In the digital age, there’s an inherent tension between running a media business effectively and protecting its users’ privacy.
On the one hand, the business wants as much information as possible about everyone it touches. It wants to be able to serve them with the most relevant content, connect them to those with similar interests and affinities and, yes, serve them high-value ads that are as targeted and pertinent to them as possible.
On the other hand, the media company will, at the very least, annoy its users if they feel their privacy’s not respected and their precious data is unprotected. People generally don’t want their actions tracked or their data used without their permission.
For the Internet to work, AT&T chief privacy officer Bob Quinn told me in a phone interview, “you have to have a trust environment.” AT&T follows four basic tenets in protecting privacy: transparency, customer control, consumer value and security.
Here are my eight recommendations for how to put those and other best practices in place:
1. Be Open
People are often willing to share data if they know they’re doing so and, that by doing so, they’re getting something in return.
So offer access to areas of a site, or certain types of functionality such as location-based services or more useful advertising while telling users what you’re going to do with their information. Your precepts should be spelled out, in language that’s as brief and clear as possible, on your website.
2. Put Users First
Said another way: be willing to forgo short-term revenue to protect your long-term business interests.
It can be very hard to ask, “Does this conform to our standards?” when the head of sales has a $100,000 (or even a $1,000,000) deal in hand.
But in my experience, there’s usually a way to realize the revenue and uphold your standards. After all, one of the reasons respectable advertisers want to be on your site is because of the audience you bring, and your strong relationship with them.
Quinn told me that AT&T will even “restrict a partner’s ability to perform the tasks we’ve asked them to” in order to protect privacy. For example, the company will require that data be destroyed or work to convince its app makers to forgo certain kinds of monetization.
“At the end of the day,” Quinn said, “if people come to the conclusion their data is everywhere — that people are selling it, that there’s not a value proposition for them, that their personal information is compromised — people are going to stop downloading apps.”
3. Explain the Value While Allowing Opt-Outs
Yes, you’re collecting information on your users.
But do they know that since you have that information, you can serve them more relevant ads and content and waste less of their time? Ads can actually be made more relevant to what someone wants.
“A well-targeted ad ceases to be advertising and turns into useful information for the user,” said 24/7 Real Media CEO David Moore at the recent OnMedia business conference in New York, at which online privacy was a consistent theme.
You can also explain to users that, by giving up some info, it lets you provide them with the site for free or subsidize their access.
“Pretty soon you’ll come to a website that says, ‘I’m sorry, can you please turn your tracking back on, because we need to serve ads to make money,’” AppNexus CEO Brian O’Kelley said at OnMedia.
Still, do offer people the option of limiting what they share and how much of their data you can collect and use.
“The best thing that we’ve done is show people what we’ve done [with their data] and allow people to easily opt out,” said PeekYou CEO Michael Hussey, whose company aggregates data on some 250 million people. “Within 24 hours, in most cases, we can take care of that for people,” he told me in a phone interview.
4. Anonymize The Data
To the best of your ability, remove anything in your databases that could identify a user, if someone got their hands on them. And separate the databases so that if someone gets access to one, they don’t have access to everything.
Destroy information after you’ve used it, as much as possible. Let cookies expire. Target ads by the group rather than by the individual.
And don’t assume that because information appears to be anonymous it really is. AOL learned that lesson the hard way a few years ago when reporters were able to figure out some very personal details of people who were supposed to be anonymous in search results the company had released to researchers.
5. Make Personal Data Subpoena-Proof
As soon as a legal authority demands you turn over users’ data, all your protections can go out the window. What can you say when a federal judge orders you to hand over the most intimate details of someone’s actions on your website?
That user will be more protected if you can honestly reply that you have no way of matching actions to specific individuals.
Daniel Jaye, president and COO of Ad Summos, told me that his company has built a solution to serve targeted ads in a “double-blind” way that can’t identify individuals and destroys the data once the session is done. (This is similar to a technique used for many kinds of secure transactions in which computers exchange a secure “key” code during the session that’s then discarded.)
“I can’t figure who anyone is even if I wanted to,” said Jaye, who has advised government agencies and testified before Congress on privacy matters. “I make our [privacy] policy as if I’m testifying in the Senate Commerce Committee with the most vociferous privacy advocate next to me.”
6. Use Strong Security Protocols
Make sure you protect data as vigorously as possible. If there’s a breach, do everything you can to contain the damage, such as shutting off and changing access codes and telling users what risks they may face, so they can avoid ID theft or other dangers.
Where you do collect personal data, make it damn hard to hack. You should install the best encryption, protocols and standards you can. Get certified by vendors like Verisign or eTrust to make sure you’re following the best practices in the industry.
Instruct staff to make sure passwords are hard to crack, that sensitive data doesn’t leave your premises on laptops or flash drives, and that everyone makes sure not to give up data over the phone without very strong assurance of the caller’s identity.
7. Use Third Party Fulfillment
One way to assure your users that you’re not collecting some of their most sensitive information is simply to not collect it.
If you sell something, you can use third-party payment systems like Google Checkout or Bill Me Later or PayPal. For commenting and registration, you can let users log in with their Facebook or Twitter log-ins. If you have a Facebook app, have it require a minimum of information for someone to install it.
True, you have to balance business imperatives — collecting and controlling as much data as possible — vs. privacy protection. Ask yourself how much data you really need to run your business and whether it’s core to the operation.
8. Participate in Industry Groups
Now that Congress and federal agencies are considering regulations and laws to restrict industry practices, trade organizations have become especially serious about protecting privacy.
The more you and others can do to better instill best practices in groups such as the Interactive Advertising Bureau and privacy offshoot Evidon (formerly Better Advertising), the better off users and businesses will ultimately be.
A former managing editor at ABCNews.com and an MBA, Dorian Benkoil has devised and executed marketing and sales strategies for MediaShift. He is SVP at Teeming Media, a strategic media consultancy focused on attracting, engaging, and activating communities through digital media. He tweets at @dbenk.