On April 20, 2007, CDD, EPIC and US PIRG filed a complaint (pdf) with the Federal Trade Commission, requesting that the Commission open an investigation into the proposed acquisition, specifically with regard to the ability of Google to record, analyze, track, and profile the activities of Internet users with data that is both personally identifiable and data that is not personally identifiable. The three groups filed a supplement (pdf) to the complaint with the Commission in June.
On September 17, 2007, at the National Press Club, the Center for Digital Democracy, EPIC and US PIRG announced a second supplement (pdf) to the groups' original complaint (pdf) and subsequent supplement (pdf) with the FTC concerning the proposed Google-DoubleClick merger. The amended complaint detailed new facts supporting the conclusion that the FTC should block Google's proposed acquisition of DoubleClick.
The FTC has made a "second request" in its review of Google's merger with DoubleClick (the world’s largest Internet advertising technology firm). According to FTC Chair Majoras's statement (pdf) on the merger review process, "the majority of investigations in which the FTC issued a second request resulted in a merger challenge, consent order, or modification to the transaction, suggesting that the FTC generally issues second requests only when there is a strong possibility that some aspect of the investigation would violate the antitrust laws."
As admirers go, Google is definitely of the secret variety. From its highly guarded formula for generating search results, to the shroud of mystery that surrounds its plans "to organize the world's information and make it universally accessible and useful," to a complex privacy policy that is spread over 20 separate pages on the Web, the search giant invariably raises more questions than it answers. "Don't be evil," reads the company's motto, but apparently it's OK to be evasive. "It's somewhat of a paradox," financial analyst Jordan Rohan told the Los Angeles Times last year. "Google's whole purpose is to make information easier to access—unless, of course, you want to know information about Google." As theTimes added, "Google's unwillingness to disclose little more than the legally required basics of how it does what it does—and where it's headed—has left advertisers puzzled, partners confused, competitors nervous and investors frustrated."
Make no mistake, however, this secret admirer really does care about us. Why else would Google give us so much—lightning-fast search results, interactive maps, email service (with plenty of storage space to archive our communications), online calendars, word processing programs, spreadsheet applications, and more—all free of charge?
The answer, of course, is that Google actually gets plenty in return, in the form of massive amounts of data that it compiles on consumer interests, tastes, and behavior. For all of its variations on the search engine theme—from Google News to Google Video to Google Product Search—the company remains above all else an advertising engine, one whose $500 stock price and $700 billion revenues are testaments of its success.
So how does Google love us? Let us count the ways, with a sampling of the kinds of user data to which Google currently has access:
1. The keywords and phrases we use in the searches we perform.
2. The time and date of these searches.
3. Our Internet IP address and browser configuration.
4. The websites we visit as a result of these searches.
5. The amount of time we spend on those sites before returning to Google.
6. Our patterns of navigation as we travel away from and back to Google.
7. The addresses and directions we enter in Google Maps.
8. The messages we send and receive via Gmail or Google Talk.
9. The schedules we create on Google Calendar.
10. The documents we create and edit in Google Docs.
11. The figures we enter in Google Spreadsheets.
12. The sources we subscribe to in Google Reader.
13. The accounts we create and the information we post to Google's far-flung Web properties, including Blogger, Orkut, and YouTube.
14. The activities we carry out using a variety of Google-branded "helper" applications, including Google Desktop, Google Toolbar, Google Checkout, Google Web History, and Picasa.
"Google has been aggressive about collecting information about its users' activities online," observed Adam Cohen in the New York Times. "It stores their search data, possibly forever…. Its e-mail system, Gmail, scans the content of e-mail messages so relevant ads can be posted. Google's written privacy policy reserves the right to pool what it learns about users from their searches with what it learns from their e-mail messages, though Google says it won't do so. It also warns that users' personal information may be processed on computers located in other countries."
The lynchpin in Google's vast data-dragnet is the small text file placed on the user's hard drive, known as a "cookie," stamped with a unique user ID and passing information back and forth between one's PC and a particular website. "Google was the first search engine to use a cookie that expires in 2038," explains Google-Watch.org. "...This cookie places a unique ID number on your hard disk. Anytime you land on a Google page, you get a Google cookie if you don't already have one. If you have one, they read and record your unique ID number."
As if Google (with its billions of searches and millions of users it serves every month) doesn't already know enough about us, its proposed $3.1 billion acquisition of DoubleClick will bring online consumer surveillance to an entirely new level. DoubleClick might not be the household name that Google is, but in its field—online advertising—it is perhaps even more dominant, reaching an estimated 80 to 85 percent of all Web surfers with some 720 billion ads a year. Its consumer analysis, profiling, and behavioral targeting technologies, carried out on a vast network of affiliated websites, are extraordinarily thorough. "Without a doubt, DoubleClick's historical data is very valuable," says Jupiter Research analyst Emily Riley. "Every time you're online, every page visit, and every ad you see comes with the possibility that a cookie is placed on your machine. DoubleClick has all the data."
And soon Google will have access to all of that data as well. DoubleClick's DART system, for example, will provide Google with a complete set of applications—and data access—to allow it to extend its more linear search advertising business into the third-party and rich-media advertising market. Another of DoubleClick's key technologies, called Motif, is used to track user interaction with video content. As the search and online video markets converge, the ability to identify and assess user response to interactive media environments will be central to online advertising. Google's interest in such technology was no doubt fueled by its $1.65 billion acquisition of YouTube in 2006. Google is now in the process of "data-tagging" all of the videos on YouTube in order to make the site a much more effective platform for advertisers.
A combined Google and DoubleClick, clearly, will be a potent force in the online universe. As the New York State Consumer Protection Board recently declared, the Google/DoubleClick "merger presents significant privacy implications. The combination of DoubleClick’s Internet surfing history generated through consumers’ pattern of clicking on specific advertisements, coupled with Google’s database of consumers’ past Internet searches, will result in the creation of 'super-profiles,' which will make up the world’s single largest electronic repository of personally and non-personally identifiable information."
Privacy International
September 6, 2007
PI has tracked the development of the Internet since the creation of the World Wide Web in the early 1990s. We have continually voiced our concern that this medium provides the potential for a haemorrhage of personal privacy, and we have argued for some years that Internet companies should embrace a wider range of privacy protections for users.
The privacy threat on the Internet arises from a number of factors. Increasing disclosure by consumers of personal information allows companies to capture and process data to a significant extent. New technologies permit the capture of increasingly detailed levels of information. Meanwhile, new Internet products often involve a requirement for user registration, enabling of identifying techniques and agreement to terms and conditions that are frequently hostile to privacy.
However the emergence over the past three years of an aggressive move by major Internet companies into "ad space" has created the most recent and possibly most dangerous threat to privacy.
Google's DoubleClick Takeover: Double Data-Dealing
Comments by Jeff Chester, Center for Digital Democracy
National Press Club, September 17, 2007
Online and interactive advertising and marketing is a powerful, but still largely invisible, force shaping the future of our global society. The diversity of our news, information, and entertainment, our personal privacy, and ultimately our values related to family, work, friendship, and democracy are now linked to the structure of digital communications. Interactive marketing is at the core of the business model for much of the new media, including the personal computer and mobile platforms. A system has emerged where we are tracked, profiled, and analyzed, and then subjected to an array of sophisticated marketing communications designed to direct and change our personal behavior. Sadly, the public hasn't been well informed about what all of this means, what the choices and consequences might be, and what can be done about it. We are in a very important period of transition, where the decisions we make today about how we wish the Internet and other digital media to serve us as citizens and consumers will have profound consequences for us and for future generations.
(More - PDF below)
1. Order Google to provide meaningful notification when personal data from two distinct Google services are combined to produce a result that is linked an identifiable user.
2. Order Google to give a user the right to obtain knowledge, in a reasonable and timely manner, of whether or not the data relating to the user is processed and if it is processed, information to the purpose of the processing.
3. Order Google to provide, in a reasonable and timely manner, the logic involved in any automatic processing of data concerning that user.
4. Order Google not to retain user data in a form that permits the
identification of data subjects for longer than necessary for the purposes for which the data were collected.
5. Order Google to institute an “opt-in” approach to collecting user
information. If Google allows a user to “opt-in” before collecting personal data in order to personalize the search experience, Google should implement the same system with regards to a user’s privacy options.
6. Order Google to allow individuals reasonable access to their personal
information, along with the ability to edit and delete that information.
7. Order Google to stipulate to never engage in behavioral tracking.
8. Further order Google not to sell personally identifiable information.
9. Order Google to implement a functional and secure system of
anonymizing stored user data. Anonymized data remains traceable to the
individual user, as demonstrated when America Online inadvertently leaked the search records of 658,000 Americans.124 Google must implement a technique that truly anonymizes this data, either by erasing more the last octet of the IP address, erasing the IP address completely, assigning randomized numbers to the data, or developing an alternative technique that will render tracing the data back to the individual source impossible.
10. Order Google to cease storage of IP addresses. The search engine
functionality would not be impaired if a search engine did not store any user information at all.
11. Condition the merger on Google and DoubleClick maintaining separate
databases of user information.
12. Order Google to craft, disclose, and implement a security plan that will maintain, protect, or enhance the privacy, confidentiality, or security of all personally identifiable information.
13. Order Google to implement remedies and a system of accountability in the event of a breach, and to disclose to the public the extent to which it cannot or will not protect the privacy, confidentiality, and security of all personally identifiable information.
*For full text of the requests for relief as stated above, please see our amended complaint to the FTC.
In the rapidly expanding world of online advertising, a few mega-giants are dramatically expanding their power, including the ability to track consumers' online movements, to collect and analyze personal data resulting from those travels, and to craft ever-more-sophisticated digital marketing campaigns based on that analysis. The recent spate of mergers and acquisitions in the online advertising industry—led by Google's $3.1 billion takeover of DoubleClick in April and Microsoft's $6 billion buyout of aQuantive in May—threatens to undermine privacy, competition, and diversity on the Internet. Permitting the further growth of these data-dependent unrestrained giants is a threat to personal privacy online. Increasing digital media consolidation will also have a negative impact on the diversity of public interest content essential for a civil society (e.g., news, public affairs, and cultural programming).
The importance of search technologies to the online ecosystem cannot be overstressed. Search platforms like Google—which controls over 75 percent of the U.S. market—serve as the launching pad for hundreds of millions of online journeys every day, and"search plays a role in roughly half of all online purchases, according to DoubleClick's research. One problem with the online search process, however, is that it is essentially a two-way mirror: while we seek information on various topics, and click from site to site in quest of answers to our queries, companies like Google and Yahoo (and their legions of advertising clients) are watching our every move, compiling data, inferring tastes and interests, and assembling extensive profiles that will shape the content that will come our way in the future. The amount of data covertly changing hands in this fashion is staggering, as a recent Red Herring article on DoubleClick's digital holdings makes clear:
"Without a doubt, DoubleClick's historical data is very valuable," says Jupiter Research analyst Emily Riley. "Every time you're online, every page visit, and every ad you see comes with the possibility that a cookie is placed on your machine. DoubleClick has all the data." How much data? Ms. Riley's back-of-the-envelope calculation puts it into the fifteen figures: with more than 100 million web users viewing a quarter million pages a year, it hits the 2.6 quadrillion mark—and that's just U.S. users. If DoubleClick's ad network touched even half of those interactions, it amounts to the kind of database advertisers would drool over. "What it does is complete the picture for Google about what's happening on publishers' web sites," Ms. Riley says.
While much has been made of the looming Google/DoubleClick threat to its competitors—"a potentially frightening situation for [ad] agencies," according to Online Media Daily, as "a rather sinister master plan begins to unfold"—much less has been written of the larger threat posed by Google—to the culture of the Internet itself. In this context, Precursor analyst Scott Cleland makes an apt comparison to Microsoft:
Just as Microsoft vertically-leveraged (bundled/tied) its operating system dominance to dominate the office applications market via the Windows platform, Google apparently looks to vertically-leverage (bundle/tie) its keyword search dominance with DoubleClick's leadership in online banner/video display advertising, and with its Google-YouTube dominance in video search…. This vertical combination reportedly could give Google-DoubleClick upwards of 80% of the overall market for advertisements provided to third-party websites. Just like Microsoft became the default office applications platform for email, e-calendars, word processing, spreadsheets, and PowerPoint, for any user, Google has obvious designs on becoming the default Internet advertising broker/platform for: keywords, website display ads, and TV, radio, newspaper/magazine advertising for the average large advertiser.
While the mainstream media generally avoid any substantive discussion of this new digital landscape, the trade press has duly noted the potential impact of Google's and Microsoft's recent moves. As Search Insider pointed out, for example, "If Microsoft gains access to all the data, across all the engines, for aQuantive's entire client roster of search clients, it will be sitting on a treasure trove of information that it's never seen before—and which should have Google feeling very nervous. The same is true, of course, for the information that DoubleClick's Performics can provide to Google. To a network, an agency is a wealth of competitive data—a fact about which all of the networks are undoubtedly aware." Regarding Google's DoubleClick acquisition, similarly, Direct Marketing News noted that "[t]his deal gives Google access to publishers outside of its current AdSense network and to behavioral data that will help them with ad targeting."
Indeed, such targeting, unbeknownst to the vast majority of those who traverse the Net, is at the heart of the new personalized marketing paradigm. As DoubleClick tells its clients, touting its "Boomerang" one-to-one targeting technology:
Behavioral targeting is the most effective form of targeting available. It allows you to re-target the most desirable audience of all: browsers who have already shown an interest in your product or service. With Boomerang, you can now engage that audience in a dialogue, providing timely and relevant messages triggered by their online actions. Boomerang delivers true behavior-driven advertising, so you can reach pre-qualified prospects and customers more quickly and easily.
Google will incorporate Doubleclick’s Boomerang and related technologies into its massive data collection and tracking system (which also tracks users of online video, such as YouTube).
Ultimately, however, the threat posed by Google and Microsoft in particular and the converged advertising environment in general extends far beyond commerce, reaching to the very culture of the Internet. The danger is that in the quest for the most desirable demographic (and the higher advertising revenues that these audiences bring), less marketable material—including the public affairs and cultural programming on which a civil society depends—will be driven further into the margins of online culture. Just as the old media's fixation on circulation figures, box office receipts, and Nielsen ratings have impinged on creativity and independence, so will the new media's ad-driven pursuit of the highest returns on investment yield similar results—lowest-common-denominator programming designed, once again, to deliver "eyeballs to advertisers." The manner in which content creation and distribution is "monetized" (to use a favorite word of digital venture capitalists) will largely be determined by its ability to generate profits, raising critical competition issues for a medium once heralded for its ability to support a full range of diverse content. The impact of Google/DoubleClick and related mergers in online marketing, in short, must be assessed in light of their effect on the Internet as a robust marketplace of ideas, and not merely as another shopping mall.
Recommendations: