Companies that market online are fighting a new standard, proposed last week by privacy advocates at a meeting in Washington, that would bar businesses owned by the same parent corporation from sharing customer information.
For example, the proposed rule would prevent See’s Candies and insurer Geico, both of which are owned by Berkshire Hathaway, from sharing customer data with one another. Online companies say the rule would upend routine business practices, and impose huge new costs, thereby harming Internet advertisers and customers.
The rules, proposed by the open source software project Mozilla, privacy advocate Electronic Frontier Foundation, and Jonathan Mayer, a researcher at Stanford University, surfaced at a meeting organized by the World Wide Web Consortium, a standard setting group.
At the same meeting Yahoo, Microsoft and the Digital Advertising Alliance, a coalition of dozens of the nation’s media and marketing trade associations–whose members range from Disney and Google to Kraft and GM–offered their own competing proposal. It is similar to the Mozilla proposal in many ways, allowing consumers to click on a button and opt out of having their information collected when they visit a website–but with one critical difference. It would allow businesses that are owned by the same parent to share the customer data that they do collect.
Yahoo said the plan, which it plans to implement on its sites this summer, would protect consumer privacy without imposing major new costs or limitations on business.
Participants from both industry and privacy groups say they hope to reach a compromise by the beginning of Summer, though hammering out details could take longer. President Obama and the Federal Trade Commission have come out in favor of a Do Not Track policy, putting pressure on the groups to reach a compromise before lawmakers can act.
Whatever the policy turns out to be, it will have a major impact on business. Internet advertising is vast and complex and cuts across the entire economy. Zenith Optimedia estimates the size of the market at $72 billion, including $25 billion in display ads, which tend to be used by large corporations.
Many businesses resist the idea of “silo-ing” customer data, in part because it would require massive IT retooling, and would be “incredibly, prohibitively expensive,” says Shane Wiley, vice-president of privacy and data management at Yahoo. He co-authored the rival proposal with policy specialists from companies such as Microsoft and Google.
“It would need to be a fairly absolute divide of the backend,” said Wiley. “Every single thing that happens in your backend, every data system, every script, all your reporting systems–nothing would be untouched.”
Mozilla’s proposed rule would leave companies with a way to bypass the requirements—but it would be an expensive dodge. They would be allowed to share customer data among various business units—and avoid a costly overhaul of IT—by using branding messages to make their various holdings and ownership structures clear to customers. For example, The Wall Street Journal would be allowed to share data with Fox News, both of which are owned by News Corp. as long as the web sites of both companies made their relationship clear, through co-branding.
As the W3C tried to reach consensus, the room often sounded like a yoga class. After each proposal was presented, participants were asked to hum if they were in favor of it. “It’s a way of getting a sense of where the group stands, without people having to raise their hands and explain themselves,” said John Simpson, an advocate for Consumer Watchdog, who supported the Mozilla proposal at last week’s meeting.
A proposal from an Apple representative, David Singer, received little humming. That’s because both privacy advocates and other industry representatives found little to love in the draft, which erased the “squirrely” distinction between companies that customers visit, and third-party advertisers. It also limited the data that any of them could collect. Apple declined to comment.
The Mozilla and Yahoo proposals won the most support. The Yahoo proposal differs sharply from Mozilla’s by allowing companies to share data across company affiliates, even if a user had clicked the Do Not Track button.
“The affiliate definition has a deep history and is very much part of corporate law,” said Wiley. His proposal would, however, prohibit advertisers from following and creating profiles of users as they move across the Internet.
Privacy activists say that’s not enough. They maintain that corporate structures are so complex, users have no way of knowing who is getting their data.
“If you go to See’s Candies the notion they could share your information with Geico because they’re both part of Berkshire Hathaway–it doesn’t make sense,” Simpson said. “There has to be a sense of fulfilling customer expectation, and there’s nothing that would prompt an average customer to [be aware] of such divergent lines of businesses.”
Another sticking point: Wiley says Do Not Track needs an exception that would allow marketers to record how many times a single user has seen a particular advertisement, known in the industry as frequency capping. Wiley says that repeatedly showing a customer the same ad, instead of serving up new ones, would annoy customers and be bad for business.
“When you go to Yahoo and see the same ad over and over, you might get upset with Yahoo … You might also turn off Do Not Track,” Wiley said. The Do Not Track rule also would create a problem for online companies such as Yahoo, because they would have difficulty proving they had honored their commitments to advertisers, to deliver a specific number of customer views.
Simpson, the privacy advocate, said he appreciates the dilemma, and that he would be open to an exception, if it limited how long marketers kept ad-view data. “I’m willing to explore proposals on how they will accomplish that,” Simpson said. “But so far I haven’t seen those.”
