IP addresses + zip codes = ?
ClearSight Interactive, a new behavioral targeting company, has spent the past 18 months collecting more than 100 million IP addresses. CEO Tom Alison says, in a comment to the article, "Our goal is to become the bridge between online and offline data."Whoa, baby.Alison claims in his comment that Wendy Davis, the writer of the article, didn't accurately describe what ClearSight Interactive is doing. So let's look at the claims he puts out in his comment.
We have a file of IP addresses with 9-digit zip code appended. Our data providers supply the zip code linked to IP without any personally identifiable information. We are able to predict a more likely neighborhood or work location than the zip code or longitude and latitude of the ISPs server readily available from many software or online providers...
In other words, they know where you live. Their press release says more: "ClearSight Interactive bridges IP addresses to verified postal addresses and email addresses."Alison claims they do not collect data on online behavior:
We offer geo-demographic marketplace data, not behavioral data. We collect no online behavior. Unlike those companies and websites that utilize individual household data and set cookies, we append census and de-identified marketing data at the neighborhood level. We all know that people in the same household or neighborhood are not the same. But for many useful marketing attributes, bird of a feather do flock or even live together.
I guess that's supposed to make me feel better, that the company knows where I live but it only guesses what I might be looking for in a car. Actually, the company isn't guessing. It promises in its press release, "After a consumer views or clicks an ad, the company can then monitor the users future behavior using contact information databases to determine if they later made a purchase - e.g. did someone who viewed a car ad actually visit the dealership and purchase a vehicle?"Almost more shocking is Alison's attitude about the privacy implications. He repeats over and over that they do not have "PII" or "personally identifying information." If nothing else, we've learned from the AOL debacle and numerous other supposedly anonymized databases, that PII like name and address are not necessary to successfully reidentify large numbers of people in a dataset.So how did ClearSight Interactive even get this information? It bought it from publishers, who normally ask their customers if they are okay with their information being shared with third-party marketers. As the article points out, most people who click "yes" assume that means they'll get emails from third-party marketers. They don't assume that the publishers will sell IP logs to a third-party targeting company. ClearSight Interactive promises that if you choose to opt-out later, the company will update its records and remove you from its databases. To which, all I can say is, if you're so sure that people have actively chosen to allow you to have this information, why not build your business around asking them to opt-in?On some level, Alison is clearly aware privacy could impact his company. He writes, "At ClearSight we take privacy matters very seriously," and the article quotes him as saying they are waiting to see if Congress passes privacy legislation. But if it's true that "[a]ll our IP and zip data fall within the appropriate privacy provisions of our partners" and everything they've done is legal, well, that's some of the strongest evidence I've heard in support of better privacy legislation.