Release 0.9: Cookies and Disclosure

I'm at Burda's Digital Lifestyle Day in Munich, which is well-covered elsewhere.

One of the more interesting, less flashy attendees is David Morgan of Tacoda, who runs a behavioral targeting ad network. That is, his company Tacoda tracks about 150 million (mostly US) anonymous users' behavior on the Web, keeping a running tally of the sites each user visits. Then it serves them ads based on their behavior, sharing revenues with the publishers (such as New York Times Online, Cars.com, Dow Jones Online and NBC Universal sites) whose content surrounds the ads and links the consumers see.

SKIP THIS BIT IF YOU KNOW IT ALL: The users are identified only as cookies; for example, I just went into my browser to check [click on tools/options/privacy/cookies in Firefox] and I have a Tacoda.net cookie called 0^1169479147^1169480947|12174^1169479147^1169480947. Each time I visit a site managed by Tacoda, it asks my browser to send it any Tacoda.net cookies it has stored, and this is what my browser sends. After some time, Tacoda has a record of sites it manages that I have visited, but it doesn't really know or care "who" I am. However, it can predict where I will visit next and - based on matching that cookie with behavior if I buy something at one of those sites - it knows if that cookie's owner buys things. It uses its users' past behavior to predict each user's future behavior. More on the curious correlations of behavior some other time, but suffice it to say that people who visit business news sites tend to buy a lot of pet food. (Cookies also ensure that you don't seem the same ad too often, that you get ads that are (mostly) relevant, and of course that you don't have to refill your data or preferences every time you visit your favorite sites.)

Says Morgan: "We don't try to use our intuition. We're not interested in individuals; we're interested in clusters and categories and volume. I know the seven indicators that tie people to Toyota: I can see it in their movies, their music, their news sources and even things like interest in sports."

That's all pretty innocent. Tacoda collects no personal behavior...though of course it could. So could the restaurants I visit collect my food preferences, and so do grocery chains and drugstores collect records of their loyalty card-holding customers' purchases, by name.

I have been talking with Morgan for a year or more about the combination of paranoia and ignorance surrounding cookies. Did you enjoy reading the explanation above? Or did you skip it even though you don't know it all?

That's really the issue. Of course companies can track you on the Web; get real. But it's not really in their interest to do so, either financially or politically. (You should be worried about real spyware and phishing though, which is an entirely different matter.)

Morgan has been on a fairly lonely crusade (outside the so-called privacy community) to foster better disclosure about the use of cookies. Most people in the industry, including its trade associations, prefer just to let the sleeping dog lie. Let someone else wake it up and endure the first bites.

But that dog of concerned consumers will wake up for sure - all the more enraged for being ignored. If you made it through the description above - and believed it - you'll agree that cookies are harmless. But if they're so harmless, why do advertisers and ad networks insist on keeping them a secret.

After all, the truth is pretty boring so why confuse people who probably aren't interested anyway? The reason they should do so is that eventually people will ask - or someone else will tell them, and with a spin that will both confuse and scare them.

Currently, consumers can find out about cookies if they take the trouble to a small link at the bottom of the publisher's site or (typically) at the bottom of the ad.

Okay, that's the background. Now read on:

Using the medium to carry the message

The last time I saw David he told me he was planning to launch a consumer-education campaign about cookies using - what else? - Tacoda's ad network. It took a little longer than he planned, he says, but now he is about to launch what he calls "robust notice" (as opposed to "passive disclosure"). Two times a year per cookie, which probably means four times per user, users will see an invitation to learn about cookies where they might otherwise see an ad for TacoToyota, Snapple Green Tea or Coke.

I like this; it's using the medium to carry its own message. Ironically, the people who delete their cookies may see more of the disclosures, because Tacoda relies on its cookies to know how many times people have visited each of the sites it works with and the ads it serves.

So Morgan is thinking of creating a kind of meta-cookie that would use the browser cache rather than the cookie store ...and that would persist even when people delete their cookies. Why couldn't an evil advertiser - or worse, an evil [YOUR NIGHTMARE HERE] use it too?

Morgan has that covered, he hopes: He's trying to get a patent on the technology. He'll license it for free to anyone who signs a contract committing to use it properly (and with disclosure); a Creative Commons implied license isn't very enforceable. Of course, the crooks who would abuse it are unlikely to worry about a patent - but they could be prosecuted for use of the technology even if their misbehavior is harder to prove.

And the moral?

The moral of this story is not simple. Cookies are okay, but they can be mis-used like any other technology. As a business proposition, disclosure is the best policy. Because when someone does mis-use cookies, those who use them correctly want to be visibly on the side of the angels.

So look closely. Someday soon you'll see an ad asking if you want to know more about cookies. You may or may not be interested. It's pretty dull. But if you know enough, it won';t be scary.

My own disclosure: I've been fighting this fight
for a long time, last year as an advisor to an
organization called Safecount that wanted to run
a broad-based consumer-education effort around
cookies. But it was a volunteer effort and
didn't get a lot of traction. We transferred the
project to the Interactive Advertising Bureau to move it forward, but instead it
more or less vanished. (Though I also ran into
new IAB executive director Randy Rothenberg here
and he promised to look into it....)