Many users feel their privacy is being violated by the information compiled in the profiles. Indeed, online advertising agencies use a broad spectrum of parameters to target ads to individual users. DoubleClick, Inc., the largest agency serving a network of 11,500 sites, uses the following information from the client to serve an ad [DC00a]:

• IP address
• top-level domain
• browser type and version
• operating system
• Internet service provider
• local time and date
• language
• page viewed

This information is transmitted by the browser every time it requests a file from any server since it is required by the HTTP specification. In addition, DoubleClick might also use demographic information provided by publishers or advertisers, such as gender, age, education, financial status, etc. With this data, DoubleClick enables advertisers to target users by a combination of various criteria [DC00b]:

• interest category
• search keyword
• editorial keyword
• geographic location
• top-level domain
• page viewed
• organization type, name, size and revenue
• Internet service provider
• operating system
• browser type
• day and time
• publisher-supplied demographic information

While these criteria allow for relatively fine targeting of ads, they all rely on non-personally identifiable information (Non-PII): Although DoubleClick associates individual users with specific profiles, the users still remain anonymous to the advertiser, agency and publisher since they don't know their name and address.

However, in 1999, DoubleClick acquired Abacus Direct Corp., a direct-marketing services company that maintains a database of names, addresses, retail purchasing habits and demographic information on 90% of American households. This move enables the company to associate the so-far anonymous profiles with the actual names and addresses of users. The process of correlating DoubleClick's existing non-PII with the personally identifiable information (PII) in the Abacus database is relatively easy: When a user visits a site in the DoubleClick network that requests personal identification (like name and address for online shopping), that site can send the personal data to DoubleClick where it is associated with the user's invididual cookie. DoubleClick can also look up the user's name in the Abacus database to find information on his offline buying behaviour. The combined PII and non-PII of each identified user is then stored in the Abacus Online database [DC00c].

By matching users' web activities with the names in the Abacus database, targeting on an unprecedented scale is possible: According to David Banisar, deputy director of Privacy International, the combination of DoubleClick's over 100 million cookie-derived profiles with Abacus' database of purchasing habits could mean that the majority of web-connected Americans will lose their online anonymity [cited in WR00]. At the same time, data collected online can be used for targeting in offline media. Abacus touts its database is "now flagged with known Internet users", enabling its clients to identify and model Internet users in their existing address lists and targeting them separately in direct mail campaigns [AD00].

< Online Preference Marketing | The NAI Principles >