• by Kate Kaye , January 27, 2006

Over the years, Web privacy watchdog Truste has updated its certification programs in order to keep pace with the ever-evolving privacy and security implications of consumers' online interactions. In November, the nonprofit organization announced criteria for its latest effort, the Trusted Download Program, through which Truste and its testing partner, AppLabs, will evaluate downloadable adware and trackware applications for certification. Truste's director of product development, Colin O'Malley, says software vendors recognize the need to raise the standards for disclosure of exactly what their products do; however, some of the new Trusted Download approval requirements have met with resistance. Behavioral Insider asked O'Malley how Truste's certification programs could affect the behavioral marketing industry.

Behavioral Insider: Web site publishers--from really big portals to small niche sites--are using behavioral targeting technologies to track users' Web behavior in order to target ads that are served both on their own sites as well as on others. How aware of these ad targeting methods and capabilities are the average Web users?

O'Malley: I think that it's tough to make a blanket statement. The average user is not as aware as they need to be. I think that is both because Web publishers still need to make some progress in how they're providing disclosure to consumers so that a consumer can make [himself] aware of that kind of tracking.

BI: That actually raises another question that I have regarding your Web Privacy Seal requirements that companies give "users choice and consent over how their information is used and shared." We're seeing behavioral targeting companies paying publishers now for data collected on users that is, in turn, used to serve ads on other Web sites. While site privacy policies often refer to third parties having access to user data collected on their sites, some users may not believe that they've been given "choice and consent"' over use of their data if it's employed to serve ads on other sites within a behavioral ad network. Is the Truste Privacy Seal program evaluating these new uses of user data or updating criteria as a result?

O'Malley: Absolutely. We think that one of our key strengths is keeping abreast of the industry. If you look back at the last nine years--I think we're going into version 10.0. We [update] it more than every year.... When we first started our Privacy Seal program, people weren't concerned about cookies; and it's a huge issue now, [so] that's been incorporated. They weren't concerned with Web beacons, and that's a huge issue now, and we've incorporated that as well.

We're also developing new programs with new sets of standards based on what's going on in the industry. Trusted Download program is another example [of this[. In particular we were seeing that a lot of third-party ad serving was going on..., enabling a lot of Web publishers to serve ads in a new and even less predictable fashion for consumers. We felt that for Truste to fully execute on their mission... we had to have a program to account for that kind of ad serving... If you go through the requirements doc for the Trusted Download program, you'll find that for adware and trackware technologies, our standards go into a lot more detail and actually are a lot more strict than they have been traditionally for the Web program.

BI: How are you differentiating among spyware, adware and trackware?

O'Malley: Spyware would be programs that are doing nefarious things to a consumer's computer that are taking advantage of a consumer's naïveté and doing drive-by downloads, monitoring behavior in a manner that is not expected or disclosed.... Spyware is something that we would never certify.

BI: And that is always software that is unwittingly--or wittingly--downloaded to a hard drive as opposed to something that's done through a cookie? Or is it both?

O'Malley:Well, again, it's less to do with the actual technology used and more to do with behavior that is directly damaging to a user's computer--or is engaging behavior that ought to be disclosed but isn't being disclosed.

Adware is software that is serving advertisements to a consumer such as pop-up windows that are not obvious components of the applications that are running....We don't pass any judgment on whether or not that is or is not appropriate. In fact, we think there may be a legitimate business model there. There are quite a few ad serving clients that are adware providers that are facilitating the use of free software; and the value exchange for many consumers may make sense. Our priority is making sure that every consumer that enters into one of those exchanges does so with the full set of information at their disposal and knowingly makes that decision....

BI: What is the difference between adware and trackware exactly?

O'Malley: Adware is an application that serves advertisements. Trackware is an application that tracks a user's actions in a manner that would be unexpected and that shares those actions with some kind of third party. Again, the unexpected element of both of these definitions is really critical....

BI: It's interesting to hear you explain it that way. Looking at the list of companies that have Privacy Seals, there are several that I would say would probably fall into the category of trackware, and there's a potential adware company there as well.

O'Malley: We do have companies in our Web Seal program that have released software that would be considered to be adware and trackware, and that's one of the reasons why we wanted to launch the Trusted Download program. In the past we've had this Web Seal program, and it really covers the behavior of a Web site; it doesn't necessarily cover the behavior of the business entity that's behind that Web site.

BI: I see. So it's based more on the actual Web site than it is what their technologies enable.

O'Malley: Right.... In the case of adware and trackware providers in the current program, we wanted to create this program so that their software could go through it and we would know whether or not they were adhering to best practices in the industry with respect to their adware and trackware. Going forward, once we launch this program, we will be requiring licensees with those applications to get certified. That's going to be a requirement of the Truste Web Seal program.

Our advisory committee consists of a number of the leading companies in the space: Yahoo!, AOL, Verizon, Computer Associates, CNET, CDT. And these companies will be offering incentives.

BI: Are you conferring with any vendors of behavioral targeting technologies in your development of the Trusted Download program?

O'Malley: We are. We've engaged with the NAI [Network Advertising Initiative], they've been very helpful, and with individual vendors as well.

BI: In its explanation of the program, Truste notes that "Adware and trackware application providers will likely need to significantly change current practices to earn certification." What practices will adware and trackware providers need to change in order to get a Truste stamp of approval?

O'Malley: One of the most important is in affiliate control. What we've seen too much of, unfortunately, is application owners distributing their software through a wide network of partners and disowning some level of accountability for how those partners are distributing their software.... Any application owner that wants to get certified will need to have very tight control over their network.

We're also moving all of the notice for adware applications about their ad serving applications into what we call the primary notice, which is pulled out from the ULA [End User License Agreement] and presented directly in front of the consumer.

BI: That's a really big--and probably threatening--change to a lot of these companies. How are they responding to the program and to potential outcomes like that?

O'Malley: This is one of the areas that has met with some resistance, but I say it's not universal resistance. Most adware companies out there that want to be here to stay recognize that their industry has come under a lot of scrutiny and they're looking for ways to prove that this business model can work and is legitimate and that consumers are knowingly entering into these exchanges. For them to do that, I think they recognize that they need to start making these exchanges explicitly clear to the consumer.