Posts Tagged ‘adsense’

A Self-Regulatory Moment

March 26, 2010

An earlier post about Google’s new “certified ad network” program raised the question of whether websites should disclose to consumers which third-party networks may have access to user data through AdSense. Google’s program allows certified networks to use previously collected behavioral data to target ads served through AdSense, but prohibits (by contract) the collection of new data for future use. Based on this distinction, Google does not provide consumers with any specific notice-and-choice as to certified ad networks.

Lurking here is a fundamental question about ad-targeting disclosure: is it good enough to provide notice and choice only when behavioral data are being collected, or must you also provide it when being used?

Google’s approach seems founded on a literal reading the FTC’s 2009 Staff Report on Behavioral Advertising (see page 52), which by its terms speaks only of notice-and-choice on every website “where data is collected.” The NAI’s self-regulatory principles use similar language. But neither the FTC nor the NAI discussed “use” versus “collection,” the involvement of multiple companies in delivery of a single ad, nor a notion that disclosure standards might differ in those cases.

There are good reasons to conclude that consumers deserve notice-and-choice both at the point of collection and the point of use of behavioral data.

  1. The serving of a targeted ad will be the moment of recognition for many consumers; the very point at which they want to understand and exercise their choices. If they can’t easily identify the company serving the ad based on prior collected behavior, they have no way to prevent it from continuing.
  2. With visibility as to which third-parties have access to data, consumers can make their own decision about whether to rely on Google’s contractual rules about how it may be used. Google’s approach is a black box for consumers; they receive no direct assurance from the certified ad network about their practices, nor any assurance that Google will monitor or enforce the contractual prohibitions on their behalf.

In plain terms, Google says to the consumer: If you don’t opt-out when information is first being collected about you, you lose the practical ability to do so when it is used to show you targeted ads. Google’s own opt-out program does not appear to remove the user from receiving behaviorally targeted ads from non-Google networks through AdSense.

Did the FTC Staff intend this outcome? There’s nothing in the rest of the Staff’s discussion to indicate that they meant to exclude the use-only situation from enhanced disclosure.  Indeed, in distinguishing first-party from third-party data collection, the Staff said:

By contrast, when behavioral advertising involves the sharing of data with ad networks or other third parties, the consumer may not understand why he has received ads from unknown marketers based on his activities at an assortment of previously visited websites. Moreover, he may not know whom to contact to register his concerns or how to avoid the practice.

In the same statement, the FTC Staff spoke to this kind of novel situation when they said, “Where the data collection occurs outside of the traditional context, companies should develop alternative methods of disclosure and consumer choices that meet the [transparency] standards described above …”

The IAB-led coalition has adopted principles that require notice-and-choice “when data is collected from or used on a Web site for Online Behavioral Advertising purposes …” (page 17) The IAB’s overall approach to disclosure is premised on embedding notice into ad-delivery, which like the FTC explained, satisfies a consumer curious about why they saw a particular ad. This is true whether or not data are also being collected for future targeting.

“Fourth-party” ad delivery of the sort now available in AdSense is increasingly common, and Google’s precedent may end up as an industry standard. If enhanced disclosure only applies at the point of collection of behavioral data, and not at the point of use, that should be based on a thoughtful discussion of the consumer impact, rather than a narrow reading — and most likely a mis-reading — of FTC staff guidance.

This will be an important test of the industry’s self-regulatory framework. Google is an NAI member (as are several certified ad networks), and this question involves interpretation of NAI guidelines. One way or another, the NAI must pass judgment on the point, and in doing so will demonstrate whether consumers (and the FTC) can count on an effective self-regulatory effort for behavioral advertising.


AdSense Opens Up to “Certified Ad Networks”: Three Questions for Google

March 22, 2010

Google made it official last week: Any site in the vast AdSense network may now carry ads placed by third-party ad companies, which Google calls “certified ad networks.” This is an important privacy development, as it means that more than 80 new companies may now use or collect user behavioral information through Google ad tags that are already installed on millions of web pages. (To learn how this works, see the video embedded at the end of this post.)

Because these companies are hungry for access to the AdSense network, Google’s certification requirements may have more immediate impact on prevailing ad-industry privacy practices than any new regulation or industry initiative. By setting and enforcing standards on participating networks and AdSense publishers, Google has the opportunity to catalyze a truly effective self-regulatory system for interest-based advertising.

To do so, Google should answer three key questions:

1. How does Google confirm compliance with certification standards?

Google’s policies do not require that certified networks be members of the Network Advertising Initiative, the group of leading ad companies (including Google) that sets standards and provides compliance reviews. But Google does require certified ad networks to abide by the NAI’s 2008 Guidelines. These rules require a consumer-facing explanation of what kind of information is gathered and how it is used, as well as:

  • Disclosure of how long consumer data is retained;
  • A consumer opt-out process (such as an opt-out cookie); and
  • Assurance that sensitive behavior (i.e. health, personal finance) will not be used for ad targeting without prior user consent.

A review of selected privacy policies from certified ad networks shows that quite a few do not meet these requirements (as of 3/19/10). Some examples (with links to the PrivacyChoice Index):

Google also should clarify these technical and operational points:

  • Do certified ad networks have access to behavioral data, even if they have agreed not to collect such information when serving ads through AdSense?
  • Does the network see the site or page visited, an IP address or the network’s cookie? If so, does each certified ad network need to engineer their backend systems to segregate AdSense data from data gathered elsewhere?
  • Will compliance be subject to review by Google personnel or any independent organization?

2. Will Google provide AdSense publishers with privacy-related information about certified networks, in order to enable them to make better decisions?

Google puts AdSense publishers in control by allowing them to turn off certified networks individually or entirely, but does not yet provide any privacy-related information to inform those decisions. Some AdSense publishers might want to allow only companies that are subject to oversight through the NAI; others might want to review retention or other specific privacy policies.

Google could improve website decision-making by showing publishers information about the privacy practices and oversight for each certified ad network. Website operators ultimately must be accountable to their own users for the practices of companies who have access to their user information. Google can make it easier for publishers to make good decisions, and thereby support higher standards across the industry.

3. Will Google provide AdSense publishers with a way to disclose third-party networks and their privacy policies to consumers visiting their sites?

Google already requires AdSense publishers to disclose that Google itself may collect or use behavioral information through AdSense, and requires sites to link to Google’s privacy policy and consumer opt-out choices. Under the NAI guidelines, each certified ad network engaged in behavioral advertising also has the same obligation when serving ads via AdSense. The practical problem is that AdSense publishers may not know which certified networks will be serving ads on their pages, since the ads come through pre-existing tags. The list is also subject to change, which makes disclosure a continuing headache for websites. Of course, just providing one big list of 80+ networks would not constitute meaningful disclosure.

For good reason, both the NAI Guidelines and those adopted by the IAB-led coalition require such disclosure not only when behavioral data are being collected, but also when behavioral data are being used to target ads (which is when the consumer may be most curious). This means that even if certified networks follow the rules against collecting behavioral information through AdSense, if they use other behavioral data to target ads, then enhanced disclosure is required on the website or page where the ad appears.

The process of providing this disclosure can be automated. The free PrivacyWidget service demonstrates one method to automatically present the right list of ad networks (and related opt-outs) on the fly, with minimal publisher effort.


When Google launched interest-based advertising across AdSense last year, their transparent consumer privacy approach raised the bar for other ad networks. Google’s launch of certified ad networks in AdSense should reflect the same commitment. By following through on the questions outlined here, Google can seize the opportunity to set best practices for the industry and accelerate consumer understanding (and informed acceptance) of interest-based advertising.


AdSense opens up and privacy disclosure gets more complicated

August 27, 2009

According to Paid Content, Google’s AdSense network will soon allow many other third-party ad networks to serve advertising via the AdSense code already embedded on millions of websites. This is significant from a privacy point of view, to the extent that it provides many smaller ad networks with access to a much wider set of websites, complicating privacy and opt-out disclosures.

googleadsenseGoogle will make the determination as to whether a third-party ad network qualifies to participate, and according to the program rules, this includes a review of their privacy practices. When it comes to user targeting, here’s how Google explains the requirements in an FAQ for third-party ad networks:

You may use cookies for reporting purposes and to target ads, provided that the data you use was collected in accordance with industry standards:

Where there is a conflict between the NAI and IAB UK policies, the more stringent policy applies. Google determines at its own discretion whether or not you are compliant with these standards.

In particular, the certification process requires you to have the following:

  • A descriptive privacy policy on your site
  • A prominent link to opt-out from the privacy policy
  • No PII used in the creation of segments
  • No sensitive segments or segments targeted at children under 13 years of age
  • No packet sniffing in the collection of behavioral data

There’s no mention of the new self-regulatory principles, which are more specific about disclosure and require individual websites to disclose specific ad networks that use or collect behavioral data on their site (if such disclosure is not present in the ads themselves). Google does not seem to be requiring that a participating AdSense website provide such disclosure; the privacy statement and opt-out presentation applies only to the ad network’s own website.

The AdSense policies draw a distinction between collection and use of behavioral information in this program — third-party networks may use behavioral information they have gathered elsewhere to serve the ad, but may not collect information for behavioral purposes in the course of serving it. As Google explains it to the ad network:

You may use a cookie, web beacon, or other tracking mechanism to collect anonymous traffic data for purposes of aggregated reach, frequency and/or conversion reporting. Collecting impression-level data via cookies or other mechanisms for purposes of subsequent re-targeting, interest category categorization, or syndication to other parties on AdSense inventory is prohibited. (This restriction does not apply to click- or conversion-level data.)

Google does not explain here if or how these distinctions will be enforced. The same information is available to the ad network in either case, so to confirm compliance with this rule would require some kind of back-end audit of the network’s practices.

We will be watching AdSense sites closely as new networks start to flow through Google’s widely distributed Javascript. The privacychoice platform looks beyond the Javascript itself to see which servers are actually serving ads on a page through that code, so our Network Privacy Profiles will provide an accurate picture of the privacy policies in play for any AdSense website that opens up to third-party ads. For an AdSense website publisher committed to complete privacy disclosure and choice, our system should provide a simple solution.

Proximic’s 126-word privacy policy: more than complete

August 17, 2009

On the policies page of Proximic’s website, this is all they have to say about privacy:

We respect your privacy!

Proximic does not ask, require, acquire or retain any individual personal information to identify end-users as a prerequisite to use our products and services. Obviously from a technology standpoint individual IP Addresses could be tracked and identify browsing behavior. However, we have committed ourselves to an extensive self-binding Privacy Policy prohibiting us to do so. Proximic does not record the browsing behavior of its end-users or visitors of the sites in the Proximic Publisher Network at all – neither via a browser plug-in, cookie placement or any other tracking method. At no point any kind of individual information about the browsing behavior is stored. Therefore Proximic in no case markets or communicates to a third party any personal data collected. See our Privacy Policy for details.

Although they mention a Privacy Policy that isn’t yet linked, I’m not sure there’s much more that they need to say. Since  they don’t track anybody across sites in their network, the questions of sensitivity, sharing and deletion fall away. This is pretty unique among ad-network polices that we track, and it required creating some new summary templates when adding them to the Network Privacy Profile database.

Although we don’t see proximic much in our site sampling, their bet on success through contextual rather than behavioral factors certainly makes for a clean privacy profile. It will be interesting to see if their business keeps them on this course, particularly with the dominant-competitor Google adding behavioral factors into the mix with AdSense.

AdSense interest-based targeting: how many publishers are on board?

June 26, 2009

When Google rolled out interest-based targeting in March, they called on each of their Adsense publishers to revise their privacy policies:

Your posted privacy policy should include the following information about Google and the DoubleClick DART cookie:

* Google, as a third party vendor, uses cookies to serve ads on your site.
* Google’s use of the DART cookie enables it to serve ads to your users based on their visit to your sites and other sites on the Internet.
* Users may opt out of the use of the DART cookie by visiting the Google ad and content network privacy policy.

So, now that we’re three months past the announcement, just how many AdSense sites have complied with this directive and opted-in to interest based advertising?

Other than some apocryphal findings, I haven’t seen a reported number, but perhaps one rough way to measure it is to see how many privacy policy pages the search engines show as having that required link to Google’s privacy policy. Each search engine provides its own answer:

On Google – 93,600
On Yahoo! – 78,000
On Bing – 21,100

That’s a wide variation, but even if you take the high one, you’re still talking about what’s likely a small percentage of the total number of AdSense sites, although potentially a high percentage of AdSense traffic (only Google knows).

Does this reflect publisher hesitation about behavioral targeting? Uncertain impact on ad revenue? Inattention?  AdSense malaise?


NB This decidedly unscientific exercise depends on the construction of my search query, which no doubt may be interpreted differently by each search engine. Here’s the query:

“privacy policy” AND link: OR “”

The idea is to only capture pages that (1) are site privacy policies; and (2) either have the URL in searchable text or have the URL as a hypertext link.

If there are any search experts out there with suggestions on how this query could be structured better, please let me know!

Google to websites: change your privacy policy to accommodate our ads | National Business Review (NBR) New Zealand – Business, News, Arts, Media, Share Market and More

March 13, 2009


Google to websites: change your privacy policy to accommodate our ads | National Business Review (NBR) New Zealand – Business, News, Arts, Media, Share Market and More.

Here’s Google letting their AdSense sites know about the new interest-based advertising initiative.  Interestingly, with a presumptoin that the privacy policies of those sites should include a specific reference to this kind of targeting.  Is their view that the “notice” in the advertisement itself is insufficient?

Advertisers spend more money on campaigns that reach the right audience; helping them do that should drive more revenue to your websites. This week we’re announcing plans to provide interest-based advertising across AdSense publisher sites to help achieve that goal.

In the past, advertisers have taken advantage of contextual and placement-targeted advertising on AdSense publisher sites. With this enhancement they’ll also be able to reach users based on their previous interactions with them, such as visits to the advertiser website, as well as reach users on the basis of their interests (such as “sports enthusiasts” or “travel enthusiasts”). Over the next few months we’ll start offering interest-based advertising to a limited number of advertisers as part of a beta, and expand the offering later in 2009.

Whether the advertiser’s goal is to drive brand awareness or increase responses to their ads, these capabilities can help expand the success of their campaigns and should increase your earnings as advertiser participation increases. To develop interest categories, we’ll recognize the types of webpages users visit across the AdSense network.

As an example, if they visit a number of sports pages, we’ll add them to the “sports enthusiast” interest category. You can visit the Help Center to learn more about how interest categories will be developed and your associated account settings. As a result of this launch, your privacy policy will now need to reflect the use of interest-based advertising. Please ensure that your site’s privacy policies are up-to-date and make any necessary changes by April 8, 2009.Users browsing the web will benefit from the additional relevancy that interest-based ads can provide. And by visiting the new Ads Preferences Manager, users can see what interest categories we think they fall into, or add and remove categories themselves. The Ads Preferences Manager can be found by clicking on most “Ads by Google” links you see on Google ads throughout the web. You can read more about how interest-based advertising benefits the online ecosystem and about the privacy innovations developed for this launch in the Official Google Blog and the Google Public Policy Blog. We look forward to providing users with ads more closely tied to their interests, helping advertisers reach their campaign goals, and helping you to monetize your website most effectively.

Posted by Aitan Weinberg – Product Manager via Driving monetization with ads that reach the right audience – Inside AdSense | Google Groups .