Online Profiling

"Online profiling" is a phrase that conjures up images of Big Brother tracking your online movements for some ambiguous, but nefarious purpose. If you're an e-business, online profiling may lead you to the promised land (profits). It lets you build a database of your customers' habits and hobbies by keeping track of where your customers go online after they leave your website.

The specter of potential abuse of online profiling has spooked several federal agencies into considering legislation to limit its use. In an effort to prevent legislation, several major Internet advertising companies worked with the Federal Trade Commission (FTC) and developed self-regulatory rules which limit how and when online consumers' actions may be traced and recorded by e-businesses.

These rules were just given the green light by the FTC and are now in effect. You need to be aware of these rules, and analyze how they affect the way you conduct your e-business, both now and in the future.

How Does Online Profiling Work?

It all begins with your customers' Web browser. When your customers visit a web page that contains banner ads, there's special code written into the web page. This code tells your customers' web browser to get the banner ads from an advertising network site on the Internet, or "ad network." The browser then asks the add network for an ad and it then pops up inside the Web page. Your customer usually doesn't realize that the ads are coming from the ad network, and the web page contents from you.

When your customer clicks on one of the ads, the ad network receives a message, which then sends your customer to wherever the ad goes. However, the fun doesn't end there.

The ad network keeps a record of your customer's Internet Protocol (or "IP") address, the number of times that your customer's particular IP address responded to a particular ad and, more importantly, the ad network may begin to track your customer's IP address as she moves from site to site on the Net.

The Value of Online Profiling

Knowing where customers go after they leave your website can be valuable information for you. It can help direct how you spend your precious advertising dollars. Now you'll know those websites that tend to attract traffic from the people who will likely visit and purchase things from your e-business.

For example, let's say GolfClubsForEveryone.com sells golf clubs. Being the excellent golfer that I am (well, not really, but it's my column), I happen to see their e-store's banner advertisement on another site, and I click on the ad which takes me to their GolfClubsForEveryone.com website.

Let's also assume that after browsing the site, I decide to keep my credit card firmly entrenched inside my wallet. Instead, I next visit a website devoted to the stock market, followed by another website which sells home theater equipment.

Although the golf company didn't make a sale, it still may have profited if it used online profiling to track my activities after I left its website. If it did, it got an inside look at my personal interests--finance and stereo equipment.

After tracking many people in this manner, the golf company could build a database of its visitors' interests, and adjust its advertising focus accordingly. Therefore, the next time I visit their site, I may just find that they are offering a free CD player with every purchase. (Hold on, let me go get my credit card…)

The New Rules

Before the new rules took effect, Web companies had few guidelines as to when and how they could use online profiling to build databases about their customers. Predictably, this caused concern among various privacy watchdog groups, and the government began to consider heavy-handed legislation to curb the use of online profiling.

In an effort to make the Web a kinder, gentler place without the need to resort to legislation, eight of the leading Internet ad networks (24/7 Media, AdForce, AdKnowledge, Avenue A, Burst! Media, DoubleClick, Engage and MatchLogic) teamed with the FTC to develop rules that prevent companies from abusing the information they receive through online profiling.

The result of their effort was a set of four self-regulatory principles. These principles not only require you to tell your customers about your online profiling activities, but also require you to give your customers the option to choose whether you can store and use their online habits and interests. The specifics follow.

First, the rules provide that you must tell your customers if you use online profiling to track their online interests and hobbies. If you collect personally identifiable information about them, such as their names, addresses or telephone numbers, your website must clearly and unambiguously notify them of this fact before you collect this information.

Second, your customers must be given a choice on participation in profiling. Under the rules, the choice method that you offer depends on the type of information you wish to collect.

For example, if you want to link personally identifiable information that you already know about a customer--such as a name, address or telephone number--with data you just acquired (such as the fact that your customer just visited "GolfClubsForEveryone.com"), the customer must first "opt in." This means that you must receive your customer's permission before linking the pieces of information together. If you simply want to merge non-personal data about your customers, you only have to give your customers the ability to "opt out" before doing that.

Third, the rules provide that your customers must be given reasonable access to any personally identifiable information that you keep about them for profiling. This one could be your worst nightmare.

It may mean that you have to spend significant amounts of time and money to run a search of your entire database upon the request of anyone who asks you to do so. If your business is large enough, you may find it necessary to hire additional staff to conduct these searches on a full-time basis. Ouch.

Having said that, I suspect that over the next few months, we'll see software solutions develop that will allow you to comply with the "reasonable access" problem with little or no human intervention.

Finally, the rules require you to make reasonable efforts to protect the data you collect for profiling purposes from loss, misuse, alteration or improper access. Of all the rules, this is the least controversial because you're probably doing this anyway. And if you're not, then the rule is good medicine for you. You should be protecting your data regardless of what any rule tells you to do.

You Need to Comply Now

This is important stuff. If you don't think so, ask yourself this: When was the last time that eight of the largest companies in any industry not only agreed with each other, but also agreed with the federal government? It doesn't happen often. So if your business does online profiling of its customers, then implementing the new rules should be on your short list of things to do.

The simple fact is that online privacy is becoming an increasingly regulated area. You're going to need to get with your e-commerce lawyer to insure that you're in full compliance immediately.