Chapter 11 Privacy Policies and Behavioral Marketing

Website Privacy Policies- Geocities Geocities allowed customers to build free websites Monetized with banner ads Collected customer demographic data ‘we will never give your information to anyone without your permission’ Geocities sold data in violation of own policy Fined by FTC PgP BUSA331

Website Privacy Policy- Toysmart Toysmart collected data, privacy policy to never disclose Toysmart goes into bankruptcy, data is valuable, creditors want to sell US Bankruptcy court says no, destroy data, per privacy policy… PgP BUSA331

Perception Vs Reality Company privacy policy, not law is restriction on data collection Americans believe online browsing is private…NOT! PgP BUSA331

Web Site Privacy Policies People want privacy, marketers want to target audiences, so personal data is very valuable Some companies not responsible hire inmates to input data, so sex offenders steal and misuse… Better to not have privacy policy? Matter of trust with customers… EU has ‘Safe Harbor’ with US companies due to more restrictive EU laws PgP BUSA331

Model Privacy Policy See pages 246 to 248 Simple is best Make sure employees do not violate Record dates enacted, and changed Archive copies PgP BUSA331

Burden of Proof Issue- what company promised in privacy policy Or what plaintiff read? Not clear See Northwest Airlines and JetBlue cases PgP BUSA331

Behavioral Marketing Online advertising is $45B industry Movement is from contextual to behavioral marketing Use clickstream data to track visited sites Creates profile Targeted advertising based on profile PgP BUSA331

Cookies Most common form of behavioral marketing Saves website settings Use 3 rd party cookies to deliver ads based on history Session cookies occur when user logs in, allows personal tracking Facebook users are ‘products offered to advertisers’ PgP BUSA331

IE Cookie PgP BUSA331

Flash Cookies Not deletable by normal methods Security concern, lots of data Collect across browsers Do not expire, Zombie cookies Flash Player Manager Settings: n/flashplayer/help/settings_manager07.html n/flashplayer/help/settings_manager07.html PgP BUSA331

Stored Browser Histories Browser urls store personal information Fb page visited PgP BUSA331

Device Fingerprinting Panopticlick Clock settings, time zones, fonts, plug-ins… PgP BUSA331

Privacy Concerns To prevent cookies look into Ghostery DoNotTrackMe FTC favors industry self-regulation, but outdated by technology State data is being collected Secure data Obtain consent Express consent to collect sensitive data PgP BUSA331

Deep Packet Inspection ISPs have greater ability to harvest customer clickstream data than Google, but have not…yet, but could… Deep Packet Inspection –like Total Information Awareness Privacy advocates worried Communications Act of 1934 prohibits companies transmitting cannot divulge contents! ECPA allows divulging with consent Cable TV Privacy Act of 1984 prohibits disclosure of PII… PgP BUSA331

Behavioral Marketing and Privacy Policies Failing to disclose that PII is shared can cost company, like Toys R Us… PII = Personally Identifiable Information! PgP BUSA331

Society, Technology and the Law Privacy policy problems Long, so seldom read Confusing legalese, contradictory language Misleading about data-harvesting practices End users need to get educated Beware of social engineering Development of browsers that emphasize privacy Congress and FTC can enact laws and regulations PgP BUSA331