The Looming Landscape of Regulation

In the digital marketing industry, the common wisdom has been that there is a disconnect between how concerned people say they are with privacy, and how they really act online.  However, a recent presentation by David Vladeck, former director of the FTC’s Bureau of Consumer Protection, reveals that we have been delusional in our thinking about the concern of consumers for their data. They’re very concerned.  The online  media and marketing industry  thinks it is being held to a higher standard, but it is not.

According to Vladeck, Chapman University puts out an annual study about what makes Americans afraid, and the two things people fear most are corporate misuse of their data and online tracking. Opt out mechanisms are misleading, and most privacy statements turn out to be data sharing statements instead.

So it’s not a random occurrence that ad blocking has grown.  About 110 million Americans have already had their financial information exposed in the almost ubiquitous data breaches that have become a daily affair, and it’s almost impossible to trace back which breach caused any particular harm. There is no such thing as perfect security.

Perhaps the worst consequence of a data breach for a consumer is identity theft, which rises in lock step with data breaches. Identity theft is the debris of the digital economy.  Having to put up with identify theft is an enormous time and money burden to place on people, not to mention the emotional issues that arise when really personal information is exposed, as in the Ashley Madison incident or the release of patient prescriptions for Prozac.

We in the industry may not see the consequences of data breaches immediately, but they are real. Financial loss from identity theft was $25 billion in 2012, and presumably more now, and  this is based only on losses that have to be reported. We really don’t know where all the leakages occur, because although consumer facing companies are subject to data breach laws, companies that are not consumer facing are  not subject to any notification law. We only know a slice of  what’s actually happening, which is that there is a 24/7 robust market for private information.

No wonder consumers are very worried about the digital economy and the effect it is having on their lives. No wonder they have become more concerned with privacy, to the extent of blocking trackers and ads.

Vladeck says the FTC has only a slice of the nation’s economy, limited to making sure companies have adequate data security practices, and to investigating after the fact. But the agency can’t protect consumers from breaches that have already occurred. Once consumer data gets to a data brokerage, it can be legally bought and sold.

Much digital advertising is dependent on old school data brokerages such as Acxiom and Intelius. Acxiom has thousands and thousands of data points on everyone.  But companies we don’t recognize as data brokers per se, like Facebook and Oracle, also have data on millions of people that is used for marketing and advertising.  And that data, too, could one day be in the wild.

In response to consumer concerns, the FTC is calling for legislation that would call for consumers to be allowed to see what information the data brokerages have, and at the very least determine whether it is accurate.

When information is used to make consequential decisions about consumers, the consumers should have the right of correction. Most Americans don’t even know the names of the data brokers, much less how their data is used. Data brokerages are like the credit reporting agencies of marketing, underwriting, insurance, and employment. The profiling has become so dense that set of presumptions can be made about consumers that could be discriminatory.

Robustness of the data broker data allows for segmentation that sometimes gives cause for concern to civil rights advocates. Marketers can buy highly segmented lists to make offers that can’t be justified on any other basis than a discriminatory one.

Moreover, since all this profiling is done by sophisticated data mining algorithms that change based on the information that goes into them, the process can never be  transparent. If we are going to win back the confidence of consumers, we are not only going to have to change the types of ads we show them, but we may also have to give up some of the granularity of our targeting.