FTC’s Proposed Privacy Framework

FTC’s proposed a framework to protect the privacy of consumers. Part of this framework is a “Do Not Track” option that has raised a lot of questions among the web analytics and advertising community. Well since this is just a proposal at this stage nobody knows how it will finally pan out. At this point FTC has published the report to seek public comments. The report that FTC has put together is 122 pages long. I have extracted some important point from that report in case you don’t have the time to read the full report.

The basic building blocks of this framework are:

• Scope: The framework applies to all commercial entities that collect or use consumer data that can be reasonably linked to a specific consumer, computer, or other device.
  
  Note: This is not limited only those who collect PII data, if you collect any information about a consumer then this applies to you. However commission is seeking input on how to determine
  “reasonably linked to a specific consumer…”
  
• Privacy by Design: Companies should promote consumer privacy throughout their organizations and at every stage of the development of their products and services.
  
  • Companies should incorporate substantive privacy protections into their
    practices, such as data security, reasonable collection limits, sound
    retention practices, and data accuracy.
  • Companies should maintain comprehensive data management procedures
    throughout the life cycle of their products and services.
    
    Note: You might need to assign a person to oversee that privacy of data is built into your products/services/process etc. Think, “Chief Privacy officer”.
    
    • Ensure physical data protection
    • Do not collect what is not required
    • Do not retain data for longer than it is required
    • Ensure accuracy of the data so that you do not harm someone because of the inaccurate data
• Simplified Choice: Consumers face considerable burdens in understanding lengthy privacy policies and effectively exercising any available choices based on those policies. Under proposed framework, companies should simplify consumer choice.
  
  
  • Companies do not need to provide choice before collecting and using consumers’ data for commonly accepted practices, such as product fulfillment.
    This also includes tracking for improving the sites (Web Analytics), fraud protections, legal compliance and first party marketing.
  • For practices requiring choice, companies should offer the choice at a time and in a context in which the consumer is making a decision about his or her data.
• Greater Transparency: Companies should increase the transparency of their data practices.
  
  • Privacy notices should be clearer, shorter, and more standardized, to enable better comprehension and comparison of privacy practices.
  • Companies should provide consumers with reasonable access to data about themselves; the extent of access should depend on the sensitivity of the data and the nature of its use.
  • Companies must provide prominent disclosures and obtain affirmative express consent before using consumer data in a materially different manner than claimed when the data was collected.
  • All stakeholders should work to educate consumers about commercial data privacy practices.

Feel free to leave a comment if I missed anything. You can read the full report at http://ftc.gov/os/2010/12/101201privacyreport.pdf.

Read my other articles on Privacy

----------------------------------------------------------------------------------------------------
Open Web Analytics and Online Marketing Jobs

• Web Data Analyst
  at Genworth Financial (Richmond, VA)
• Web Games Analyst
  at Arkadium (New York, NY)
• Web Metrics Analyst
  at Omnitec Solutions (Alexandria, VA)
• Web Data Analyst
  at Alzheimer's Association (Chicago, IL)
• Web Analytics Manager
  at Tig Global (Chevy Chase, MD)
• Sr. Data Analyst
  at Capella University (Minneapolis, MN)
• Manager, Web Analytics, Search & Production Support
  at Asme (New York, NY)
• Web Analytics Manager
  at Conde Nast (New York, NY)
• Web Analytics Manager
  at Juggle (Swansea, IL)
• Sr. Analyst Web Analytics
  at Williams-Sonoma (San Francisco, CA)

The Web’s New Gold Mine: Personalizing Your Online Experience

Past weekend, WSJ published a story titled Web’s New Gold Mine: Your Secrets on online tracking and advertising (behavioral targeting). It appears to me that the author of this article is either confused between malware and cookies is or she is just doing what she is supposed to do to sell the story i.e. using words that instill fear in people.

The article projects any tracking, business and advertisers do to serve relevant ads or personalize the users experience on web, as malicious. Businesses have been trying to understand consumer preferences and then make personalized recommendations ever since the humans existed. We do it offline all the time. So how is online tracking for the same purpose malicious?

My dad used to run his clothing store in India, way before internet existed. He used to gather all the information (in his brain) about consumers browsing and purchase behavior to make personalized recommendation to existing customers and new customers. He used all that information to determine what products, colors, sizes, quantities etc. to stock. He knew almost all of the existing customers by their name and what they preferred. Was that spying? Nope. Customer loved it.

If someone can understand me and provide me exactly what I want then why won’t I like it? If they miss the mark well then I have a choice of not paying attention to them.

Do you know that Visa, MasterCard and American express have more information about you than any cookie or advertising company has? Your super market collects your information and tries to guess about what you might buy next. Have you ever got a coupon from an automated coupon dispenser when you check out from your local super market? Well do you know that it is based on your current and past purchases, you zip code etc? Do you ever worry about that or happily walk away with the coupon? Why is the fuss about online tracking for the same purpose? Don’t you love personalized recommendations from Netflix or Amazon?

In my opinion advertisers/publishers/network should invest in consumer education and make tracking and targeting more transparent and articles like this should help with the education instead of branding all tracking as bad.

Comments?

Why is Google really rolling out Google Analytics opt-out plug-in?

Last week I wrote about a browser plug-in that will allow people to opt-out of the Google Analytics cookie. The release of this plug-in seems to be a proactive step towards another announcement.

Eric Peterson, on his blog, voiced his opinion on why Google is rolling out this plug-in. I think Eric has a point in his post about Google trying to make a push into Federal Government web sites and this roll out is a check-box to satisfy the needs of privacy advocates.

However, I am still not entirely clear on what Google will get if it can’t use all the data that it will collect on Federal Government website? It won’t be able to use in any way…well maybe at an aggregate level to compete with the likes of ComScore. So what do I think the reason is?

Behavioral Targeting

I think the real answer to Google Analytics’ rolling out Opt-out is “Behavioral Targeting”.
Google Analytics is deployed on thousands of websites and collects a wealth of data. However, so far this data is used by individual sites to optimize their ad spend and improve the site for customers while improving the websites impact on the bottom line. Google has not really used that data much other than providing benchmarking reports in Google Analytics. I think the time has come for Google to start using Google Analytics data to make more money.

Google Analytics Data Sharing

Remember, in 2006 Google Analytics started asking GA accounts to opt-in/opt-out of data sharing. As I wrote in my blog post on Google Analytics Data Sharing, “data sharing” was a step towards using Google Analytics data for behavioral targeting. This opt-out plug-in seems to be a next step in that direction.

Limited functionality of Adwords Remarketing

Last week Google Adwords announced the roll-out of “Remarketing” feature that will allow advertisers to remarket to the visitors (cookies) who came to their sites but left without taking the desired action i.e. without converting (this is also called Retargeting, a form of Behavioral Targeting). For this feature to work, Adwords advertisers will have to put a small script and identify the people (cookies) whom they want to target.
The functionality to identify the segment that you want to retarget seems to be very limited in Adwords.

Google Analytics role in enhancing Adwords Remarketing

Now imagine, you can create complex segment in Google Analytics and then use Adwords to target the visitors who fall in that segment. Won’t that be nice? Well that can’t happen unless you use Google Analytics. Here is an example to make this clear:
I want to target visitors who viewed more than 3 products and looked at the contact us page and then left without converting (or it could be more complex than this).
This is a segment that I won’t be able to create easily in Adwords without some coding on my pages. Using Google Analytics, advanced segment functionality this is a piece of cake. I create my segment then use Adwords to remarket to visitors who fall in that segment. Won’t that be more powerful? I think that’s where the money is.

Other Behavioral Targeting Scenarios with Google Analytics

Let’s take a hypothetical example to see how this will work.

Say I write a blog on luxury cars. I use Google Analytics as my web analytics tool (it is free, so why not). I don’t have real business model but I use Adsense ads to make some extra money. Since my blog is really popular I get lot of traffic. My blog reader are those who have interest in luxury cars because that’s all I write about.

Now imagine Google asks me to pool my visitors’ information, collected in Google Analytics, into a pool that they can use for advertising purposes. They tell me that by doing so I will be able to make some more money from my visitors even when the visitors have left my site. Hmm… free money. Sure :)

How will Google use that data?

Google will identify the visitors who come to my blog, read articles, write comments, come often etc. They will then put the visitors (cookies) who fulfill certain criteria (as defined by Google or the Advertiser) in a segment called “Luxury Car Enthusiast”. They will pool my data with other similar sites or similar pages on other sites to create a bigger pool than my site has to offer. Google now has a set of cookies who are interested in luxury cars.

BMW creates a campaign in Adwords to reach “Luxury Car Enthusiasts”. They are willing to play 2X-3X CPC or CPM to reach this target.

A visitor, who left my site (A) and lands on a site (B) that, has nothing to do with luxury cars. Google can identify that visitor because that visitor is in the pool of cookies that belong to “Luxury Car Enthusiasts” segment. Google shows this visitor an ad from BMW on Site B. Visitor sees the ad that matches his/her interest and the advertiser reaches their target.

Note: This all is a speculation by me and I have no official information.

Win-Win Situation

• BMW finds its target
• Google gets more money for the same ad slot.
• Publisher of the ad makes more money.
• Sites, which pool their visitors in this segment, get a cut.

What does GA Plug-in has to do with all this?

Behavioral Targeting has been under scrutiny for a long time and there is a big uproar about tracking people. Privacy advocates want an easy way for people to opt-out of Behavioral targeting and this plug-in seems to be a proactive step in that direction.

What do you think?

---

Looking to fill your Web Analytics or Online Marketing position?
Post your open jobs on Web Analytics Job Board

• Senior Data Analyst
  at Looksmart (San Francisco, CA)

Online Privacy - Consumer Education is Missing

During 2007-2008 I wrote a lot about online privacy on this blog. Most of the online privacy discussion at that time revolved around online targeting based on tracking users online behaviors also knows as behavioral targeting.

It amazes my how many privacy advocates and senators are concerned about anonymous online tracking and behaviorally targeted ads based on peoples click behavior when the consumers are voluntarily giving all the private information on social media sites.

Last week Google Analytics announced a plug-in that will let users opt-out of Google Analytics. Really...is web analytics tracking detrimental to visitors' privacy? Google Analytics collects click stream data anonymously. It does not know who you are, it identifies you via a cookie and tracks what pages were viewed by that cookie, what buttons were clicked by cookie etc. This data is then used by individual sites using the tool (Google Analytics) to understand the behavior of their visitors and optimize the experience both for the user and their business. Where is the privacy threat in all this?

Proliferation of the services like Facebook, Twitter and location based services like Gowalla and Foursquare have enabled people to share their personal information with their "friends". Users of these services are willingly giving a lot of personal information. Information, that can be used by others ("friends"), in so many harmful ways. But is general consumer aware of such harms? Why isn't that the most important issue?

The real threat to privacy is the lack of education about the online information sharing. We are the ones who are voluntarily revealing a ton of information, which is far more harmful than anonymous click stream behavior. Using Facebook, twitter and Foursquare you can pretty much know what a person likes, dislikes, who the family members are, what time they leave the house, what time they arrive at work, where do they spend their day, afternoon, evening, what they wear, etc. That to me should be more concerning than anonymous web analytics tracking and the ads that are targeted based on a users click behavior.

Most of the consumers don't even know how all the little personal information they are leaving on social media sites could harm them. I have not seen any public service ads warning me about the downside of using such services. Shouldn't there be those ads warning people, both offline and online?

In my opinion governmental agencies, privacy advocates and marketers should focus their attention on consumer education. Educate them about various tracking methods, implications of information sharing on social media sites etc. No matter how strict the online tracking & targeting rules are you won't be able to avoid privacy leaks unless the end consumer is educated about the implications.

What do you think?

---

Looking to fill your Web Analytics or Online Marketing position?
Post your open jobs on Web Analytics Job Board

• Senior Data Analyst
  at Looksmart (San Francisco, CA)

Google Analytics Opt-out Browser Plug-in

Late last week Google Analytics announced a browser plug-in that will allow users to opt-out of Google Analytics tracking.

Here is an offical statement from Amy Chang, group product manager at Google Analytics:

As an enterprise-class web analytics solution, Google Analytics not only provides site owners with information on their website traffic and marketing effectiveness, it also does so with high regard for protecting user data privacy. Over the past year, we have been exploring ways to offer users more choice on how their data is collected by Google Analytics. We concluded that the best approach would be to develop a global browser based plug-in to allow users to opt out of being tracked by Google Analytics. Our engineers are now hard at work finalizing and testing this opt-out functionality. We look forward to make it globally available to our users in the coming weeks.

How does it impact the website stats reported by Google Analytics

This is the biggest question everybody is asking. Since I don't have the full information on how this plug-in will exactly work, let's take a look two potential ways this plug-in can work.

• The plug-in will not collect any sort of data for the user
  Let's assume that this plug-in will ensure that absolutely no data about the users behavior on any of the site that user visits will be collected. Which means that Google Analytics will completly ignore the presence of that person (computer) as if that person never visited the site. In that case all of the data, i.e. visitors, visits and page views, conversion etc., will be under reported.
  
• The plug-in will collect the data but then destroy the cookie after every session (visit)
  In this case, a session level cookie will still work but this cookie will be removed from the users computer after every session. This will result in the accurate count of visits (sessions) and page views and all the data that is reported at visit or page view level. However, the visitors count will be inflated since same person (computer) will get a new cookie for every visits.

How big the impact will be?

Well, it is not clear how widespread the use of this plug-in will be. Currently, there are 3rd party tools available clear or block Google analytics cookies but the use of such tools do not seem to be an issue for Google Analytics tracking. So I wonder if this plug-in will have any huge impact on Google Analytics data. However keep in mind that there will be some impact.

---

Looking to fill your Web Analytics or Online Marketing position?
Post your open jobs on Web Analytics Job Board

• Senior Data Analyst
  at Looksmart (San Francisco, CA)

Online Data Tracking and Privacy

Online privacy is a hot button these days. Privacy advocates and lawmakers are putting a lot of pressure on several large internet companies such as Google, Microsoft and Yahoo to be transparent about how they intend to use users web surfing data (behavior). Mainly they are concerned with the companies that collect a huge amount of user data and then engage in Behavioral Targeting.

However online data tracking is not limited to companies who engage in Behavioral Targeting. Any companies which collects users’ web surfing data or user provided data needs to make sure do not compromise user privacy (actual or perceived). They need to clearly state how they are collecting data and how that data will be used.
Enterprise web analytics tools like Omniture, WebTrends, Coremetrics etc and free tools like Google Analytics and Yahoo IndexTools have made it very easy for website owners of any size to track users’ online behaviors. Most of the web analytics tools use a first party anonymous cookie to track users and their behaviors on any given site.

Side Note: The data is called anonymous because it mainly uses a cookie value to indentify a user (there are other ways which I am not covering in this post) without knowing who the actual user is. Say John Doe arrives on AnilBatra.com, a web analytics tool will drop a cookie with a random id say 123ASXBA12. This cookie id is not tied to any personally identifiable information (see below) of John Doe. So Web Analytics tools (in most cases) do not know who the person is, they just know that cookie id 123ASXBA12 came to the site. They use this id to track current and future site visits.

Even if the data is anonymous the potential of it being tied to personally identifiable information is there and that can cause privacy concerns. It is critical that every company that collects any sort of consumer data, anonymous or personal, needs to clearly state its data collection and usage policy in its site’s privacy policy.

Usually Web Analysts do not tackle this issue and it is left to the legal department. However, a lot of times the web analytics tracking and any kind of targeting is implemented without getting legal involved. As a result companies sometimes do not have proper privacy policy in place. This is a huge blunder, companies need to take privacy issues seriously and pay due attention to their privacy policy.

Do we need Privacy policy even though we use Third Party Web Analytics Tool and they collect the data.

It does not matter who is collecting the data. The data is collected on your site and is collected on your behalf so you are responsible for clearly stating how you are collecting and using the data.
Those who use Google Analytics, need to be aware that Google Analytics requires such disclosures. Here is what Google Analytics states in its Terms of Service

You will have and abide by an appropriate privacy policy and will comply with all applicable laws relating to the collection of information from visitors to Your websites. You must post a privacy policy and that policy must provide notice of your use of a cookie that collects anonymous traffic data.

Tracking Personally Identifiable Data

In simple terms Personally Identifiable Information (PII) can identify a particular user, example last name, first name, email address etc. Most of the commercial Web Analytics Tools have the capability to track Personally Identifiable Information. In other tools such as Omniture, Webtrends etc. you can pass the personally identifiable information either via JavaScript variables or via importing an outside file which ties the anonymous cookie with identifiable information.
If you collect or track PII data then it becomes even more important that you disclose what information you are collecting or tracking and how you intend to use that information. Before you start collecting PII information, think hard what information you need and why you need it. Once you have figure out the information then make sure to fully disclose it on your site’s privacy policy.
I am a big supporter of giving users an opt-in option before using PII data for tracking and targeting. If you do decide that opt-in is not the right for your business model then at least provide an easy way for users to opt-out from being tracked and targeted using PII information.

Note: Google Analytics does not allow any Personally Identifiable information to be tracked via Google Analytics, period. Here is what Google Analytics Terms of Service says:

You will not (and will not allow any third party to) use the Service to track or collect personally identifiable information of Internet users, nor will You (or will You allow any third party to) associate any data gathered from Your website(s) (or such third parties' website(s)) with any personally identifying information from any source as part of Your use (or such third parties' use) of the Service.

Google Analytics even considers IP address as PII. It uses IP address to populate Geo Report but will not show IP address in any report. Other tools such as Omniture, WebTrends etc. can display IP and other PII data.

Optimization and Privacy

Most of the Optimization (A/B and Multivariate Testing) tools allow you to segment users based on IP, cookie or user provided data. For examples if you want to test a page on Males, age 35-45 from Redmond, WA, then you need to collect data from users so that you can create the right segment to test. However this type of data crosses the line of PII data, even though there could be thousands of users in that segment it can be used to identify a particular user. So make sure you are clear in your privacy policy that you might be (or are) using the data to test the optimal layout of the page and provide a better experience etc.

Examples of good privacy policies
Smart Money
Amazon.com
Proflowers.com

As marketers and web analysts lets do our part, let’s make sure to be clear and forthcoming in our privacy policies.


Also see Jim Stern’s view on giving users the control on privacy.

Questions? Comments?

--------------------------------------------------------------------------------
Site: AnilBatra.com

Twitter: http://www.twitter.com/anilbatra

--------------------------------------------------------------------------------
Looking to fill your Web Analytics or Online Marketing position? Try WebAnalytics Job Board

New Position

(Web Sales) Conversion Marketing Manager at Hewlett Packard (American Fork, UT)