January 26, 2010

Alan Chapell Goes Public on Privacy, Part 2



By Wendy McHale

We kicked off our 3-Part Series yesterday with Alan Chapell and his willingness to go public on privacy. Here it is for your reference, PART 1. Today, our conversation continues with Editor, Tim McHale as he gets Alan's thoughts on DoubleClick, BT and the FTC.

Tim: How involved should a company's corporate communications group be in order to avoid the whacking DoubleClick got? Should they have seen that coming? That was unfair. It had everyone in our industry captivated. I remember it was the first time the digital media business was challenged in one of its most vulnerable areas.

Alan: DoubleClick's privacy issue is still the most oft-referred to answer to any CEO's question - "why should I care about privacy." Managing the PR aspect of an alleged privacy gaffe or governmental investigation is vital. Oftentimes, a companies' internal PR team may be too myopic and/or lack the requite skill set to manage this process. Mark Naples at WIT Strategy is one of the few practitioners in that space who understands the privacy landscape, and who's built his business around anticipating such minefields.


Tim: I agree. Mark is great. World-class professional. What do you think of the media business today and that 80+% are controlled by less than a dozen companies around the globe?

Alan: I'm not sure where you got those percentages, but I would be very concerned by the prospect of having too much power focused in a limited portion of the online media marketplace. It wasn't a long term recipe for success for the auto industry - and it's an even worse recipe for interactive media.

Tim: Definitely, what did you take away from your experience working with Chrysler and GM that's relevant to your work in online media? How have things changed in privacy law since the work you performed for these two companies?

Alan: Good question. As part of my role as privacy ombudsman, I spent a fair amount of time in Court during both the GM and Chrysler proceedings. Mostly, I was waiting to share my findings with the judge. But as I watched the senior executives of both organizations testify, I began to really think about the significance of these events. Two of the largest economic engines of the past 50 years had been brought to their knees. And no matter how you slice it, that means that many good people will be out of work - and many others will lose their pensions, their health insurance. To say that this was a sad time is a gross understatement.


Tim: No doubt.

Alan: And I was also thinking - if not Chrysler and GM - who is going to be creating jobs over the NEXT 50 years? What companies are going to spark the next generation of economic growth? And being an interactive person, names like Google and Y! and Apple immediately comes to mind. And I'm sure there are other companies being started as we speak - that will come in and completely reinvent things, collectively creating millions of jobs as a result. That is, if we as an industry can do the right thing and demonstrates effective self-regulation. And if the good people in DC and at the State level can equally resist the temptation to fix something that simply isn't broken.

Tim: I never looked at it that way.

Alan: I keep referring to oligopolies, but I think that one of the primary takeaways in my recent experience is that consolidating power among a handful of giants isn't good. If history has taught us anything, this type of consolidation isn't good for innovation. It's not good for consumers. It's not good for democracy. And ultimately, it's not good for the creation of jobs and economic growth.

Tim: I think Jefferson and Hamilton, two people who never saw eye to eye on almost anything would agree here.

Alan: And then I think about Legislation, where the companies in possession of the resources to hire armies of lobbyists are able to exercise more influence in making law, to create "carve outs" to suit their own unique business models, and in some respects, to stifle competition. While I don't entirely discount the intentions of the market makers, if you don't think that there's a chess match going on under the guise of privacy, IP and regulatory matters, you're just not paying attention.

Tim: That's why the industry needs you. Is regulation coming this year? Will it be too weak or go overboard?

Alan: Overall, given what's gone on over the past few years in automotive, financial services and health care over the past few years - with all the work left to be done in those industries - with trillions of dollars of taxpayer money at stake - the idea of stifling one of the few sectors that is doing relatively well absent any demonstrated harm to consumers is, well.... puzzling.


Tim: Ya think? (Smiling)

Alan: On the Legislative side, it's difficult to predict. I'm confident that a bill will be drafted this year. Whether or not that bill will have enough support to make it out of committee, or whether such a bill make it all the way to the President's desk has a lot to do with our industries response to the Government's call to self-regulate. If our response to that call is viewed as weak, I think a privacy bill will have a lot more support, and is more likely to pass. If our response to Government's call on self-regulation is strong, I think support for a bill is significantly diminished. In any event, all indications coming from Washington indicate a significantly more activist FTC, and I'm confident that you'll see additional enforcement actions in the upcoming months.

Tim: You will hopefully share your thoughts on it as it begins to be enforced. How did the laws surrounding privacy change from before to after Doubleclick's acquisition of abacus? Is this the second major case that privacy has been a key driver in a company's practices since DoubleClick/Abacus?

Alan: One positive thing that came as a result of the DCLK / Abacus privacy issue was the emergence of the Network Advertising Initiative. The NAI is a trade association that I've been affiliated with for several years - one that has established standards for (as broadly defined) behavioral marketing.

Tim: Going back a couple of months what was your reaction of Eric Schmidt's resignation from the Apple Computer board? Wasn't that due to a company's right to have corporate secrecy? Did he resign due to any self-regulating corporate policies or due to some SEC issue with regard to protecting shareholder rights?

Alan: I think the larger reason for his resignation is that Google and Apple are increasingly going head to head against each other.

Tim: When I think of behavioral targeting, I still think of Tacoda and Revenue (now Audience) Science. How has the BT landscape changed over the past five years?

Alan: Perhaps the starkest change in BT is the number of entities - at a number of different entry points within the ecosystem - that have entered the BT space. With Adobe, Quantcast, ad agencies and even offline data companies looking to participate, the funnel has flipped. We're now at the point where one might ask - who ISN'T looking to participate in the data economy.

Tim: Who owns the data in theory and in reality?

Alan: I believe that many in the advertising chain have an argument to be made that they own - or at least have some rights to - the data. The publishers believe that they own the audience and, by extension, the data that pertains to their audience. I think publishers are terrified by the prospect of de-coupling audience from advertising - and rightly so.


Tim: I bet.

Alan: Advertisers, ad networks, behavioral vendors, agencies, and even ISPs all have their arguments to make about data ownership. I've worked with a number of different constituencies, and I remain fairly agnostic. The larger issue for me is ensuring transparency.

Tim: Okay.

Alan: I think consumers have a legitimate argument that they own their data. Unfortunately, if you think about the history of the old school direct marketing world, that really hasn't been the case. Consumer data has been routinely collected and transferred around the globe with or without consumer consent. Some consumers have routinely taken steps to control that data - as witnessed by those who pay extra to be de-listed from the phone book. But for every person that delists themselves from the phone book, there seems to be ten more that put everything out there on Facebook for the whole world to see. And I think that speaks to the myriad of attitudes that consumers express when it comes to privacy.

Tim: It's an issue that cuts across the entire net.

Alan: I believe that consumers have rights to own their information, but I don't think ANYBODY has quite figured out what that means yet. Consumer privacy rights should be thought about on a sliding scale. So that my rights to my credit card, social security or driver's license numbers is broader than my right to my telephone number, email and postal address. And I don't believe that it's practical to expect that my rights to information that doesn't identify me personally should be the same as my rights to exercise control over my credit card information.

Tim: Wow.

Alan: What makes this challenging is that technology continues to blur the line between what is personally identifiable, what is quasi-personally identifiable, and what is non-personally identifiable.

Tim: Right.

Alan: Part of what I think gets lost in the privacy debate - at least as it pertains to interactive media - is the notion that data is subsidizing free content. And I think that the industry in generally hasn't done a great job in making this tradeoff clear to consumers.

Tim: No, we haven't.

Alan: To be clear - I don't believe that anyone thinks its fair for consumers to get free content without ads. There are real costs around creating content, and unless consumers are willing to pay for it, then I think they need to accept some ads. And nobody - not content creators, advertisers, and certainly not consumers - want too many ads. The issue is defining "how many" ads are too many. Data can be the answer here. If data can be used to help keep the number of ads to a minimum, that's certainly a positive thing. And in that respect, data can act as a subsidy for both free content and fewer ads.

Tim: I agree but I'm not sure everyone else would.

Alan: That's an issue. I believe that we sometimes under estimate consumer understanding of these issues. It would be interesting for someone to conduct research on consumer attitudes toward the tradeoff of paying for content vs. targeting. To what extent consumers understand that some of their clicks are used by those other than the website they are currently surfing. Perhaps something that asks how many people are willing to pay for their content if the targeting subsidy is taken away.


Tim: How wide-spread is privacy pushed back to the end of the line in terms of corporate compliance? Are the lines still blurry? As compared to Chrysler and GM, isn't Google an equal player in monetizing BT as these companies are?

Alan: Yes - Google is absolutely involved here. And their voice will continue to get louder.

Tim: What do you think of co-reg programs who incentivize consumers to sign their privacy issues away in return for some immediate benefit?

Alan: To my earlier comment paraphrasing a friend, Many consumers will give their mother's social security number away for five cents off of a BIG MAC. And while I personally would not do that, I'm really uncomfortable with the concept of prohibiting other people from making that bargain - so long as the essence of the bargain is disclosed in a way that consumers can understand it.

Tim: Of course.

Alan: The problem historically with some, though certainly not all of the performance marketing programs is that they were rife with fraud. Confusing, conflicting terms - or no terms visible at all. Some of the things I saw in the ring tone space a few years ago were an embarrassment to our industry. The IAB, the MMA and Performance Marketing Alliance (along with a few notable FTC and state enforcement actions) have gone a long way towards cleaning that space up.

Tim: That's good to hear.

Alan: It's also worth noting that the performance marketing space is famous for privacy policies that read like a Tolstoy novel. I do this for a living, and some of those policies I can barely make heads or tails of. I would strongly encourage anyone writing a privacy policy to do their best to communicate in clear, simple English.

Tim: LOL! Do you know of anyone who has ever written the "Terms & Conditions" that we automatically must click on "I agree" before interacting with some sort of tech download of digital action?

Alan: I know many people - myself included - who have written terms and conditions. Unfortunately, few consumers read them. And that's their right. One thing that's really important to point out is that there are certain functionalities that are so important that they can't be buried in the terms and conditions.


Tim: Like what?

Alan: Well, for example, if you're going to charge me $10 per month for the use of your software, you can't bury that in your t/c's. Similarly, if you're going to be collecting every URL that I visit, you need to communicate that outside of the terms and conditions per some recent FTC decisions, not to mention the recent IAB / AAAA / DMA behavioral code and the recent standards espoused by Congressman Boucher.

Tim: Are most "terms and conditions" the same for every company?

Alan: There are certainly provisions that are common to many terms and conditions. And the way our legal system functions, there are certain provisions that need to be included in terms and conditions in order for the company offering them to adequately protect its rights. Privacy policies and terms and conditions are considered legal documents. And as a result, both are written like, well... legal documents.

Tim: For sure.

Alan: There are a couple of groups making the rounds in privacy circles - talking about abbreviated or "short-form" privacy notices. The idea makes a lot of sense conceptually.

Tim: Interesting. I have to think about how I feel about that. While consumers may see their privacy invaded, they still benefit by Amazon-like business rules "people who bought that buy..." Do companies regularly promote their privacy issues to investors as a sign that the company is well run?

Alan: While I think Amazon's "people who bought that buy" is extremely beneficial, I think that's only the tip of the iceberg. Consumers see significant benefit as a result of the data practices of the online media industry. Consumers receive free content. And that free content isn't paid for with advertising; it's paid for with TARGETED advertising. Ask yourself, Tim - how much is an ad impression on Madison Avenue Journal worth to you? How much would that same ad impression be worth if you were no longer able to offer frequency caps to your advertisers?

Tim: Good question. Not my in my editor's job description! That's the sales group's problem.

Alan: LOL!

Tim: Question, other than firing someone what actions do companies take proactively or by law against individuals who are caught breaking privacy rules/laws? Isn't this an embarrassing issue that could unfairly detract from a company's reputation, particularly due to the fact that their uncovering of privacy invasions is actually a sign of their diligence?

Alan: The lack of accountability - even at executive levels isn't limited to the interactive space.

Tim: Good point. You mention Tacoda and Revenue Science, but aren't companies like Epsilon and Datran potentially equally capable of monetizing BT?


Alan: Yes, and I think you're going to continue seeing more companies enter the BT (broadly defined) space. In the case of the offline data providers, they need to ensure their businesses follow consumers - not to mention the advertising dollars.

Tim: I agree.

Alan: The tricky thing for some of the offline data companies - is that some of them don't fully appreciate the regulatory differences inherent in the online media world. In the offline world, one could collect data, and use it (with a few limitations such as the Telemarketing Sales Rule and DMA guidelines) in just about any way one wants to. And one can essentially transfer whatever data you collect repeatedly to just about anyone you want.

Tim: Right.

Alan: Contrast that with the online world, where there are pretty strict rules around data usage and privacy. And many who come from the offline world don't necessarily appreciate those rules. I've had offline DM folks tell me that because they are compliant with Can-Spam, they can do whatever they want with the data. And that's a recipe for a regulatory incident.

Tim: For sure. I keep reading about the FTC - both at the Commissioner level and the staff level - really pushing the industry to change its policies and to "get serious about self-regulation." with an implied (if not overt) message of "Or else." What does the industry need to do in order to avoid the "or else", when does it need to happen, and what will happen if (in the FTC's view) the industry hasn't done enough?

Alan: Commissioner Leibowitz and what seems like the entire Commission has made it abundantly clear that we as an industry are down to our last strike when it comes to self-regulation. For example, Mr. Vladek (the FTC's new head of Consumer Protection) has signaled a huge shift in the commission's perspective. The most significant is the notion that government should be addressing certain harms of personal dignity - and that the collection of non-personally identifiable data may, under certain circumstances, may rise to that level of harm.

Tim: You've mentioned that privacy has often been used as a "red herring." Can you explain what you mean by that?

Alan: Over the course of the past few years, privacy has been used as way to rally support against disruptive business models. If someone comes up with a business model that puts yours at risk, it's much easier to jump up and down about privacy - as that gets the blood flowing, as they say - than it is to openly state that such a business model might put you model in serious jeopardy. I'm not here to praise nor bury ISP BT, for example.

Tim: Okay.

Alan: I did some work years ago for Phorm and NebuAd, but I've also work with lots of other in the space. Terms like "Deep Packet Inspection" while technically accurate are also politically charged- akin to the term "Community Organizer."

Tim: That's funny.

Alan: The issue I have with the use of privacy in this manner is that it impacts us all downstream. We're in one of the few industries that seems to go out of its way to bash each other in front of legislators and regulators. And we wonder why some of them feel that there is some egregious injury of dignity that they need to prevent.


MACVIDEONY Creative Work

Hey Google, Save the Curbs

Next-Gen Mobile Carrier: Magee

Sarah Fay in wwwLand, Parts 1 thru 3.

Alan Chapell Goes Public on Privacy, Parts 1-3.

800 lb Gorilla Fandango Makes Noise at App Planet

Agency Rich Media Lovers Boogie as Palm Gets "Flash-y"

Churchill @ the Mobile UpFront

Google's Buzz Gets Stoned @ the WMC

Don't Go Into the Bathroom!