IP addresses + zip codes = ?

March 1st, 2010 by Grace Meng

ClearSight Interactive, a new behavioral targeting company, has spent the past 18 months collecting more than 100 million IP addresses.  CEO Tom Alison says, in a comment to the article, “Our goal is to become the bridge between online and offline data.”

Whoa, baby.

Alison claims in his comment that Wendy Davis, the writer of the article, didn’t accurately describe what ClearSight Interactive is doing.  So let’s look at the claims he puts out in his comment.

We have a file of IP addresses with 9-digit zip code appended. Our data providers supply the zip code linked to IP without any personally identifiable information. We are able to predict a more likely neighborhood or work location than the zip code or longitude and latitude of the ISPs server readily available from many software or online providers…

In other words, they know where you live. Their press release says more: “ClearSight Interactive bridges IP addresses to verified postal addresses and email addresses.”

Alison claims they do not collect data on online behavior:

We offer geo-demographic marketplace data, not behavioral data. We collect no online behavior. Unlike those companies and websites that utilize individual household data and set cookies, we append census and de-identified marketing data at the neighborhood level.  We all know that people in the same household or neighborhood are not the same. But for many useful marketing attributes, bird of a feather do flock or even live together.

I guess that’s supposed to make me feel better, that the company knows where I live but it only guesses what I might be looking for in a car.  Actually, the company isn’t guessing.  It promises in its press release, “After a consumer views or clicks an ad, the company can then monitor the users future behavior using contact information databases to determine if they later made a purchase – e.g. did someone who viewed a car ad actually visit the dealership and purchase a vehicle?”

Almost more shocking is Alison’s attitude about the privacy implications.  He repeats over and over that they do not have “PII” or “personally identifying information.”  If nothing else, we’ve learned from the AOL debacle and numerous other supposedly anonymized databases, that PII like name and address are not necessary to successfully reidentify large numbers of people in a dataset.

So how did ClearSight Interactive even get this information?  It bought it from publishers, who normally ask their customers if they are okay with their information being shared with third-party marketers.  As the article points out, most people who click “yes” assume that means they’ll get emails from third-party marketers.  They don’t assume that the publishers will sell IP logs to a third-party targeting company.  ClearSight Interactive promises that if you choose to opt-out later, the company will update its records and remove you from its databases.  To which, all I can say is, if you’re so sure that people have actively chosen to allow you to have this information, why not build your business around asking them to opt-in?

On some level, Alison is clearly aware privacy could impact his company.  He writes, “At ClearSight we take privacy matters very seriously,” and the article quotes him as saying they are waiting to see if Congress passes privacy legislation.  But if it’s true that “[a]ll our IP and zip data fall within the appropriate privacy provisions of our partners” and everything they’ve done is legal, well, that’s some of the strongest evidence I’ve heard in support of better privacy legislation.

Tags: ,

One Response to “IP addresses + zip codes = ?”

  1. Mimi Yin says:

    What smells funny about ClearSights’ positioning of what they’re doing is that it feels like a lot of unnecessary hoop jumping. Buying up IP addresses and crossing them with location and demographic data isn’t really more private than say explicitly tracking computers with a unique identifier. It simply makes for more inaccurate data.

    So why not simply ask people to opt-in to being tracked with a unique identifier? Then marketers could at least distinguish between different computers in the same household, if not distinguish between different users of the same computer.

    After all, ClearSight is being very careful to only buy IP addresses of people who opted-in (through their ISP) to share their information with marketers. Surely, people would happily opt-in to a more direct appeal to be more accurately tracked. We can simply think of it as a way of paying for all those free web sites we enjoy online. Or maybe we’ll decide that giving up our identity and personal browsing history is too high a price to pay. Either way, we should have the right to choose, which means requiring companies to ask for permission to track us in a forthright manner.

    Or we could try a totally different tact and figure out some meaningful guidelines around truly anonymizing online data (and I don’t mean removing names, email addresses and phone numbers) so that marketers can go nuts targeting users based on demographics and behavior without also risking exposing individual identities.

Get Adobe Flash player