by Ben Isaacson

Anti-spyware programs target two types of online activities: installed programs and cookies. Since a number of organizations and laws are addressing downloadable software, it is time for marketers to educate consumers about cookies. The three best places for consumer education are on Web sites, in Platform for Privacy Preferences (P3P) policies, and within cookie technology itself.

The foremost place where companies can educate users about cookies is on their Web sites. However, the traditional privacy policy may not be the best place for this kind of education, because many consumers do not read it. There is a movement to refine the formal privacy policy into a short form that gives users a complete overview of a company’s privacy practices in a highly abbreviated, easy-to-read format with links to more information. (Proctor & Gamble’s Web site provides a good example of the short form.) Short forms are ideal places to educate consumers about the site’s use of cookies.

Another ideal place for consumer education is the point where the Web site collects personal information. It is not enough to just provide a link to the privacy policy here: Sites should consider using additional text, an explanatory pop-up, or other vehicle at the point of collection to ensure that users understand and value the personalization and relevancy cookies offer, as well as the behavioral marketing that their use enables.

Perhaps the most critical process marketers should modify is their use of the P3P, also called a “compact privacy policy.” P3P is embedded in all Web browser software, yet few marketers are aware of their P3P practices. A quick check of five large national Web sites that I frequent found that three had advertisers whose cookies were blocked in the default Microsoft Internet Explorer privacy setting because they lacked P3P policies.

If you are an online advertiser, you need to set up a P3P policy and link all cookie deployments to it, then test their placement references to ensure accuracy. Web sites that publish online advertising, in turn, should consider requiring advertisers to create a P3P policy tied to the cookies they deploy on the site. Since users can see privacy-settings violations in the bottom right corner of the Internet Explorer browser window, any violation by an advertiser decreases consumer trust in the Web site that allowed the violation to occur.

Most of the anti-spyware programs on the market target the use of third-party cookies. To avoid being singled out by anti-spyware software, online marketers may want to change their cookie practices to incorporate the following techniques:

• Use first-party domain cookies, which can be delivered through an allocated first-party subdomain.
• Increase the transparency of the cookie domain, and only reference the top-level corporate domain rather than a smaller or unrecognizable domain name.
• Reconsider the use of third-party cookies altogether, focusing instead on the use of page tags (Web beacons) combined with clickstream data and first-party Web site cookie use.

There is plenty of time for online marketers to amend their cookie practices before anti-spyware software targets all cookies. Through point-of-collection consumer education efforts, P3P policies, and increased transparency, online marketers can continue to reap the many rewards that cookies enable.

Ben Isaacson is privacy and compliance leader at Experian and CheetahMail.

 

Ponemon Institute