1. Chapter 11 Privacy Policies and Behavioral Marketing

2. Website Privacy Policies- Geocities Geocities allowed customers to build free websites Monetized with banner ads Collected customer demographic data ‘we will never give your information to anyone without your permission’ Geocities sold data in violation of own policy Fined by FTC PgP BUSA331

3. Website Privacy Policy- Toysmart Toysmart collected data, privacy policy to never disclose Toysmart goes into bankruptcy, data is valuable, creditors want to sell US Bankruptcy court says no, destroy data, per privacy policy… PgP BUSA331

4. Perception Vs Reality Company privacy policy, not law is restriction on data collection Americans believe online browsing is private…NOT! PgP BUSA331

5. Web Site Privacy Policies People want privacy, marketers want to target audiences, so personal data is very valuable Some companies not responsible hire inmates to input data, so sex offenders steal and misuse… Better to not have privacy policy? Matter of trust with customers… EU has ‘Safe Harbor’ with US companies due to more restrictive EU laws PgP BUSA331

6. Model Privacy Policy See pages 246 to 248 Simple is best Make sure employees do not violate Record dates enacted, and changed Archive copies PgP BUSA331

7. Burden of Proof Issue- what company promised in privacy policy Or what plaintiff read? Not clear See Northwest Airlines and JetBlue cases PgP BUSA331

8. Behavioral Marketing Online advertising is $45B industry Movement is from contextual to behavioral marketing Use clickstream data to track visited sites Creates profile Targeted advertising based on profile PgP BUSA331

9. Cookies Most common form of behavioral marketing Saves website settings Use 3 rd party cookies to deliver ads based on history Session cookies occur when user logs in, allows personal tracking Facebook users are ‘products offered to advertisers’ PgP BUSA331

10. IE Cookie PgP BUSA331

11. Flash Cookies Not deletable by normal methods Security concern, lots of data Collect across browsers Do not expire, Zombie cookies Flash Player Manager Settings: http://www.adobe.com/support/documentation/e n/flashplayer/help/settings_manager07.html http://www.adobe.com/support/documentation/e n/flashplayer/help/settings_manager07.html PgP BUSA331

12. Stored Browser Histories Browser urls store personal information Fb page visited https://www.facebook.com/eProfessor PgP BUSA331

13. Device Fingerprinting Panopticlick http://panopticlick.eff.org Clock settings, time zones, fonts, plug-ins… PgP BUSA331

14. Privacy Concerns To prevent cookies look into Ghostery DoNotTrackMe FTC favors industry self-regulation, but outdated by technology State data is being collected Secure data Obtain consent Express consent to collect sensitive data PgP BUSA331

15. Deep Packet Inspection ISPs have greater ability to harvest customer clickstream data than Google, but have not…yet, but could… Deep Packet Inspection –like Total Information Awareness Privacy advocates worried Communications Act of 1934 prohibits companies transmitting cannot divulge contents! ECPA allows divulging with consent Cable TV Privacy Act of 1984 prohibits disclosure of PII… PgP BUSA331

16. Behavioral Marketing and Privacy Policies Failing to disclose that PII is shared can cost company, like Toys R Us… PII = Personally Identifiable Information! PgP BUSA331

17. Society, Technology and the Law Privacy policy problems Long, so seldom read Confusing legalese, contradictory language Misleading about data-harvesting practices End users need to get educated Beware of social engineering Development of browsers that emphasize privacy Congress and FTC can enact laws and regulations PgP BUSA331