Business Horizons (2011) 54, 509514

www.elsevier.com/locate/bushor

BUSINESS LAW & ETHICS CORNER

Personal privacy and Internet marketing: An impossible conict or a marriage made in heaven?
Linda Christiansen
School of Business, Indiana University Southeast, 4201 Grant Line Road, New Albany, IN 47150, U.S.A.

KEYWORDS
Personal privacy; Marketing; Internet marketing; Data mining

Abstract With the decline of print media and network television, marketing strategy is changing. As these advertising vehicles are slowing down and more individuals turn to the Internet for daily functioning, marketers are following in kind. Technology offers businesses and marketing specialists the ability to collect immense amounts of private data about individuals interests or characteristics as they surf the Internet and input personal information. Data collection falls into one of two categories: a users voluntary sharing of such information, or involuntary/ uninformed collection by other parties. The threat posed by invasion of personal privacy is real. At the same time, Internet users can benet in several ways from the sharing and collection of personal information. For example, much online content is funded by advertising, and would otherwise only be available to consumers for a fee. Additionally, valuable information regarding trends and happenings (e.g., u outbreaks) are detected by aggregated Internet tracking. Finally, many Internet users value and enjoy targeted advertising geared to their particular interests or needs. Laws regarding this matter are currently limited, but are developing in order to protect individuals from unscrupulous data collection, especially involving children. Fortunately, there are ways marketers can legally and ethically collect and use personal information. Ultimately, regulation needs to be developed, and the marketing profession can aid itself by expanding self-regulation and policing in order to stave off additionaland potentially onerousregulation. # 2011 Kelley School of Business, Indiana University. All rights reserved.

1. Collision: Technology versus personal privacy

Who is watching you? Who is collecting your personal and private information? Who has purchased your personal information, and that of your children, for uses both constructive and predatory in nature? If

E-mail address: lchristi@ius.edu

you have volunteered data on a website, do you know what is being done with your private information? What are the benets and problems associated with personal data collection? Recently, many U.S. citizens were disturbed by the implementation of a new security-check system installed at several airports nationwide. Travelers passing through these facilities face a choice of either undergoing an x-ray scan or enduring a fullbody patdown before being allowed to board ights.

0007-6813/$ see front matter # 2011 Kelley School of Business, Indiana University. All rights reserved. doi:10.1016/j.bushor.2011.06.002

510 While some have expressed concern regarding radiation exposure from the x-rays, others are upset because they feel theyre being forced to choose between two privacy violations: total body imaging or extensive physical touching. One has to wonder about the irony: Why the great unease surrounding personal privacy at the airport when so many people regularly share very important and valuable information online without giving it a second thought? While privacy may be invaded in both cases, the potential risk for long-term harm is far greater with online sharing of personal information.

BUSINESS LAW & ETHICS CORNER based on valuable consumer information, websites are able to charge a premium to place ads based on the parameters selected by the advertisers. Websites and ad networks can take several approaches to the collection and use of personal information. It is important to understand the distinctions in order to analyze the issue at hand. Personal information from the Internet can be collected by a variety of parties. For some companies, data collection is merely a side business; others intentionally track Internet users, organize that data, and sell the prole of information they develop. In many cases, individual websites themselves are collecting information. For example, Facebook utilizes information from users to post targeted ads on individuals pages. If a user falls into a certain age group, has discussed travel, or posted about having children, he or she should see ads related to these topics. Another example is Amazon.com, which makes product suggestions to customers based on their past purchases and/or searches. In both cases, the websitesFacebook and Amazonare using information they have collected to market to consumers. An online advertising network, or ad network, is a company in the business of collecting and utilizing information from website users. This third-party business acts as a broker, connecting advertisers with multiple websites that have collected user information and also have ad space to sell. An ad network helps websites sell ad space, while aiding advertisers in nding targeted placement of advertisements. The remaining data-collection businesses purchase information from a variety of sources with the express purpose of building and selling proles bearing identiable information connected to specic people. Websites can employ several approaches to data collection, including the following three methods: 1. Collect personal data, then anonymize and aggregate it to sell to third parties and/or to use internally. In some cases, a website or ad network will collect information from Web users and organize it in a database butinstead of selling identiable informationwill use or sell aggregated information to third parties. This information is valuable for advertisers to determine the overall characteristics of the websites users. The website itself could also use this information to strategize regarding content decisions and to sell advertisements. This type of information collection and dissemination is not as invasive as the other methods if limited to this purpose. 2. Collect personal data, keeping personal data within the company but providing the opportunity for advertisers to specify a certain range of

2. Demand for personal information in marketing

Marketers are hungry for personal information such that they may more effectively use their dollars toward targeted advertising. The online ad industry, alone, totals $23 billion and continues to grow (Angwin & Valentino-DeVries, 2010). For businesses eager to market their goods and services, information regarding a persons demographics, income, interests, and habits represents a gold mine. Marketers and business executives know that a customer is more likely to complete a purchase when the message is precisely targeted toward him or her, as opposed to being more general in nature. This is called target marketing, and while far more expensive per exposure than traditional advertising, it is also more lucrative in that it provides less wasted coverage. The question is: How do marketers collect and use this information to effectively deliver targeted advertising? The Internet has been the best answer to this question since marketing came into existence. In recent years, marketers have observed the decline of the traditional stalwarts of marketing: print media and network television. The Internet has displaced many of the traditional forms of advertising media and, as a result, marketers have followed consumers to this medium. At the same time, the Internet and evolving technologies provide unique opportunities to collect and organize personal information about individual users into specic proles. Consequently, target marketing utilizing personal information from these types of prole databases has become the Holy Grail of the industry.

3. Approaches to collection and usage of personal information

Target marketing requires the collection, retention, and analysis of information about users. Because it is

BUSINESS LAW & ETHICS CORNER traits for target marketing. Advertisers pay a premium for ad placement directed to those users who meet the advertisers specic criteria. Although the existence of data collection and retention might be considered questionable by some, if information kept within the website is being accessed and used only by the party with which the user shared the information, users should not be alarmed. 3. Collect personal data with the intention of selling the information, sometimes including specific proles or names, to third parties. Websites and Internet service providers (ISPs) have the ability to accumulate users personal information in a database, to offer for sale to outside partners. The third-party rms then compile that information into a comprehensive database for extensive and long-term data mining. Proles of individuals are available for sale to anyone with an interest and money to pay the fee. While this is a growing industry, many websites and ad networks are reluctant to sell customers information because doing so could limit their ability to sell targeted advertising. This is the type of data collection, retention, and sales that is most intrusive from a personal privacy perspective.

511

4.2. Taking of information from adults (involuntary disclosure)

This malicious method involves the use of technology to collect data and track movements by Internet users without their knowledge and/or permission. For instance, the placement of Web browser text lesknown as cookiesis used by websites to track les and Internet viewing histories. Cookies are used in online target marketing, as well as to aid collection of information and building of personal proles. Some ash cookies are so invasive that they are stored in two areas of the computer and can reinstate themselves even if a computer user has deleted the cookie le (Vega, 2010). Even more invasive, deep packet inspection involves the reading and analyzing of packets of information traveling across the Internet. The purpose is to monitor all online activity of an Internet user, not just Web browsing, resulting in extremely detailed proles of that user (Stecklow & Sonne, 2010). History snifng allows the third party to run code in a users Web browser to detect certain sites visited (Vascellaro, 2010). Scraping, a particularly worrisome method of data collection, involves gathering personal details shared on forum discussions and social media sites in order to expand and esh-out personal proles of specic people, even when sites are for members only or are intended to be condential (Angwin & Stecklow, 2010). Another invasive method is digital-device ngerprinting, which tracks online activities to build proles using the digital ngerprintor identiable traitsof every electronic device in use. Each individual device is distinguished by the various ways it is unique, such as the clock setting, software, and hardware identication number (Angwin & Valentino-DeVries, 2010). And most recently, the press is reporting that smartphones can help track users movements, relationships, moods, health, calling habits, and spending patterns, as well as movements in the Dow Jones Industrial Average and the spread of political ideas in the aggregate (Hotz, 2011). These escalating, egregious, and invasive examples of private-information collection are becoming more common. When these methods of data collection are employed, the computer user is typically unaware and has no idea how to protect his or her personal information.

4. Types of sharing of personal information and related privacy concerns

Privacy concerns vary by the circumstance of online disclosures. Disclosures may fall into the following three categories.

4.1. Voluntary sharing or disclosure by adults

One relatively benign example of this is the sharing of preferences or product reviews with websites such as Amazon or Netix. In many other cases, though, people do not exercise sufcient caution in sharing personal information under certain circumstances. Subjecting themselves to this potential danger could stem from a lack of awareness, from not taking the time to read privacy policies, or from a generalized lack of concerneven if these factors are known. Too often, individuals click through warnings, permission requests, and privacy policies without thinking about how it may impact their privacy. Even adults can exercise poor judgment by revealing personal information via Facebook or blog posts, not taking into consideration possible information collection and use by other parties.

4.3. Sharing by children

While disclosure by adults can be separated into the categories of voluntary and involuntary, any sharing

512 of personal information by children is problematic. Children obviously have limited capacity, both practically and legally, to discern when disclosure of personal information is proper and safe. Studies show that, in general, childrens websites deposit more cookies than mainstream websites visited by adults; one study found that 50 popular childrens websites deposited 4,123 cookies on a computer 30% more than deposited by the 50 most popular U.S.-based websites (Stecklow, 2010).

BUSINESS LAW & ETHICS CORNER collected by online methods. Four specic arenas of development are analyzed next.

6.1. The legal system

Use of the legal system through litigation and legislation to protect online privacy rights is gaining momentum. Consider the following three elds of action: litigation, existing legislation, and proposed legislation. 6.1.1. Litigation In 2001, the use of cookies to collect information was ruled a legitimate, lawful activity; that precedent has not been overturned in the years since (DoubleClick, 2001). Topical lawsuits have dealt with cookies placed on mobile phones, and the aforementioned regenerating ash cookies (Vega, 2010). Most recently, some iPhone and iPad owners are suing Apple for invasion of privacy and computer fraud as a result of the devices collection and retention of up to one-years location data. Following on the heels of these litigation trends, government regulators worldwide are launching investigations regarding these allegations (Gullo, 2011). 6.1.2. Existing legislation The Childrens Online Privacy Protection Act of 1998 (15 U.S.C. 6501-6506 (supp. V2000)), or COPPA, prevents organizations from collectingwithout parental permissionpersonal information from children up to their 13th birthday. Although this statute is limited, it at least provides some protection for children under age 13; however, children aged 13 years and older are not protected by a similar statute. For Internet users of all ages, other existing statutes provide a variety of restrictions governing activity, but only offer a patchwork of protection for some of these issues. 6.1.3. Proposed legislation: The Commercial Privacy Bill of Rights Proposed in Congress last April by Senators John Kerry and John McCain, the Commercial Privacy Bill of Rights Act (2011) would create consumer privacy rights, including notice, consent, access, and correction of information accumulated by collectors and parties employed by them. These entities would be required to implement security measures to protect the information they collect and maintain. Additionally, collectors would be allowed to gather only the information necessary for the transaction or service, and other limited circumstances. Finally, they would be required to use reasonable procedures to ensure accuracy.

5. Ways individuals can be harmed by data collection/retention of personal information

People may be harmed by data collection and yet not realize it, or even anticipate the level of damage. Indeed, the results can prove to be costly and potentially embarrassing, and certainly extend beyond what one might imagine. Personal information gleaned from the Internet has been used in the following circumstances:

 Running of background checks by employers for

hiring decisions;

 Pricing and assessing risk of injury or death by

insurance companies (based on Internet searches, blogs, and condential online support groups, for example);

 Termination decisions by employers (for example,

if a user is criticizing the workplace or found to be lying to the employer);

 Recruiting and scholarship decisions by athletic

coaches;

 Searching for relevant evidence by attorneys in

the course of case preparation;

 Detecting political leanings for fundraising purposes and to target individuals who are undecided on an issue or a candidate; and

 Facilitating criminal attacks.

6. Protection of personal privacy

Increases in threats to personal privacy and corresponding outcries of concern have prompted movement in the protection of private information

BUSINESS LAW & ETHICS CORNER

513 punished while benecial uses are concurrently managed. Online data collection of personal information may be addressed by government regulation in the following ways: 1. Prohibit egregious activities, such as the building and selling of names/proles without user permission, and fraudulent practices. Government intervention offers the best chance to prohibit and punish this behavior. 2. Manage neutral activities, including anonymized aggregated data for trends or macro-feedback, such that the information is used positively and not as an invasion of privacy. 3. Encourage benecial activitiesincluding user sign up/opt-in for targeted ads and free or inexpensive Web contentas long as the correlated data collection and retention is protected, and performed in compliance with existing laws.

6.2. National Do Not Track lists

These lists, similar to the national Do Not Call lists, have been proposed as a possible solution for growing privacy concerns.

6.3. Web browser Do Not Track feature

These options are being added to most mainstream Web browsers. However, this protection is dependent on ad networks voluntarily honoring the desires of the users, as there is no force of law behind such desires at this point.

6.4. Educating the public

An increased emphasis on public and parental education would be an effective complement to these other methods, to increase privacy protection with user awareness.

7. Recommendations for the marketing industry and government regulators

Internet marketing is clearly here to stay, and it should be legal and ethical, as well as benecial. Achieving a balance of appropriate online data collection and effective marketing depends on the identication and implementation of standards and practices by which benets outweigh harms, and some degree of control is afforded to the individual user. Online marketing is vital to the Internet as we know it. So much online content is either free or less expensive because it is supported by advertisers. And some consumers truly want to be tracked for targeted advertisements; they regularly register for email notications of sales and product offerings. Many Internet users prefer that ads and suggested merchandise be geared toward their interests and demographics. And because websites are able to charge a premium for the targeted advertising, all parties benetthe website owners, Internet users, and advertiserswhen target marketing is utilized.

7.2. Marketing industry self-regulation

No one knows better than marketers the value of online advertising. The marketing profession, as a whole, should realize that it is better to proactively self-regulate than to wait for government intervention. When government becomes involved, conditions have typically reached a fevered pitch, and Congress reaction can be extreme. Voluntarily providing full disclosure to consumers, as well as various privacy options, is far preferable to onerous regulation by the government and/or consumer backlash. Websites and ad networks should post clear, concise, and fair privacy policies and settings, and then adhere strictly to user preferences. Industry members should also consider making their websites default to opt-out of data collection and target marketing, allowing interested users to make the opt-in decision if they so choose. Online data collection and prole building has mushroomed in recent years, and its threat to personal privacy is growing exponentially. Public awareness regarding some of these invasive methods is beginning to emerge. Unfortunately, however, most people are unaware of the information trail they leave when surng the Internet, and are also unaware of the myriad commercial uses for their private information. Employing the steps outlined here, Internet marketing can benet and ourish, while personal privacy remains protected.

7.1. Government regulation

To encourage effective Internet marketing while also protecting Internet users personal privacy, improper uses of data must be restricted and

514

BUSINESS LAW & ETHICS CORNER

Hotz, R.L. (2011, April 23). The really smart phone. The Wall Street Journal. Retrieved April 24, 2011, from http://online. wsj.com/article/SB10001424052748704547604576263261679 848814.html Stecklow, S. (2010, September 17). On the Web, children face intensive tracking. The Wall Street Journal. Retrieved April 24, 2011, from http://online.wsj.com/article/SB1000142405 2748703904304575497903523187146.html Stecklow, S., & Sonne, P. (2010, November 24). Shunned proling technology on the verge of comeback. The Wall Street Journal. Retrieved April 24, 2011, from http://online.wsj.com/article/ SB10001424052748704243904575630751094784516.html Vascellaro, J. (2010, December 5). Lawsuit targets an online data collection technique. The Wall Street Journal. Retrieved April 24, 2011, from http://online.wsj.com/article/SB1000142405 2748704767804575654910216593180.html Vega, T. (2010, September 20). Code that tracks users browsing prompts lawsuits. The New York Times. Retrieved April 24, 2011, from http://www.nytimes.com/2010/09/21/technology/21 cookie.html

References
Angwin, J., & Stecklow, S. (2010, October 12). Scrapers dig deep for data on Web. The Wall Street Journal. Retrieved April 24, 2011, from http://online.wsj.com/article/SB1000142405274 8703358504575544381288117888.html Angwin, J., & Valentino-DeVries, J. (2010, November 30). Race is on to ngerprint phones, PCs. The Wall Street Journal. Retrieved April 24, 2011, from http://online.wsj.com/article/SB1000 1424052748704679204575646704100959546.html Commercial Privacy Bill of Rights Act. (2011). 112th Congress, 1st Session, BAG11284 DoubleClick, (2001). Privacy Litigation, 154 F. Supp, 2d 497. (S.D.N.Y. 2001) Gullo, K. (2011, April 25). Apple accused in suit of tracking iPad, iPhone user location. Bloomberg. Retrieved April 28, 2011, from http://www.bloomberg.com/news/2011-04-25/ apple-accused-in-suit-of-tracking-ipad-iphone-user-location1-.html