Privacy concerns dog Google-DoubleClick deal
Consumer privacy advocates worry what Google will do with combined data on Internet users' search and surf habits. Video: Schmidt discusses DoubleClick
How will the search-advertising powerhouse treat the massive amounts of data it already stores on people's search histories, once it also has at its disposal a storehouse of data on people's surfing habits from DoubleClick, the No. 1 digital ad-serving company?
Specifically, will Google combine the two data systems to map not only what someone searches for, but also which sites they visit, videos they watch and ads they click across the Web in order to better target marketers' promotions?
"It leaves too much personal information about all of us in one company's hands--Google's," said Jeff Chester, founder and executive director of the Center for Digital Democracy, a privacy watchdog. The CDD has called on the Federal Trade Commission and European Union to stop the merger for privacy and anticompetitive concerns.
On Monday, Microsoft (which reportedly was also in talks to acquire DoubleClick) and AT&T stoked those fears and also asked the FTC to examine the merger for anticompetitive issues around online advertising.
Google says such fears are unwarranted. (The deal is expected to close later this year.) When asked about such worries Tuesday
"It's a legitimate concern. If we lose our advertisers' support or end-user support, the company goes kaput," Schmidt said.
Video:
At Web 2.0 Expo, CEO discusses companies' synergies
Schmidt and Wong's assurances notwithstanding, privacy advocates worry that Google's vision for protecting users' personal information on the Web, and therefore its privacy policies and practices, haven't yet caught up with the breakneck pace of the company's expansion. DoubleClick was intensely criticized for the way it handled users' personal information during the dot-com boom.
"This is bringing together two very large advertising networks. To the extent that information is being centralized raises concerns that it could become a target" for hackers or overzealous government investigators, said Kurt Opsahl, senior staff attorney at the Electronic Frontier Foundation, a legal advocacy group. "Google said it has no plans to integrate the two services...but that doesn't mean that later, you might not develop those plans."
During the dot-com bubble, DoubleClick was to online advertising what Google is to Web search today. The company dominated the field so much that when it bought offline direct marketer Abacus and eventually began combining data on customers' real-world buying habits with their online behaviors, consumer privacy advocates sounded warning bells.
The FTC stepped in, and DoubleClick eventually backed away from the consumer media business and from targeting ads based on people's behavior.
Part of DoubleClick's retreat could be attributed to increased competition: Google and Yahoo became advertising powerhouses and made DoubleClick's business
The prize: the display ad market
For Google, the DoubleClick deal is about breaking open the display-advertising market on the Web in the way it did with search marketing, media executives say.
By turning search advertising into an opportunity for anyone with a credit card and Web page, Google has attracted more than a million advertisers for its search ad marketplace, according to one advertising executive. But display advertising on the Web is still dominated by about 1,000 of the largest marketers.
With DoubleClick, Google could try to democratize display and rich-media ads the same way as it did with search, expanding the number of advertisers in the mix. In turn, it could boost demand for ad-serving technology that DoubleClick sells.
Media executives estimate that DoubleClick reaches between 80 percent and 85 percent of the Web population, given that such a high percentage of publishers and advertisers use its back-end ad-serving technology. (Its customers include Time Warner's AOL and Viacom's MTV Networks.)
Although DoubleClick's technology delivers the ads, the company does not collect personal information about Web surfers, nor does it target ads based on personal preferences, according to the company. Rather, it says its customers--the publishers and advertisers--own data on consumers.
DoubleClick doesn't need to collect personal information in order to target ads, privacy advocates say. With the placement of tracking cookies on individual computers, the company has access to a given computer's Internet Protocol address, as well as a record of sites it has visited.
"The question for DoubleClick is not whether they own the data but whether they store it," Opsahl said. "They have a storehouse of information that could be later accessed by a third party."
The scary scenario for privacy advocates would be if Google were to combine its own storehouse of data on users--yielded through cookies and other personal information given up for services like Gmail--with DoubleClick's data. It would then have unparalleled visibility into people's online behavior, a point brought home last year when AOL accidentally leaked the search histories of users.
What's more, with Google venturing into ad sales for offline media, including radio, TV and print, the company could eventually have a user profile database that goes well beyond what DoubleClick ever planned. Google, for example, just introduced a
"You start to add on more and more collections of information, and they have the ability to tie all of this together, and that poses a major potential for privacy risk in the future," said Ari Schwartz, deputy director for the Center for Democracy and Technology, an advocacy group in Washington.
Merger may spur dialogue on practices
Still, privacy advocates think the merger could be an opportunity to talk to Google about its practices and put together some clear privacy standards for the industry.
The CDT has urged the FTC to hold a workshop on behavioral targeting to set best practices in the industry and get players like Microsoft, Google and Yahoo to agree on them. The organization wants to ensure that people have control in the event that these companies begin to merge consumer information from search and Web-surfing records to personalize ads.
Google currently targets ads to people based only on the context of their searches. A search for lemon pie recipes, for example, might yield an ad for Martha Stewart's recipe database. It also uses IP addresses to target people by their location.
Schwartz, whose CDT brought privacy action against DoubleClick in 2000, said Google called the center after the purchase was finished. Although CDT is still talking to Google, he said the group has some concerns with the acquisition that aren't necessarily related to DoubleClick's collection practices. They deal more with the wide-ranging projects Google has tackled without developing clear privacy policies for each one.
For example, Google is forward about letting people know about the privacy implications involved with installing its Toolbar application, saying "it's not the usual yada yada yada" and that it will collect Web-surfing footprints from the user if he or she opts in. In contrast, Schwartz said Google has been unclear on how long it takes Gmail to get rid of e-mail, once a user has deleted it, unlike rival Yahoo.
Earlier this year, Google also changed its data retention policy. Now the company will purge search query data associated with cookies and IP addresses after 18 to 24 months, rather than its previous policy of keeping them forever. Still, privacy advocates would like to see Google come up with data retention policies for other services on its site, such as histories associated with watching videos on YouTube.
"There's a complexity there about where they're going. They've had this goal of collecting all of the world's information and making it publicly searchable, but they haven't had the corresponding policy to protect privacy," Schwartz said.
"They've had a shadow of protection in what they discuss by 'not doing evil,' but they don't have that bigger vision," he added.
Opsahl said he would like to see Google consider rendering the IP addresses that DoubleClick collects through its ad servers more private, the way Google itself has done.
Google recently said it will remove the last quartet of the IP address associated with an individual computer so the number is lumped into a larger set of 256 IP numbers. That way, it can target people based on country, not by computer. "It's a step in the right direction; it's not complete anonymity," he said.
The goal, Opsahl said, is "to minimize the amount of information collected to only the necessary info to operate the business, and keep it for minimum amount of time. That's something to continue the dialogue with Google about."
Some think Google just hasn't yet been able to articulate its vision for consumer privacy. On a conference call announcing the DoubleClick deal Friday, even one of Google's co-founders had difficulty articulating his company's plans.
"Overall, we care very much about end-user privacy, and that's really going to take the No. 1 priority when we contemplate new kinds of ad products," co-founder Sergey Brin said.
"So I think anything along those lines..." and Brin trailed off. Then he added: "There are quite a few challenges with such a plan, with respect to how we feel about privacy."