MediaPost reports on a new company, Clearsight, that links IP addresses to individual e-mail and postal addresses. (An Internet Protocol address is a unique 32-bit numeric address that identifies a computer on a network.) The company seeks to improve targeted behavioral advertising.
There has been substantial debate over whether IP addresses are personally identifiable data. I believe they are, as they identify individual computers, which are easily linked to individuals. There is also the expectation among users that personal data such as IP addresses will be kept private. In 2008, a New Jersey court unanimously ruled, “citizens have a reasonable expectation of privacy … in the subscriber information they provide to internet service providers — just as New Jersey citizens have a privacy interest in their bank records stored by banks and telephone billing records kept by phone companies.” State v. Reid, 195 N.J. 422, 949 A.2d 850 (N.J. 2008). However, last year, a decision (pdf) from a federal district court in Washington ruled that IP addresses are not considered “personally identifiable information.”
Clearsight has taken personal identification and IP addresses further. “As of today, ClearSight Interactive believes it has collected enough data from publishers to reliably link 65 million “sticky” IP addresses — typically for people who connect to the Web using cable modems — to specific individuals,” MediaPost reports. The company gathered the data from publishers:
The publishers collect a host of data from customers — including their IP addresses — when they register, says ClearSight . Generally, publishers ask customers if they are willing to share information about themselves with third-party marketers. If they check the box indicating yes, the publishers pass along their names, email addresses and other information — including the IP address logged at the time. While some of those IP addresses are from work addresses, libraries, etc., others are from users’ homes. […]
For now, the plan is to target those users only by their neighborhoods (ZIP-codes plus-four) but not to append other data about individual users to the IP addresses. Not yet, anyway. CEO Tom Alison says the company will first wait to see what happens in Congress, where Rep. Rick Boucher (D. Va.) has vowed to introduce privacy legislation.
Clearsight CEO also says “that users have opted in by agreeing to let publishers share data with third parties.” I urge the opt-in process — but this is not true opt-in, which gives consumers control over their relationships with advertisers. Opt-in puts the burden on companies to have strong privacy and security protections and use limitations so consumers will choose to share their data.
This is not a situation where consumers have control over their relationship with Clearsight. This is more akin to opt-out, the choice of the majority of ad industry players, which puts the burden on consumers to learn about what the privacy policies are, whether they protect consumer data, whom the data is shared with and for what purpose, and how to opt-out of this data collection, use and sharing. The MediaPost article explains the issue well:
But this position seems to distort the meaning of opt-in, considering that users almost certainly believe they’re signing up to receive emails from third parties when they give publishers permission to share data. Surely it hasn’t crossed many Web users’ minds that a publisher would share its IP logs with a third-party targeting company.
Alison also says that people who have previously opted in also can opt out at the publishers’ sites. Again, however, if users don’t realize that someone has passed along their IP address for targeting purposes, it won’t occur to them to opt out.