Yahoo: Not So Private After All

Now you can opt out of its behaviorally targeted ads, but the search giant can still see what you're doing on its site

by Heather Green and Catherine Holahan

Yahoo! says it won't target you… to your face. On Aug. 8, the Internet giant announced that it will allow users to opt out of behavioral targeting on its site. But in fact, that change only affects behaviorally targeted ads that users see. The company will still collect information on the Web sites visited by unique computers, it just won't serve ads to individual users based on the info.

"This isn't rejecting cookies outright, you are just preferring not to see the ads," says Anne Toth, Yahoo's head of privacy and vice-president of policy.

So Yahoo (YHOO) will still know that you looked up Fannie Mae's stock on Yahoo Finance and then checked out foreclosed homes on Yahoo's real estate site. It just won't serve you a mortgage ad based on that info when you're checking e-mail. It will also still serve ads to you based on your location and the content of the page that you are on.

Toth says Yahoo must keep the information to report accurate financials on advertising click-through rates and visitors. It probably also wants to tell advertisers about the kind of people who visit certain pages, in aggregate, to sell more expensive advertising. Behavioral targeting can more than triple the price of some ads.

Congressional Pressure

The move came in response to congressional action. On Aug. 1, the House Energy & Commerce Committee sent a letter to 33 companies, including AT&T (ATT), Comcast (CMCSA), Google (GOOG), Microsoft (MSFT), and Yahoo, opening an inquiry into their practices for collecting and using data to target ads to consumers based on what they do online.

Behavioral targeting is different from other kinds of targeting, such as search targeting or geotargeting, which uses IP addresses or Zip Codes that people provide when they sign up for a site. Behavioral targeting works by tracking surfers as they move around the Web. Companies then apply sophisticated algorithms to that past behavior to decide what kinds of ads to show the people they're tracking.

Yahoo's response follows Google's rollout on Aug. 7 of DoubleClick tracking (BusinessWeek.com, 3/12/08) across its network and a way to opt out of tracking on the Google content network and DoubleClick tracking. Microsoft also allows users to shut off targeted ads.

Will these moves be enough to keep Congress happy? The committee seems pretty riled up after holding hearings about NebuAd, a behavioral targeting company that was little known until recently. NebuAd takes behavioral targeting one step further than Google and Yahoo. It works directly with Internet service providers, or ISPs, placing a device on their networks to log surfers' movements, a technique similar to wiretapping.

Guidelines for Self-Regulation

Now the committee is broadening its inquiries to include more companies. Congress is digging into questions about how long data are held, how consumers are alerted to the practice, what kind of data are being collected (health, financial, and other personal information), and how many people are being tracked. And the committee has been making noise about passing legislation and obliging companies to ask people to opt in before collecting data.

The Federal Trade Commission looked into these questions last fall and came up with tentative guidelines for self-regulation. The industry responded with an update of the guidelines it follows, which are set out by the Network Advertising Initiative, the industry association.

Some of the privacy folks aren't entirely happy with either the FTC's recommendations or the NAI's response.