, however, the poor woman was over the next number of months continually harassed by advertisements from the makers of baby products. As it turns out, the clinic had shared her pregnancy news, and home address, with baby product suppliers, who presumably paid for such information. The young woman was enraged; the clinic learned an important lesson.
It was a similar sentiment that drove the CPAP user to complain about the Google advertising system to the Privacy Commissioner. The OPC had previously given thought to this form of online behavioural advertising (OBA) and had concluded that, when it came to certain sensitive types of information, such as medical information, OBA should only be done with the express consent of the relevant individual. As such consent was not obtained in this case, the OPC found Google had violated Canada's federal privacy law.
Ironically, Google itself had a policy similar to that of the OPC prohibiting e-tailers from using (among other types of sensitive information) medical information without express consent. What became clear from the OPC investigation is that enforcing these sorts of restrictions through the online advertising system operated by Google is quite a challenge.
As a result, in its resolution of the matter with the OPC, Google agreed to improve the training given to its own staff about the rules of the road for this sort of service. Equally, Google agreed to monitor its network of advertisers, and implement better screening where sensitive information is at issue. These are positive steps, and necessary if the promise of more efficient, more useful online advertising is to be realized in a way that doesn't creep out users.
In short, care is required when harnessing the power of targeted online advertising, especially when sensitive personal information is involved.
George Takach is a senior partner at McCarthy Tétrault LLP, the author of Computer Law, and an Adjunct Professor in Computer Law at Osgoode Hall Law School.
Lawyer(s)
George S. Takach