Behavioral Advertising Across Multiple Sites
To understand behavioral advertising across multiple sites (also known as "third-party" behavioral advertising), you must first understand the concept of an online "ad network." You’ve undoubtedly encountered these networks, though you might not know it.
Advertisers almost never deliver their own ads online. If you see a car ad, it’s unlikely that the car company’s marketing department put it up on the Internet itself. Instead, advertisers (such as the car company) contract with intermediary companies to get their ads onto Web sites. Likewise, major Web sites (known as "publishers") don’t usually sell their own ad space to advertisers, but instead use other companies to do it for them. Ad networks are intermediary companies that fit both of these needs. They contract with a bunch of advertisers on one side, and a bunch of Web sites on the other. Armed with a pool of online ad space, and a pool of ads to display, ad networks are in the business of matching up the two. The following diagram shows how an ad network might enter into contracts with several advertisers and several publishers and deliver the advertisers’ messages on the Web sites.
Basic model across multiple sites
Remember that an ad network has contracts with many different Web sites ("publishers"). An ad network can track your behavior as you browse from one Web site to the next in its network. Most ad networks accomplish this tracking by using (you guessed it) cookies.
Consider the ad network diagrammed above. Imagine that you go to SF-hotel-review.com. Because SF-hotel-review.com is part of the ad network, the network can deposit a cookie with a unique ID on your computer during this first visit. This is exactly what we mean when we talk about third-party cookies – the ad network is the third party and SF-hotel-review.com is the first party. Now suppose you leave SF-hotel-review.com, visit a few other sites, and then decide to check out dogzblogs.com. Because the ad network also has a contract with dogzblogs.com, it can request and read your cookie ID. Now the ad network knows that you visited both SF-hotel-review.com and dogzblogs.com, and it can store that information in the profile that it keeps about you. If you later visit social-network.net, the same sequence will happen again, and information about your visit to social-network.net will be added to your profile.
The following diagram of the whole process shows how the ad network deposits on a consumer’s computer a cookie with the ID number "12345" when the consumer first goes to a Web site in the ad network’s network and then uses that same cookie to track the user across other sites.
The point of all of this is to serve you ads targeted to your interests. For example, based on your visit to SF-hotel-review.com, the ad network might surmise that you’re planning a trip to San Francisco. The next time you visit a Web site in the network, you might see an ad about travel to California.
This behavioral advertising model is used by dozens of ad network companies across thousands of the Web’s most popular Web sites.
If you decide that you’d rather not have ad networks create behavioral profiles about you and serve you targeted ads, check out the tips in the Controlling Your Data section to learn how you may be able to opt out.
Model using PII across multiple sites
Although the model described above is certainly the most prevalent one, there are several variations in how third-party behavioral advertising might work and what kind of data might be involved. For example, imagine that dogzblogs.com offers users the option of providing their names to the site, so that this information can be listed alongside their blog comments. Once this data is collected, dogzblogs.com may decide to share it with the ad network. Since the ad network already knows your cookie ID, it can then link your name to your cookie, and thereby to the profile that the ad network keeps about you, as shown in the following diagram:
Once the ad network knows your name, it might take the opportunity to find out a little bit more about you. It might search public databases for information about you, or it might buy data from other companies that know about you, like retail stores or data aggregation companies. Any new data that it acquires goes right into your profile. Then, when you visit other sites in the network, you may see ads targeted based on this other information.
Many ad networks that use personally identifiable information in this way will give you the opportunity to opt out of this data linkage at the point where the personally identifiable information is collected. In our example, dogzblogs.com might tell you that it intends to share your name with the ad network just when you’re about to type in your name, and it will offer you the choice of not sharing it. Take a look at the Controlling Your Data section for more information about opting out.
ISP behavioral advertising
Recently, companies have begun experimenting with another form of behavioral advertising, one that involves not just ad networks and Web sites, but Internet Service Providers (ISPs) as well. Your ISP is the company that you buy Internet service from (usually a phone or cable company if you’re in the U.S.).
In this variation, ad networks are still central. But instead of contracting with Web sites to collect data about their visitors, ISP-linked ad networks contract with ISPs to collect data about their subscribers. Rather than signing contracts with lots of individual Web sites to be allowed to track users on those sites, these ad networks sign contracts with ISPs to be able to monitor the Web browsing happening on the ISPs’ networks. Once an ISP has entered into this kind of deal, it ships its subscribers’ browsing activity over to the ad network. From there, everything else is the same: the ad network analyzes the sites you’re visiting, uses that information to create a profile about you, and later serves you ads that it thinks you’ll like.
Only a small number of ISPs have begun participating in behavioral advertising this way. To find out if yours is one of them, take a look at your ISP’s privacy policy and terms of service (both of which are likely accessible via links on the ISP’s home page). Keep an eye out for an explanation of the ISP’s advertising practices or policies around disclosure of data to third parties. If your ISP is engaged in this kind of behavioral advertising, it might offer you a choice about whether you want to participate. Information about that choice should be in the company’s policies as well.