Witness the ad industry’s reaction to claims it is dragging its feet on “Do Not Track,” a system to let consumers tell companies not to harvest their online personal information.

“We keep getting demagogued by the FTC,” Stu Ingis, the head of the Digital Advertising Alliance, told AdWeek. The remark came in response to a speech this week in which the head of the Federal Trade Commission suggested new rules might be on the way.

Does Ingis have reason to worry? Perhaps. Consider that after a year of relative silence, the dreaded (in the ad industry, anyway) “Do Not Track” phrase is back in the news on a regular basis. Next week, for instance, U.S. Senator Jay Rockefeller (D-W.Va)  is holding a public hearing to trumpet his do-not-track legislation. Meanwhile, Microsoft and Mozilla are setting their Internet Explorer and Firefox browsers to block third-party cookies — small, ubiquitous computer programs that record the web pages you visit.

For advertisers, these developments threaten to throw a wrench into an ad system that puts a high value on “retargeted” ads. Indeed, there is already evidence that fewer cookies means lower ad prices.

On the other hand, any type of sweeping law is unlikely. While politicians like beating the privacy drum, the details — and even the definition — of “Do Not Track” are hopelessly complicated. Companies like Google and Facebook (which are giant advertising firms) claim the term is confusing to consumers and, in some cases, have chosen to ignore browser instructions about cookies.

At the same time, these companies are doubling down on ad products that target individual users. Facebook, for instance, now lets customers buy ads based on third party data and is even partnering with retail outlets like drug stores to collect users’ offline shopping information. The social network and other tech companies, which have growing clout in Washington, will lobby hard to prevent any serious change to the current ad system.

Finally, the focus on cookies could ultimately prove to be a red herring in the”Do Not Track” debate. This is because more consumers are using mobile devices to access the internet — and these devices don’t rely on cookies for advertising in the first place.  In response, Apple has developed a sophisticated way for advertisers to target users’ devices while companies like TapAd and Adelphic have found ways to identify users no matter what device they use. In other words, any new “Do Not Track” law that targeted cookies would have a limited effect in a world where marketers follow us on our mobile devices.

The bottom line is there has been more sound and fury than usual about “Do Not Track” but that comprehensive privacy reforms are nowhere in sight.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Consumer privacy in the mobile advertising era
• Controversy, courtrooms and the cloud in Q1
• Connected world: the consumer technology revolution

One example is New York ad company Tapad, which claims its “Device Graph” uses 2 billion data points to find people on whatever screen they’re using. This means, for example, that a shoe company can identify a potential customer and hit them with a succession of ads — one on their work computer, another on their phone as they walk home and yet another as they look at a tablet on their couch.

In a recent interview, CEO Are Traasdahl said about 100 clients are using Tapad’s technology, including Dell and major electronics and finance firms. The appeal, he says, is that ad campaigns are more efficient if marketers know that an ad viewer on a computer and a smartphone is the same person.

Tapad’s technology may provide a boon to marketers but it also raises some obvious questions. First, how do we know it works? Mobile marketing is tricky in the first place because smartphones and tablets generate fewer cookies (the bits of computer code that indicate you’ve visited a given website); for example, Apple limits cookie collection by its Safari iPhone browser and by third party apps. This makes it difficult for brands to use so-called “retargeting” (showing an ad to someone based on what they done in the past) on a mobile device; identifying that same person across multiple devices would seem even more difficult.

According to Traasdahl, Tapad uses a sliding scale to guess whether a computer and phone user is the same person. Like all advertising, he says, there is an inherent degree of uncertainty. But he adds that, for brands, the proof is the pudding — they can look at whether multidevice targeting produced a lift in response or sales.

There is also the question of just how Tapad is tracking people. Like other companies in the mobile marketing space, such as Google Ventures-backed Adelphic, Tapad is tight-lipped about its techniques. Traasdahl did, however, say the company uses data sources like publishers’ log-in information, Wi-Fi locations and zip codes as some of the sources for its billions of data points. This is an example of what a recent MIT Technology Review article described as “reverse-engineering” our online identities.

Finally, in addition to the technology dimensions, there is the creepy factor. While companies like Tapad may provide more efficient advertising, some are going to bristle at its efforts to track them wherever they go. Tapad, like others in the advertising industry, protects “PII” — personally identifiable information — which means the “identity” that marketers see is just a random number, not your name or address. Still, there is growing concern in the media about tracking (see this week’s “Technology Turns to Tracking People Offline” in the New York Times) and in Congress where there are regular mutterings about Do Not Track legislation.

For now, the likes of Tapad and its investors (who include FirstMark Capital and Avalon) are counting on a light regulatory hand as they fine tune the online marketing machine.

(Image by Alexey Fursov via Shutterstock)

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Consumer privacy in the mobile advertising era
• Hyperlocal: opportunities for publishers and developers
• Opportunities and challenges for mobile deals

The apps in question were rejected by App Store reviewers because of a user interface problem, not expressly because of the use of HTML5 cookies in apps, according to a source familiar with the situation. And there is no change in Apple’s policy, no new enforcement and “no crackdown” on cookie tracking at all, this source said.

Techcrunch reported on Monday that the rejections “signaled a push to its own identifier technology” and compared this move to how Apple began enforcing the move away from unique device identifiers (UDIDs) in late 2011. That was when Apple began to reject some apps that were using UDIDs, which are an anonymized number connected to an iOS device that publishers and advertisers could use to track user behavior and better target ads to those users. But UDIDs weren’t as anonymous or private as people thought; with just a bit more information like the user’s birthdate, gender or email address, which some apps were tracking, his or her location and identity could be resolved.

That’s why in September 2012 Apple introduced the Advertising Identifier, which let users have more privacy and gave them more control over what publishers and advertisers know about their use of apps. But Apple, so far anyway, is not forcing anyone to use it.

There are a handful of different tracking methods in use right now, said Craig Palli, vice president of business development at mobile app marketing company Fiksu. UDID has been officially phased out by Apple and few apps continue to use it, but there are five or six other methods also in use, including cookie tracking and the use of MAC addresses.

The apps in question (which have not been officially named and which sources were unwilling to relay) were rejected over clause 10.6 in the App Store guidelines, I’m told. That rule (rather vaguely) states, “If your user interface is complex or less than very good, it may be rejected.” These apps, once launched, briefly kick a user over to mobile Safari before bringing them back to the app — in other words, an experience that is not Apple’s ideal user interface for a native app. The company has “always rejected” apps that do that, this source said.

It is very possible that Apple will eventually want to move all apps over to the Advertising Identifier. But whatever is happening now isn’t really comparable — at least yet — to what happened with UDIDs, according to the source. Developers have not been told specifically by Apple to either use Advertising Identifier or not use other tracking methods like cookie tracking they way they were told in 2012 to stop using UDIDs.

Apple did not comment on whether the company would begin enforcing use of Advertising Identifier.

Palli, who is also quoted in the original story, notes that he personally knows of 10 apps — which he did not name — that use cookie tracking and were approved by Apple in the last month. “Some very large brands have been rejected, but those [app] rejections are not pervasive across the ecosystem,” he noted. In other words, there’s no real pattern yet in the rejections, perhaps other than a user interface rule violation.

Thumbnail image courtesy Shutterstock user Cienpies Design.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Mobile 2012 and beyond
• Takeaways from mobile’s second quarter
• Hyperlocal: opportunities for publishers and developers

Google will pay a $22.5 million penalty as punishment for breaking the terms of a 20-year privacy settlement that the FTC had slapped on the company last year. Under that settlement, Google had to pledge it would not “misrepresent” the degree over which users had control of their privacy settings.

The FTC found Google had committed such a misrepresentation when it placed tools known as “cookies” to collect advertising information from users even though the company had suggested Apple’s browser settings would prevent this from occurring. In the words of the FTC:

for several months in 2011 and 2012, Google placed a certain advertising tracking cookie on the computers of Safari users who visited sites within Google’s DoubleClick advertising network, although Google had previously told these users they would automatically be opted out of such tracking, as a result of the default settings of the Safari browser used in Macs, iPhones and iPads.

News of the fine was leaked to the Wall Street Journal in June and today’s announcement makes it official. As is customary in these type of cases, Google does not admit liability under the terms of its penalty agreement with the FTC.

Both Google and Facebook are under 20-year privacy agreements with the FTC. Privacy issues have become a hot issue as regulators try to find the right balance between safe-guarding consumers’ privacies while also ensuring they don’t stifle innovation in the tech sector.

“The record setting penalty in this matter sends a clear message to all companies under an FTC privacy order,” said Jon Leibowitz, Chairman of the FTC.  “No matter how big or small, all companies must abide by FTC orders against them and keep their privacy promises to consumers, or they will end up paying many times what it would have cost to comply in the first place.”

Read the full announcement here.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Controversy, courtrooms and the cloud in Q1
• Connected world: the consumer technology revolution
• Google doesn’t like walled gardens — except its own

The incident stems from a highly publicized incident in February in which a Stanford graduate student discovered that Google was using trickery in order to by-pass ad-blocking settings on Apple’s Safari browser. The scheme involved coding ads to masquerade as form submissions in order to install advertising cookies (see my colleague Tom Krazit’s great explanation of the tricky business — and its relation to Google+ — here).

While other companies and app makers may have engaged in similar chicanery, the Federal Trade Commission appears determined to hit deep-pocketed Google hard. The Journal reports that the FTC’s $22.5 million punishment is based on Google’s failure to tell the truth about its advertising practices.

The federal agency has in recent years emerged as the country’s de facto chief privacy cop even though the laws governing the agency aren’t particularly designed to do this. While other countries have special Privacy Commissioners, the FTC instead relies on its traditional powers to regulate “deceptive” and “unfair” trade practices.

The FTC recently used these powers to slap a 20-year “consent decree” on Google to punish it for missteps related to its ill-fated Google Buzz social network. That consent decree in turn provided the FTC with powers to fine Google $16,000 a day if it violated the terms of the decree. That is what appears to have happened here: Google didn’t comply with terms of the decree that requires it to tell users about its advertising practices.

Google also faces a series of private class action suits over the Safari incident. The news of the FTC fine comes at a time when every large technology company is confronting lawsuits and regulatory scrutiny over their privacy practices.

(Image by Suzanne Tucker via Shutterstock)

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• What Does the Future Hold For Browsers?
• Consumer privacy in the mobile advertising era
• Analyzing the wearable computing market

But whether they’re outraged, scrabbling in terror, or simply hoping it goes away, it’s the privacy rule that European startups can’t ignore. But what exactly is the so-called “cookie directive”?

As the rules finally come into force in the U.K., we take a look at the details.

What is it?

Let’s start by giving the rule its proper name: it’s EU Directive 2009/136/EC (PDF), known as the E-Privacy Directive. The broad legislation was first passed into European law two years ago, essentially forming a series of amendments to federal rules regarding electronic communications and data privacy.

Specifically, there is one section of that directive — Article 5(3) — that applies to the use of data storage by websites. And for the most part, that boils down to cookies.

Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information… about the purposes of the processing.

Forget the legalese, here’s the bottom line: under the rules, which cover the whole of the European Union, websites must ask visitors for their consent before they can install most cookies.

Unsurprisingly, it’s a little bit more complicated than that.

First, this rule — championed by European Commissioner Neelie Kroes — doesn’t actually apply to cookies alone — it still counts if you use HTML5 local storage, for example. But the reality is that because cookies are so widespread, they have become central to the way the rule is being interpreted.

Second, it doesn’t ban cookies — it just needs consent from users before they can be installed (which can, in some cases, be given through browser settings).

And third, not all cookies are subject to the rules. Data that’s considered necessary for the basic functioning of the website — the session cookies used for tracking a basket of goods up to the checkout, for example — don’t require consent, because it’s implied by the simple fact they’re trying to use the site in the first place.

What’s the point?

The idea is to give users more control over who knows what about them, and how it’s used. As part of a wider directive, it’s an attempt to harmonize laws across European member states around things like data retention and privacy.

And lawmakers have good reason to think that website tracking is an important issue: a recent study by Truste said that the typical British web page uses 14 different tools to track user behavior — usually without their knowledge.

Why is it being brought in now?

The directive was first passed in 2009, and the wheels of European regulation spin very, very slowly. Many countries have struggled to make the federal rule mesh with their own local implementation and privacy laws. By the time the original deadline for adoption arrived in 2011, only Denmark and Estonia had enacted national laws that were deemed compliant.

Just over a year ago, faced with mass non-compliance, the U.K. took the unique decision to defer adoption for one year — though whether it had the authority to do so is disputed.

In any case, that year is up.

Where does it cover?

The rule is already theoretically in force across Europe, but the truth is that it’s a complete patchwork. It comes into force in the U.K. on May 26, 2012.

Who does it affect?

Pretty much everybody based in Europe who runs a web-based business is subject to the directive. Anyone headquartered or with offices in Europe is subject to the law, or will eventually be. And unlike some online regulation, it doesn’t matter where your servers are based, but where your business is directed.

Typical services that will definitely fall under the rules include website analytics, advertising — particularly third-party advertising — or recommendations. Essentially anything that is not completely intrinsic to the functioning of the site.

And how is it meant to be implemented?

The most common approach seems to be a check box that users are presented with when they first visit a site:

Here’s the BBC’s approach. It’s fairly typical.

But that’s what has so many startups up in arms, since they believe this step will lose them valuable traffic, dissuade users, lose them money and — potentially — hand power over to American startups that aren’t subject to the same regulations.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Google and the Ghost of Silicon Valley Past
• Controversy, courtrooms and the cloud in Q1
• Facebook’s IPO filing: ideas and implications

At an Internet Week panel in New York City, Ed Felton, the Federal Trade Commission’s CTO, first publicized the decision. Soon after, Twitter confirmed the news with a tweet. The Do Not Track feature allows users to opt-out of third-party tracking.

In a statement, Twitter spokeswoman Carolyn Penner said, “Twitter now supports Do Not Track. We applaud the FTC’s leadership on Do Not Track, and are excited to provide the benefits of Do Not Track.”

The company declined to elaborate on whether it would support Do Not Track on other browsers that currently support the initiative. But it seems likely that given its decision to implement the feature on Firefox, Twitter’s support will expand to other browsers.

Currently, Internet Explorer and Safari support some kind of Do Not Track control. Google has said that it will roll out a Do Not Track feature for its Chrome browser by the end of the year. In March, Yahoo announced its support for Do Not Track, as has AOL. But Facebook, one of the Web’s biggest collectors of data, has not put its weight behind the effort. Given the amount of user data it is in a position to collect, Twitter’s move is especially significant.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Connected world: the consumer technology revolution
• Social third-quarter 2012: analysis and outlook
• Social media in Q1: commerce and discovery dominated

That’s what a team ex-AdMob and Google scientists believe they’ve put together with their stealth start-up Drawbridge, which is finally going public today with $6.5 million in funding from Kleiner Perkins Caufield & Byers and Sequoia Capital. The interest from these top VCs underscores the potential breakthrough Drawbridge and its founder, former AdMob lead scientist Kamakshi Sivaramakrishnan, have hit upon.

Drawbridge’s self-learning algorithm takes a mountain of consumer behavior data from both online and mobile ad requests and then tries to determine through an inference model if two users from a desktop and mobile device are the same person. After a while, Drawbridge believes it can achieve a high level of confidence that it can basically follow one person between devices.

The system requires a number of observations to work  and needs to be reset regularly to ensure it’s got the right person. But when it works, it can boost conversions – post event clicks – by 3 to 10 times, Sivaramakrishnan told me.

Sherlock Holmes inferences

“We are essentially creating a mobile cookie, a cross-device cookie, once we tie it across devices,” she said. “The bar is very high on our ability to make associations. It’s almost like Sherlock Holmes, using all implicit inferences.”

This could be a big boon for advertisers, many of whom have resisted embracing mobile in a big way. Now, they can have more confidence that they’re reaching the right consumers. For instance, a consumer who visits a travel site on their computer may stop short of buying a flight. But with Drawbridge, an advertiser may be able to hit that same person with a timely ad to help them complete their purchase. This could mean more return on investment for advertisers and higher CPMs for publishers.

“Mobile advertising is a decade behind Internet advertising in both targeting and scale,” said Matt Murphy, partner at Kleiner Perkins Caufield & Byers in a statement. “Drawbridge will close that gap by combining the best of both worlds to deliver industry-leading targeting and ROI across the entire digital landscape.”

Filling holes in mobile advertising

This also fills in some holes in mobile that have befuddled advertisers. In mobile, it’s been hard to replicate cookies. There hasn’t been the same kind of data exchanges like BlueKai as well. And now, with Apple banning the use of UDID, there’s one less way for advertisers and developers to target mobile users.

Sivaramakrishnan said Drawbridge can scale up and become an important tool for advertisers. But she said consumers should also be on board because the system doesn’t use personally identifiable information. And it will include an opt-out option for consumers. Still, this will probably raise more concerns from privacy hounds, who are increasingly speaking out against the ways advertisers track consumers.

A more business-related question is how Sivaramakrishnan’s old bosses will respond. Sivaramakrishnan, a Stanford PHd, was part of the team that built AdMob’s ad engine, before it got sold to Google. Many of the 20 people at Drawbridge came over from AdMob and Google.

Photo courtesy of Shutterstock user Nimblewit.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Readers weigh in: future prospects for Twitter
• A look back at mobile in Q1
• Facebook’s IPO filing: ideas and implications

The controversy turns on a ham-fisted attempt by the search giant to promote its Google+ product. Stanford researcher Jonathan Mayer revealed in February that the company used a piece of code to trick Apple’s mobile browser, which blocks third party ad tracking, into thinking a user had given it permission to install an advertising cookie.

Google’s gambit coincided with reports of numerous third party app developers engaged in similar shenanigans. The company’s deep pockets, however, make it a tempting target for class action lawyers who hope to take a generous cut of what could be an expensive settlement.

Lawyers’ eyes are lighting up because Google’s actions may technically violate the Wiretap Act, a federal law that makes it illegal to record other people’s communication and that sets out actual dollar amounts that a violator must pay. This matters because courts have responded to some invasion of privacy lawsuits that were not related to the Wiretap Act — like FriendFinder showing your picture on Facebook without permission — by stating that they aren’t worth anything in money terms.

Past incidents like Google Buzz and Facebook’s Beacon suggest that the new parade of lawsuits will result in Google settling the suits by paying a pot of money to self-appointed privacy advocates.

Lawsuits have been filed in Florida, California, New Jersey, Illinois, Kansas, Texas, Delaware, Maryland, Missouri, Mississippi and Washington, DC. They will likely be consolidated into a single case in coming months.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Social media in Q1: commerce and discovery dominated
• Google doesn’t like walled gardens — except its own
• Controversy, courtrooms and the cloud in Q1

There has been an ocean of outrage recently over Google’s new privacy policy, which went into effect on Thursday: The European Union is protesting the changes, the Electronic Frontier Foundation is recommending that users delete their search histories, and much of the coverage seems designed to fan the flames of panic. But should Google’s moves be cause for alarm? Hardly. For one thing, the new policy is not much of a change from the company’s previous policies (as some observers have pointed out). But more than that, tracking users is one of the fundamental building blocks of Web services, and it arguably makes the Web better, not worse.

Alexis Madrigal at the Atlantic recently provided a glimpse into just how much tracking occurs on the Web when a user is simply going about his usual day: A check of his activity with a new tool from the Mozilla Foundation called Collusion, Madrigal says, showed that more than 100 services were tracking him in some form or another via cookies installed in his browser. Most of these, as he describes in the post in some depth — tools such as AdBrite and Aggregate Knowledge — are designed to pick up signals from users that will make it easier to target advertising in a variety of ways. Madrigal adds:

There’s nothing necessarily sinister about this subterranean data exchange: this is, after all, the advertising ecosystem that supports free online content. All the data lets advertisers tune their ads, and the rest of the information logging lets them measure how well things are actually working.

News flash: I actually want to be targeted for advertising

In a nutshell, this is the point we need to keep in mind when thinking about Google’s tracking of users, Facebook’s data-collection policies or even Twitter’s moves to sell historical data to analytics providers: namely, that those kinds of activities are what fund the services we use. Google and Facebook both run dozens of multibillion-dollar server farms that hold all of that free email and photo hosting users are so enamored of (Facebook alone holds more than 140 billion photos). That is one reason why Google’s only opt-out feature is to simply not use the company’s services at all. The tracking and analytics and the services themselves are so intertwined it is probably impossible to disentangle them.

I will go a step further: I’m not just ambivalent about this kind of tracking — I actually want to be tracked by companies like Google and even Facebook. Not just because it helps pay for the services I use but also because it should (theoretically at least) make my Web experience better, by targeting ads and other things toward me instead of bombarding me with useless advertising that turns most websites into a garish nightmare, the visual equivalent of email spam. If tracking my activity (which is anonymized by the majority of companies who use it) helps reduce that problem, then I am all for it.

I wrote not long ago about a privacy complaint from a number of groups who complained that Google and WebMD and other services showed users ads based on the fact that they were searching for medical terms, and my point is the same now as it was then: I want Google to track my search so it can show me relevant ads and other content. If I have cancer or know someone with cancer, showing me information about cancer has a high likelihood of being beneficial. Maybe it’s just me, but I don’t see it as intrusive; I see it as a service, if it is done well (and that is the holy grail for advertising).

Don’t worry about Google; worry about Homeland Security

Obviously this doesn’t mean we should just allow companies to do whatever they wish when it comes to tracking our Web behavior. Encouraging them — and if necessary, forcing them — to be transparent about what is happening and what the data is being collected for is a worthwhile goal, and that’s what much of the Obama administration’s new privacy “bill of rights” is designed to do. And yes, Facebook should probably quit screwing around with its settings all the time and changing things to be opt-out instead of opt-in, but I have no issue with them tracking me via the Like button.

There are plenty of quasi-shady companies that track your behavior online and merge your identity from one network into another, as Rapleaf has been accused of doing in the past, and that is worth criticizing. It’s probably worth being skeptical about how (and why) the Department of Homeland Security and others are tracking your behavior as well. But lots of offline companies and agencies collect all kinds of data on your payment history, credit score, insurance claims and other crucial information, and no one seems to be interested in how little we know about that process.

In other words, there are things worth being concerned about when it comes to your personal information being used in ways you don’t want it to be, and maybe you aren’t willing to make the trade-off involved in exchanging your data for better services or better ads. Regardless, Google’s new privacy policy should be the least of your worries.

Post and thumbnail images courtesy of Flickr users Josh Hallett and Stefan

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Connected world: the consumer technology revolution
• Readers weigh in: future prospects for Twitter
• Social media in Q1: commerce and discovery dominated