Privacy Gourmet

Communicating about privacy and data use to web surfers in the United Kingdom

In June, AOL conducted a survey of a thousand internet users in the United Kingdom to better understand the best way to communicate about privacy and explain online data use.

Here are the questions and results:

Q1. Before today, how familiar were you about behavioral advertising?

	UK
Very familiar	13%
Somewhat familiar	39%
Not too familiar	29%
Not at all familiar	19%

Base 1001

Q2. Do you typically read privacy policies online to understand what information a website collects and how they plan to use that data?

	UK
Yes	38%
No	61%

Base 1001

                              

Q3. Typically, how useful is the information?

	UK
Very useful	15%
Somewhat useful	58%
Not too useful	24%
Not at all useful	3%

Base 379

Q4. Typically, how easy is the information to understand?

	UK
Very easy	9%
Somewhat easy	41%
Not too easy	42%
Not at all easy	8%

Base 379

Q5. Why do you not read privacy policies? (Select all that apply)

Q5. On the occasions you do not read privacy policies, why do you not read them? (Select all that apply)

	UK
Just don’t care	6%
Takes too long	51%
Too much “legalese” or jargon	53%
Interrupts what I am trying to do online	30%
Other	5%

Base 1001

Q6. Assuming you wanted to find information about how a site uses the data they collect for behavioral advertising….

	Very helpful	Somewhat helpful	Not too helpful	Not helpful at all
Video of someone explaining behavioral advertising	25%	39%	23%	13%
An animated story or cartoon explaining behavioral advertising	21%	40%	25%	14%
A paragraph describing behavioral advertising	35%	42%	17%	6%
Diagrams of how behavioral advertising works	33%	44%	17%	7%

Base 1001

Q7. If a site offered information about behavioral advertising, would you stop what you were doing online to learn more about behavioral advertising?

	UK
Yes, but only a brief glance	47%
Yes, I would spend time reviewing the information available	24%
No, I wouldn’t stop what I am doing	30%

Base 1001

Q8. How important is it to you personally to get information on each of the following?

	T2B	B2B
Whether information includes your name or is anonymous	80%	2%
The sensitivity of the data collected	79%	2%
The types of data shared across websites	65%	3%
Being able to opt out of sharing my data across websites	83%	3%
How cookies or other technologies are used	43%	5%
Explaining how behavioral advertising works	33%	6%
Benefits of advertising being tailored	23%	13%
Privacy issues with targeting ads	53%	5%
Security process for the data collected	70%	3%
How long the data about you is stored and used	64%	4%

Base 1001

Q9/Q10. Out of the list below which is the most important/ the second most important piece of information a site can tell you about behavioral advertising?

	UK
Whether information includes your name or is anonymous	59%
The sensitivity of the data collected	37%
The types of data shared across the websites	11%
Being able to opt out of sharing my data across websites	42%
How cookies or other technologies are used	9%
Explaining how behavioral advertising works	3%
Benefits of advertising being tailored	1%
Privacy issues with targeting ads	7%
Security process for the data collected	27%
How long the data about you is stored and used	12%

Base 1001

Q11. What other information should a site tell you about behavioral advertising? (open ended)

Q12. If you were looking for more information about behavioral advertising, which one would you most likely click on for information? (Select one)

	UK
A banner ad	15%
Link to a privacy policy	19%
Help link	18%
Link to a government website	18%
Link to industry website	4%
Don’t know/ Not sure	25%

Base 1001

Q13.  If you saw one of the messages below on a banner ad, how likely are you to click to find out more information about behavioral advertising? 

	Very likely	Somewhat likely	Not too likely	Not Likely at all
Banner ad that says “Privacy”	13%	55%	23%	9%
Banner ad referring to how advertising works at this site	25%	40%	36%	5%
Banner ad saying “Important Privacy Notice”	57%	29%	8%	7%

      Base 152

So What Do These Behavioral Profiles Look Like?

Here on the TACODA Web site is a list of many of the behavorial profiles that advertisers can seek to reach.  As our animated penguin explains, these are developed when consumers visit Web sites that have code on them that results in information about the site and the consumer's cookie being sent to TACODA.  Those sites are required by contract with TACODA to have a privacy policy explaining this data use and a link to allow consumers to opt-out.

Listed are many of the segments of greatest interest to marketers.  There are many many more and I am working on assembling a more complete list to post and to increase transparency in this area.

Behavioral Targeting Rules Updated

The Network Advertising Initiative, a self-regulatory group for ad networks that do behavioral targeting, has just finalized updated rules for companies that tailor ads across a network of sites.  AOL's ad networks, Advertising.com and TACODA, are part of our Platform A advertising division and offer advertisers the opportunity to have their ads delivered to consumers who have been to auto sites or other types of sites in their networks.  These ad networks are members of the NAI and their privacy leads, Ho Shin and Khan Smith, worked closely with me to help the NAI update the standards and close some important gaps.  I was part of the group that drafted the initial set of rules, about 7 years ago when I was Chief Privacy Officer at DoubleClick and I have to admit that they had grown stale and needed to catch up to the current marketplace.  It took some urging by the Federal Trade Commission to get companies moving on this and there is more to do, but this was a big step forward.

The most important advance is that the rules now clearly limit ad networks from creating a "clickstream profile" that represents a sensitive category such as cancer, HIV or other sensitive health categories, unless a user explicitly opts-in.  This was in the old rules - but only if the profile was personal.  The new rules restrict such activity even when the ad is targeted based solely on cookie linked information, without a name attached to the profile.  Also covered are areas like sexual behavior/orientation/identity, mental illness, sexually related conditions, abortion related and more.  And since children can't consent to data sharing, an ad network kids profile isn't permitted, even on an opt-in basis.

AOL, Advertising.com and TACODA have for quite some time enforced a similar internal policy, considering it inappropriate to use these types of categories to tailor an ad on one Web site based on a consumers visit to another.  We are pleased to see all the major portals and ad networks coalescing around this.

Another key point in the new rules is a restriction against using a clickstream profile for a non-marketing use.  This means that the data can be used to help deliver an ad for a motorcycle to a biker, but that profile may not be used by an insurance company to turn them down for a policy.  I am not aware of anyone in the industry doing anything of the sort, but I have often seen speculation from critics that such could occur.  Hopefully this should put those concerns to rest.

I will post more on the NAI rules in the future, but one last area that should be cleared up by the rules is regarding the use of flash cookies for tracking.  HTTP cookies, with all their frailties, are subject to many controls.  You can block them with your browser settings, remove them with an anti-spyware program, or overwrite them with an opt-out cookie. In fact, your browser will only hold so many cookies, and then they will be overwritten.  Flash cookies are very useful to allow an application to remember your settings, or for example to save your high score for an online game.  But since they are not as well known, they are not as easy for consumers to delete or control with browser settings as are HTTP cookies.  My opinion is that it is not a good practice to use a Flash cookie to create an ad network behavioral profile.  The new NAI document makes it clear that the requirements are technology neutral. All Web sites that share data for behavioral targeting need to provide a link to an easy to use opt-out  - and if you can't do that with a flash cookie, then you shouldn't use it for tracking.  I do note that Macromedia has more recently built additional settings that allow some user control of flash cookies, but I agree with the concerns of privacy experts at the Center for Democracy and Technology on this one.

Jules