Nick Martin's Marketing Pages

Spying for Secrets?

Late last year the European Parliament and Council set the scene for a potentially dramatic challenge to the way online advertising is developing, enabling targeting of advertising content based on online activity collected via cookies.

Online behavioural advertising  (OBA) uses  information  to  target  the consumer with advertising messages  that  match  their  interests and presumed buying intentions.  Information derived from online activity determines what ad or what version is served to whom (or not), dramatically improving targeting and reducing wastage.

OBA is a game changer, improving the consumer experience, cutting out irrelevant content, and delivering a better marketing return to brand owners.

As well as agreeing a revision of the EU Telecoms Package - designed to update the legal framework for the telecommunications sector – in slipped an e-Privacy Directive that requires consent prior to the setting of cookies on a web browser.  EU member states have until next May to implement the package.

At the EU-level, MEPs claimed success in introducing an opt-in regime; industry and some national governments maintain that the wording implies keeping the opt-out. This leaves it to the national governments to specify the meaning of “consent” when implementing the Directive. Plus ca change, and a recipe for wildly differing local implementations as we already have seen with the original Data Protection Directive, where they range from explicit prior consent to implied consent and soft opt-in for customers.

Against this backdrop the Article 29 Working Party published their opinion in the summer. It appears to significantly extend the definitions of personal data and comes down heavily in favour of explicit, prior consent prior to the collection of behavioural online data via browser cookies.

 1. That Article 5.3 of the ePrivacy Directive (the basis for setting and accessing cookies on a browser) applies irrespective of whether the information constitutes personal data or not.

 2. Where the tracking process involves personal data, the relevant provisions of the general Data Protection Directive have to be applied as well such as subject access rights. 

 3. That tracking usually involves personal data, because the cookies contain a unique identifier, or are linked to an IP address, which either identify a data subject or relate to them.

 4. Any party that stores or accesses a cookie must collect the user’s consent, regardless of whether this party acts as a data controller or as a data processor. In the case of 3rd party OBA this obligation falls to the ad network provider.

 5. The opinion stresses that consent, which must be freely given and specific, needs to be obtained before the cookie is stored. In order for consent to be valid, highly visible information must be provided. Information about the use of cookies also needs to be provided prior to the processing. In order to collect valid, informed consent, the working party recommends that ad network providers create prior opt-in mechanisms that require an affirmative action by the data subjects. Once given, it would not be necessary to request consent for each reading of a cookie.

 All this begs the question, how clearly do legislators really understand the use of anonymous cookies in 3^rd party OBA?

How would subject access requests work in the situation where vast number of cookie IDs containing recent behavioural data used in raw or aggregated form for advertisers from different sectors, nonetheless contain no personal data?

Do legislators really think that cookies are used to spy on consumers? Is there a common (mis)understanding of the benefits cookies offer to faster navigation and better user experiences, delivery of more appropriate offers, and data transparency?

The political dimension isn't helped of course when Wall Street Journal publishes an ‘expose’ on how tracking technologies are designed to share consumers’ secrets.

The WSJs investigation found that the nation's 50 top websites on average installed 64 pieces of tracking technology onto the computers of visitors, usually with no warning. A dozen sites each installed more than a hundred. The nonprofit Wikipedia installed none.

Tracking technology is getting smarter and more intrusive, they concluded.

“Monitoring used to be limited mainly to cookie files that record websites people visit. But the Journal found new tools that scan in real time what people are doing on a Web page, then instantly assess location, income, shopping interests and even medical conditions. Some tools surreptitiously re-spawn themselves even after users try to delete them.”

It’s time to address key concerns of user protection and security, in applying key principles of Data Protection to these burgeoning, global advertising channels.

a) For example, surely we should be insisting that a broad definition of sensitive data be used to ensure that offers such as dietary plans ought to be subject to explicit consent.

b) Deep Packet Inspection (DPI) has caused deep concerns for years, gaining Phorm notoriety, enabling an ISP uses technology to inspect the entire clickstream of a browser, and inevitably will end up subject to an explicit consent regime.

c) Where personal information that identifies a user by name, sex, age, household composition etc. is combined with online behavioural data, the use of that ensuing personal profile ought to be notified as a specific and fresh use requiring consent.

d) Certain uses of non-personally identifiable data collection may need to be proscribed such as using tracking to support discriminatory pricing, an issue of concern to legislators.

e) Lastly, Privacy Enhancing Technologies (PETs), overlooked beyond the basics such as SSL security over the last decade, may well be about to come of age, faced with an internet-wide challenge of incomparable commercial scale.

     

Technologies that separate data, that anonymise through splitting or masking and destroy personal data, as well as those that limit use are urgently needed to demonstrate users can be exceptionally well protected at the same time as experiencing the benefits of OBA.

As the market for well-executed OBA starts it’s long road towards maturity, organisations that aggregate user behaviour data are perfectly placed to apply these technologies to their platform, and must prepare to play their forthcoming role of responsible and respected data controllers.

For now the focus is on cookies. Browser settings do at least currently provide a consumer dashboard to express preference. In a recital to the e-Privacy Directive, non-binding guidance suggested that browser settings would indeed serve as a consent mechanism, which was interpreted as a pointer towards an opt out regime.  Whilst on the face of it, the Working Party’s guidance blows that interpretation out of the water, no one should conclude that that is the endgame.

This winter looks set to be one of the most significant in the history of the Internet.

Thanks to FEDMA for providing access to many of the source material used for this article, and from which I have borrowed.

The price of customer engagement

How many consumers start a transaction, only to drop out before agreeing terms or completing payment?

The truth is, winning the attention of consumers - then proving the value of your product or service in an increasingly frictionless environment - is tougher than ever.

In a recent consumer survey by Fastmap, a third of all people visiting financial services websites or dialling into a call centre found the experience confusing, whilst a further third would have appreciated a more skilled advisor.  That makes two thirds of consumers who might have bought a financial services product may not have done as a result of an inadequate user experience.

There is of course a broad range of reasons why people abandon a transactional process. Shipping charges and price comparison browsing are commonly quoted. Notwithstanding, understanding the avoidable barriers that dissuade buyers from following through with a purchase is key to improving the consumer engagement.

Established agency solutions to winning those consumers back who have dropped out of the online sales funnel includes retargeting – the process of serving ads via a network following, for example, basket abandonment on destination sites and portals.  

The trouble is, using browser data for retargeting falls under the broad category of online behavioural targeting (OBT), the recent subject of the EU Article 29 Working Party. Their published opinion does not augur well for the future of any kind of third party OBT marketing activity; even where browser based cookies do not hold any personal data.

To quote an excellent summary and initial analysis by FEDMA:

In the view of the Working Party (WP), the revised ePrivacy Directive (as a part of the reviewed Telecoms Package) reinforces the requirement to collect “informed prior consent” as an adequate legal basis for 3^rd party OBA. The opinion stresses that consent, which must be freely given and specific, needs to be obtained before the cookie is stored. In order for consent to be valid, highly visible information must be provided. Information about the use of cookies also needs to be provided prior to the processing. In order to collect valid, informed consent, the WP recommends that ad network providers create prior opt-in mechanisms that require an affirmative action by the data subjects, indicating their willingness to receive cookies and to the processing of these cookies for the purposes of delivering targeted advertising.

 So is now the time to look beyond online consumer activity and implying conclusions about habits and purchasing needs through behavioural analysis, notably in regard to acquisition marketing?

There is undoubted value in responding in real-time to consumer confusion or questions that demand a degree of expert knowledge and a consistent approach.

 Call Me buttons that route users to an off-line call centre, or Agent Chat programs that enable you to connect with a call centre are both important ploys to handle questions and improve conversion to sale. Their weakness is in the depth of knowledge of the call centre agents. Many times I have sought help, only to discover I know more about the product or service I wish to purchase than the agents on the other end of phone.

 Part of the answer surely lies in the creation of a really effective company knowledge base.  With this in place, it becomes possible to accurately respond to questions & obstacles to sell in real-time. Translating the product and service value proposition, together with detailed practical and operational information (e.g. delivery options) into a knowledge base needs to be a core building block of online marketing.

Currently this information is hopelessly fragmented across the majority of organizations and therefore is impossible for its customers to access. As a consequence, when IKEA implemented a rudimentary, cartoonish avatar on their site, its ability to answer questions effectively was severely limited.  On a recent visit it was unable to answer any of the questions my wife posed.  Needless to say, the impact is lost business.

Once the creation of the knowledge base is undertaken, it can be turned into consistent, accurate dialogue with consumers via enabled call centres, online avatars and drive social media conversations.

Recent experiences of avatar deployment have delivered astounding results, for example improving quote to book ratios by 300%+ in France, proving that there’s no help like real time help, as long as it’s delivered with the requisite level of expertise.

In an increasingly unforgiving, socially networked world, knowledge and the ability to apply it in real time must be a core business competency. It is up to marketing to seize ownership.

Basle III - Banks mauled by sheep

So the regulator's tough love turned out to to be missing the tough bits. The banking lobbyists can claim a comprehensive victory. 

Even proposed Chinese regulation makes Basle III look tame. The long implementation window of 2013-2019 presumably is a tacit admission that the banks won't lend anytime soon if they are entirely focused on rebuilding their balance sheets, no matter how severe the exhortations of Government. It's a fingers crossed strategy: demonstrate greater long-term rigour whilst praying to God for no more near term banking crises.