Title: AllAdvantage: A Front-End to DoubleClick Author: Andrew Schulman (http://www.undoc.com, undoc@sonic.net) Date: July 18, 2000 Summary ------- AllAdvantage pays its several million users to surf the web, and in exchange shows these users advertising, and collects information about the web sites and specific pages they visit, and about some of the data they enter into web-page forms (such as search engine queries). While users realize that they are being paid to look at ads, they may not fully realize that their web browsing is being watched. AllAdvantage sends this tracking information, along with user demographics, to DoubleClick, an internet advertising network. The AllAdvantage Privacy Policy discloses the tracking, but does not explicitly mention DoubleClick. AllAdvantage makes an effort to remove personally-identifying information from tracking data before sending it to DoubleClick, and in many (though not all) cases honors opt-outs from DoubleClick. According to AllAdvantage's Privacy Policy, AllAdvantage data is supposed to be kept segregated at DoubleClick, but this does not always happen. Since its Privacy Policy states that AllAdvantage's whole business model is based on privacy concerns, it is worthwhile to examine this company in detail. In essence, AllAdvantage is paying users for their clickstream data, as well as to look at ads. Though the financials may not make sense (AllAdvantage has even been described by *Fortune* as "the dumbest dot-com"), AllAdvantage sees its payments -- for what could otherwise be a privacy violation -- as a model for the rest of the industry. Yet AllAdvantage users are in some ways forming more of a relationship with DoubleClick than with AllAdvantage. While the company describes itself as an "infomediary" and "gatekeeper," the words "conduit" or "funnel" are perhaps more accurate. And to the extent that AllAdvantage is acting as an infomediary, its business is not thriving. At the time of this writing, AllAdvantage has just postponed its IPO. [AllAdvantage has switched to sweepstakes: http://www.msnbc.com/news/450592.asp] [Taking advantage of lower-income surfers? cf. http://www.msnbc.com/news/449269.asp (on ValuePay.com, etc.).] Description ----------- AllAdvantage is a "get paid to surf" service. Since its start in March 1999, it has had a total of over 5 million users, with about 1.7 million active users in 1Q 2000. AllAdvantage pays its users 50 cents per hour to view advertisements (about one ad per minute) in an AllAdvantage window called the "Viewbar" that users must download, and that runs as a separate add-on to their web browser (see Figure 1). This is a "persistent" window that continually displays ads, no matter where users go on the web. [INSERT FIG. 1: SCREEN SHOT OF ALLADVANTAGE VIEWBAR] AllAdvantage also pays users for referrals, using a multi-level marketing system ("Not only can you get paid when you surf, you can also get paid when your friends surf. And their friends. And THEIR friends"). Between a cap of 25 hours per month on the one hand, and five levels of referrals on the other, the average payment works out to about $28 per month. However, some users with very large "downlines" (referral pyramids) have been reported to have made several thousand dollars per month. TRACKING In addition to displaying ads to its users, AllAdvantage also watches their movements on the web while surfing. AllAdvantage discloses this practice in its Privacy Policy: "While you are using the Viewbar, we automatically track certain information about your surfing behavior. This information includes the URL of the page you are visiting, what browser you are using, and your IP address." (As noted below, AllAdvantage fortunately does not in fact track the full URL.) [Need to explain URL?] AllAdvantage's February 2000 IPO filing (subsequently withdrawn) puts it in stronger terms -- "we collect data about our members' behavior wherever they go on the Internet" -- and acknowledges that "members might not like having their online activities tracked." The company's Media Kit makes it even clearer: "The Viewbar is a recording device that enables AllAdvantage.com, with members' consent, to collect accurate data on members' surfing habits." This raises an interesting question: if this "recording device" statement were prominently displayed somewhere that potential AllAdvantage users *had* to see it, how many would still consent? What sort of consent have users really given to practices they may not fully understand? More generally, to test whether web sites and services are really getting informed consent from users, we could ask how many users would still use the site or service if it prominently displayed to users the same statements that it makes to advertisers or to the SEC. It's useful to think of AllAdvantage (and any web site or service that collects data on users) in terms of a subpoena: Is it worth 50 cents an hour (or $25 a month, or whatever) to have someone else holding a relatively complete history of what sites you've visited on the web? AllAdvantage users should realize that the service is not only tracking which sites they visit on the web, but also specific pages within these sites, and (depending on the web site) may also see what they have typed into forms located on web pages. The company's Media Kit explicitly states that advertisers can do "keyword buys," based on what users are looking for with search engines. For example, if a user employs a search engine such as AltaVista to look for information on AIDS, AllAdvantage will record, not only the fact that they visited AltaVista, but also the fact that they were looking for information about AIDS (see the section on "URLs" below for more information). AllAdvantage will only see information that appears in URLs. If a web-page form uses the GET method (rather than the somewhat more secure POST method), AllAdvantage may see what the user has typed into the form, because the GET method takes the user's data (such as a search-engine query) and places it into the URL of the form's results page. Fortunately, almost all web-site developers know not to use the GET method for forms that collect credit card numbers, passwords, etc. It is highly unlikely that the AllAdvantage Viewbar would see this type of personal information. [Need cross-reference to page on GET vs. POST?] DOUBLECLICK Interestingly, AllAdvantage's "recording device" sends off the information it collects, not to AllAdvantage itself, but to DoubleClick, an internet advertising network. The Viewbar's only communication with AllAdvantage itself is a "ping," issued approximately every ten minutes, to indicate that a user is surfing the web and thus eligible for payment. The AllAdvantage Viewbar also communicates with several other servers (such as AdKnowledge, Mediaplex, and 24/7 Media), but according to AllAdvantage's IPO filing (S-1 statement filed with the US Securities and Exchange Commission, February 2000), "we currently rely on technology provided by DoubleClick to deliver substantially all of the advertisements on our Viewbar." However, the AllAdvantage Privacy Policy (which users are far more likely to read than the IPO filing) does not mention this close relationship with DoubleClick. Instead, it refers vaguely to "our ad-serving company." Given that the AllAdvantage Viewbar acts primarily as a conduit for information to DoubleClick, and that its agreement with DoubleClick does not expire until December 2002, the AllAdvantage Privacy Policy should fully disclose this relationship. Users should not have to read SEC filings (or Media Kits) to learn basic facts that belong at the very least in the Privacy Policy, if not also in more prominent parts of the web site. The coy failure to tell its users about DoubleClick is especially odd given AllAdvantage chief privacy officer Ray Everett-Church's statement in a letter to the US Federal Trade Commission (FTC) that "To heighten awareness of profiling, we are developing the AllAdvantage.com Privacy Center as a one-stop reference for information relating to consumer information privacy." PRIVACY POLICY An important general point for users of any web service is that they ought to carefully read Privacy Policies, looking especially for any (probably confusingly-worded) references to "tracking", "URLs", "cookies", or "clickstream data". If the Privacy Policy says that the service tracks URLs, then the consumer should think twice about whether they want this. And unfortunately, given current poor disclosure practices, thoughtful consumers may even need to read financial statements (available through sites such as http://www.10kwizard.com), or Media Kits aimed at advertisers, to learn what a web site or service really does. AllAdvantage describes itself as an "infomediary" that protects the privacy of its members. As noted in AllAdvantage's IPO filing, "Many companies on the Internet are collecting valuable data about consumers without their knowledge or permission." AllAdvantage's "infomediary" model therefore depends on users giving their informed consent, by reading and fully understanding a Privacy Policy which in turn should fully disclose any relationships with third parties, especially one such as DoubleClick which is widely viewed as "collecting valuable data about consumers withour their knowledge or permission." [Note that according to Everett-Church, AllAdvantage business model is based on the book on "infomediaries", *Net Worth* by Hagel and Singer.] COOKIES The AllAdvantage Privacy Policy section titled "Ad-Serving Company" says the following: "We use an outside company to display ads on the Viewbar. These ads may place cookies on your computer. While we use cookies in other parts of our Web site, cookies received with banner ads are monitored by our ad-serving company, and we do not have access to this information. However, we have contractual arrangements that restrict our partners, including the ad-serving company, from using these cookies for anything other than fulfilling their service to AllAdvantage.com." In other words, DoubleClick uses a cookie (with a unique ID number for each user) to build up a profile for each AllAdvantage user, but this profile is supposed to be separate from other DoubleClick profiles. Indeed, AllAdvantage primarily sends user data, not to the the standard DoubleClick server, but to aa.doubleclick.net (the "aa" presumably stands for AllAdvantage). However, aa.doubleclick.net uses the exact same cookie as the standard DoubleClick servers, such as m.doubleclick.net. Furthermore, the AllAdvantage Viewbar also fetches images from m.doubleclick.net, and in the process ends up spilling user data to this standard DoubleClick server (see below). This profile is supposed to be anonymous: there is a unique entity (such as "id=e7ccc9ef"), but DoubleClick is not supposed to know who this entity belongs to. AllAdvantage registration information (including the user's name, address, and other information necessary to mail payments for surfing) is not sent to DoubleClick. URLs Furthermore, the AllAdvantage Viewbar strives to remove possibly identifying information from URLs, before sending these URLs to DoubleClick. It appears that all numerics (which could possibly contain zip codes, phone numbers, credit card numbers, etc.) are removed. Everything except for the domain name is removed, and turned into a collection of keywords. For example, if the user does a Yahoo! search for the words "HIV AIDS", AllAdvantage will send the following information to DoubleClick (along with the DoubleClick cookie and some encrypted demographics): kw=hiv+aids;d=search;d=yahoo;path=bin/search As another example, consider searching AltaVista for the "porno." The AllAdvantage will send a packet of data such as the following to aa.doubleclick.net: [Need to explain the following, or is it self-evident? Need to highlight word "porno" below?] GET /adf/alladvantage.com/;kw=web+porno;d=altavista;path=cgi-bin/query; d1=DEBFHCBA;d7=XDCEYPWI;d5=CQTD6LSV;d3=ABAB8ADG;d8=BC9B9BAD;d2=PUVPFHMH; d9=DILJDF7L;cs=33;se=1;pe=1;sz=468x60;tile=1;ord=2658319043? HTTP/1.1 Accept: */* Accept-Language: en-us Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt) Host: aa.doubleclick.net Connection: Keep-Alive Cookie: id=e7ccc9ef (This data was captured by a "packet sniffer", TracePlus32/Winsock; see http://www.sstinc.com.) [Need a separate article, explaining how to read packet sniffer dumps?] [INSERT TABLE WITH EXAMPLES, INCLUDING HOTMAIL LOGIN. TRY HOTMAIL LOGIN WITH NUMERIC, E.G. "foobar666" AS WELL AS "foobar". ALSO INCLUDE AN https:// EXAMPLE!] AllAdvantage's "parsing" of URLs on the user's machine should be noted by developers of other browser add-ons. Currently, programs such as Alexa Internet send off entire URLs, without any attempt to remove possible personally identifying information contained in URL "query strings." The AllAdvantage Viewbar shows that it is feasible for browser add-ons to remove most potentially personal information. DATA SPILLED TO DOUBLECLICK According to its IPO filing, AllAdvantage is "acting as the gatekeeper to our members while maintaining their privacy." This "gatekeeper" role would be corrupted if data from AllAdvantage were integrated with regular DoubleClick data that suffers from data-spill problems [cross-reference article on data spills?]. Segregating this data is presumably the purpose of the aa.doubleclick.net server. However, as noted above, the AllAdvantage Viewbar does also communicate with regular DoubleClick servers, such as m.doubleclick.net, and unfortunately AllAdvantage sends its encrypted data (most likely demographics), as part of the "HTTP_REFERER", when fetching ad images from this standard DoubleClick server. For example, AllAdvantage sent the following packet to m.doubleclick.net during the same AltaVista search for "porno," described above: GET /viewad/371412-shop_468x60-1adaaabaa3.gif HTTP/1.1 Accept: */* Referer: http://aa.doubleclick.net/adf/alladvantage.com/;kw=web+porno; d1=DEBFHCBA;d7=XDCEYPWI;d5=CQTD6LSV;d3=ABAB8ADG;d8=BC9B9BAD;d2=PUVPFHMH; d9=DILJDF7L;rlad=0;cs=33;se=1;pe=1;sz=468x60;tile=1;ord=1317422720? Accept-Language: en-us Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt) Host: m.doubleclick.net Connection: Keep-Alive Cookie: id=e7ccc9ef [Need better example? ord= doesn't match earlier example. In dumpfile, this ord= happened to fetch graphic from mojofarm.mediaplex.com.] As seen here, the AllAdvantage Viewbar takes the same information that it sends to aa.doubleclick.net, and also sends it, as the "Referer" string, to m.doubleclick.net. OPT-OUT The AllAdvantage Viewbar uses the Microsoft Internet Explorer cookies directory. As a result, if an IE user has opted out from DoubleClick, AllAdvantage will respect this, sending DoubleClick an "id=OPT_OUT" cookie value rather than a unique ID number. However, if a Netscape user has opted out from DoubleClick, AllAdvantage will not reflect this decision. The ViewBar (which is running as IE) simply assumes that cookies are in \windows\cookies or \windows\profiles\\cookies. It doesn't check the Netscape cookies.txt file. [Too Windows specific?] Since the AllAdvantage Privacy Policy makes no explicit mention of DoubleClick, it is not surprising that it fails to tell users how to opt-out of DoubleClick. The Privacy Policy merely says that, to opt-out from AllAdvantage, users can close the Viewbar window. [Oddly, AA seems to still send out its "ping" even if the user has the ViewBar minimized; it does not send out ad requests when the ViewBar is minimized or closed.] PRIVACY AS PROPERTY? Given AllAdvantage's apparent role as a front-end to DoubleClick, it is interesting that AllAdvantage sees itself as an opponent of the practices for which DoubleClick is frequently criticized. For example, AllAdvantage chief privacy office Ray Everett-Church, in his 1999 comments to the FTC, stated: "Consumers are realizing that the profiles being surreptiously gathered about them are tremendously valuable, and it is only a matter of time before consumers demand value in exchange for the use of these assets." "Infomediaries operate on the assumption that personal information is the property of the individual described, not the property of the one who gathers it." In other words, according to AllAdvantage, consumers on the web are not being adequately compensated for the taking of their personal information. The problem isn't simply that the taking is surreptious, but that it is uncompensated. And the data belongs to consumers, not to companies such as DoubleClick that collect it. AllAdvantage says that it responds to this situation "with a business proposition: let us do openly what others do surreptiously." AllAdvantage's IPO filing similarly stated that "...online consumers have had limited ways to control this flow of data *or realize any of its value*" (italics added). This approach -- in essence, throwing money at the privacy problem -- is in stark contrast to the views of AllAdvantage's close partner. For DoubleClick, users already realize the monetary value of personal data; according to one spokesperson for DoubleClick, "The only reason the Web is free is that advertisers are footing the bill." Without ads, "websites will have to start charging for their content" (quoted in *Time Digital*, July 2000, p. 39). Indeed, it has often been pointed out that, for all their stated concerns about privacy in polls, few users say they would *pay* to subscribe to web sites that were free of advertising. Thus, in effect they are already being paid to look at ads. But advertising isn't the same thing as profiling of individual users. These two functions tend to get confused on the web, because the web makes it so easy for advertisers to collect data. Banner ads on the web function like billboards that automatically log information about everyone that happens to look at them. A billboard on the highway that did such a thing would be regarded as intrusive. Similarly, the Nielsen rating system isn't attached to every TV set. Ads do subsidize the "free" web (whether paying $20 per month to an ISP counts as free is a separate question), but this doesn't mean that online profiling is also necessary to maintain the "free" web. As a thought experiment, consider what would happen if every user opted-out from two the largest ad networks, DoubleClick and Engage/CMGI? Or, what if every user ran a program that frequently deleted their DoubleClick and Engage cookies? Would these large ad networks automatically fold up business? Or would they simply have to adjust, by redefining their role as pure advertising, rather than advertising combined with semi-covert profiling of individual users? Obviously, they do not need to be profiling individual users in order to carry out the advertising function. What does all this have to do with AllAdvantage? Plenty: AllAdvantage's business model is in flat contradiction to the models of the ad companies it depends on for revenues. AllAdvantage needs money from advertisers in order to pay consumers. But consumers are already seeing ads on most web pages they view. And advertisers regard these web pages themselves as adequate compensation for the advertisements (and presumably, though they don't say so, for the data tracking). AllAdvantage depends on advertisers (primarily via the DoubleClick ad network) to come up the money needed to pay consumers. AllAdvantage says the data belongs belongs to consumers. The ad networks say the data belongs to them. In order to compensate users for information that is currently taken by ad networks, AllAdvantage must get money from these same ad networks. There's a problem here. What's at stake here? AllAdvantage views its payments as a free-market solution to the internet privacy problem, one that shows that government regulation of privacy isn't necessary. According to Ray Everett-Church, the current "self-regulatory framework has allowed us to establish ourselves as an alternative to current business models and has given us an opportunity to establish a thriving working model of an Infomediary. We hope that other companies will follow the path we are showing..." AllAdvantage's apparent failure to thrive (see below) calls into question the notion that the market can take care of this problem, or at least the notion that the problem is solved by having one company pay consumers for more or less the same data that DoubleClick already takes. REVENUE PROBLEMS "Lining up advertisers fast enough so the pyramid doesn't topple is a challenge, [AllAdvantage CEO James] Jorgenson admits" ("'Pay-for-surf' plan attracts million," ZDNet, October 7, 1999). As noted earlier, AllAdvantage recently delayed its IPO, and there has been speculation that the company will soon run out of money (see, for example, "The Dumbest Dot-Com," *Fortune Technology Daily*, June 19, 2000). The company is currently paying out far more to members than it takes in from advertisers. In a supplement to its IPO filing, AllAdvantage stated that in 1Q 2000 it paid out $32.7 million in "direct member costs" and $8.6 million for "member referral costs." Meanwhile, its revenue from ads was $9.1 million. The $32.7 million in direct member costs presumably represents about 65 million hours of surfing. If you do the math, this in turn means that the average ad impression is shown for about 15 seconds (thouygh in my own testing, it looks more like one ad impression per minute). If an ad impression takes 15 seconds, and with a payment of 50 cents an hour to surf plus an average of perhaps 12 cents an hour for referrals, AllAdvantage must make at least 62 cents to display 240 ad impressions (with a one-minute ad impression, it must make about a penny per ad impression). But AllAdvantage's IPO filing says, "In the month of January 2000, we delivered over 6 billion advertising impressions on our Viewbar." Assuming similar figures for February and March, that's 18 billion ad impressions for 1Q 2000, divided by $9.1 million in ad revenues, or a remarkably low CPM (cost per thousand ad impressions) -- certainly far less than than what it needs to break even. Meanwhile, AllAdvantage itself is a major advertiser, for example in April 2000 reaching about 10% of at-home internet users, and 15% of at-work internet users in April 2000, according to Nielsen ratings (http://adres.internet.com/statistics/advertising/article/0,1401,9231_363641,00.html). All this advertising costs money. [Get figures from supplement to S-1?] Seen in this light, AllAdvantage's privacy practices may seem like a minor concern: it's like critiquing the paint job on a house (or a pyramid) that may be in danger of collapsing. However, AllAdvantage's possible financial problems does have a lot to do with privacy, for at least two reasons. First, as noted above, AllAdvantage says that users need to be financially compensated for their personal data. If AllAdvantage cannot "thrive" while carrying out this compensation, it may call into question the idea of giving users money for their data. Second, as dot-coms run out of money, they may be under increasing pressure to sell personal data which previously they had been hoarding. As AllAdvantage notes, this personal data is "valuable." A Cnet article titled "Failed dot-coms may be selling your private information" (June 29, 2000) notes that "Customer lists are considered among the most valued assets of any technology company." While the Cnet article discusses failed dot-coms such as boo.com, it may prove relevant to AllAdvantage. [See Privacy Policy on future changes? Last updated August 1999. Standard language, "Changes to the Policy". By registering, you are aware that policy may change from time to time; members will be notified on home page, etc.] TARGETING VS. DEMOGRAPHICS "Drop the demographics." (AllAdvantage ad at www.clickz.com) "The Viewbar targets your customers based on their actual surfing behavior, which is more useful than using age, education and income as surrogates." (AllAdvantage Media Kit) AllAdvantage is promoting the notion that "demographics are dead," and that its Viewbar "recording device" allows precision targeting of ads. "Precise targeting is here," claims another AllAdvantage ad aimed at advertisers. However, the ads displayed by the AllAdvantage Viewbar hardly ever seem conneted with what the user is doing in the web browser. Indeed, AllAdvantage's IPO statement admits that "During the fourth quarter of 1999, substantially all of the advertisements we sold were not highly-targeted." According to Fortune's "Dumbest dot-com" article on AllAdvantage, "the prospect of 'highly targeted' ads that would take advantage of the information that AllAdvantage collects about users' surfing habits is still a dream. The information is in AllAdvantage's data banks, but only a tiny fraction of it is actually useful to advertisers." This is a more general problem with the online profiles being built, not only by AllAdvantage, but also by companies such as DoubleClick. There seems to be a "technological imperative" behind much of this online profiling: companies are collecting data about users simply because the web makes it easy to collect data. Armed with the data, it then looks for something to do with it. Online profiling may sound impressive to investors, but so far it doesn't seem to be yielding results. (For an excellent article on this phenomenon, see: "So Far, Big Brother Isn't Big Business," *New York Times*, May 7, 2000.) [Speaking of investors, somewhere mention major investor in AA: Softbank, $70 million.] In the case of AllAdvantage, this means promoting "targeting" over "demographics," even though few of the ads shown by AllAdvantage are particularly targeted, and even though AllAdvantage does offer demographic advertising based on member-provided data (for example, member-provided zip codes are accurate because memebers want to receipt their payments for surfing). In the end, demographics probably continue to make more sense than AllAdvantage's claimed "precise targeting." [RMS: Of course the demographics of their own customer base isn't the greatest. I suspect most of their surfers don't have a lot of extra income to spend on the products they are being pitched. (though ads for debt consolidation, credit cards, hair replacement...)] MULTI-LEVEL MARKETING AND SPAM "Our member referral program could generate negative media attention. We rely primarily on member referrals to add to our membership. Although we maintain an anti-spam policy regarding email solicitations for membership growth, it is difficult for us to monitor the use of email by our members to solicit referrals. Anti-spam groups or activists might generate negative media attention respecting member referral activities. Further, anti-spam legislation, in the United States or elsewhere, could restrict our ability or the ability of our members to use email to solicit referrals. Although members do not make any payment to us to participate in our member referral program, some jurisdictions could assert a claim that the use of email marketing to add to our membership violates laws restricting multi-level marketing activities." (AllAdvantage S-1 IPO filing, February 2000) [Unfair to quote IPO filing at length, since required to put things in negative terms as CYA? Perhaps more generally unfair to say that everything they say in IPO filing has to be said prominently at site?] Over 1 million AllAdvantage users have referred at least one friend, and as noted above some users have very large "downline" pyramids. Some of these pyramids have been constructed using unsolicited bulk email, or spam. For example: "Subject: Check This Out "just click on https://www.alladvantage.com/joinsecure.asp?refid=GGO737 and you can instantly start collecting $$$$ in US These people pay you just for signing up and web surfing!!! isn't that crazy?? every month you get a check in the mail??? It can pay for you cable/dialup/or whatever connection you have!!! you can surf the internet for FREE??!!! "take my word click on the link... you won't be disappointed!!!" AllAdvantage has an anti-spam policy (see http://www.alladvantage.com/antispam.asp), and has cancelled members who have been reported for email abuse. For example, user ID GGO-737, who sent out the above email, is listed in the "hall of shame" at http://www.alladvantage.com/spamlist.asp. If a new user signs up at AllAdvantage, using this referral id ("refid=GGO737"), any referral fees that would have gone to GGO-737 will instead go into an anti-spam slush fund. However, as AllAdvantage noted in its IPO filing, the company relies primarily on member referrals, and this in turn depends somewhat on spam. It seems disingenuous for AllAdvantage to not acknowledge the extent to which its multi-level marketing encourages spam. (It also encourages the proliferation of "get rich quick" web pages -- a sort of "web spam" -- as can immediately be seen by using any search engine to look for "alladvantage".) The term "veiled spammers" (see http://www.chsw.com/vsl/) has been used to describe companies such as AllAdvantage who on the one hand try to distance themselves from spam done by others in their name, but who on the other hand depend upon this spam to grow their business. It is ironic that AllAdvantage has a spam problem, because its chief privacy officer, Ray Everett-Church, was an early campaigner against spam and is a board member of the Coalition Against Unsolicited Commercial Email (CAUCE). Oddly enough, Everett-Church has been put in the position of defending what he calls AllAdvantage's "viral marketing" in an anti-spam newsgroup, news.admin.net-abuse.email (December 1999): "the viral marketing model was the quickest way to reach a critical mass of membership... I'll be very surprised if by this time next year we are continuing to do the referral thing" (http://x51.deja.com/getdoc.xp?AN=563679266&CONTEXT=962804263.730267664). AllAdvantage's use of "viral marketing" may be self-defeating: the company loses money on every member, and is trying to make it up on volume. CHEAT PROGRAMS Many of the web pages that encourage you to sign up for AllAdvantage (of course giving the web page's author as the referral ID), also encourage readers to sign up for many of the other "get paid to surf" services on the web, such as Spedia, GetPaid4, Gotoworld, and UtopiAd. In fact, the "make money fast" web pages frequently encourage you to sign up for several of these services at the same time. Apart from calling into question the value to advertisers of the more enthusiastic "get paid to surf" members, this practice of signing up for multiple services also makes one wonder how users can get any real work (or even surfing) done, if their screen is cluttered up by multiple persistent advertising windows. One answer to this question is that, not surprisingly, there are "cheat" programs that will let you move the AllAdvantage Viewbar and similar programs offscreen, or otherwise fool the service into thinking that you are online and using the service when you aren't. One such program is called FakeSurf. (One AllAdvantage competitor, Spedia, has an amusing "hall of shame" at their site; see http://www.spedia.net/make_money_hall_of_shame.htm, which describes some of the frauds people engage in to rack up hours online.) There have been (unconfirmed) reports that the AllAdvantage Viewbar scans your list of currently-running Windows programs, trying to detect if you are running FakeSurf or a similar program. Apparently your list of currently-running programs is *not* sent to AllAdvantage -- the test is performed locally -- so this is unlikely to raise privacy concerns. CHILDREN Interestingly, AllAdvantage CEO James Jorgensen was previously a cofounder of Discovery Zone (DZ), a sort of indoor playground for kids that charges an admission fee. AllAdvantage seeks to comply with the US Children's Online Privacy Protection Act (COPPA) by asking that anyone under 13 get a parent's or guardian's permission. There is a Parental/Guardian Consent form. [Is there any validation, e.g. with credit card? Is this really all that is needed for COPPA compliance?] COMPETITORS As noted above, there are many other companies in the "get paid to surf" space. For a comprehensive list, search Yahoo! for "alladvantage" and note all the other companies on the page devoted to "get paid to surf" "business opportunities." At least one of these companies, ClickDough, distinguishes itself from AllAdvantage by refraining entirely from tracking (see "Recommended Corrective Actions" below). In addition, there are some other approaches to compensating users for viewing advertising (and probably for being profiled as well). For example, NetZero provides free ISP services, in exchange for looking at ads, and eMachines provides a "free" PC which features an ad bar from iWare that looks somewhat like the AllAdvantage Viewbar. Items for Further Investigation ------------------------------- From looking at the Viewbar.exe program file, it appears that the pages sent to the AllAdvantage Viewbar can apparently contain tags such as , , etc. The AllAdvantage Viewbar offers a search-engine form and a menu of additional features. It may be useful to look into these. Recommended Corrective Actions ------------------------------ If an AllAdvantage user wants to surf the web without being AllAdvantage sending their online profile to DoubleClick, the user can close or minimize the Viewbar. Unfortunately, the Viewbar's user interface does not make it obvious how to do this: you must right click on the AllAdvantage icon on the taskbar, or right click the Minimize button on the Viewbar itself, and then select Quit from the popup menu. For a more permanent end to your relationship with AllAdvantage, you can remove AllAdvantage from Windows StartUp, and from the taskbar. [Show how! Uninstall?] Note that these techniques of course won't stop DoubleClick and other ad networks from seeing what you do anyway. As noted above, the AllAdvantage Viewbar sends DoubleClick much of the same information that it would be getting anyway, given its ubiquity on the web. Users of Microsoft Internet Explorer and AOL can opt-out of DoubleClick by going to DoubleClick's "DoubleClick Privacy & Opt-Out" page (http://www.doubleclick.net/company_info/about_doubleclick/privacy/privacy2.htm) and clicking on the "Opt Out Click Here" button. [Also give link to Richard's "universal opt-out" page?] AllAdvantage users who are concerned about giving DoubleClick even more data might consider switching to a different "get paid to look at ads" service that doesn't do online profiling. One such company is ClickDough: "Unlike the competition, we don't spy on your surfing habits or track which web sites you visit.... About every 6-10 minutes, we'll ask you to click a validation button. That's your way to tell us that you're still watching, and that we should keep sending you money-making advertisements." Indeed, ClickDough really doesn't track where you go on the web; it simply displays an additional browser window that periodically pulls down a new ad. The corrective actions that AllAdvantage itself could take were suggested above: disclose the same information to consumers on its web site (and not just in fine print in its Privacy Policy) that it discloses in its IPO statements and Media Kit; clean up the relationship with DoubleClick; take further action to reign in over-enthusiastic members who engage in spam and "get rich quick" come-ons. Links ----- AllAdvantage Privacy Policy, August 1999 (http://www.alladvantage.com/privacy.asp) AllAdvantage Media Kit (http://www.alladvantage.com/adsales1/download/media_kit.pdf) AllAdvantage IPO filing, S-1, February 7, 2000 (http://10kwizard.com/fil_submis.asp?iacc=1087450). Also see other AllAdvantage filings, including June 30, 2000 request to withdraw S-1 (http://10kwizard.com/symbol.asp?s=AADV&o=fil). Ray Everett-Church, Comments on FTC public workshop on "Online Profiling," November 1999 (http://www.cdt.org/privacy/FTC/profiling/AllAdvantage.pdf) Mark Gimein, "The Dumbest Dot-Com," Fortune Technology Daily, June 19, 2000 (http://www.fortune.com/fortune/technology/daily/0,3467,617000619,00.html) Bob Sullivan, "'Pay-for-surf' plan attracts millions," ZDNet, October 7, 1999 (http://www.zdnet.com/filters/printerfriendly/0,6061,2349320-2,00.html) Ed Foster, "Viral marketing goes one step too far -- to a place where friends spam friends," InfoWorld, Feb. 4, 2000 (http://www.infoworld.com/articles/op/xml/00/02/07/000207opfoster.xml) Kora McNaughton, "Pay-per-view ads get new twist," Cnet, March 30, 1999 (http://home.cnet.com/category/0-1007-200-340560.html) Acknowledgments --------------- Thanks to Dana Hawkins of *US News and World Report*, for first drawing our attention to AllAdvantage.com and to the privacy implications of "get paid to surf" services. Feedback? mailto:feedback@privacyfoundation.org Audience: Users of "get paid to surf" services; developers of browser add-ons Vendors: AllAdvantage.com (Hayward CA; NASDAQ:AADV) [AllAdvantage has postponed its IPO, but it still has a symbol] Products affected: AllAdvantage Viewbar Web site: http://www.alladvantage.com Path: \Program Files\AllAdvantage.com\Viewbar\Viewbar.exe [We should give the Windows path for programs? Viewbar also runs on Mac OS 8.6+.] Severity: -1 (B+) [We should use negative numbers to indicate problems. Or perhaps use letter grades A through F? AllAdvantage would get a B or B+. In addition to a composite number or grade, we should give the reasoning behind our grade.] -1 : AllAdvantage Privacy Policy doesn't adequately disclose close ties with DoubleClick -1 : AllAdvantage data may not be adequately segregated at DoubleClick -1 : AllAdvantage doesn't always honor DoubleClick opt-out +1 : AllAdvantage pays users for their clickstream data +1 : AllAdvantage strives to remove personally identifying information from clickstream data [We will need to have cross-linked glossary of terms such as "clickstream data" and "personally identifying information"?]