[Infowarrior] - Privacy concerns dog Google-DoubleClick deal

Wed Apr 18 14:18:42 UTC 2007

Privacy concerns dog Google-DoubleClick deal

By Stefanie Olsen
http://news.com.com/Privacy+concerns+dog+Google-DoubleClick+deal/2100-1024_3
-6177029.html

Story last modified Wed Apr 18 06:25:08 PDT 2007

There is growing unease among consumer privacy advocates over Google's
proposed $3.1 billion acquisition of DoubleClick.

How will the search-advertising powerhouse treat the massive amounts of data
it already stores on people's search histories, once it also has at its
disposal a storehouse of data on people's surfing habits from DoubleClick,
the No. 1 digital ad-serving company?

Specifically, will Google combine the two data systems to map not only what
someone searches for, but also which sites they visit, videos they watch and
ads they click across the Web in order to better target marketers'
promotions?

"It leaves too much personal information about all of us in one company's
hands--Google's," said Jeff Chester, founder and executive director of the
Center for Digital Democracy, a privacy watchdog. The CDD has called on the
Federal Trade Commission and European Union to stop the merger for privacy
and anticompetitive concerns.

On Monday, Microsoft (which reportedly was also in talks to acquire
DoubleClick) and AT&T stoked those fears and also asked the FTC to examine
the merger for anticompetitive issues around online advertising.

Google says such fears are unwarranted. (The deal is expected to close later
this year.) When asked about such worries Tuesday at the Web 2.0 Expo in San
Francisco, Google CEO Eric Schmidt replied that the company recognizes the
importance of privacy and making people comfortable with its practices. He
speculated that Google could create an opt-in system for consumers or
maintain separate data storehouses.

"It's a legitimate concern. If we lose our advertisers' support or end-user
support, the company goes kaput," Schmidt said.

Google representatives did not immediately respond to requests for
additional comment, but Nicole Wong, Google's associate general counsel,
told The Los Angeles Times that the company hopes to merge the
"nonpersonally identifiable data" from Google and DoubleClick to better
target ads. She said that could help prevent consumers from being bombarded
with repetitive promotions. Personally identifiable data like names and
e-mail addresses will be kept apart.

Schmidt and Wong's assurances notwithstanding, privacy advocates worry that
Google's vision for protecting users' personal information on the Web, and
therefore its privacy policies and practices, haven't yet caught up with the
breakneck pace of the company's expansion. DoubleClick was intensely
criticized for the way it handled users' personal information during the
dot-com boom.

"This is bringing together two very large advertising networks. To the
extent that information is being centralized raises concerns that it could
become a target" for hackers or overzealous government investigators, said
Kurt Opsahl, senior staff attorney at the Electronic Frontier Foundation, a
legal advocacy group. "Google said it has no plans to integrate the two
services...but that doesn't mean that later, you might not develop those
plans."

During the dot-com bubble, DoubleClick was to online advertising what Google
is to Web search today. The company dominated the field so much that when it
bought offline direct marketer Abacus and eventually began combining data on
customers' real-world buying habits with their online behaviors, consumer
privacy advocates sounded warning bells.

The FTC stepped in, and DoubleClick eventually backed away from the consumer
media business and from targeting ads based on people's behavior.

Part of DoubleClick's retreat could be attributed to increased competition:
Google and Yahoo became advertising powerhouses and made DoubleClick's
business not as lucrative as it once was.

For Google, the DoubleClick deal is about breaking open the
display-advertising market on the Web in the way it did with search
marketing, media executives say.

By turning search advertising into an opportunity for anyone with a credit
card and Web page, Google has attracted more than a million advertisers for
its search ad marketplace, according to one advertising executive. But
display advertising on the Web is still dominated by about 1,000 of the
largest marketers.

With DoubleClick, Google could try to democratize display and rich-media ads
the same way as it did with search, expanding the number of advertisers in
the mix. In turn, it could boost demand for ad-serving technology that
DoubleClick sells.

Media executives estimate that DoubleClick reaches between 80 percent and 85
percent of the Web population, given that such a high percentage of
publishers and advertisers use its back-end ad-serving technology. (Its
customers include Time Warner's AOL and Viacom's MTV Networks.)

Although DoubleClick's technology delivers the ads, the company does not
collect personal information about Web surfers, nor does it target ads based
on personal preferences, according to the company. Rather, it says its
customers--the publishers and advertisers--own data on consumers.

DoubleClick doesn't need to collect personal information in order to target
ads, privacy advocates say. With the placement of tracking cookies on
individual computers, the company has access to a given computer's Internet
Protocol address, as well as a record of sites it has visited.

"The question for DoubleClick is not whether they own the data but whether
they store it," Opsahl said. "They have a storehouse of information that
could be later accessed by a third party."

The scary scenario for privacy advocates would be if Google were to combine
its own storehouse of data on users--yielded through cookies and other
personal information given up for services like Gmail--with DoubleClick's
data. It would then have unparalleled visibility into people's online
behavior, a point brought home last year when AOL accidentally leaked the
search histories of users.

What's more, with Google venturing into ad sales for offline media,
including radio, TV and print, the company could eventually have a user
profile database that goes well beyond what DoubleClick ever planned.
Google, for example, just introduced a free voice-activated local-search
service for the cell phone and landlines.

"You start to add on more and more collections of information, and they have
the ability to tie all of this together, and that poses a major potential
for privacy risk in the future," said Ari Schwartz, deputy director for the
Center for Democracy and Technology, an advocacy group in Washington.

Merger may spur dialogue on practices
Still, privacy advocates think the merger could be an opportunity to talk to
Google about its practices and put together some clear privacy standards for
the industry.

The CDT has urged the FTC to hold a workshop on behavioral targeting to set
best practices in the industry and get players like Microsoft, Google and
Yahoo to agree on them. The organization wants to ensure that people have
control in the event that these companies begin to merge consumer
information from search and Web-surfing records to personalize ads.

Google currently targets ads to people based only on the context of their
searches. A search for lemon pie recipes, for example, might yield an ad for
Martha Stewart's recipe database. It also uses IP addresses to target people
by their location.

Schwartz, whose CDT brought privacy action against DoubleClick in 2000, said
Google called the center after the purchase was finished. Although CDT is
still talking to Google, he said the group has some concerns with the
acquisition that aren't necessarily related to DoubleClick's collection
practices. They deal more with the wide-ranging projects Google has tackled
without developing clear privacy policies for each one.

For example, Google is forward about letting people know about the privacy
implications involved with installing its Toolbar application, saying "it's
not the usual yada yada yada" and that it will collect Web-surfing
footprints from the user if he or she opts in. In contrast, Schwartz said
Google has been unclear on how long it takes Gmail to get rid of e-mail,
once a user has deleted it, unlike rival Yahoo.

Earlier this year, Google also changed its data retention policy. Now the
company will purge search query data associated with cookies and IP
addresses after 18 to 24 months, rather than its previous policy of keeping
them forever. Still, privacy advocates would like to see Google come up with
data retention policies for other services on its site, such as histories
associated with watching videos on YouTube.

"There's a complexity there about where they're going. They've had this goal
of collecting all of the world's information and making it publicly
searchable, but they haven't had the corresponding policy to protect
privacy," Schwartz said.

"They've had a shadow of protection in what they discuss by 'not doing
evil,' but they don't have that bigger vision," he added.

Opsahl said he would like to see Google consider rendering the IP addresses
that DoubleClick collects through its ad servers more private, the way
Google itself has done.

Google recently said it will remove the last quartet of the IP address
associated with an individual computer so the number is lumped into a larger
set of 256 IP numbers. That way, it can target people based on country, not
by computer. "It's a step in the right direction; it's not complete
anonymity," he said.

The goal, Opsahl said, is "to minimize the amount of information collected
to only the necessary info to operate the business, and keep it for minimum
amount of time. That's something to continue the dialogue with Google
about."

Some think Google just hasn't yet been able to articulate its vision for
consumer privacy. On a conference call announcing the DoubleClick deal
Friday, even one of Google's co-founders had difficulty articulating his
company's plans.

"Overall, we care very much about end-user privacy, and that's really going
to take the No. 1 priority when we contemplate new kinds of ad products,"
co-founder Sergey Brin said.

"So I think anything along those lines..." and Brin trailed off. Then he
added: "There are quite a few challenges with such a plan, with respect to
how we feel about privacy."