Behavioral advertising: the cryptic hunter and gatherer of the Internet.

• Author: Penn, Joanna

1. INTRODUCTION II. ONLINE BEHAVIORAL ADVERTISING A. Targeting B. Retargeting C. What is FetchBack? III. HOW USERS ARE TARGETED A. The Type of Information Gathered B. How that Information Is Gathered. IV. THE PROBLEMS WITH BEHAVIORAL TARGETING A. Harm Through Profiling B. Harm Through Data Fusion C Harm Through Information Leaks D. Harm Through Lack of Consent IV. PROPOSALS TO PROTECT INFORMATION PRIVACY A. Legislation B. FTC Regulations C. Privacy Policies and User Consent 1. Clearer Approval 2. Greater Transparency D. User Consent 1. Opting-Out Option on a Retailer's Page 2. Opting-Out of FetchBack's Services 3. Opting-In V. LOOKING FORWARD A. Model for the Future B. Conclusion I. INTRODUCTION

   You see a shadow lurking around the comer. You hear the creak of a door. You sense that someone is watching you. But then you look and listen, and you realize no one is there. But what if you were being watched, followed, and tracked and had no way of knowing? Enter behavioral advertising--the rich, talented, and mysterious Big Brother of the Internet.

   Online shoppers feel bamboozled when they browse for a particular item online and then become "haunted" by the same, or sister, products. Julie Matlin contemplated buying a pair of shoes online at Zappos, but did not go through with the purchase. (1) Even though Matlin did not want the shoes, the shoes appeared to want Matlin: "An ad for those very shoes showed up on the blog TechCrunch. It popped up again on several other blogs and on Twitpic. It was as if Zappos had unleashed a persistent salesmen who wouldn't take no for an answer." (2) The ads that tirelessly trail users from site to site are a form of state-of-the-art online behavioral advertising known as retargeting--a type of advertising that "connects advertisers with past website visitors to entice those visitors to complete their online transactions or purchases." (3)

   This Note will break behavioral advertising down in five parts. Part II explains the difference between targeting and retargeting and points out major companies in each category. Part III describes how online users are tracked. Part IV discusses the problems and concerns with tracking. Part V introduces ways in which law makers, the Federal Trade Commission ("FTC"), and individual online retailers can improve consumer education through transparency and obvious privacy and opt-out choices. Part VI provides a conclusion and a goal for the future of behavioral advertising.

2. ONLINE BEHAVIORAL ADVERTISING

   Since the Internet boom of the mid-1990s, online advertising has evolved more than any other traditional form of advertising due, in part, to the advent of behavioral targeting. (4) Online behavioral advertising tracks consumers' online activities in order to deliver tailored advertising for goods and services that they are likely to click on, view, and ultimately purchase. (5) Cutting-edge algorithms analyze a user's online activity and deduce a user's likely inclinations. (6) Such a sophisticated method is made possible by the implementation of cookies, which are "small data file[s] (up to 4KB) created by a Web site you visit that [are] stored on your computer either temporarily for that session only or permanently on the hard disk (persistent cookie)." (7) The cookies are what enable data collectors to track and report the behavior of the user.

   Using the data from the cookies, users are separated into profiles. These profiles provide information such as which websites and products have been viewed, demographics, and. when available, personality traits pertaining to the specific individual. (8) Tracking the user is extremely valuable because it allows businesses to narrow their approach and display items that more closely align with what interests a specific person, based on his or her predilections and search history. (9) Consumers have traditionally participated in offline, real-world tracking mechanisms--which record purchasing behavior and personal information--by signing up for customer loyalty programs and club cards in exchange for discounts or coupons. (10)

   Contrary to tracking in the real world, online consumers are not signing up for behavioral targeting. (11) These shoppers are not making an active choice, but rather, they are merely silently "agreeing" to have information gathered concerning their habits and preferences while they load their cyber carts. (12) An example of such behavioral advertising is the following: an online shopper visits a clothing retailer and searches for blue sweaters. The potential consumer views blue sweaters but does not make a purchase. The shopper later visits Facebook and receives an ad for "blue sweaters on sale starting at $19.99." Interpreting what type of behavioral advertising this message is depends upon the previous actions of the user and the form of marketing a specific retailer employs for its needs.

   1. Targeting

      With a network of over eleven thousand web publishers and billions of advertisements placed online, DoubleClick is the leader when it comes to delivering targeted online advertising. (13) DoubleClick specializes in "collecting, compiling and analyzing information about Internet users through propriety technolog[y]" in order to provide the consumer the most appealing banner ads. (14) This task is completed by placing a cookie on a user's hard drive when they visit one of DoubleClick's client's sites--an action that is neither evident nor explicitly permitted by the user. (15)

      DoubleClick's cookies collect submitted information in three forms: "GET" (information that is submitted as part of a website's address), "POST" (information that is submitted by fill-in multiple blank fields on a webpage), and "GIF" (information from tags that are put on affiliated websites). (16) Professor Joel Reidenberg states, "These cookies enable DoubleClick to track the clickstream of Internet users [sic] keyboard stroke by keyboard stroke across any of DoubleClick's 11,000 affiliated Web sites." (17) With the collection of the tracking data, profiles are then created. DoubleClick allegedly has more than one hundred million specific user profiles. (18)

   2. Retargeting

      The latest form of behavioral advertising acts as an intermediary between advertisers and consumers. Retargeting displays ads from websites that users have already visited in order to encourage them to purchase products or services in which they have shown interest. (19) "With retargeting you only target users that have visited your site and already had an experience with your brand." (20) Retargeting narrows the types of advertising images that are displayed, usually by showing products a user has already viewed, which increases the chances that the viewer has interest in the ad. (21) FetchBack is a leading company of such innovative marketing.

   3. What is FetchBack?

      FetchBack is the up-and-comer in advertising retargeting. With over 700 active advertisers under its belt and $400 million "fetched" sales for its clients, the company is becoming a household name among Internet retailers. (22) FetchBack's mission is simple: it wants to put messages in front of lost prospects who have left a website by reminding and urging them to come back and purchase the product they left behind. (23) But how does it get these customers back?

      As FetchBack puts it, "[w]hen prospects leave [a company's] site and browse the Internet, [the site's] ads will display on other sites they visit. keeping [the original] website in their peripheral vision and top of mind." (24) FetchBack is also confident that these buyers will come back to the site and tend to make the purchase they had previously considered and will sometimes even add additional items to the cart. (25) But, the question still remains, how does FetchBack really do it?

3. How USERS ARE TARGETED

   1. The Type of Information Gathered

      Personally identifiable information ("PII") is defined as "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other personal oridentifying information that is linked or linkable to a specific individual." (26) PH is not limited to a specific set of data but instead requires a case-by-case analysis to see if the information could be used to identify a specific individual. (27)

      FetchBack claims that it only collects PII, such as names, email addresses, credit card numbers, and other distinguishable bits of data from those who have a FetchBack account and have registered the information. (28) Meanwhile, the majority of information collected is nonpersonally identifiable information ("non-PII") that is gathered from its partner sites. (29) Unlike PII, non-PII is simply anonymous data that, without more specific data added to it, cannot identify a specific person. (30) FetchBack also claims that none of the information it collects from partner sites can be used to identify a specific user. (31)

   2. How that Information Is Gathered

      An Internet user who is seen to be a prospective customer receives a cookie from FetchBack and FetchBack's partners when they visit FetchBack.com or, more commonly, one of the FetchBack advertiser websites. (32) FetchBack states that it has no control over what information its partners collect from cookies, but requires that it is only non-PII formation for the purpose of serving retargeted ads. (33)

      FetchBack also uses a...