CORVALLIS, Ore. — It’s illegal for businesses and law enforcement to profile a person based on their race, gender, or ethnicity, yet millions of Americans are being profiled every day based on their online consumer behavior and demographics.
Known as consumer profiling for behavioral advertising purposes, this type of profiling is largely unregulated.
The result, according to two recent articles in the journal of Computer Law & Security Review, is that consumers have less privacy and are being targeted by advertisers using increasingly sophisticated measures, which may include efforts to alter behavior based on online tracking and profiling.
The articles examine existing privacy laws to determine how well they protect consumers’ privacy and look at possible ways to protect consumer privacy including adopting new laws, using technology to protect privacy and voluntary efforts by the advertising industry.
Nancy King, associate professor of business law at Oregon State University, is lead author on the articles in a two-part series on profiling of mobile customers. King is an expert on privacy issues and e-commerce and has been studying issues related to consumer privacy and data protection for more than a decade.
“Most people do not know they are being tracked, and they aren’t given a choice whether to be tracked or to have their online behavior and personal information shared with large networks of advertisers,” King said. “Online advertisers may know or make inferences about what neighborhood you live in, your gender and how much money you make and even very intimate details — such as if you are trying to lose weight or where your next vacation is planned — and they use that information to target advertising at you.”
In addition to the concerns regarding online behavioral advertising, mobile users have added concerns, King said, because typically only one person uses a particular cell phone and the geographic location of cell phones may also be tracked. So advertising generated through cell phone tracking and profiling may be both personal and location-specific.
King gives a hypothetical example of fast food ads based on profiling teenage customer behavior and demographics that could produce highly-targeted ads sent to teens on their cell phones. These ads can be time- and location-targeted, arriving when teens are likely to be out of school or when they happen to be near fast food restaurants.
Given the concern about obesity in our culture, King said teens and their parents may have legitimate privacy concerns about the impact of these types of ads on teenagers’ food choices; yet existing laws do not protect these privacy interests.
“Profiling can manipulate consumers’ behavior without them knowing that they have been categorized by advertisers,” King said.
King seeks potential solutions to protect consumers’ privacy, but she said it is important to avoid privacy solutions that go too far and might unduly restrict the behavioral advertising industry. Often the right balance involves ensuring consumers have enough information and mechanisms in place to protect their privacy.
As it stands now, King said, consumers have little choice whether or not they are tracked or profiled. Online users can disable tracking cookies — software code that is downloaded to your computer by websites that track consumers’ behavior — but many websites will not allow users to access their sites if cookies are disabled. And wiping cookies from your computer regularly may not help either.
Web beacons are another tool used to track behavior, but instead of downloading the tracking device to a personal computer, a beacon tracks behavior directly from the website. Web beacons can record almost every individual move of a web user and users have no control over beacons since they reside on the websites that users are visiting.
King said that online behavioral advertising is a new and effective tool to reach potential customers, which is one reason why the privacy issues are as yet unresolved. However, as lawsuits — such as one pending against Facebook for potentially disclosing users’ personal data to advertisers — continue to increase, King said it is inevitable that the issue of online and mobile privacy will be addressed, if not by Congress, then by the courts.
“The bottom line is that we as consumers are being tracked and profiled, and it is an invasion of privacy and in some cases gets into issues of social justice,” King said. “You are being targeted because you ‘look’ like someone who may — or may not — be interested in a certain product, but you may never know what the advertiser knows about you that lead to this conclusion.”
The implications of consumer profiling go far beyond receipt of targeted advertising. Imagine this scenario: you are on a travel website browsing airline ticket fees, and you decide to do shopping on other websites. You find a good deal on a hotel at your proposed destination, so you make a reservation. A few hours later you re-check the travel site only to notice that the price has increased by $100. Most likely, you have been profiled as a return visitor and a customer who is highly likely to buy an airline ticket, based on online tracking enabled by the cookie that was downloaded to your computer on your first visit to the travel site. So, now the price of those tickets is higher — just for you.
This type of profiling is not currently illegal in the U.S., nor is it known how frequently it may occur.
“You should have the right to surf the Internet and use your mobile phone without being tracked and profiled, and you should be given a choice about whether you want to receive behavioral advertising,” King said.
The first part of this study was published in the September issue of the Computer Law & Security Review and the second part appeared in the November issue. Pernille Wegener Jessen from Aarhus University in Denmark is co-author of the paper, which was named “Best Academic Paper” recently at a conference in Barcelona for the International Association of IT Lawyers.
