This is page 3 of:

GuestView Column: Private Info For Product Discounts. A Faustian Bargain?

July 15th, 2009

• Opt-in for sensitive data: The new guidelines would provide that merchants would have to obtain express consent of the consumer before they use sensitive data – for example, data about children, health or finances. However, as companies merge – with health insurers acting as banks, etc., the same company collects the sensitive information. A better approach is that the information collected can ONLY be used for the purpose for which it has been collected without the specific consent of the consumer. If I buy a widget online, I expect the merchant to need my name and address for shipping, and my credit card for payment. Once the sale is completed and the item is shipped and accepted, do they REALLY need the information anymore?

What is Missing

The big thing missing from these voluntary guidelines was pointed out by Saul Hansell of the New York Times. There is no mechanism for a consumer to know what information about them has been collected, stored, shared or distributed, and with whom it has been shared. Most people don’t care about this because they are blissfully unaware of the threat to their privacy. For example, when the data broker ChoicePoint suffered a breach several years ago, consumers were not up-in-arms because they had no idea what kind of information ChoicePoint had about them.

If consumers could see what advertisers and behavioral marketers know – or, in the near future, could know – about them, they might be shocked and outraged. Marketers can know, for example, that six years ago I was searching for information about liver failure (for a research paper, but they wouldn’t know that.) They might know that I like electronics, read liberal and conservative political blogs (and how often I read each) and where I’m physically situated when I do this.

They can collect, combine, collate and cross-reference this data, creating a valuable profile of me and my activities – both online and off. They can combine this data with a background investigation, scouring public records to find out my real estate holdings, past residences, educational information, licensing and litigation history and even who my cell phone provider might be. The data can go back as far as they have records and be kept and shared for so long as they feel there is a business need or a law enforcement need.

Consumers have no way to access this information about themselves. This transparency is necessary in order for the consumer to adequately decide whether they truly want to enter into these bargains with merchants and Web providers. The merchants and behavioral advertisers rely on the fact that consumers don’t know what they are giving up.

Reversing the Bargain

What’s worse is that, if consumers are unhappy with their end of the bargains they have no effective recourse. For example, in order to drive traffic to its new search engine, “Bing,” Microsoft announced a program called “Bing Cashback” where consumers who used Bing to search for products or services, and clicked on specific “sponsored links” to Microsoft’s business partners, could buy products at a discount – sometimes a substantial discount.

In fact, as soon as the new Apple iPhone 3GS was announced, I bought two of them, and a third phone, from AT&T through the Bing site, hoping to take advantage of the Bing Cashback discount. However, Microsoft contended I didn’t complete the transaction in a “single Web session,” as required in the Bing contract, because – during the course of my making the order, I was redirected back to Bing to provide additional personal information. So Microsoft gave me no discount or “cashback,” but still got my personal information and had induced me to buy the phone on the AT&T site instead of at Best Buy, where I could have used a bunch of gift certificates I’d accumulated and wouldn’t have had to wait a week for delivery.

Yes, I can return the phones for a refund if I want. But how do I get back from Microsoft my personal information? How do I get it back from AT&T? How do I make sure that it isn’t used in any way? That’s the problem with the information-for-reward “bargain.”

There is an old saying that if something looks too good to be true it probably is. The same is true of these programs that trade privacy for small discounts – the discount may or may not come, but the privacy violation continues indefinitely.


Comments are closed.


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.