The Ethical Issues with 3rd Party Behavioral Tracking

Eric PicardThe Debate” is a column focused on the current debate around ad targeting and consumer privacy. Last week, executives in the digital ad ecosystem provided their thoughts about online behavioral advertising and, specifically, “If a consumer asked you ‘Why is tracking good?’, what would you say?” Read it.

Today, TRAFFIQ Chief Product Officer Eric Picard continues the theme with his own thoughts on behavioral tracking.

Companies that track consumers’ behavior across the web without their consent, and without providing them any recognizable value, should stop. I’ll argue that virtually no company that tracks consumer behavior across multiple sites actually provides consumers with recognizable value.

And the real issue here is that consumers never opt-into being tracked this way – if we required this, then the ethical issues would go away. But we don’t require an opt-in because in reality, consumers don’t want this, don’t benefit from it, and as an industry we’re acting in unethical ways. I realize that for this audience, my position makes me as unpopular as a New York City steam bath in August, but I challenge the industry to really stand up and do the right thing here.

For clarity – Publishers that track what their visitors do on that one publisher’s site face completely different issues. Consumers who visit a publisher’s site are engaging in a direct relationship with that publisher. As long as the publisher is collecting data to be used only on its own website, this is defensible – the consumer has elected to visit their site, and gets the value of content that the publisher provides. And if the publisher asks the consumer to opt-into being tracked across multiple websites, then there is no ethical issue at stake. But cross-publisher behavioral tracking should definitely require an opt-in.

As long as a publisher has a clear privacy policy, data collection for their site without an opt-in is ethical. The consumer gets value from personalization of content as well as enabling the publisher to sell behaviorally targeted advertising. And the publisher has the right to collect this data to optimize their business, especially given that most publishers make the most of their revenue from advertising – this data is generally used to better sell ads to advertisers.

While a consumer is visiting a publisher’s site, the publisher certainly has the right to track his or her behavior. And having a user specifically ‘opt-out’ of being tracked on that publisher is the ‘right’ option to provide in terms of creating consumer good will.

There are three arguments commonly used by advertising industry professionals that make a case for behavioral targeting today:

1. Behavioral targeting makes advertising more relevant, a consumer benefit.

Targeting doesn’t make advertising more relevant – it makes a small percentage of the ads people see more relevant. In order to really increase relevance of advertising via targeting, the number of advertisers would need to vastly increase. There are more than 5 trillion ad impressions per month in online display. And more than 90% of US display ad spend is driven by less than 6,000 advertisers.

Frequently the argument is used that with Paid Search, consumers feel that contextual targeting makes the ads more relevant. But contextual targeting doesn’t require consumer behavior data. And further, the basis is completely wrong: Paid Search has roughly 250 billion impressions a month, and 400,000 active advertisers (verses 5 trillion ad impressions and 6,000 – 8,000 for display ads.)

The math is pretty simple – there is very little opportunity to target display advertising against niche segments today in order to increase overall relevancy of the ads. The reason people aren’t seeing relevant ads is not because targeting is not good enough, or we’re not collecting enough behavioral data, it’s because there are too few ad creatives to apply against the vast number of ad impressions.

This could change over time as more advertisers start moving into display – especially if we ever find a way to make display advertising efficient and effective for local advertisers, at which point there’d be lots more creatives. But even in these cases – cross-publisher tracking wouldn’t be necessary. As long as we had geographic targeting available (which doesn’t require any browsing history) and basic data that the publisher could track themselves, the ads could be much more relevant and valuable. But, until we grow the number of advertisers, and more importantly, the number of creatives to more closely match paid search – this is a moot point.

2. There is no harm in the third-party tracking technologies, the tracking is anonymous.

So-called anonymous tracking is not very secure – the anonymity is fairly easily broken. Cracking open that anonymous shell and merging it with personally identifiable information from other sources is a fairly easy engineering feat. Search for, “netflix prize privacy” in any search engine for one example. (Keeping in mind that this example is from 2007). There’s been a lot more examples since then.

Beyond this, many of the players in the behavioral targeting space are small startups, without a huge amount of investment in security infrastructure. Even major corporations have leaked millions of people’s data into the public domain. Searching for “AOL Data Leak”, “Sony PlayStation Data Leak”, “Skype Android Data Leak”, “Epsilon Data Leak” should prove interesting. More of these happen all the time. If these major corporations can’t keep your personal data secure, the idea that a small startup is a safe place for this data simply doesn’t ring true. And I say this with all respect to my friends working at these companies – at the same time, I’m worried about it.

There are lots of very ethical people in this industry who would never do anything intentional or nefarious with the behavioral data that is collected. But that doesn’t mean that bad actors don’t exist. And even if good people are at the helm in some of these companies today – over time, mergers and acquisitions, or bankruptcies can cause changes in ownership over this potentially sensitive data.

I think I’ve shown above that the potential for damage is both real and proven, and could be quite harmful.

3. We’re not as ‘bad’ as the offline marketers.

I probably shouldn’t have to even engage in this kind of argument. But just because I hear this a lot – I’ll address it.

Yes, the offline direct marketers do use a lot of targeting data – much of it using personally identifiable information – in order to target users on direct mail campaigns and other mechanisms. Yes, they use credit card purchase data, and financial data that no consumer really would ever be excited about anyone getting access to. And yes – they’ve been doing it for years. As far as I’m concerned, this is unethical as hell. And I’ve written lots of articles over the years that state my position on this.

That doesn’t justify us doing this online, even if we were doing things in a vacuum. However, we’re not doing things in a vacuum. The process used in the online space in order to support a lot of this behavioral targeting data being actually used for buying ads requires cookie matching.

Cookie matching requires the use of a third party to find some kind of ‘data key’ that sits in a third party data provider, which is used to match two anonymous sources together. This can be an email address, or could be a telephone number, or a mailing address, or something else. This ‘key’ allows two separate anonymous cookies to be matched together as one single user.

The main providers of this service are the same exact ‘offline marketing’ data companies that are referenced by people in our industry as the ones who are ‘worse than we are.’ In other words – there is no difference whatsoever between the online and offline data providers – as they are both used in order for this behavior to function in our space.

Some of you may remember that the acquisition of Abacus (an offline data provider to direct marketing companies who built targeted mailing lists) by DoubleClick was blocked way back in 1999 because of fears that Abacus’ data would be able to merged with online data, and that this was a dangerous thing to the privacy of consumers.

But in reality – only a few years later, other providers of offline data for direct marketing began offering this kind of cookie matching service to online marketers – without any acquisitions. If this was such a concern that it caused DoubleClick’s acquisition to be rejected by regulators – then why is this not a concern when it’s done as part of the day-to-day business of the online advertising industry?

In the end, this is really just about doing the right thing – from my perspective. Consumers should give their approval before anyone without a direct relationship with them begins tracking their behavior across numerous web sites. This seems self-evident to me, and to most consumers I’ve talked to about it. The only argument to the contrary I’ve ever gotten was from professionals in the marketing industry. And as I’ve shown above, these don’t hold water as far as I’m concerned.

Follow Eric Picard (@ericpicard), TRAFFIQ (@TRAFFIQ) and (@adexchanger) on Twitter.

Enjoying this content?

Sign up to be an AdExchanger Member today and get unlimited access to articles like this, plus proprietary data and research, conference discounts, on-demand access to event content, and more!

Join Today!


  1. Eric,

    Thanks for writing this thoughtful article.  I think this conversation should be happening more often than it is.

    I offer a very simple counter argument that you didn’t mention.

    Behavioral audience targeting, like content targeting, sponsored advertorials, pre-rolls and every other ad product available in digital environments, serves content creators.  Keeping content creators in business serves consumers, giving them a myriad of digital environments to explore. 

    Advertisers who misuse behavioral data should be properly reprimanded.

    Most importantly the web is a communications lifeline that has – and will continue to – revolutionize how humans interact with each other.

    Real innovation that has come and has yet to come from this budding medium will be driven by the possibility of profit.  Content creators must be allowed to profit and behavioral audience targeting is one important revenue stream.

    -Robert Brill

  2. How do you reconcile this with your company Traffiq’s privacy policy which fairly clearly lays out all the reasons you use cookies and track? “….customize, enhance, fulfill.”

    A movement always starts with one action.

  3. @Robert Brill – thanks for your comments. As I discussed in my article, Publishers can ethically track activity that takes place on their web site in order to better serve their customers with content personalization and advertising.

    And although I didn’t state this specifically – advertisers who track their customer’s behavior on the advertiser’s site, or who use CRM information to inform their targeting are within their rights.

    What is a problem is when third party companies with no direct relationship to the consumer begin tracking those consumers across numerous web sites, create profiles of that behavior and profit off that information that they haven’t asked permission to collect. That’s an ethically problematic issue.


  4. @Ramsey

    Thanks for the question. And for the record, my opinions, are my own.

    But since you ask – TRAFFIQ doesn’t collect data with our cookies for behavioral targeting across web sites. And in fact, as of this month we no longer are delivering ads through our legacy ad server – we’ve become completely ad server (and frankly ad vendor) agnostic. It’s probably time to update our privacy policy.

    TRAFFIQ does have an extremely open platform, and we connect any ad technology vendors into our platform so that our customers, who are mainly ad agencies, can have a single unified workflow with unified reporting. We act as a central ‘connector’ to pull together all those various vendors so that we can provide a unified workflow across the whole ecosystem. Soon we’ll also provide the means for ad technology vendors to plug themselves into our platform.

    We don’t make any decisions about which vendors our customers work with, nor do we force them to work with vendors in any specific way. This is their professional set of decisions and it’s up to them to decide how to operate.

    That said – my personal professional opinions are obviously quite clear. 😉


  5. Eric —

    Since writing this in 2011, what new adtech/martech technologies, if any, have opened up new opportunities for ethical application of behavioral tracking across third party publisher networks?

    As one example, lookalike demographic profiles are widely used for outbound display target expansion. Why not also integrate behavioral profiling for the same thing?

    Perhaps there are more new approaches.