01/23/2007 10:11 am ET Updated May 25, 2011

Release 0.9 : Cookies and Disclosure

I'm at Burda"s Digital Lifestyle Day in Munich,
which is well-covered elsewhere.

One of the more interesting, less flashy
attendees is David Morgan of Tacoda, who runs a
behavioral targeting ad network. That is, his
company Tacoda tracks about 150 million (mostly
US) anonymous users' behavior on the Web, keeping
a running tally of the sites each user
visits. Then it serves them ads based on their
behavior, sharing revenues with the publishers
(such as New York Times Online,, Dow
Jones Online and NBC Universal sites) whose
content surrounds the ads and links the consumers see.

The users are identified only as cookies; for
example, I just went into my browser to check
[click on tools/options/privacy/cookies in
Firefox] and I have a cookie called
Each time I visit a site managed by Tacoda, it
asks my browser to send it any cookies
it has stored, and this is what my browser
sends. After some time, Tacoda has a record of
sites it manages that I have visited, but it
doesn't really know or care "who" I am. However,
it can predict where I will visit next and -
based on matching that cookie with behavior if I
buy something at one of those sites - it knows if
that cookie's owner buys things. It uses its
users' past behavior to predict each user's
future behavior. More on the curious correlations
of behavior some other time, but suffice it to
say that people who visit business news sites
tend to buy a lot of pet food. (Cookies also
ensure that you don't seem the same ad too often,
that you get ads that are (mostly) relevant, and
of course that you don't have to refill your data
or preferences every time you visit your favorite sites.)

Says Morgan: "We don't try to use our intuition.
We're not interested in individuals; we're
interested in clusters and categories and
volume. I know the seven indicators that tie
people to Toyota: I can see it in their movies,
their music, their news sources and even things like interest in sports."

That's all pretty innocent. Tacoda collects no
personal behavior...though of course it could. So
could the restaurants I visit collect my food
preferences, and so do grocery chains and
drugstores collect records of their loyalty
card-holding customers' purchases, by name.

I have been talking with Morgan for a year or
more about the combination of paranoia and
ignorance surrounding cookies. Did you enjoy
reading the explanation above? Or did you skip
it even though you don't know it all?

That's really the issue. Of course companies can
track you on the Web; get real. But it's not
really in their interest to do so, either
financially or politically. (You should be
worried about real spyware and phishing though,
which is an entirely different matter.)

Morgan has been on a fairly lonely crusade
(outside the so-called privacy community) to
foster better disclosure about the use of
cookies. Most people in the industry, including
its trade associations, prefer just to let the
sleeping dog lie. Let someone else wake it up and endure the first bites.

But that dog of concerned consumers will wake up
for sure - all the more enraged for being
ignored. If you made it through the description
above - and believed it - you'll agree that
cookies are harmless. But if they're so harmless,
why do advertisers and ad networks insist on keeping them a secret.

After all, the truth is pretty boring so why
confuse people who probably aren't interested
anyway? The reason they should do so is that
eventually people will ask - or someone else will
tell them, and with a spin that will both confuse and scare them.

Currently, consumers can find out about cookies
if they take the trouble to a small link at the
bottom of the publisher's site or (typically) at the bottom of the ad.

Okay, that's the background. Now read on:

Using the medium to carry the message

The last time I saw David he told me he was
planning to launch a consumer-education campaign
about cookies using - what else? - Tacoda's ad
network. It took a little longer than he
planned, he says, but now he is about to launch
what he calls "robust notice" (as opposed to
"passive disclosure"). Two times a year per
cookie, which probably means four times per user,
users will see an invitation to learn about
cookies where they might otherwise see an ad for
TacoToyota, Snapple Green Tea or Coke.

I like this; it's using the medium to carry its
own message. Ironically, the people who delete
their cookies may see more of the disclosures,
because Tacoda relies on its cookies to know how
many times people have visited each of the sites
it works with and the ads it serves.

So Morgan is thinking of creating a kind of
meta-cookie that would use the browser cache
rather than the cookie store ...and that would
persist even when people delete their
cookies. Why couldn't an evil advertiser - or
worse, an evil [YOUR NIGHTMARE HERE] use it too?

Morgan has that covered, he hopes: He's trying to
get a patent on the technology. He'll license it
for free to anyone who signs a contract
committing to use it properly (and with
disclosure); a Creative Commons implied license
isn't very enforceable. Of course, the crooks
who would abuse it are unlikely to worry about a
patent - but they could be prosecuted for use of
the technology even if their misbehavior is harder to prove.

And the moral?

The moral of this story is not simple. Cookies
are okay, but they can be mis-used like any other
technology. As a business proposition,
disclosure is the best policy. Because when
someone does mis-use cookies, those who use them
correctly want to be visibly on the side of the angels.

So look closely. Someday soon you'll see an ad
asking if you want to know more about
cookies. You may or may not be interested. It's
pretty dull. But if you know enough, it won';t be scary.

My own disclosure: I've been fighting this fight
for a long time, last year as an advisor to an
organization called Safecount that wanted to run
a broad-based consumer-education effort around
cookies. But it was a volunteer effort and
didn't get a lot of traction. We transferred the
project to the Interactive Advertising Bureau to move it forward, but instead it
more or less vanished. (Though I also ran into
new IAB executive director Randy Rothenberg here
and he promised to look into it....)