Behavioural targeting: tailored advertising on the internet

Browsing behaviour can reveal a lot of information about individual internet users. For example, it’s unlikely that people who regularly use search engines to find vegan recipes also want to buy a pack of value sausages. For advertisers, this means that displaying ads to everyone is an ineffective method. A wide margin of scatter loss results in companies unnecessarily wasting money. This means it is of great importance to determine the interests of individual internet users - both for online retailers and for advertising service providers.

Search engines such as Google demonstrate the effectiveness of targeted advertising. Here, keywords act as an indication of the user’s intention. For example, if a user searches for hotels in Barcelona, there is a higher probability that the user will be receptive to relevant advertising. If online retailers are successful in orienting their adverts towards their target group, the ads will not be regarded as a nuisance, and may even be seen as helpful.

There are also other forms of advertising that rely on collecting data from other sources outside of search engines in order to refine their target group and increase the effectiveness of their advertisements. When the user’s behaviour is the main focus, one speaks of behavioural targeting. This strategy is as popular with retailers as it is controversial among advocates of data privacy.

If an online ad is irrelevant to the user, the clicks will also fail to materialise. In order to minimise scatter loss, advertisers are increasingly using targeting (directly appealing to their target group). This presents various options to entice the user. Content targeting is the simplest method of addressing target groups. This is the strategy of adapting advertisements so that they resemble editorial content. This content must fit seamlessly into the environment in which it’s presented. While an advert for a chocolate company would appear out of place on a weight loss website, healthy living and fitness brands could generate great gains here. Semantic targeting goes one step further by attempting to distinguish a website’s various themes to accurately place advertising in the correct section. Socio-demographic targeting is the name given to defining the target audience by factors such as age, sex, occupation, income, or professional status. Meanwhile, when a company defines its target audience based on their physical location, it is known as Geo-targeting. This method requires the implementation of geo-localisation. Another method of selecting a target audience is through technical targeting, which allows companies to analyse the digital fingerprint of the website visitor. All internet users leave a trail when surfing the net. As well as their IP address, users can be identified by their user-agent string – an identifier attached to every browser on the internet containing a great deal of data through which users can be identified. The browser name, the version number, the operating system, as well as the language and font settings are automatically legible. In addition, JavaScript and Flash provide detailed information on any installed plug-ins. Since internet users have very few resources to shield themselves from technical targeting, this is a highly controversial process, criticised widely by experts, consumers, and data protection activists. However, if a user’s digital fingerprint is used, and the user’s behaviour is tracked over several websites, this is known as behavioural targeting. However, this does not necessarily have to be based on the browser signature; the use of cookies is a far more common form of user tracking. These small text files are stored on the user’s device and allow behavioural targeting without the browser string being analysed. Because it can be blocked by the browser settings if necessary, the use of cookies is considered the ‘clean’ kind of user data analysis.

To increase the relevance of an advertisement, advertisers try to collect as much information as possible about potential customers’ online behaviour by keeping track of their interactions with relevant websites. For this to be effective, the main prerequisite is that the user who visited a relevant website must be identified as the same user during later visits or when clicking on similar websites. The advertising industry therefore primarily relies on cookie technology and anonymous user profiles.

Cookies transfer detailed information about interactions and which websites an internet user visits to website operators and advertising service providers. This data can be pooled in a central location to create a user profile. Depending on the level of detail of the data, conclusions can be made about the user’s interests, purchasing intentions, and leisure activities. This is all valuable information that can help advertisers to assign users to concrete groups, and subsequently match them to a tailored advertising channels. Website owners often employ the use of analysis tools like Google Analytics, Piwik, or eTracker to create detailed user profiles. These are integrated into a website’s source text via a tracking code, which enables a comprehensive analysis of the user’s behaviour. However, in certain European countries web analytics cannot be used with their general settings. Website owners operating in Germany, for example, need to ensure that they either record data anonymously or have the user’s authorisation to legally create user profiles. To find out how to adapt the analysis tools’ tracking code, check out our article on web analysis and data protection.

When it comes to advertising techniques, behavioural targeting is rarely limited to just one website. To show users relevant adverts, advertising marketers like Google combine various online platforms to advertising networks. While smaller providers work with selected partners, Google’s display network is open to any website operator. Today, it comprises more than two million websites and reaches over 90% of internet user worldwide.

Advertising marketers such as Google DoubleClick, Facebook, Ad Pepper, TradeDoubler, Ligatus, and many more, function as a mediator between advertisers and publishers; cooperating website owners supply advertising space, which marketers fill with their advertiser’s text and image displays as required.

The distribution of advertising media takes places centrally through ad servers. These are database management systems responsible for managing online advertising space. Ad servers are responsible for the storage and delivery of advertising media, while also allowing advertisers to analyse the success of their campaigns using quantitative factors such as impressions and clicks.

Rather than directly embedding an advertising banner with links to the provider into a website’s HTML code, advertising space is provided with a script. This causes the user's browser to submit an ad request to the ad server. As such, incoming requests are matched with user profiles; the ad server searches for an ad that corresponds with the target audience and sends a response back to the browser. The selection of the advertisement depends on the structure of the website and each visitor’s individual behaviour. When the user clicks on a banner, they are redirected to the ad server, which logs the user interaction and then redirects to the advertiser's website.

Advertising networks cover vast areas of the internet, providing a detailed picture of potential customers’ online behaviour. Data collected on a partner page is managed centrally by ad servers and is available for targeting ad campaigns throughout the ad network. This allows advertisers to create personalised advertising strategies, like retargeting, which targets internet users with ads to the products they have previously shown interest in.

Predictive behavioural targeting is a variation of targeted advertising, which designates certain attributes to anonymous user groups based on statistical forecasts. These can be determined by socio-demographic factors such as age, gender distribution, income, and level of education, as well as psychographic characteristics such as motives, approaches, knowledge and interests. When creating forecast models, advertising is based on information about online behaviour, as well as surveys and data collected by customer administration systems.

As well as descriptive statistics, click-stream analysis and multivariate methods and data mining methods are increasingly being used to search through the continuously growing mountains of data for trends and connections. The goal of predictive behavioural targeting is to acquire statistical user profiles (so-called personas), through which web visitors can be classified.

An advert is only effective if it reaches its target audience. If an ad is irrelevant to the viewer, it’s highly unlikely that it will result in a click, meaning the chances of attaining a conversion go from slim to zero. Among advertisers, this is known as a high scattering loss. Targeted advertising helps to reduce this scatter loss and increase the success of the advertising campaign.  The aim of behavioural targeting is to increase conversion rates – the central figure in evaluating online advertising campaigns.

Engaging with the users’ interests is key to having a successful campaign. If a relevant ad appears in the right place at the right time, the user is far more likely to click on it and, in the best-case scenario, will lead to a conversion. If the user has already visited the site, their data is stored and they can be re-addressed at regular intervals, unless they have explicitly opted out of this process. Cookies allow advertisers to follow customers through the network and recall appropriate products or services.

Advocates of consumer rights are against corporations and advertisers’ methods of collecting customer data, and behavioural targeting is particularly viewed with suspicion by these groups. Critics have expressed concerns that behavioural data could potentially be linked to personal data. These fears are not unfounded; while the industry’s major players continuously emphasise that data is recorded anonymously, it would be difficult, theoretically, for the owner of a small online business to compare the web analysis results with the data from customer databases.

To prevent this, there are clear data protection rules for selected countries. Firstly, personal user profiles may only be created with the user’s explicit authorisation. Therefore, websites should provide an opt-in option and ask for user’s permission to save and process personal data. However, this does not apply to targeting measures, as individual user’s identities are protected far more here. User profiles with pseudonyms are also permitted in the context of advertising or market research and for designing adverts, as long as the user is informed in advance about the data processing and given the right to decline.

If behavioural targeting is used without the user’s consent, there are legal definitions of personally identifiable information. The Executive Office of the President, Office of Management and Budget (OMB) defines this as: Information which can be used to distinguish or trace an individual's identity… or when combined with other personal or identifying information which is linked or linkable to a specific individual The National Institute of Standards and Technology (NIST) has supplied a more concrete definition of this, as well as a list of examples of personally identifiable information:

• Full name
• Home address
• Private email address
• National identification number
• Passport number
• IP address (when linked, but not PII by itself in US)
• Vehicle registration plate number
• Driver's license number
• Face, fingerprints, or handwriting
• Credit card numbers
• Digital identity
• Date of birth
• Birthplace
• Genetic information
• Telephone number
• Login name, screen name, nickname, or handle

These details can be associated with an individual when the data is collected in conjunction with the person's name, or if a connection can be deduced directly from the data. By law, data is ‘identifiable’ if their identity can be ascertained directly or through additional information. Individual details about legal entities (companies or associations), however, are not regarded as personal data, and neither is statistical data that bears no reference to an individual user.

Whether IP addresses belong to the realm of personally identifiable information is still disputed, with the legal status varying in different countries. For advocates of data security, the fact that IP addresses are identifiable (for example, through the internet service provider) is an argument for the anonymisation of IP addresses. This is reinforced by the Advocate General of the European Court of Justice (ECJ). This ruling from the German Federal Supreme Court concludes that IP addresses are to be considered as personally identifiable information in German law.

Cookies can also provide data that indicates the individual users’ identity, as they can be used to link user’s browsing history and IP addresses together. For website operators based in EU countries, the EU Data Protection Directive for electronic communications and the 2009 amendment, known informally as The Cookie Law, ensure that internet users are informed of the installation of cookies and the processing purpose of the data collected. However, each member country has its own method of interpreting the requirements. Therefore, if operating a website from an EU country, it’s recommended to learn more about how the law is implemented in your country.