Cracker of an Issue

Untangling the Web of Online Advertising and Privacy

Thursday, August 11, 2005

Adware done right

In the article FTC Wants Adware Dead…Or Alive? | Legally Yours with Mike Sproule, Mr. Sproule seems to be extremely concerned that in the recent Advertising.com settlement, the FTC did not take a stance against adware, and instead merely stated that the sole requirement for the distribution of adware is clear and prominent disclosure that consumers who install the program will receive advertisements. Although the consent order is specific to the facts of the Advertising.com compliant, Mr. Sprule rightfully notes that others will use it as guidance (and the problem here is that the FTC has set a particularly low standard for how to legally distribute adware).

The Advertising.com settlement

Firstly, for a really good analysis of this settlement, read Eric Goldman's post on his blog. Further, I think the FTC has conveyed the right message through this settlement by making it somewhat clear that companies must specifically disclose adware functionality in a clear and conspicuous manner OUTSIDE OF THE EULA. I don't see anything wrong with that approach at all, because the goal is to make sure that consumers are provided with the opportunity to make an informed decision before installing software that is bundled with adware. This means that adware companies can no longer get away with burying their disclosures in EULA's and need to become more transparent during the installation process.

Secondly, Mr. Sproule seems concerned that the FTC in this order does not even require disclosure of the adware’s collection of information about users’ web surfing. This concern seems to be related to data collection practices of adware companies. Firstly, all adware does not 'collect' and track user data to serve ads. Secondly, data collection practices are disclosed in privacy policies and the FTC can use its authority under Section 5 of the FTC Act, to bring cases to enforce the promises in privacy statements. Is Mr. Sproule suggesting that a big concern is privacy and therefore, adware companies should be required to include their privacy policy in the notice they provide to consumers? Wouldn’t that defeat the purpose of trying to encourage disclosures outside of the EULA?

The right approach

My goal here is not to criticize Mr. Sproule’s views, but instead to make the point that adware companies who want to run legitimate businesses should anyway make a sincere effort to exceed standards established by the FTC or any legislation. I think the best practice would be to provide clear and conspicuous notification at the beginning of the download process. This notification should be provided in a separate installation screen and should inform the consumer that they are about to receive adware, along with a brief description of exactly how the adware will function. Further, consumers should consent to a separate EULA that explains in greater detail exactly how the software works and the data collection, use and sharing practices of the adware provider. Of course, there are further steps that can be taken post-installation, such as disclosures in the ads served and obviously providing users with an easy uninstall mechanism, etc.

What is so wrong with the above approach? If the consumer is provided with clear and prominent notice and choice prior to installing the adware, isn't there adequate knowledge and consent? Of course the disclosure provided should clearly describe what the user is getting into and should not include deceptive claims. Now, assuming the disclosure is prominent and honest, what if a consumer has made an informed choice between paying for the software he wants and installing adware so he can get the software for free? Is it impossible that a consumer might recognize the value proposition offered here and choose to actually install adware? I think not, and that's why adware, if done right is definitely a legitimate business model.

The greater challenge adware companies face is ensuring that consumers trust them enough to keep them on their computers. This can be achieved only if consumers have a positive experience after installing the adware. If you want to do adware the right way, you wouldn't want to bombard and annoy users with your ads, but make them fewer but more relevant and ensure that the adware has minimal impact on the user's computer. Further, you would want consumers to know your company better by effectively branding your ads so they can learn to accept and eventually appreciate the value provided. Lastly, for adware that does collect and store behavioral data of users, the privacy risks are greater and such companies should be making an extra effort to communicate their practices not only through their adware itself but also through sincere consumer education efforts.

Think beyond compliance

So; are the current players in the adware space doing any of the above? Yes, and no. However, the one’s that don’t do it right will continue to face enormous churn rates and consumer backlash. The one’s that do it right on the other hand and go the extra mile to ensure that their practices are transparent and designed to deliver the optimum user experience, rather than generating revenue by serving billion ads a day will eventually rise as truly legitimate players in the online advertising space.

Further, as adware players expand and target mainstream publishers by leveraging their installation bases, and merging the capabilities of behavioral targeting across the web, the potential for new revenue streams, as well as further consumer privacy concerns will increase. Adware installed on computers that serve ads on web sites, rather than pop-ups hardly lay to rest consumer concerns regarding excessive data collection and companies building detailed consumer profiles. The companies that will be able to truly succeed will be those that are willing to risk slower growth by first ensuring their practices are well beyond the standards set by the FTC or any pending legislation. Compliance might alleviate legal risks, but building consumer trust will ultimately reap greater rewards.