Sunday, September 25, 2005

Cookie News: Will you pay me to stop deleting my cookies?

Last night someone in the Web Analytics Forum posted a comparison of browser cookies and RFID devices based on their read of this post in Wired. I thought the post was particularly well written and it got me thinking about the missing piece of the puzzle, incentive.

In the Wired post, Bruce Sterling speculates that consumers will fear RFIDs because they're technologically complex and their use is obscured to the consumer. Sound familiar? It's basically people's complaint about cookies. Consumers simply don't understand what cookies are for and failing to derive any direct, tangible value from their use, they "vote" against cookies and remove them from their computers.

This reminded me of Walt Mossberg's rant on the subject in which he was making the case that cookies fit the definition of spyware. While many disagree with his central thesis, Walt said one thing that seemed kind of crazy at the time but appears less-so with every passing day:

"Rather than trying to legitimize tracking cookies with pressure and marketing campaigns, I suggest that, if they really believe tracking cookies are legitimate, the companies that use them simply go straight. They should ask a user's permission to install the cookies, pointing out whatever user benefits they believe the cookies provide. They might even offer users compensation for allowing tracking cookies on their machines."

I gleefully allow my grocer to compile data about my culinary preferences in exchange for a small discount on some purchases, I happily allow my credit card agency to track my buying habits in exchange for the ability to defer purchases and I enthusiastically provide the airlines insight into my travel patterns in exchange for the occassional upgrade or free flight. But what do I ** personally ** get in exchange for accepting browser cookies?

Nothing.

While I'm sure everyone would blanch at the prospect of being asked about accepting cookies at every site one visits (try it, it's painful) the notion that sites could provide incentive to consumers who keep their cookies is not that bad an idea. Cookies could be spun up as the "new loyalty card" and consumers could gain benefits as their cookies progressively age (e.g., are not somehow deleted.)

Site operators may want to consider how they can provide incremental value to consumers who opt to keep their specific cookies in their browsers. Assuming the use of first-party cookies, confirming the age of cookies is trivial from a technical standpoint. Sites could offer additional access/value/savings to their site visitors as they're able to confirm a long-standing relationship with said visitor. Considering this would help sites determine the actual value of cookies to the site, forcing the site to answer the question "How much are we willing to give consumers who keep our cookies?"

Retail sites could offer free shipping to "loyal" customers (as tracked by cookies), media properties could offer access to more/better/unique content for "loyal" visitors and marketing sites could make promotions available to prospects who keep their cookies. Cookies would develop a new, positive buzz in the consumer market. Average people would proactively switch to anti-spyware applications that don't delete cookies. Analytics measurement and advertising tracking would improve and consumers would feel like they were getting something of value out of the arrangement.

Cookies would be saved.

I welcome your thoughts on the subject

Friday, September 23, 2005

Give Consumers a Choice

COOKIES, AND BY DEFAULT THE online advertising industry, have taken their share of punches lately. Industry trade publications and mainstream media outlets have written endlessly about reports that show large numbers of consumers are routinely deleting cookies from their computers. Then Walt Mossberg, one of the most well respected technology reporters in the country, weighed in via his Wall Street Journal column and registered his strong dislike for what he calls "tracking" cookies.

As Dave Morgan pointed out in his MediaPost column, our industry has to work on educating consumers about the need for and benefits derived from cookies. Consumers need to understand that an Internet without a cookie-enabled targeted advertising model will inevitably lead to more and more content accessible only by subscription or micro-payments.

I would, contend, however, that changing and altering consumer knowledge is an expensive and lengthy proposition. We could spend inordinate amounts of time, energy, and money, and barely move the needle on consumer perception of cookies. Lowest-common-denominator reporting in national broadcast media only makes this challenge more imposing. Cookies are inaccurately lumped into much larger articles that I would describe as sensationalized, Internet scare stories: "Beware of cookies. Marketers are watching you," etc.

As an industry, we need to provide consumers with an informed choice -- to opt-out of cookies. I would further argue that this choice shouldn't be buried deep within an ad network's site or privacy policy, but should be offered to consumers within every single ad that we serve them. Anti-spyware companies, which have a huge impact on the cookie deletion rate, also need to give consumers an informed choice. Currently some of those software programs label most third-party cookies as potential threats. Anti-spyware companies don't offer consumers the information that they need to make an informed choice about deleting cookies. Following the labeling of third-party cookies as threats, most consumers delete them without knowing how this practice affects their online experience.

Why won't anti-spyware companies give consumers more information so they can make an educated choice about which cookies to delete? The reason for this is clear: it's currently in the economic interest of anti-spyware companies to demonize cookies as harmful. With many spyware and adware companies changing their policies and business models in the face of pending legislation, the rationale for anti-spyware software has begun to fade. The response of anti-spyware companies has been to attempt to prove the usefulness of their software by labeling and defining cookies as harmful threats.

If the online ad industry were to adopt a strong opt-out policy and give consumers a choice regarding third-party cookies, it would create a stronger argument for anti-spyware companies to stop labeling third-party cookies as threats. If we, as an industry, give consumers a choice at every opportunity to opt-out from third-party cookies, the vendors of anti-spyware software will no longer have a legitimate or logical argument for labeling these cookies as threats.

When anti-spyware companies refuse to provide consumers with specific information about cookies, they do consumers a disservice by erasing cookies that are used to identify consumers who have opted out. Imagine the following scenario after we enable cookie opt-out directly from our banners: Angry consumers will contact ad networks or other companies that employ behavioral targeting technology to find out why they are still receiving targeted ads after opting-out. When that happens, we'll explain to consumers that their anti-spy software deleted the opt-out cookie without informing them which cookies correlate with each ad. Consumers will quickly learn that it's better not to erase cookies using their anti-spyware software or browsers, but instead to opt-out only from the ads they find offensive by using the opt-out links within the ads while leaving the other cookies untouched.

As an industry we claim that we provide consumers with a service. If we really believe in the service that we're providing, we should also allow consumers who don't like our service to opt-out.

Thursday, September 22, 2005

Brad Berens chats with Safecount board member Mike Zeman about the fight to save cookies.

Safecount board member Mike Zeman is the director of insights and analytics for Starcom IP. In this role, he oversees the consumer insight and accountability research initiatives of all Starcom IP clients, which include Allstate, Kellogg's, Miller Brewing, Morgan Stanley/Discover Card and the U.S. Army. In addition to client-specific research, the insights and analytics function is also charged with the ideation and development of Starcom IP proprietary resources and tools.

iMedia: Let's start with the basics: we covered the launch of Safecount back in April, and then you named a board of directors in June. Now, six months post-launch, how would you describe Safecount? What is its mission? Who are its members? And, more generally, does the membership slant toward a particular population of agencies, publishers or vendors?

Mike Zeman: Safecount's mission remains the same as it was at inception, which I think is critically important. We must not lose focus of the task at hand which, both simply and complicatedly, is to enable a set of online measurement protocols that consumers can not only live with, but also appreciate and benefit from.

Certainly many of the folks in our industry and beyond have a vested stake in that mission, which is why Safecount's members span the agency, research company, ad-server, publisher and marketer arenas. And what's great is that there really isn't a majority stake by any of the above groups in terms of supporter composition. In fact, it's that heterogeneity that really ensures that all parties are forced to see the issues at hand from multiple angles.

iMedia: How would you describe Safecount's activities, triumphs and challenges of the last six months? Anything you're particularly proud of or disappointed by?

Zeman: In terms of triumphs, there have been many. First and foremost is that we've established this central forum for people in the industry to engage in a dialogue around these issues. Second would have to be the support we've received across the industry. On Safecount.org, there is an index of supporters, which is 11 scrolls down on my screen (approximately 400 people). I think that says a lot. Third, is the fact that we have helped (with others like NAI and CMOR) educate the Washington legislators that are grappling with the issues around spyware and spyware removal. Fourth, that we are gaining alignment on the buy and sell side to begin the very difficult but necessary task of having a direct dialogue with consumers around these issues. And lastly, we are proud that we have helped to push and secure behavioral-based studies of cookie-lifespan through the ARF and the IAB.

iMedia: So much of the time, we internet folks -- and the even slimmer subsection of internet marketing/advertising folks -- speak our own language, so it can be difficult for outsiders to understand. The difference, for example, between adware and spyware is clear to us, but often invisible to others. What has the experience of the Safecount folks been with this? Have you had to translate for civilians? And, if so, has the necessity of doing so been illuminating?

Zeman: We are currently going through that process. Some Safecount members have conducted research, some already public, some about to be. I would say a common theme is that consumers overall are certainly not crystal clear about cookies (even some people in that slimmer subsection of the industry are not). The real challenge, though, is that many of the misguided ones think that they are. Clearly, some education is needed, and what I can tell you is that when that education is initiated, we will be speaking through a consumer filter. Meaning, ample pre-testing will be done to ensure that our message is in a language that the average internet user can understand, and that consumers actually helped to develop.

iMedia: Is Safecount making any effort to get anti-spyware tools like Ad-Aware and WebRoot to whitelist some cookies and remove them from the spyware list? Reclassification would be one easy way of addressing the cookie perception problem? If so, what sort of cookies should be whitelisted? And what success have you had?

Zeman: What you're talking about is half of the Safecount equation. So we've got the consumer side, which largely rests with education and trust-building initiatives, and then we've got the business side. And, indeed, the end-goal there is to establish a list of cookies (and associated companies) that abide by a particular set of consumer-friendly protocols. In other words, these are cookies that should not be pooled in with those that represent potentially malicious software. Of course, enabling such a system is going to take time, but we think we are making progress.

I think we've cleared the first hurdle in that at least spyware detection companies are recognizing that a cookie in and of itself isn't an inherent danger. The next step is the formulation of what types of cookies should be whitelisted, so to speak. I can't guess what the breakout will be among company type, but, again, I think the key here is that they will be cookies worthy of consumer trust, and third-party blessed as such.

iMedia: On an individual level, do you have a sense of why the consumers who don't like cookies don't like them? These are, often enough, the same folks who will gladly sign away all their private information at the grocery store to save 10 cents on toilet paper... so why is a 4K piece of software so threatening?

Zeman: Well, I think you've really got two sets of people deleting cookies on a regular basis: 1) People who don't understand cookie technology/protocol and believe that they are malicious and invasive. 2) People who simply don't like the idea that their behavior is captured and stored in any way. In both cases, these folks are willing to sign away personally identifiable information in situations where no potential threat is perceived. Of course, it's going to be a lot easier to change the thinking of the first group (in terms of when a threat is real versus perceived) than the second, but I think the positive news is that the ratio of the two groups is probably 10 to one.

iMedia: On the same theme, Safecount talks a lot about changing the consumer and legislative mindset about cookies, but what about changes in cookies themselves. Are there technological changes on the horizon? Do you ever foresee a day when cookies would be permission-based as a default -- where as a matter of course a browser would ask before dropping a cookie?

Zeman: You know, it's hard for me to think of a situation where cookies would be opt-in on an ad-hoc basis. Reason being, you can pretty much already control the cookies that are being dropped on your machine via your browser settings. And, I don't think the opt-in versus blanket approach would alter behavior all that much given that consumers see the situation in a pretty black-and-white way. I also don't think consumers would be very receptive to the idea of having cookie permission pop-ups interrupt their internet usage on a continuous basis.

Regardless, I don't think the cookie technology is the thing that we need to be centered on. I think we must place our focus on gaining a consumer appreciation of the benefits of the type of tracking that cookies represent. As Nick Nyhan says, we don't want to get into a technological arms race with the consumer. That is simply a lose-lose situation.

iMedia: What should the industry look forward to from Safecount in the next six months?

Zeman: The industry at large will very shortly (i.e. in the next month or two) be hearing about what we feel is the beginning of the consumer education and trust-building process.

Look, we're realistic in terms of the frequency and continuity that we'll need to have in order to get this message across. But we've got to start somewhere, and we feel like we've got an approach that's going to, if nothing else, certainly be noticed by a very large portion of online consumers and will get people talking. As I mentioned, we'll also continue to work on the business side of the equation in parallel.

iMedia: Finally, what sort of help does Safecount need? What should the interested do to pitch in?

Zeman: Clearly we all stand to benefit from both the consumer and business initiatives that Safecount is pushing. So whether you are an ad-server, agency, marketer, research company, et cetera, there are certainly ways to chip in on one or both sides of the equation. There's a good chance that if you are in the industry we'll be reaching out to you. However, for those that are not contacted, please reach out to someone on the board of Safecount -- we'd love to get you involved. Additionally, if people have not already voiced their support on Safecount.org, we encourage them to do so. One group of constituents that we'd particularly like to see with a bit more representation on the support list is the marketer community.

Brad Berens is the executive editor for iMedia Communications.

Nielsen/NetRatings Seeks MRC Nod

Nielsen/NetRatings, is officially seeking accreditation for its audience measurement procedures from the Media Rating Council.

Nielsen claims to be the only online measurement organization to have applied for such accreditation from the MRC, a non-profit organization that typically weighs in on the credibility of traditional media research. Nielsen is owned by Mediaweek parent VNU.

Initially, two Nielsen//NetRatings panels will be evaluated: the NetView panel, which is recruited using Random Digital Dial methodology, and the MegaPanel, which is based on monitoring actual users Web surfing habits. The MRC will also examine the how Nielsen integrates its various sources of data.

With this move, Nielsen appears to be hoping that accreditation will provide some distinction in an arena that is crowded and lacking a true leader, as companies like comScore Media Metrix and Hitwise also vie for a position of authority in the minds of media planners. Nielsen has recently been working closely with the Interactive Advertising Bureau in developing measurement standards in the industry, including how often users delete cookies, and how that effects the validity of audience data.

Friday, September 9, 2005

Lost in the Cookie Debate--What About Data Harvesting?

AMID THE HUBBUB ABOUT COOKIES and their uses over the summer, one element of the debate seems to have been lost in the mix. Ironically, it is among the more prevalent uses of cookies, and also among the more potentially dangerous uses for publishers.


I'm talking about the instantaneous data harvesting that occurs routinely in the online ad buying/delivery process. Here are two types that have made a few companies and individuals extremely wealthy, while remaining predominantly under the radar of this debate.

Ad Broker Networks--these companies (like Advertising.com, Fastclick, Undertone Networks, and others) place cookies on consumer browsers as part of their ad buys. They typically capture and store information about where the person was surfing when the ad was delivered (such as the technology section of USAToday.com), what they just surfed before reaching that site (the referrer's Web site), who the advertiser is and what type of business/or offer is involved (i.e., Sprint, mobile telecom offer).


Additionally, this cookie obtains a great deal of technical information (the type of browser, browser plug-ins, machine brand, time of day, connection bandwidth, and IP-based geo-location), and finally, whether or not the surfer clicked on the ad.


These ad brokers capture this information to optimize the space that they bought (their business is to buy low and sell high) with CPA offers. However, they typically keep this information (both on the cookie and in a database, most likely), and re-use it whenever they see the user again. For example, they may routinely make large, multi-billion monthly page view buys on MSN or Yahoo! at a very, very low CPM--maybe for less than 40 cents. If they know that a user visits tech content at a major publisher site, is located in New York City, and has responded favorably to a mobile telecom offer recently, they could deliver that person a very high-value Verizon Wireless ad with an effective CPM of $10.


Essentially, the broker is able to leverage cookie-based data that they captured from one publisher on an earlier buy (which paid for itself) into a massive arbitrage on a subsequent buy solely because they were able to capture and re-use cookie-based data.


This is one of the major ways that ad brokers make money, of course. Rarely do publishers ever ask or require that these networks disclose which cookies they will be setting when they make buys. Nor do they require knowing what data the brokers will be capturing, or what they will do with it.


In fact, many times, the broker that buys the remnant space will not be the one that actually fills it. For example, a company like Drive Performance Media (DrivePM) may buy space from a publisher. They may have their ad server called first. If they don't see a cookie that they recognize, they may "hand-off" the space to Blue Lithium, who may do the same thing. They will look for one of their cookies. If they don't see one, they may hand it off to Right Media, who may resell the space again.


This kind of tactical data harvesting is almost always undisclosed to the publisher, and is certainly unknown to the consumer. Is it bad? Well--for publishers, it may be. But many publishers are happy to part with their remnant inventory under these terms. Is it bad for consumers? As eCommerce grows and the Web marketing model expands, that would be an even more difficult case to make.


Should it be more transparent? That's what I'm hoping to hear from you readers on. I think it needs to become more transparent--and soon. But I'm assuming many of you will disagree with me on that point.


The second type of Data Harvesting I'd like to examine here is done by Third-Party Ad Servers. Some third-party ad servers set a unique cookie in their own domain on all browsers of all campaigns that they see. This way, they are able to see this cookie in the future when they see the same user again, assuming that the user has kept the cookie.





Some third-party ad servers routinely keep technical information about the user with this cookie (browser type, etc.). Some third-party ad server contracts include as a standard default clause the right to keep and re-use certain anonymous data about the campaign. For example, they may keep information about what category of ad was displayed and how the user responded. They may keep information about what type of Web site or section or page the user was surfing or referred from when the ad was delivered. They might keep information of the frequency of visits or how recently they have seen the user. Some of these companies then re-use that data for campaign optimization as part of proprietary "optimization" that they charge advertisers for. They may also use this data much like the ad broker networks, and buy remnant inventory to then optimize it against CPA campaigns.


Atlas DMT, for example, may make purchases like those aforementioned on MSN to optimize their inventory, or they may just offer the optimization as a service. Essentially, they are able to convert the consumer data that they captured from publishers and from advertisers or other agencies that use their services into media arbitrage.


As consumers, are you aware that this is going on in your hard drive and vis 'a vis the sites you visit? More to the point, if you're a Web publisher, did you have any idea where your user data has been going and who else has been monetizing your users?


For years, I've been saying that the cookie/privacy issue is far more of a business matter than a consumer privacy matter, and I think that is truer still today than ever before.


But until Web publishers get the same kind of transparency from their affiliates that consumers are demanding from the publishers themselves, there will be far less industry awareness than is needed in this debate.


Thursday, September 1, 2005

Tech Q&A: What are cookies, and are they dangerous?

By Anick Jesdanun, The Associated Press

Q. I've been hearing a lot lately about "cookies" on my computer. What are they, and are they really dangerous?

A. Cookies have been getting a bad reputation lately because some are linked to spyware and adware, programs that often sneak onto your computers. Many anti-spyware programs identify cookies as threats because Web sites can use them to target ads based on your surfing habits.

But cookies are much more than that.

Fundamentally, cookies are small data files your Web browser uses to help sites remember who you are. They were invented at Netscape Communications Corp. a decade ago and incorporated into the then-reigning Netscape Navigator browsers to make Web surfing more efficient. Other browsers soon adopted cookies, too.

Without cookies, each interaction with a Web site would be treated as a new visit. The site would have no way of knowing that the page you just called up and the one you called up five minutes ago were summoned by the same person.

That's often not a problem for basic Web pages.

But for commercial Web sites, it can be.