Online Profiling the Extensive Collection,

Online Profiling

The extensive collection, sharing and exchange of information between online companies to create profiles of individuals have become a major concern for privacy advocates. They do not believe online profiling it is a fair practice because many consumers have no idea that information is being collected or that a cookie is downloaded to their computers. The majority of the public doesn't object to online profiling provided that there are benefits for them and that online profilers take steps to prevent abuse. However, they don't believe this is happening and that there are just as many concerns as there are benefits. Despite these worries, online profiling practices remain self-regulated by fairly weak provisions that receive a low level of compliance by businesses. For all these reasons, the rules of engagement for online profiling should be both strengthened and regulated.

This won't necessarily end the ability of businesses to create targeted marketing campaigns online because customers want personalization as long as their privacy is respected and their information is properly safeguraded. Opt-in strategies hold great promise for meeting these needs.

Online Profiling Defined

Online profiling may involve the collection of anonymous transactional data and it may also involve the merger of this click stream data with personally identifiable information such as name, address, telephone number, credit card number, social security number, email address, etc. (Sax, 1999) click stream is the sequence of clicks or pages requested as a visitor explores a Web site. The click stream data collected may include information such as Web sites and Web pages visited, the time and duration of the visit, search terms typed in search engines' forms, and other queries, purchases, "click through" responses to advertisements, and the previous page visited (Mulligan, 1999).

There are essentially three major types of online profiling (Mulligan, 1999). Web sites or Internet service providers collect information from users -- information provided directly by the individual and click stream data. This data may be captured for a limited session or may be collected and maintained as an ongoing profile of the user. It may be directly tied to a unique user, to a pseudonym or to a specific, named user. Data is also captured by third parties known as advertising networks. With the permission of the Web site, but not the individual, advertising networks place unique identifiers on individuals' computers called cookies. These cookies are then used to track the individual as they surf the Web. The individual's profile grows with time through the continuous collection of online behavior. A profile may be supplemented with "inferential" or "psychographic" data -- information that the business infers about the individual based on the behavioral data captured. From this comprehensive profile, advertisers may form sophisticated inferences including the individual's interests, habits, associations, and other traits.

Privacy Concerns

Online profiling objections essentially break down into three primary categories of privacy concerns:

Invisibility: The consumer is not necessarily aware of the collection of personal information through click stream technology (Clickstream concerns). Eighty percent of the companies that allow third parties to place cookies on user computers don't disclose this practice to users. Unless the user's browser is specially configured to warn the user about cookies, they work behind the scenes without the user's consent. Opt-out options to protect the consumer's right to privacy are insufficient because the user never even realizes what is happening.

Ubiquity: Advertising networks monitor individuals across a multitude of seemingly unrelated Web sites and over an indefinite period of time (Online profiling: Benefits and concerns, 2000). The accumulation over time of vast numbers of minor details about an individual produces a portrait that is quite comprehensive and, to many, inherently intrusive.

Invasion: With the use of cookies, web servers invade the user's client hard disk by storing files on it (Clickstream concerns). The invasion is, thus, not limited to just an attack on personal privacy, but it is a physical covert invasion on the user's personal property.

Public Perception

Taylor (2003) summarizes a Harris Poll on consumer privacy which reveals that there are three segments of consumers who hold different views on privacy. On the far extremes are privacy fundamentals who feel very strongly about privacy and are resistance to any further erosion of it and privacy unconcerned individuals who have few concerns about privacy and how organizations are collecting and using information about them.

Privacy fundamentalists are about twenty-six percent of all adults while the privacy unconcerned people are about ten percent. In the middle grounds are privacy pragmatists who make up sixty-four percent of adults and have strong feelings about privacy and protecting themselves from the misuse of personal information. Even so, they are willing to allow organizations to have access to and use of their personal information if the pragmatists understand the reasons for its use and see the benefits as long as the appropriate measures to prevent misuse of their information are taken. Further results from the Harris Poll (Taylor, 2003) show that:

Sixty-nine percent of adults agree, "consumers have lost all control over how personal information is collected and used by companies."

Fifty-four percent of the public disagree that "most businesses handle the personal information they collect about consumers in a proper and confidential way."

Fifty-three percent of all adults disagree that "existing laws and organizational practices provide a reasonable level of protection for consumer privacy today."

Seventy-six percent of the public feel that being able to share confidential matter with someone the trust is extremely important.

Seventy-three percent of adults feel that not having someone watch them or listen to them without their permission is extremely important.

A large number of other surveys also show that online privacy is a very sensitive issue for consumers (Why business cannot afford to disregard consumer privacy concerns):

2000 survey by Forrester Research concluded that two-thirds of the respondents were concerned about Internet privacy survey by Odyssey, a San Francisco-based research firm, reported that ninety-two percent of respondents do not trust companies to keep personal information confidential.

"1999 at&T Study," revealed that eighty-seven percent of experienced Internet users were concerned about threats to their privacy online.

1998 Business Week/Harris Poll indicated that privacy was the number one reason why individuals stay off the Internet.

1998 Harris survey disclosed that over ninety percent of Internet users and felt that it was important for Internet sites to post privacy policies.

Benefits and Concerns

Supporters of online profiling say that profiling is nothing new; offline advertising and promotions have long been based on profiles of the target audience in terms of the media they read or view, their purchasing habits and other socio-economic information (Arnis, 2000). Therefore, online profiling advocates contend that online advertising and marketers are merely demanding the same rights as already allowed offline. Further, they contend there will be even fewer problems with online profiling because it is more accurate and requires less customer effort.

The benefits of online profiling for marketers are well-known. They commonly use online profiling to (Suchet, 2004):

Record user information over time and sessions to continually enrich knowledge about the customer.

Know referral sources: where the users came from and how they arrived at the Web site.

Track behavior: frequency of online visits, sections/product categories visited, products viewed, and exit points.

Request personal information: name, contact info, and demographics.

Maintain full online purchase history and ry to combine it with offline information.

Know responsiveness to online and email offers.

All these activities make it easier and more affordable for businesses to target consumers who are likely to buy their products. Some claim that these same benefits accrue to the consumer because they only receive offers and information about goods and services in which they are interested in buying. Additionally, targeted advertising is claimed to help to subsidize free content on the Internet (Online profiling: Benefits and concerns, 2000).

However, there is just as much concern that business will use information that know about consumers to create unethical selling advantages. For example, using "first degree" price discrimination, a company can determine the maximum that an individual is willing to pay for a product, and engage in "dynamic" pricing (Report: Consumers vulnerable to profiling, price discrimination, 2005). This practice helps sellers to offer the same products at the same time to different people at different prices. Dynamic pricing becomes easier in online environments where users are tracked by registration data and cookies. A similar concept is already being commonly implemented by online profilers who offer rewards or incentives to consumers who are abandoning their shopping carts (Privacy & online politics: Is online profiling doing more harm than good for citizens in our political system?).

Further, online profilers aren't restricted to just understanding their customer's shopping habits. Their online profiles can determine sensitive information such as a customer's political and religious views, sexual orientation or medical condition. This information can then be shared and sold without the knowledge or consent of customers (Thibodeau, 2000).

Self-Regulation

Eight of the leading Internet advertising networks (24/7 Media, AdForce, AdKnowledge, Avenue a, Burst! Media, DoubleClick, Engage and MatchLogic) formed the Network Advertising Initiative (NAI) to develop a framework for self-regulation of the online profiling industry. They worked with the FTC to define the following four Fair Information Practices, rules designed to prevent companies from abusing the information they receive through online profiling (Computer law tip of the week, 2000):

Rule 1 (Notice): A company must notify customers that it uses online profiling to track their online habits. If it collects personally identifiable information about customers, such as their names, addresses or telephone numbers, the company's website must clearly and unambiguously notify them of this fact before the company collects this information.

Rule 2 (Choice): Depending on the type of information a company collects, there must be opt-in and opt-out options. Opt-in, or obtaining the customer's permission, is required to link personally identifiable information that a company has about a customer such as name, address or telephone number with data acquired about Web surfing habits. Opt-out means that the customers have to be given the chance to say no, but they don't have to explicitly agree. Opt-out is required when merging non-personal data about customers.

Rule 3 (Access): Customers must have reasonable access to personally identifiable information that a company keeps about them for profiling.

Rule 4 (Security): A company must make reasonable efforts to protect the data it collects for profiling purposes from loss, misuse, alteration and improper access.

Compliance with Self-Regulation

According to the Federal Trade Commission (FTC), NAI's membership constitutes over ninety percent of the network advertising industry in terms of revenue and ads served. Therefore, the FTC has concluded that legislation is required to bring the remaining ten percent of the industry in compliance with NAI rules of online profiling conduct. Further, the FTC states that:

Self-regulation cannot address recalcitrant and bad actors, new entrants to the market, and drop-outs from the self-regulatory program. In addition, there are unavoidable gaps in the network advertising companies' ability to require host Web sites to post notices about profiling, namely Web sites that do not directly contract with the network advertisers; only legislation can guarantee that notice and choice are always provided in the place and at the time consumers need them." (Online profiling: a report to Congress, 2000).

Still, others argue that self-regulation is largely ignored not just by a few bad actors, but that the majority of companies fail to fully comply with NAI standards (Berman, 2000). There has definitely been an increase in the number of companies including a privacy policy on their Web site, rising from two percent in 1998 to sixty-two percent in 2000 after the NAI's guidelines were released. and, in 1998, only fourteen percent of surveyed sites made any statement about their use of personal information. This number grew to seventy-nine percent in 2000. but, the number of companies meeting all NAI standards was only twenty percent in 2000. Critics charge that all the NAI has accomplished is making businesses appear that they are doing something about privacy issues to appease an increasingly outraged public and to stave off meaningful legislation.