Back at the end of October last year I wrote a blog post on why Privacy on the Internet is NOT “binary”. So I thought I would follow up with another blog post discussing the alternative viewpoint – What if it was binary?

Well first we need a little context about the Internet and how it works. At it’s core it’s basically two cans and a piece of string. The can (client) on one end talks to the other can (server) on the other end. The string acts as the communication layer (protocol) between the two cans. The protocol that runs across the string is “stateless”.

In short that means that there is no means of storing a users data between requests. The work around for this is…. Cookies which allows the server to track requests from the originating client (can). So how we do we stop one of the cans tracking the other one?

Obviously we cannot get rid of cookies otherwise the Web is going to grind to a halt. So what we need is another “binary” method of allowing me to control my privacy.

Enter the “Do Not Track” option. This is a browser setting that tells the first can (client) to send a message to the second can (server) that it doesn’t want to be tracked. (We’ll discuss how you enforce this in a later blog). Great – I now have a method of communicating with a Web server telling it that I want to remain Private.

Well here’s where it gets interesting or should I say “binary”. Most people think of binary as either a Zero or a One (0,1) however there is actually a third state in the case of the Do Not Track header and it’s called “not set”. So in essence the absence of a Zero or a One is another “state”.

So what does this mean. Actually quite a lot. If the user turns on his Do Not Track option then the answer is obvious. The server MUST not track him/her. If the Do Not Track option is turned off then the server can track away. However if the option is NOT set at all what is the server to do?

Here comes the really big problem – what if the Web service providers are forced either by legislation or by the W3 standards group to start honoring the Do Not Track option? It’s really easy to spot a Zero or a One as part of the communication request. But what if you don’t see anything? Well it means that you have “insufficient data” to make a decision. Which in turn means that you have to send another message back to the client (can) and ask it for more data.

So how does this all work? Well I have to figure out how to send a pop up message to that device and ask the user if they want to be tracked. Well you can guess what the answer will be – no thanks! So in essence we’ve wasted bandwidth, processing cycles, battery life (on a Mobile phone). And at the same time we’re ruining the users experience. The only thing this third “binary state” (which actually doesn’t exist) has done is draw attention to the problem. Think of all the code that is going to be written to solve this problem. What a waste of resources!

Everybody is trying to solve this “Do Not Track” problem through the lens of the “Web server”. (Because it’s where all the content is stored). What no one is thinking about is solving it through the lens of the Browser user i.e. ME. It’s pretty clear that Privacy cannot be binary – there’s simply not enough information to make real decisions which effect my rights.

By making it binary the Web is risking billions and billions in revenue. Why? Because people want a Choice – if forced to pick between Privacy and NO Privacy which one would you pick.

Pretty obvious really. 

Well it sure has been a busy day on the Privacy front. However as I watch all of this, I can’t help but ponder if people really understand the magnitude of the problem the Web faces. Lets talk about “Scaling”.

On a thermometer today would have Privacy scaling above boiling point. Something is going to happen for sure. Browser companies will have to make changes, Web services will have to make changes – but does it scale?

Let’s think about it for a moment in the context of the “Do Not Track” header which is proposed standard to help curb the Privacy problem. If the Do Not Track header is on then Web services “MUST” observe the customers requests and not track them. There is no ambiguity in the word MUST. It’s a have to do vs. a should or may do.

But what are the implications? Well no one really knows, but Web servers, ISP, all tiers of the Internet will be affected. They will have to add code, a lot of code, to accurately support this measure. We’re talking years of coding efforts in some cases.

Up until now we’ve been living in a free for all world. Then Mobile came along and the world changed. Now Privacy is Personal and that means everybody is going to have to honor my request to not be tracked.

And lets not forget “location”. What if I get on a plane and access a Web site from a foreign country. Before they can really service my request there’s a lot of context they have to determine. And that translates into code, which translates into bandwidth and processor issues.

People want a Choice – because without it there is no Privacy. Today was just a glimpse at what is coming down the pike. The temperature is rising, and it’s rising fast.

Well it seems like a epic battle is about to get underway. To the North are the Humans – demanding that their Privacy be protected and to the South are the Algorithms – constantly “searching” to undermine my Privacy in the name of a better experience.

Years ago when I was studying for my Airline Pilot’s license, one of subjects was the Inter Tropical Convergence Zone, colloquially known as the “ITCZ”. It’s that area on the planet (Source: link) that circles the Earth, near the equator, where the trade winds of the Northern and Southern Hemispheres come together. The intense sun and warm water of the equator heats the air in the ITCZ, raising its humidity and causing it to rise. As the air rises it cools, releasing the accumulated moisture in an almost perpetual series of thunderstorms.

Well that’s exactly what’s happening right now. Especially with the announcement this morning by the WSJ (link) that Google is tracking iPhone users. There is now intense heat coming to bear from the “Humans” regarding their privacy. Something is going to give. People want a Choice when it comes to their Privacy. Sort of like “Freedom of Speech”. You just can’t take it away from people and expect them to not be upset.

For those of you who are interested in Privacy I suggest you head over to this link It’s the W3.org’s Web site on Public Tracking. Take a spin through the mailing lists. It’s fascinating. Everything is hinging on one binary number… 1 This is the setting that users will be able to control in their browser to stop Web sites tracking them. Unfortunately as we’ve seen today Google et al is ignoring those settings.

This cannot end well for the Algorithms – and here’s why. The Humans (Lawyers and Privacy Rights Activists) will write legislation to reign in the ability to track. As scissors always beats paper so will the legislation. However here’s where the law of unintended consequences comes into play – Privacy on the Internet is NOT binary (as I have written about before – link). Setting a Do Not Track header to 1 is not enough context to make a really informed decision about what a customer wants.

Ask anyone these days – Privacy is about Choice not about a number. Any solution MUST offer me a Choice otherwise it will fail. In the meantime get ready for some serious thunderstorms – the ITCZ is heating up.

Yes, Twister.  The fun, bright colored game where you get twisted up with all your friends and would-be teenage loves.  Actually, the rules of Twister are more clear than the twisted Privacy policies that dot the Web these days – which in my opinion, are less about privacy and more about making money.  The only choice I typically get is no privacy or don’t use my Web service.

It is impossible to ignore the increase in coverage regarding digital data privacy.  Today’s Wall Street Journal headline about Google bypassing iPhone Privacy Settings may just be the fateful move that brings everyone playing Digital Privacy Twister crashing down to the mat.

But before jumping to any “Google is the new Evil Empire” conclusions, have a look at this hurried, yet thoughtful post by Technology Media blogger, John Battelle, A Sad State of Internet Affairs:  The Journal of Google, Apple and “Privacy”.  Battelle, rightfully questions whether or not the default “privacy settings” in iOS are designed to protect yours and my privacy rights or protect Apple’s advertising revenues.

Sadly, the rules about Internet Privacy are simply not clear and even those being debated and proposed by the best minds in the space have to consider the impact changes will have on established business models and legitimate uses for data sharing between organizations. Privacy is about balancing the rights of you and me, as citizens (not just consumers) and a business’s right to make money.  If you mandate technology changes to stop privacy abuses, then how that impacts legitimate data use and sharing MUST be considered or you start ripping apart the very fabric of the Web – the mat holding all the brightly colored website dots together.

Maybe we are too smart for or own good.  I bet if you asked your children, they would say something wonderfully simple like, “Just ask me my permission.” or, “I’ll tell you if I trust you.”  Or perhaps, “Your a stranger.  Until I know you better I won’t tell you my name or where I live.”  Instead of trying to re-weave the Web and break what works, why not just ask the user.  Give them the Choice to share or not to share with any given site.  Give them a Choice about what to share – location, but not name.  Device information, but not cell phone number.  Privacy is not binary.  Privacy cannot be “solved.”  Privacy is a right.  Ask permission (in a simple, straightforward manner) and then respect it.  Period.

Digital Privacy should be about delivering the appropriate Web Experience base on what is shared, not taken.  An anonymous experience or a rich experience, or something in between. It should be MY choice and should not be all or nothing.  People like choice.  When you deny that choice based upon less than transparent practices and policies, people get really angry. Angry people stop doing business with you and tell all their friends.

As I watch the news unfolding about Path (link) and the controversy over accessing my address book, I can’t but shake my head in amazement that people are still missing the point. It’s not that they accessed my data without my permission that’s the problem – it’s that I have no choice in what I choose to share that’s at the heart of the matter.

Think about it for a moment, Michael Arrington is an investor in Path. Now Michael probably has an address book only second to Ron Conway’s. Can you just imagine the number of aspiring entrepreneurs who would love to access that database. And it’s probably all sitting up on someone’s servers somewhere.

Now to their credit Path immediately issued an apology and deleted everyone’s data from their servers. So far so good. Now comes the problem – they then updated their app so that it asked “permission” to access your address book. As someone would tweet – #fail.

They are still missing the core problem – I want to allow Path access to “some of the people in my address book” – but only those who Path turn into something of value for me. And therein (as the Bard says) lies the problem. Privacy is NOT binary, it’s contextual. Not only do I want a choice in what I share, I want to ensure that sharing the data results in a better outcome for both parties.

What the current approach to Privacy has #failed to do is deliver not only a choice, but it has failed to make it contextually aware of not only Who I am, but Where I am. My Privacy has value – it must have because at the moment this topic is becoming radioactive – and yet my only “Choice” is binary. Either share it or not. Well how about offering me something in return? Why do you get to keep the value and I don’t. Seems like an unfair choice to me.

Ultimately Privacy is a balance between ensuring Privacy and allowing information to be shared for a better outcome.

And that’s why we invented the new Choice™ browser. It gives you a choice in what and to whom, you want to share your personal data with.

Whether you are for or against the specific points of the act, I hope you’ll educate yourself and share your feedback with your state representative.

Being me, I decided to click on the DAA’s Ad Choice icon and then through to Google’s ad profile/privacy manager page to check things out.  I will say that having the icon does make it easier to find, review and edit your Google profile.  For that much I am grateful – thank you Google and the DAA.

But wait.  Much to my surprise I found out I am 35 – 44 year old male!  Really?  Guess I’ll need a few things – maybe some ballroom jeans?  I’d order up some “online goodies” if I knew what they were (even Wikipedia, doesn’t know).  What do you think – a bearskin or zebra shag rug for my bachelor pad?  They don’t assign a marital status, but what are the odds that I’m married if I’m looking for a job, totally into money, playing with electronics and hanging out online with my 1500 closet friends?

My Google Ad Profile as of Today:

Bottom line, Google’s ad network does not know me.

My categories are accurate, but their profiling assumptions need some work.  Am I interested in computers & electronics or do I work in the IT industry?  As a marketer, I think that matters – it goes to intent to buy – or not.  I’m not looking for a job, I use job listings as triangulation points to see what industries are equipping mobile workers with tablets and smartphones (it’s becoming a recruitment perk and helps mitigate the other BYOD issues).  Somehow they missed all my travel research – now those ads I might actually respond to.

Because online consumer privacy management is so binary (track/do not track) and most businesses are not yet using our Choice browser,  I guess I’ll just hit Johnny’s Cigar Bar, hang with the boys plan a 45th birthday golf trip to Hawaii while I wait for my online, transgender surgery to be reversed.   Later…

Typically, the first step to mobile enterprise support is Mobile Web Access – regardless of whether or not the content has been optimized for mobile users (that browser Zoom feature comes in really handy).  Based on Aberdeen Group research in 1H11, the only 100% adopted mobile technology across the enterprises that they interviewed in 2011 is the Mobile Web.  Source:  Riding the Tiger of Mobility and BYOD for Better Enterprise Security webinar, January 26, 2012.

The Choice™ Browser is designed to let each business determine the best way to manage privacy, performance and personalization.  If you are formulating or evolving your mobile strategy or are just trying to play BYOD catchup, I encourage you to subscribe to the 3PMobile^® YouTube channel to learn how enterprise browsing can help your business manage its 3Ps in today’s BYOD environment.   If access and policy management is your first priority, keep watching for some great ideas on how to extend your rules engine to support mobile Web users.

The intent of the legislation is good:  Who (other than criminals) could argue against protecting content owners from piracy?  The problem is with the unintended consequences – holding a larger, deep pocket site responsible for things they may accidentally link to (programmatically) or better yet, that their users link to within the larger platform.  While not perfect, most reputable sites do a good job of removing offending content.

Well, the same issue holds true for Web Privacy regulation.  The Do Not Track (DNT) header initiative takes the same binary approach to privacy.  Share or don’t share my information beyond this site.  The unintended consequence is that the person being protected (me) gets a lousy choice and lousy Web experience.

Do I believe that regulating digital privacy is good?  Yes.  But once again, it should not be an all or nothing directive, such as DNT (which, while it will be included in most browsers, has no legal teeth to enforce it’s use).  It has negative consequences for both Web users and marketers.  Nobody wins and only lip service is paid to privacy, while nothing really changes.

Why not let the user determine what they want to share with whom? Make choice a law.  Let the market develop techniques and tools to support compliance and let Internet businesses and companies that share their visitor data with others, pick the solution that best matches their business model and compliance needs.  Companies such as TRUSTe and 3PMobile are two good examples of companies working towards that end – giving users the choice to make more finely tuned data sharing decisions.  Decisions based on their personal sharing tolerance and the trust earned by each site or service collecting, using and sharing their data.