Online privacy

The recent subpoenas of search engine records has restarted the discussion over internet privacy.

One of the least surprising aspects of this discussion is the lack of public knowledge about their lack of privacy on many internet services. For example, a recent survey found that 77% of Google users don’t know that Google stores personal information about them. From the article:

Google maintains a lifetime cookie that expires in 2038, and records the user’s IP address. But more recently it has begun to integrate services which record the user’s personal search history, email, shopping habits, and social contacts. After first promising not to tie its email service to its search service, Google went ahead and opted its users in anyway. It’s all part of CEO Eric Schmidt’s promise to create a “Google that knows more about you”.

That’s a big problem. It is clear why Google is resisting the subpoenas. I am sure Google is in part motivated by some altruistic desire to protect people’s privacy. However, a large part of this, I would bet, is driven by the realization that if consumers don’t even know data is being collected, seeing you willingly turn it over to people has the potential to cause a huge backlash. In other words, it is damage control or prevention, depending on how you think about it.

The real danger in all of this, I think, is the impact on behavioral targeting. I have believed for a while that behavioral targeting is doomed in the long run, because of the tactics that have been historically employed to gather the information. If a well known company like Google can collect personal data without the majority of their users realizing it, imagine how many of the “adware” companies truly have consumer buy-in. My guess – not very many.

Until we have a real opt-in system, one in which consumer privacy comes first, in which there is full disclosure it will be a dangerous area for large brand advertisers.

This a dangerous area for brand advertisers, the ones who will fuel online advertising growth. Nobody wants to be associated with large consumer backlashes. They are bad for the brand, and bad for the business. And behavioral targeting, in my opinion, presents too great a PR risk at the present time.

The solution is a real opt-in system, in which there is full disclosure of what is being collected, full ability to edit or restrict the collected information, and complete trust that the terms and conditions will not change at a later date. John Battelle today called for something similar, namely:

- Access to a record of all the information they keep on us and how they use it
- The ability to challenge that data’s accuracy, and edit it for accuracy
- The ability to opt out (with a clear understanding of the resulting loss of services and opportunities that might result)
- The ability to set permissions as to who else might see the data
- The right to maintain a user copy of that data for archival purposes
- The right to share in the value of that data on negotiated terms

Amen.

Only when that type of solution is available will brand advertisers truly be safe playing in the “behavioral” realm. The first companies that get there will find a receptive audience ready to spend.