Social123: When your social life becomes the target of creepy tactics

Unethical practices

In my book, scavenging the web to build up detailed profiles through social media and other sources is something I feel is freaky and unethical.

...Social123 provides demographic and social data on any company’s Twitter followers including their e-mail address... We also append existing contact databases with publicly available information from Facebook, Twitter, and LinkedIn...

Fair practice

Don't get me wrong - I believe in engaging your audience through social media and enriching customer profiles through the information you have legitimately collected - with consent. Is what social123 doing legal? If you use their service will you put yourself into at legal risk? For example, in Canada, read "Fair information principles" from the Personal Information Protection and Electronic Documents Act (PIPEDA). Among the ten points, see those:

• define the purposes of its collection
• obtain consent
• limit its collection, use and disclosure

Do you feel what social123 is doing abides by PIPEDA principles?

The WAA Code of Ethics

As an analyst, I strive to follow strong ethics and I embrace the WAA Code of Ethics. I feel it is our collective responsibility to call out those who we believe are not helping our industry. Heck! If this company is so good about social media they will certainly get an alert within minutes of my posting... let's see what happen!

So, tell me... am I freaking? Am I the only one who think the practice of "data appending service" is unethical and potentially illegal?

For the record

The first time I got their spam I didn't disclose the company name and simply replied. I shared my concern on twitter and G+... I played fair.


But the same Jo Turner (no LinkedIn profile...) spammed me again with the same type of message. I had clearly indicated in my first reply that I was uncomfortable with their service - to which I never got any feedback.

Mistakes:

• #1 - Spamming
• #2 - Not replying to my comment
• #3 - Spamming again...
• #4 - This whole concept of building up profiles!

So here it is for you pleasure - and I will continue to update as it unfolds:

---

From: Bo Turner [mailto:bo.turner@social123.com] 
Sent: June-05-12 17:33
To: stephane
Subject: Monetizing Social Media for Marketing Automation

Stephane,
My company, Social123, provides demographic and social data on any company’s Twitter followers including their e-mail address. I found your information using our techniques and thought you may be interested in learning more. This information can be obtained for your company, industry, association, or even your competition.

We also append existing contact databases with publicly available information from Facebook, Twitter, and LinkedIn – and score them based off of their content mentions so you can reach out to the people who matter most.

Please let me know if you have a couple of minutes to discuss.
 
Bo Turner
Senior Sales Executive
www.Social123.com
(864) 494-7488

---

From: Stephane Hamel
Sent: June-05-12 17:38
To: 'Bo Turner'
Subject: RE: Monetizing Social Media for Marketing Automation

Hey you – if you want to be serious with social media, start by abiding by stronger ethical rules about spamming and check the profile of those you are talking to…

BIG MISTAKE!

---

From: Bo Turner
Sent: June-23-12 11:15
To: stephanehamel
Subject: Social Followers Plus
Hello Stephane,

I hope this week is off to a grea start! I know you weren’t expecting my email but I thought our new SocialFollowers+ would be of interest. My company, Social123, provides a completely automated system that will find demographic and social data for your social followers. We can append this data with SocialPoints+ – our customized scoring platform - which helps you rank your most influential contacts. We can also append an email address for many of the contacts. 

I found your information using our techniques and thought you may be interested in learning more. If there is a specific contact list, twitter handle or crm list you would like to append with social data, social points and emails, we would love to help.

You can sign up for free and see 150 results here http://www.social123.com/register. I am here to answer any questions and would love the opportunity to connect.
Best-

Bo Turner
Director of Strategic Accounts
Bo.Turner@social123.com
Social123 – Monetize Social Media
C: (864) 494-7488

Web analytics ethic: from theory to practice

A week ago I published three short cases where people were invited to comment on whether they were legal, ethical and abiding by their web analytics vendor Terms Of Service (TOS). Inspired from my own experience and after much talk about the WAA Code of Ethic, sessions at the recent eMetrics and discussions I had with some vendors, I thought participation would be much higher.

Here’s my point of view and some info from the brave souls who were up for the task! You should really read the previous post before continuing!

---

Photo: stock.xchng

Disclaimer: I'm not a lawyer nor a specialist of ethics - this information is provided as is... do your homework!

The majority of the 14 respondents were from the US and UK with some participants from Canada and other European countries. Unsurprisingly, most respondents said they were using Google Analytics.

Case #1: matching transaction id against back-end.

	Unsure	No	Yes
It is legal	20%	0%	80%
It is acceptable based on my TOS	27%	20%	53%
It is ethical	13%	13%	73%

In my opinion, this is perfectly legal – the data was collected with user consent in the context of a commercial relationship. It is also ethical – it is common and accepted to send a “thank you” email, along with the purchase details and some offers. The fact it is sent through traditional snail mail doesn’t matter – or does it? Since the transaction was done online, there is usually an expectation communications will also be conducted online. As one of the respondents put it, “At the end of the day, 'ethical' depends more on your relationship with your customer than anything else”. All serious tools vendors TOS specifically prohibit sending Personally Identifiable Information (PII) to their system.

A transaction id, which is clearly not PII, is typically set by your back-end system and stored in your web analytics service of choice. This is a piece of data coming from your own system, and used back to merge against it, generally no TOS issue – except with Google Analytics TOS! (emphasis mine)

7. PRIVACY . You will not (and will not allow any third party to) use the Service to track or collect personally identifiable information of Internet users, nor will You (or will You allow any third party to) associate any data gathered from Your website(s) (or such third parties' website(s)) with any personally identifying information from any source as part of Your use (or such third parties' use) of the Service. You will have and abide by an appropriate privacy policy and will comply with all applicable laws relating to the collection of information from visitors to Your websites. You must post a privacy policy and that policy must provide notice of your use of a cookie that collects anonymous traffic data.

Repeat: "You will not associate any data gathered from your website(s) with any personally identifiable information from any source as part of your use of Google Analytics". Essentially, if you use Google Analytics, you should not extract transaction ids to merge them back against your own system. This is a non-sense to me and I know of several organizations that are actually doing it – probably without realizing they are breaking their GA TOS. Let’s hope this will be revised.

Case #2: matching product id (SKU) against back-end

	Unsure	No	Yes
It is legal	7%	0%	93%
It is acceptable based on my TOS	27%	0%	73%
It is ethical	7%	0%	93%

Legal, ethical and no TOS issue. The key element here is that no PII is involved. From a business standpoint, what’s interesting is the ability to use behavioural data to correlate with sales in order to build a predictive model where we “know” which online behaviours are early indicators of upcoming sales and therefore, adjust inventories accordingly.

Case #3: key created from (potential) PII without user consent

	Unsure	No	Yes
It is legal	33%	20%	47%
It is acceptable based on my TOS	53%	40%	7%
It is ethical	33%	33%	33%

If I got it right, in the US: last name alone, 5 digits zip code or last digits of phone number are not considered PII.

However, in California, OPPA specifies what is typically a non-PII become PII when combined with other data (such as having gender associated with a specific person). In Canada, the PIPEDA law stipulates data must be collected with user consent and used for the purpose it was collected for. In Europe, and especially Germany, a last name is PII (so are IP addresses and a whole bunch of things!).

Is it ethical? In this specific case, the data is stored even if the transaction isn’t fully completed. Therefore, this practice is against the 3^rd WAA Code of Ethic guideline: User Control. It is also against PIPEDA in Canada.

What about the TOS? In general, this wouldn’t be an issue and it doesn’t really matter if this string is further encoded to obfuscate it. However, Google Analytics TOS still doesn’t allow us to use this key to merge with any other data that could contain PII.

In airports, the stand by list typically shows first three letters of last name and first letter of first name

My take

While there are passionate arguments on "free vs paid" in the #measure tweet universe, I was sincerely disappointed a topic like ethic and legal didn’t raise much interest. Is it because of a lack of interest? Fear of being wrong?

Either way, it makes me wonder if web analysts happily embrace the WAA Code of Ethic because it feels good and it's a worthy cause... or are just full of it! I guess what’s most important for now isn’t to know all there is to know about ethic, legislations and TOS, but to take action when innapropriate situations are uncovered.

I don't pretend to know more than anyone else, in fact, I'm willing to be wrong! If you have comments or additional useful references, I would love to hear from you!

Web analytics ethic trivia

While I'm still working on the 3rd post in my series on "the math behind web analytics", I thought we could play a little game related to the WAA Code of Ethic.


Read the three cases below and for each one, think if this is something you might be doing already or would feel ok to do... or not. Then you'll be invited to vote and comment (anonymously).

1. For an ecommerce site using your web analytics vendor of choice, the transaction id, along with traffic source data (referrer, campaign, search keywords, etc.) and micro-conversions info (which other business valuable tasks were completed) are extracted using the API. The transaction id are then looked up against your sales database in order to do further segmentation and build a customer list (name, address, purchase details, demographics, etc.) that will be used to send a "thank you" snail mail, along with a 50% discount on a future purchase. Clearly, there is a customer-vendor relationship in place and the information for the purchase was collected with user consent.
   
   Is this legal? Is this allowed by your vendor TOS? Is this ethical?
   
   
2. Still for the same ecommerce website, you extract the product SKUs, along with item quantity sold and the same source data and micro-conversions info. The data is merged against the back-end inventory database using the SKU and predictive models are developed to know which stock levels are optimal for each SKU.
   
   Is this legal? Is this allowed by your vendor TOS? Is this ethical?
   
   
3. A financial institution typically has several types of requests: credit card, mortgage and other financing inquiries, retirement simulator, insurance quotes, etc. Completed requests are stored in back-end systems for processing - those transactions are frequent targets of fraudulent behavior or are abandoned along the way. One way to generate a unique key is this: first 3 letters of last name + 1st letter of first name + 4 digits zip code (or last 3 characters of postal code) + last 4 digits of phone number. The result, for me, would be HAMS4C02637.
   
   Is this legal? Is this allowed by your vendor TOS? Is this ethical?
   
   Update: to make it clearer, this type of key could be used for lookups against other systems - and could be encrypted using MD5 to make it more obscure - but it is still built from input data even if the transaction isn't fully completed.

Let's see what you think - I'll share my point of view a bit later (along with pointers to reference material). I certainly don't pretend to be a lawyer or a professional of ethics, I'm just an analyst with some experience. Those three cases are inspired from real situations.

The question is... what would you do?

If you are up for it, head over here to vote and comment.

Web analytics, privacy and the WAA code of ethic

The Wall Street Journal did a whole series on “What they know”. Online marketers - especially when it comes to ad networks, web analytics and behavioral targeting – are depicted as evil spies and Cookie Monsters. Call it sensationalist, biased or even lies and fallacies; it depicts what is generally perceived outside of our little web analytics industry. If we listen to the WSJ, even underlying concepts of Web 2.0 such as embedding widgets on a website is evil. Their analysis revealed content (and most likely, cookies) being served by a 3^rd party… Bad, bad, bad! It goes beyond web analytics, but when threatened and called upon, people react and as is often the case, external events forces us, web analysts and the WAA, to act.

A fundamental misconception of web analytics

Over the year I have taught over 700 people on the fundamentals of web analytics trough courses at UBC, ULaval and my workshops. Oftentimes, a fundamental misconception about web analytics takes the form of "With the help of Google Analytics (or whichever tool), I can find dimensions such as number of visitors from a city, the source and frequency of their visit, recency of visits, keywords used, etc., however, how can I find "who these visitors are?" How can I find their contact details so as to start a personalized initiative?"

First, we need to understand the fundamental difference between Web Analytics and Customer Relationship Management (CRM).

Web Analytics

Web Analytics is about a “statistical population”, "segments", "margin of error", "outliers", etc. The goal is NOT and should NEVER be to identify unique people, but to look a trends and patterns of online behavior shared by different groups of visitors. Web analytics pertains to the realm of inbound and onsite marketing and customer-facing optimization: campaigns, web sites, social media, etc. Period.

We are not in the business of tracking users’ journey on the Interweb.

Behavioral targeting

Behavioral targeting doesn’t necessarily look at unique users; it looks at pattern of similar user behavior to determine what worked and what didn’t. However, admittedly, there are more advanced solutions where specific individual behavior is analyzed and the persuasion scenario tailored accordingly.

This can be done without ever using any PII.

Customer Relationship Management

CRM is about one-to-one customer relationship, keeping track of “touch points” for each individual person, regardless of the communication channel they use – phone, email, web, etc. At its core, the goal is to improve the relationship with prospects, clients & customers by optimizing processes around all communication channels, all touch points, at all time.

We are at the opposite end of the spectrum: Personally Identifiable Information (PII) such as name, phone, email and even more are critical to CRM.

Ethical & legal aspect

It is unethical and illegal in most cases to collect uniquely identifiable information such as contact details (phone, name, SIN#, complete address, etc.) without express user consent. Although it is technically possible, especially with advanced solutions, to collect custom data such as PII, contact details should be collected within corporate systems and used within the limits of the applicable laws (US, Canada and the European Union have laws & guidelines regarding when, how, for which reason and what you do with the collected personal information – see Privacy and PIPEDA for examples).

Offering a customized experience on Amazon because it recognizes you is CRM, not web analytics. Facebook happily using all the data you give it, reselling it or making whatever they want with it is CRM, not web analytics – risky business, but done with user consen – well… kind of. Services using Flash Cookies, be it ad networks, web analytics tools or web sites themselves storing data without user consent and rebuilding it even after the user consciously deleted it is illegal in my book… and it seems I’m not alone thinking that.

My take

Eric Peterson drafted a web analytics code of ethic and I’m glad he accepted to publish it under the umbrella of the Web Analytics Association instead of on his own. After calling on the WAA to be the voice of the industry, it would have been awkward to do otherwise! Lots of people talked about it on Twitter, commented on the blog, bloggers posted their own point of view and some vendors, like Webtrends, publicly took a stance (tip of the hat to them!). On my end, I updated my privacy policy to reflect the proposed code of ethic.

Certainly all good things. However, the WAA as an organization has about 1500 members, the whole web analytics engaged practitioners and consultants’ base represents about 5000 people worldwide. Let’s be realist… The WAA is a small fish compared to other, well established organizations such as the IAB, and honestly, pretty much insignificant when faced with structured privacy lobbying groups. It seems web analytics vendors are still more interesting in competing, purchasing and killing one another than joining a coalition and lobby for the future of the industry.

Other associations are already ahead, like the IAB Privacy self-regulation compliance icon which is being developed in collaboration with the Future of Privacy Forum. The WAA simply doesn’t have the resources and lobbying power. Considering Microsoft, Adobe and Yahoo are already members of the Future of Privacy Forum, I think the WAA should simply rally the IAB and the FPF.

Whitehouse.gov: snafu around a web bug

Even the best of intentions are often incorrectly brought to life. Here are some random quotes & opinions about the InformationWeek article entitled "White House Web Site Revisits Privacy Policy".

Note: in this post, emphasis in quotes are mine...

Privacy Policy

1st mistake: forgot to update privacy policy. The whole thing seems to have started because 3rd party cookies from WebTrends were found while the privacy policy didn't mention it.

Of course, stating "attorney" and "web bug" in the same sentence is nothing to reassure casual users and those not educated about web analytics (emphasis mine): "an attorney, warned [...] the WhiteHouse.gov site contains a Web bug."

"Certain details"

The long article continues and mention "in the process of receiving the remote request from WhiteHouse.gov [...] WebTrends also receives certain details". "Auerbach observed [...] that while he recognized some of the data requested [...] the other data gathered by WebTrends was unclear." Then the article goes on to (try) to explain "what" is being collected and fail miserably. Why? Because most web analytics vendors do not provide detailed breakdown and disclose usage of each of the parameter data they are collecting.

Using WASP would easily reveal most of value-pair information sent to WebTrends. While most tags are documented in vendors implementation guides, some of them are not. Getting information about their specific use is very difficult. And this is not specific to WebTrends, other vendors are also very reluctant in letting end-users know exactly what each tag is being used for as I found out myself.

Is it legal?

I don't want to put oil on the "is it ethical" fire. To me, that's a waste of time. However, suggesting  web analytics (in general) might be illegal is a whole other story: "I would suggest that since the collection, aggregation, and conveyance of the data to WebTrends is from the user's computer and not from WhiteHouse.gov that a very strong argument can be made that the data belongs to the user, not WhiteHouse.gov".

However, "Auerbach concedes that the data sent to WebTrends may not be clearly categorizable as personally identifiable information."

Case closed.

JavaScript Security?

"[JavaScript] is not a particularly safe practice or good for privacy, although most major sites still do it anyway, using WebTrends, Omniture, or Google Analytics". We've been arguing about that for years, yet, I still talk to a lot of people who think JavaScript and cookies are evil. As with any other technology, they can be used to make our lives better... or turn them into nightmares. Such bold statements, like any radical opinion, is never good to foster discussion and advancement.

My take

My takeaways from this story:

1. The privacy policy of Whitehouse.gov should be reviewed.
2. WebTrends should also be configured to use 1st party cookie (although, in the end, the data would still be sent to WebTrends anyway).
3. I will continue to talk with vendors to provide full disclosure about the exact use of each of the parameter they receive and include that information in WASP
   
4. Privacy advocates and casual users certainly needs to be better educated about web analytics

WASP usage tracking: full disclosure & ethics

I'm generally receiving very positive feedback about WASP and I take great pride in reading and replying to every mail I get about it. Since WASP is and will remain a constantly evolving tool for an ever changing industry, I'm also listening to "the voice of the customer" in order to decide what to do next. This morning I received something that I want to make public and comment about:

I have just noticed when debugging a client’s website that your WASP utility is tracking every request that we are making to all the sites that we visit whilst this utility is installed in our web browser.

Sorry, but I think that this is too invasive and as such I am uninstalling the utility.

Is this commonly known? If not I encourage you to make it known as I am sure others will be as uncomfortable with this as I am.

The facts:

• It’s clearly indicated on the addons.mozilla.org page, that WASP has a privacy policy
• It’s indicated in the EULA shown on the addons.mozilla.org site as well as the one shown at installation time, if you don't agree the extension is not installed
  
• You can turn that off from the Options menu.
• I'm using a tweaked implementation of Google Analytics to track host name/tool name, and some other default info like geographic region as automatically collected by Google Analytics.
  

What can you do?

• Turn off this option
• Enable WASP only when you want to check a site. WASP can be turned on/off by doing right-click/disable on the status bar icon. In this case, I don’t get any info... but see below why it's important.
• Uninstall WASP... sadly :(
  

What can I do?

• Maybe change this feature to be opt-in instead of opt-out.

What I already did:

• In the latest version currently available (v0.30) I have tweaked this behavior so I only get 1 data point per host/tool found (having it for each page was a bug in v0.29!).
• In v0.31 actually under development I have tweaked it further to receive less data and filter out what looks to be an internal domain name or IP address.
  

Why it's like that?

The collected data allows me to improve WASP: knowing which tools and where they are used helps me identify bugs and required features. For example, the next version will include more features specifically targeted toward Google and Omniture. Another side effect of the data collected through WASP is the ability to provide market research information such as the vendor market share I have started to publish.

The ROI

We're into web analytics and we know how important it is to measure, and especially measure ROI.

For the user, WASP ROI is easy: it's free, it saves valuable analyst/implementation time that can be several hundred dollars an hour, and it provides valuable information on the spot as well as market information available nowhere else.

Honestly, I have spent countless hours working on this tool and it’s based on voluntary donations. The economic model simply doesn’t work: less than 250$ donations after over 30,000 downloads, 200,000 data points collected daily, accounting for 15,000 web sites analyzed on a daily basis! One of my alternative is to provide market reports and sell them so WASP remains free. I’m also seeking other alternatives, such as corporate sponsorship from the web analytics vendors. Just to be clear, I want to continue to offer a free tool to the web analytics community, but even if I don’t get rich doing it, it has to do economic sense for me.


I know there’s a fine line between privacy and justified data analysis and being in the web analytics field, I want to make sure that I’m not crossing that line. Finally, WASP is still in beta, and feedback is very important! I carefully consider every comment I get.

I hope you will use or continue to use WASP and don’t hesitate to provide feedback and comments.

Blocking web analytics solutions?

Adam asked this very interesting question on the Yahoo! Web Analytics forum: "I have a client that claims that visitors are able to block all of the Omniture tags on their site. Is this possible? I'm not referring to cookies, rather the entire functionality. Has anyone else ever heard of this? If so, how can a visitor do this or what apps can cause the Omniture tags from firing off."

I see many ways this could be done with various levels of efficiency, and this is true of any tag-based solution, be it web analytics, ad networks or even widgets such as Feedburner subscribers count and many others. Some people have already highlighted a couple of ways. Here's some more info:

• Disabling Javascript: mostly unrealistic, this would render the web almost unusable. I don't believe a large portion of users would do that, other than privacy idealists who would pay everything cash to avoid being tracked by credit card companies...
• Disabling 3rd party cookie: obvious and easy, and that's why it's so important to use 1st party cookies, or at least what is called "friendly 3rd party cookies"!
  
• Antivirus/antispyware/ad blockers: also obvious and mostly the same thing as disabling 3rd party cookies because those tools will look at the 2o7.net used by Omniture (or whatever tool)... again, use 1st party cookies!
• Special browser extensions: most of them use simple URL and cookie detection... again, use 1st party cookie. More advanced ones might look at the presence of a specific Javascript object and substitute the function by a stub one... This is probably the most effective and advanced way of doing it. Doing this with Greasemonkey would be very easy.
  

Which brings an interesting point... while developing WASP I thought about adding an option to block specific tags/solutions. In some cases it would make sense for WA analysts and for implementation quality assurance. I decided not to do it because this would have made WASP the best anti-web-analytics tool on the market! I think education is better than this!

But then again, although 3rd party cookie blocking is easy, it's still not pandemic and there are "clean" ways to work around it (and I'm not talking about exploiting Flash Local Shared Objects to bypass cookie security!). I think cookie deletion is a much wider problem and it might have more impact on our analysis capabilities. Totally blocking a specific web analytics, yes, but would it be statistically significant? Surely not.

Is it ethical to track individual details through WA?

Another very interesting discussion thread on the Yahoo! Web Analytics discussion group. The question is:

Let's say the marketing department wanted to review the behavior of each and every user of an internal application in the banking domain. Would it be ethical to use Web Analytics to track this information?

Ethical concerns are very different when dealing with the general public or employees, especially if within the boundaries of internal corporate systems.

Web Analytics and system journalizing

Web analytics should not be used to track individuals, but rather to find actionable patterns that you can act upon. Just like in a statistics sampling, you don't have to use all the data, and you don't focus on an individual entry, but you can still come up with valid conclusions.

Journalizing (to record in a journal) goal is to track the actions of an individual person. This can be a perfectly valid scenario where "non repudiation" of an action is important (such as in financial transactions). This is usually done at the system level and is stored in secured databases, not using WA solutions. For internal systems, especially in financial institutions, it is best practice to monitor abnormal employee activities.

Is it ethical?

In the specific question above, the IT department because they are very likely to already have some kind of logging and monitoring in place... and probably it's something not widely publicized within the organization. Now, from a marketing perspective, I don't think it would be ethical to use that data in to track individual user actions. Would it be acceptable for marketing to read each employee email in the hope of understanding what everyone is doing? Obviously not. Is it acceptable to monitor email activities to filter or act on viruses, spam, adult oriented or confidential leaks received or sent by employees? Absolutely. It should be the same for the use of web sites and other systems: act on the exception, not the individual person.

For more information on this topic, read my previous post entitled "Protect you customers' privacy ethically, not legally".

Google: Is there a God?

New version of a classic joke

One of the most powerful organization in the world decided to ask the question to it's hi-tech computer. "Is there a God?". After feeding in all relevant information available they typed it in and waited. After a lot of computing the system went into an eerie silence for a few minutes and then started typing.

It's answer was "Insufficient data."

Not to be outdone, the 8,000 engineers in their infinite wisdom started gathering all the information from the Worlds libraries, archives, and Web sites. So much information was assembled that it was decided that one computer could not handle it all so a network of computers were linked for the operation. Again the question was asked and all the computers went into action. After a couple of minutes the answer was forthcoming.

"Your search for - God - did not match any documents."

Calculated a bit more and said:
"- Make sure all words are spelled correctly.
- Try different keywords.
- Try more general keywords.
- Try fewer keywords."

This time they were going to get an answer to an age old problem and nothing would stop them. After months of negotiations with the most powerful companies and worldwide governments they were able to gather enough data and link all the computers in the world together to produce the ultimate super-computer. Nothing would stop them now. Just to make sure they fed in all information even remotely connected to the subject, they included every piece of personal information they could find.

The CEO typed in the question:



The computer whirred into action checking all it's drives and then linking with all the other computers. After seconds of activity going from one computer to another everybody waited eagerly as it typed to the screen.

The moral of the story

This joke highlights the point that too much power concentration, even with the best intentions, can lead to unpredictable results. As Google market caps continues to grow (and is predicted to surpass Microsoft), attention as already shifted from one super-power to another. At the same time, worries of abuse are also shifting from Microsoft to Google. While people worried about Microsoft monopolistic positions as a software platform, Google's privacy concerns are much more troublesome. This step is just the logical chain of event that historically grew from IBM's hardware to Microsoft software, and now to Google data.

Totally excluding Google from our lives is similar to saying we won't watch TV or drive our cars... Except for the most hard core people, this kind of tactic is unrealistic. Our hope is Google will understand there is a fine (virtual) line they shouldn't cross. They are starting to play with it and if they don't watch, the "2006 person of the year" could very well start to look at other alternatives.

Cookies will get you confused

Update 07/02/13: After receiving a comment from Stephane, I realized I didn't see the subtle condition where one would get a 1st party cookie from Google.com, and later that same cookie be used in a 3rd party context such as when you embed a Google Ad on your site. This obviously leaves room for litigation and abuse. In my opinion, as soon as you "abuse" your relationship and trust privilege, your asking for trouble...

A post on Lies, damned lies left me wondering about my own experience with cookies.

Unless I missed something in my years of experience using and developing on the Web, a cookie can only be set AND read either by the site, or the domain on which it was set (depending on the value of an argument when the cookie is set). So even the mighty Microsoft/Yahoo!/Google can't do anything about it.

Most ad networks models are based on the fact a banner is served by their own web server (the 3rd party), but included within another's web site (the 1st party). DoubleClick raised uproar a couple of years ago because as part of their ad network, they were using their own cookies collected trough the means of being included in other's web sites, to analyze specific user's behavior across hundreds of web sites. Self regulation and lawsuits caused by obvious abuse led to a point were in theory, ad networks use aggregated models and are not supposed to track that Mr.X is reading times.com during the day and something of another nature at night...

A trick someone could use to pass values from one site to another "partner" would be to use the URL Query String as a relay. This would certainly be viewed, in most cases, as an invasion of privacy. Some even use Flash ability to store data on the local drive without user intervention and knowledge as a replacement of cookies, which is, in my opinion, even less ethical.

My simple definitions:

• 1st party cookie: set and read by the same server (for server-specific cookies such as host.domain.com), or on the same domain (for domain specific cookies such as *.domain.com)
  
• 3rd party cookie: set and read by a server on a different domain, or on a different host (for server-specific cookies - host.domain.com embedding an image from some.ad.net)
• friendly 3rd party cookie (or 2nd party): what would be a 3rd party cookie, but set trough a host on the first party domain which is a DNS alias of a 3rd party host. For example, stats.mydomain.com is a DNS CNAME of mydomain_com.2o7.net (2o7.net is the domain used by Omniture tracking). This technique is often used to avoid being identified as a 3rd party cookie.

In my humble opinion, any tricks used to bypass those definitions, be it by passing data on the Query String or using permanent storage techniques without the user's consent, is a blatant demonstration of privacy abuse. Do I have to strong an opinion? Am I missing something?

So I'm not sure I understand Ian's post, but if my reading is right, and if a company like Microsoft would even think of using their power to share information about my relationship with them without my consent, regardless of their honest intent, I would strongly argue against it.

Protect Your Customers’ Privacy Ethically, Not Legally

Following the recent posts about privacy and web analytics, it appears that ChangeThis was at it too with a new Manifesto entitled "The Seven Principles of Privacy: Protect Your Customers’ Privacy Ethically, Not Legally", authored by David Holtzman. I guess this will be covered in depth in his book "Privacy Lost: How Technology is Endangering Your Privacy". The manifesto highlights 7 ethical principles which might be worth looking at:

1. Don't spy on me because you can
2. Thou shall erase my data: Don’t keep data any longer than you have to; you can’t give up what you don’t have.
3. Keep my information to thyself: Require customers to opt-in for each additional use of their information.
4. Don't judge me: Never create a profiling system that labels your customers in a way that you’d have trouble justifying if they ever saw their file, because some day they probably will.
5. Protect my data like it were thine own: Provide the best computer security that you can afford.
6. I am who I say I am: Let your customers pick their own demographics.
7. Don't humiliate me: Avoid embarrassing your customers by mishandling their data.

Some of those points really focus on corporate employees, while others could be applied to anonymous data, and some are really closely tied to personal information management.

I really like the conclusion of the manifesto:

Laws make poor privacy guidelines. Business people need better directions when navigating their customer relationships than simply to be told to steer around legal roadblocks. Boardroom discussions should be less about what is permissible and prohibited and more about what is positive and proactive—in short, what is ethical. The question should not be “Can we do this?” but “Should we do this?” “What’s the right thing to do?” If your company handles the electronic representation of the customer the way that they’d deal with them if they were standing face-to-face, you’ll do fine.

It is more a general view on privacy and anonymity not specific to web analytics, however, there are some good tidbits in the complete article (plus, the ChangeThis format is fantastic, check it out if you never had the chance before!).

Tags:

• analytics
• privacy
• ethics

Web Analytics and Privacy

The heat is on again: an activist group is asking the US Federal Trade Commission to investigate the use of personal information, which, in my view, is already well governed by existing laws not only in the US, but in most countries, including Canada. The problem is this group mixes personally identified data collection and includes web analytics and anonymous data collection in the same bag.

The Web Analytics blogosphere is likely to have passionate views in regard to this opinion. So far, one of the most interesting post comes from the Web Analytics Yahoo group. The argument is simple, evident, and clearly expressed: there is already a user consent for anonymous data collection covered by privacy policies posted on any serious web site.

My contribution to this discussion is in regard to PIPEDA, the Personal Information Protection and Electronic Document Act, the Canadian law that governs the collection of private information. In a nutshell, that means the information must be:

• gathered with the user's consent
• collected for a reasonable purpose
• used only for the limited purposes for which it was gathered
• accurate
• open for your inspection and correction
• stored securely

This is expressed in 10 principles:

1. Accountability
2. Identifying purposes
3. Consent
4. Limiting collection
5. Limiting use, disclosure, and retention
6. Accuracy
7. Safeguards
8. Openness
9. Individual access
10. Challenging compliance

It is worth to note these principles not only covers the collection of personal information, but also applies to anonymous information as well. We have to admit, however, the law is not strongly enforced. Still, those who try to comply have found it reasonable and it doesn't impact the ability to use web analytics tools to better understand their user audience and preferences.

The W3C also offers some guidelines in the form of "P3P: The Platform for Privacy Preference". Although not widely used so far, I think sites offering the information about their P3P policy have an advantage:

The Platform for Privacy Preferences Project (P3P) enables Websites to express their privacy practices in a standard format that can be retrieved automatically and interpreted easily by user agents. P3P user agents will allow users to be informed of site practices (in both machine- and human-readable formats) and to automate decision-making based on these practices when appropriate. Thus users need not read the privacy policies at every site they visit.

P.S. Note the province of Quebec is governed by a similar act named "An Act respecting the protection of personal information in the private sector"

Tags:

• analytics
• privacy