Facebook’s Atlas ad server allows advertisers to target Facebook users not just on Facebook.com, but across the web and app ecosystem.
Once a user has logged into Facebook on a device, Atlas can find the user and serve ads just for that person. When he or she acts on the ad, Atlas ties that back to the specific ads the person saw.
While this development benefits advertisers, Facebook seems to be in a constant battle with privacy advocates both in the US and Europe.
Atlas’ introduction hasn’t yet drawn the attention of regulators in the US or EU, but it remains to be seen if that will remain the case over the long term.
How Atlas Could Affect Consumer Privacy
Atlas applies a user’s Facebook identity beyond Facebook’s walls. While Facebook’s cross-channel identification process starts with a known user and anonymizes that person, their stated interests on Facebook.com could follow them across the desktop and mobile web.
By contrast, cookies – notoriously unreliable in mobile environments – start with an anonymous user, and then build a profile around them. And while cookies can be cleared, Facebook IDs cannot.
Consequently, Atlas “breaks a previously unbroken barrier by a provider with such vast troves of data and widespread single sign-on reach,” said Jay Friedman, COO of Goodway Group, a marketing services and ad network company.
While advertisers could acquire information similar to what Facebook provides from third-party data providers, Facebook is a consumer-facing service, and it’s broaching territory its peers have so far avoided.
“Google, Apple, Amazon, Facebook and, to a lesser degree, others like eBay and Yahoo all have valuable data from which to build a product just like this. It’s just that to date, [they] haven’t done it,” Friedman said.
Atlas targets on age, gender and demographics. This isn’t the deep targeting available on Facebook.com, but eventually, more Facebook.com targeting segments, which can include attributes like political affiliations, credit card use and relationship status, will be targeted through Atlas, a Facebook spokesperson confirmed.
Atlas also has fully functional attribution capabilities. An advertiser can tell that a woman who saw a shoe ad served through Atlas purchased a pair if she, for instance, gave the merchant her email address.
Another feature Atlas could be used for, but isn’t yet, is tracking and profiling a user based on actions across the web. While users’ visits on pages with Atlas ad tags will not be added to the Facebook ID, it’s technologically feasible.
Facebook has a tendency to roll out features that could scare consumers slowly. Its “like” button, which sends user information back to Facebook’s servers, was not used for advertising until this June, four years after it launched.
If the past is prologue, Facebook will be cautious in releasing additional Atlas targeting features.
Opting Out Of Atlas
While Facebook users can tool with how they’re targeted or what ads they see, they can’t opt out of Facebook’s data capture mechanisms entirely. That includes tracking done for advertising purposes as well as any other information Facebook may be collecting for its own purposes, as allowed by its privacy policy.
Facebook set the stage for the Atlas’ privacy options in June, when it introduced Ad Preferences for Facebook.com, which shows users the interests and segments associated with their profile, as well as app usage.
As Atlas introduces more segmentation features, users will be able to view and change the types of ads they see via the Ad Preferences portal, which will be reflected both on Facebook.com and on sites that serve Atlas ads.
Facebook’s opt-out capabilities are consistent with those offered by others in digital advertising space. The Digital Advertising Alliance, for instance, has best practices that allow for opt-outs from “interest-based advertising” but not tracking.
And Facebook reveals some elements around why an ad is placed and who placed it. On Facebook.com, a user can mouse over an ad in order to find out who placed the ad and, occasionally, why. This is a greater level of detail than what many other platforms offer, and a Facebook spokesperson said that same level of transparency will be available through Atlas-served ads.
This level of opt-out isn’t enough for some.
“There should be some transparency and a level of control for consumers. They should be able to modify how their data is being used to stop its use,” said Gary Kibel, a digital media and privacy attorney for Davis & Gilbert.
How much agency users have in determining how their data is used on sites and platforms beyond Facebook.com is often a function of how much transparency they have in the first place.
“Will we get to see what Facebook thinks about us across platforms? Will we have a sense of the outcomes it has on the things we see, the deals we get, the way our news feeds are filtered?” said Sara M. Watson, a technology critic and fellow at Harvard University’s Berkman Center for Internet & Society.
A US Atlas
Ensuring transparency is a big issue for Facebook and other online advertisers. In 2011, Facebook had to settle an eight-count complaint from the FTC due to lack of transparency and lapses in privacy. As the result that settlement, Facebook is required to consult with the FTC for the next two decades on matters relating to privacy and undergo regular privacy audits.
“The larger point the FTC was making in the 2011 settlement (and elsewhere) is that companies should not make material changes to their privacy practices without obtaining prior consent,” said Alan Chapell, a lawyer for Chapell & Associates, which helps companies formulate their privacy and data collection practices.
Facebook did not make any changes to its privacy policy as the result of the Atlas release.
But Atlas has a separate privacy policy, one that was updated in February, a few months after Facebook acquired it from Microsoft. The Facebook spokesperson said Atlas has a separate privacy policy because it operates as a standalone company.
Facebook consulted with the FTC on the Atlas project, said a Facebook spokesperson, adding that it also considered privacy throughout the development process, as per the FTC’s guidelines.
“One of the key principles for guidance in the FTC is the idea of privacy by design. You should build privacy controls and concepts into your systems before you launch,” Kibel said.
But even if Atlas’ privacy policy is consistent with what it actually does, and its opt-outs adhere to industry best practices, Atlas could still find itself sailing rough waters.
Privacy is a politically sensitive topic. Sen. Jay Rockefeller (D-WV) has called for more transparency within the so-called data broker community and sponsored legislation last year to address this issue.
Even without legislation, the public tends to voice concern over perceived privacy invasions without doing anything about it. “The honest truth is if you look at behavioral advertising, the opt-out rates are extraordinarily low. Although consumers say they’re concerned about privacy, they don’t often act,” Kibel observed.
But will the public even care about a back-end technology like Atlas?
Watson said they might because the singularity of the Facebook ID might get through to the general public. “This consolidated Atlas view might actually be more comprehensible to consumers because it is focuses on the individual, which better matches our sense of our identities across experiences,” she said.
A European Atlas
Atlas might have a tougher political road in the EU than in the US.
It’s fully live in the EU and has the same capabilities as in the US, and Facebook said it complies with local laws.
But Atlas’ ability to targets ads at an individual level could change the game and subject it to the stricter laws for email and direct mail marketing, said Richard Beaumont, head of service development for UK-based Cookie Collective, which supplies technology for companies to comply with privacy regulations.
“This ad platform is materially different from other forms of online advertising,” Beaumont said. “I think it makes the service much more like email marketing in terms of identifying and tracking user response – and as a result its compliance needs to be looked at from that perspective, more than that of a traditional online advertising model.”
European countries are also more sensitive about the type of all-encompassing user ID Atlas provides.
Google has already gotten its hand slapped by German regulators, who warned Google last week about creating user profiles that span across properties like YouTube, Google Maps and Gmail without user consent or providing an opt-out. Recall that Facebook enables users to opt out of certain advertisements, but it doesn’t enable complete opt-out of its data-capturing capabilities.
Even if Atlas becomes an issue among European legislators, however, don’t expect any action against Facebook soon. Google unified profiles in March 2012 after giving more than a month’s notice. While privacy regulators railed against it immediately, action from the EU didn’t happen until six months later. Any change to Facebook will draw the watchful eye of regulators.
As founder Mark Zuckerberg said in a blog post after the FTC ruling against the company, “Many people are just naturally skeptical of what it means for hundreds of millions of people to share so much personal information online, especially using any one service.”
And with Atlas, the scope of that one service will now be even larger.
