Yesterday, I began the Six Sigma Privacy series with a discussion on the user attitude to online privacy, primarily focusing on the observation that most Internet users don’t really care. Today, I’m going to take a look at how some of the big players approach the topic. The bottom line is that there’s lots of talk and not a lot of action.

Privacy advocates want people to believe that this is the single biggest issue since the Colonies seceded from England. Consumers are apathetic. How do the titans of the Internet tackle privacy?

Back in July, Microsoft and Ask came together to call for global privacy standards:

Building on their respective efforts to protect consumer privacy, industry leaders Microsoft Corp. and Ask.com, a wholly owned business of IAC (NASDAQ: IACI), today joined together in the commitment to call on the industry to develop global privacy principles for data collection, use and protection related to searching and online advertising. The companies will work with other technology leaders, consumer advocacy organizations and academics to come together and join them in working on the development of these principles, which could include developing and sharing best practices to provide more control for consumers.

?As search and other online services progress, it?s important for our customers to be able to trust that their information is being used appropriately and in a way that provides value to them,? said Peter Cullen, chief privacy strategist at Microsoft. ?We hope others in the industry will join us in developing and supporting principles that address these important issues. People should be able to search and surf online without having to navigate a complicated patchwork of privacy policies.? [emphasis mine]

Google followed suit in September, with Peter Fleischer calling for global privacy standards at a UNESCO conference:

…Google is calling for a discussion about international privacy standards which work to protect everyone’s privacy on the Internet. These standards must be clear and strong, mindful of commercial realities, and in line with oftentimes divergent political needs. Moreover, global privacy standards need to reflect technological realities, taking into account how quickly these realities can change.

Their announcement, though, was met with resounding cynicism, according to MediaPost coverage:

“…It’s clear that this is motivated in part to dampen the growing opposition to the DoubleClick takeover,” said Jeff Chester, executive director of the Center for Digital Democracy (CDD). “Google is attempting to head off a global regulatory digital train wreck.”

…”Google is under enormous pressure from many countries around the world who are fed up with their arrogance and their unwillingness to make meaningful changes to their business practices,” said Marc Rotenberg, executive director of EPIC. “They are also trying desperately to push the acquisition of DoubleClick through the Federal Trade Commission. And they’ve met enormous resistance.”

…Critics argued that the search giant gave no specifics for how to move forward with a global implementation–calling it another sign that the endorsement was just Google posturing for the FTC.

“Mr. Fleisher is lobbying to get a privacy Band-aid placed over an ever-growing flow of personal data being squeezed from consumers (by Google and others),” said Chester.

Poor Google. Evil-avoidance notwithstanding, they’ve gotten so big that pretty much anything they do these days is greeted with cynicism. Take Maile Ohye and the Google Privacy Videos (one and two). Just a few days ago, Ryan Singel at Wired gave his non-held-back opinion on them:

The video skips right over the part where Google opts in new users to the tracking program without explaining to people what the program is or does.

Instead, it jumps from the “create a Google account screen” to a heartwarming story about how having searched for the “Rolling Stones” in the past will help Google disambiguate a later search on the word “bass” - so it knows you are interested in the instrument, not the fish.

This might be interesting if it were true, which I doubt it is since I’d wager MORE people who searched on the “Rolling Stones” in the past are anglers than musicians.

But why let that get in the way of a good cover story for why Google really wants to collect data about you which is, as we all know, the ad dollars.

Anyway, back to Fleischer and Google’s request for global privacy standards. In September, Google’s CEO, Eric Schmidt, added his voice to the conversation:

More encouragingly recent initiatives in this area by the United Nations, the Asian-Pacific Economic Co-operation Forum and the International Privacy Commissioners? Conference have all focussed on the need for common data protection principles. For individuals such principles would increase transparency and consumer choice, helping people to make informed decisions about the services they use as well as reducing the need for additional regulation. For business, agreed standards would mean being able to work within one clear framework, rather than the dozens that exist today. This would help stimulate innovation. And for governments, a common approach would help dramatically improve the flow of data between countries, promoting trade and commerce.

I recommend you click on the link to Schmidt’s piece and read the response from Ann Cavoukian, who chaired a working group of Commissioners convened for the purpose of creating a single harmonized privacy standard; she points out that the issue isn’t standards creation but standards implementation:

I would also like to draw your attention to documents already produced by highly regarded international authorities on privacy and suggest that the issue is not one of developing new standards, but of raising the bar by observing existing global standards and privacy principles.

What does this all add up to? Major players understand the importance of being seen as caring guardians of the people’s privacy. They talk about it, create videos about it, call for global standards for it. I’m just not yet convinced that effective actions are being taken about it, or even that these companies want people to truly understand the issues at stake. The Maile Ohye videos aren’t designed to raise awareness; they’re designed to keep people calm.

But what should they be doing instead? Tomorrow I’ll discuss some of the issues involved and why this topic is important. Until then, I’d love to hear your opinion about how the big players handle online privacy. Do you think they do a good job? Or should we demand something better?

CNET just put up the Big Five’s responses to a survey about their privacy practices. Here’s my take on the information provided.

AOL answered every question directly and simply. Bravo!

Nicholas Graham from Ask.com gave what I thought were funny answers to nearly every question. Instead of responding directly, they answered on behalf of the yet-to-be-launched AskEraser. Here are some examples:

What search-related data–including IP addresses, cookie IDs, user identities, and search terms–do you retain?
Graham: With the upcoming launch of AskEraser, a user’s IP address, search data cookie ID and search query will be completely deleted and expunged.

How long do you retain those data?
Graham: Users of AskEraser will have their complete IP address, complete search data cookie ID, and complete search query eliminated in a few hours or less.

If you retain data for a limited period of time, is it completely deleted (in such a way that the data and backups cannot be recovered, even under court order) or is it anonymized instead?
Graham: Users of AskEraser will have their complete search query data eliminated so that no one who requests it from Ask.com will be able to access it–ever.

If the data are anonymized, exactly how do you do this?
Graham: Since users of AskEraser have their complete search data totally deleted, none of their data is ever anonymized.

But the real punchline of Ask’s survey was the final question:

We wrote last month that AskEraser will launch by the end of the year. Do you have a more specific date?
Graham: We don’t have a more specific one.

Nicholas Graham, if you are reading, would you be willing to provide the answers to the questions that would be currently accurate for Ask.com? If you know Nicholas, or know someone who knows him, will you forward this request?

Victoria Grand from Google gave an utterly obfuscating answer to the question of behavioral targeting:

Do you do behavioral targeting, meaning showing ads to users based on their behavior across multiple queries?
Grand: We are committed to protecting user privacy. We also want to provide users with a more rewarding online experience by making the advertising and content users see relevant to them. We believe the targeting capabilities, reporting and analytics we offer today provide advertisers with an excellent ROI and provide a high-quality user experience. Currently, our system incorporates a large number of signals (such as the user’s query, the user’s location, type of site, content, and the advertiser’s landing page) when targeting and ranking ads. We have not focused on demographic targeting to date for targeting ads on search result pages.

Evidently the surveyers couldn’t understand that any more than I could, so they followed up:

We weren’t able to figure out your answer to our question asking whether you do behavioral targeting. In other words, if I search for “New York City vacation” in one query and “vacation hotels” in a second query a moment later, does Google.com evaluate the two responses, figure out that I’m probably looking for New York City hotels, and display ads appropriately?
Grand: No.

Don’t they, though? I’ve been reading a lot about this adjacent query thing… wait a minute! I wrote about it two weeks ago!

Meanwhile, over on Yahoo! News? Eric Auchard is writing about Google?s unwillingness to tie together profiles across their massive collection of services for the purpose of serving up targeted ads.

What they are willing to do is use information that can be gleaned from within a given search session.

“A user who types ?Italy vacation? into a Google search box might see ads about Tuscany or cheap flights to Europe. Were the same user to subsequently search for ?weather,? Google will assume there is a link between ?Italy vacation? and ?weather? and deliver ads tied to local weather conditions in Italy.”

So do they or don’t they?

Microsoft’s Peter Cullen gave some interesting answers. He was straight up about behavioral targeting, which users can opt out of (opting in is automatic).

If you do, is there a way for users to opt out of behavioral targeting?
Cullen: Once Microsoft begins to offer behavioral ad targeting on third-party sites, we will offer customers the ability to opt out of the behavioral ad targeting by Microsoft’s network-advertising service on those Web sites. This is consistent with the privacy principles of the Network Advertising Initiative, which Microsoft announced it will join. We will also continue to develop new user controls that will enhance privacy, such as letting people search and surf our sites without being associated with a personal and unique identifier used for behavioral ad targeting.

Finally, Jim Cullinan from Yahoo wins the First Annual Kaila Colbin Blunt Award:

Do you do behavioral targeting, meaning showing ads to users based on their behavior across multiple queries?
Cullinan: Yes, we do.

If you do, is there a way for users to opt out of behavioral targeting?
Cullinan: No.

His replies oblige me to repeat a question I’ve asked many times before:

What is the real privacy issue?

I presume Yahoo does behavioral targeting because they believe it gives them a market advantage. If there were a massive market backlash, they’d be forced to drop it, right? Yet I’m equally confident that if Google announced they were going to do behavioral targeting with no possibility of opting out, there would be a HUGE uproar!

Are we giving Google the short end of the stick here? Are we just worried about Google because they’re so massively and enormously big? Or is it the other way around: should we be more worried about Yahoo than we actually are?

Do you think the marketplace is expressing a consistent and coherent view of what we want?