How Microsoft and Yahoo are selling politicians access to you

Microsoft and Yahoo are selling political campaigns the ability to target voters online with tailored ads using names, Zip codes and other registration information that users provide when they sign up for free email and other services.

The Web giants provide users no notification that their information is being used for political targeting.

In one sense, campaigns are doing a more sophisticated version of what they've always done through the post office 2014 sending political fliers to selected households. But the Internet allows for more subtle targeting. It relies not on email but on advertisements that surfers may not realize have been customized for them.

Campaigns use voters records to assemble lists of people they're trying to reach 2014 for instance, "registered Republicans that have made a donation," Yahoo's director of sales Andy Cotten told ProPublica. Microsoft and Yahoo help campaigns find these people online and then send them tailored ads.

These messages don't just pop up in Yahoo Mail or Hotmail. Because Microsoft and Yahoo operate huge networks that provide advertising on some of the most popular web destinations, targeted ads can appear when a voter visits a swath of different sites.

Microsoft and Yahoo said they safeguard the privacy of their users and do not share their users' personal information directly with the campaigns. Both companies also said they do not see the campaigns' political data, because the match of voter names and registration data is done by a third company. They say the matching is done to target groups of similar voters, and not named individuals.

According to Microsoft, President Obama's re-election campaign has recently done this kind of targeting, and both national political parties have done so previously.

The marketing site ClickZ, the Wall Street Journal, Slate and others have previously noted the ability of campaigns to target online ads to specific groups of voters. But what has not been detailed is which companies are now making the targeting possible by providing users' personal information 2014 and which have decided it's off-limits.

Google and Facebook told ProPublica they do not offer this kind of political matching service.

Google's privacy policy classifies political beliefs as "sensitive personal information," which should not be used for online ad targeting. Facebook does allow political campaigns to target political advertisements, but only on the basis of political beliefs reported by the users themselves, rather than information culled from their voting records.

Jules Polonetsky, a former chief privacy Officer at AOL, and now the director of the Future of Privacy Forum, said political targeting has grown more aggressive in recent years.

Polonetsky recalls conversations within the online ad industry about "not wanting to do things like targeting users based on donor history" because "all of that was considered far too sensitive and likely to alarm users and set off privacy concerns."

"Today, those barriers have been leapt over with abandon," he said.

Industry experts argue targeted advertising can help campaigns save money by advertising more efficiently, a factor that could level the playing field for smaller campaigns.

Privacy advocates note that there's no way to track what messages campaigns are showing to different targeted groups 2014 or whether politicians may be pandering to different voters.

"Whenever a campaign or other big organization knows much more about you and your habits than you know about them, any voter is open to manipulation," said Chris Calabrese, the privacy lobbyist for the American Civil Liberties Union.

Neither presidential campaign would comment on how it targets voters.

"We have no interest in telling our opponents our digital strategy," said Obama campaign spokeswoman Katie Hogan. "However, this campaign has always and will continue to be an organization that respects and takes care to protect information that people share with us."

Mitt Romney's campaign, which also uses sophisticated microtargeting tactics, did not respond to requests for comment. Targeted Victory, a firm that specializes in digital political targeting, had done nearly $4 million of work for Romney's presidential campaign as of March. Targeted Victory's advertised services include reaching voters online using voter registration data. The company's co-founder, Zac Moffat, currently serves as the Romney campaign's digital director. Neither Moffat nor Targeted Victory would comment on whether the Romney campaign is using voter records to reach potential supporters online.

Microsoft would answer questions about its targeting services only through a public relations spokesperson, who also asked that her name not be used. Microsoft's chief privacy officer, Brendon Lynch, did not respond to requests for comment.

Yahoo would not comment on specific clients, but said it has worked with Democrats and Republicans.

The Republican National Committee worked with both Yahoo and AOL to match Internet users to voter lists in 2007, according to Becki Donatelli, co-founder of Connell Donatelli, one of the most prominent Republican digital strategy firms. Contacted by ProPublica, AOL would not explain how its targeting service works.

The Republican National Committee also wouldn't provide details about its practices, but a spokeswoman said, "Targeting is one part of a larger playbook we have and will continue to employ. We follow legal guidelines and industry best practices." The Democratic National Committee did not respond to requests for comment.

When you see an online ad, you may assume it's comparable to a billboard 2014 identical to everyone who walks by. But that's not the case for many ads. In the milliseconds it takes for a page to load, advertisers can identify a particular user visiting a site, and choose ads to display based on what they know about that user.

For instance, surfers may be shown a shoe ad if they recently visited a shoe site. Most of this sort of targeting doesn't require your name. Political targeting does. Campaigns may want to reach only reliable party members, or independents who might swing their way.

In order to do this, campaigns assemble lists of names from public records of voters they hope to reach, using such criteria as party registration, turnout history and previous donations. The campaigns often hire companies that harvest vast amounts of consumer data about individual Americans, further refining their voter lists with factors not publicly available such as income, education, magazine subscriptions, and purchasing habits.

Finding voters online is difficult, since no public record connects voters to a particular Internet address.

That's where Microsoft, Yahoo, AOL and other lesser-known companies come in. Their enormous stores of registration data can serve as the bridge between particular Internet users and their voter information.

Online advertising is delivered with the help of cookies, tiny files that companies place on surfers' browsers. Cookies can be used to track people as they move from site to site, helping specialized firms most users have never heard of create detailed records of the sites users visit and the links they click. This tracking is typically done through anonymous ID numbers; the tracking firms and advertisers don't know you by name.

Microsoft and Yahoo's targeting service combines two crucial factors: their knowledge of users' personal information and their ability to add cookies to browsers. Over the years, Internet users have given these companies their name when they signed up for free programs like the Microsoft suite of services known as Windows Live, which includes Hotmail. (Microsoft said it does not sell campaigns access to information users provide when they register for Office or other Microsoft products they've bought.)

Microsoft and Yahoo both said the cookies aren't connected directly to names or other personally identifying information. Instead, they use a complicated process to match coded voter information back to anonymous cookies on particular users' browsers.

But many parts of the process remain unclear since the companies were reluctant to explain the details of their matching and targeting.

Microsoft said that the credit reporting giant Experian performs a "double-blind" match between Microsoft's data and campaigns' data. Yahoo uses another massive data company, Acxiom. Both Experian and Acxiom also offer similar matching for commercial clients who want to find previous customers online.

"They don't need your permission to do this," said William McGeveran, a data privacy expert at the University of Minnesota Law School. As long as a company has not explicitly promised users not to do this kind of matching, the process is legal for both political and commercial entities, McGeveran said.

Microsoft, Yahoo and AOL all point out that users who don't want to be targeted can opt out.

"At AOL, we take privacy very seriously," Caroline Campbell, a company spokeswoman, wrote in an email. "We strongly support self-regulation, consumer transparency and choice, and responsible uses of data."

The Network Advertising Initiative, an industry group, offers a one-page site that allows users to turn off targeted advertising from a long list of prominent companies. Another industry group, the Digital Advertising Alliance, also offers a one-page opt-out site.

But you need to realize you're being tracked before you can decide whether to opt out.

Under the online ad industry's self-regulations, most targeted ads are marked with a tiny blue triangle and a phrase like "Ad Choices." Web surfers can click on this icon, read some general information about targeted ads, and find a link to a page that will allow them to opt out of receiving such ads in the future. Few ever notice or understand the symbol.

Speaking to an industry audience at the CampaignTech conference in Washington, D.C., in April, Cotten, from Yahoo, said less than one percent of Yahoo's users have chosen to opt out of targeted advertising.

"Most users are not even cognizant that they're being targeted," he said.

Nor are the companies' privacy policies much help.

Microsoft's privacy policy makes no mention of matching people's names and Zip codes against voter lists.

The Microsoft online privacy highlights page notes that the company collects users' personal information, and that "We use the information we collect to provide the services you request. Our services may include the display of personalized content and advertising." Like Yahoo and other companies, Microsoft's privacy policy is broken up over severaldifferent Web pages.

In an "advertising privacy supplement" Microsoft explains it may target ads using data from other companies, as well as "demographic or interest data, including any you may have provided when creating a Windows Live ID (e.g. age, ZIP or postal code, gender)." It does not say whether it classifies users' first and last names as "demographic or interest data."

"You are in charge of deciding whether we know anything about you," Microsoft explains elsewhere. "But the more you tell us about yourself, the more we can help you find information or products you want."

Yahoo's more straightforward privacy policy on data matching explains that the company may combine its users' personally identifiable information with information from other companies in order to customize ads. It names CampaignGrid, a political targeting firm, as one company that helps Yahoo! "provide more relevant content and advertising." Yahoo told ProPublica users' registration data is "consensually provided."

AOL's advertising privacy policy explains that it may customize ads "by using the registration data or other household data you have provided or that we have acquired from other companies."

The voter matching process is still far from perfect. Blaise Hazelwood of Grassroots Targeting, a Republican firm, said that the process is expensive, and that it's typically only possible to locate 20 to 40 percent of a given list of voters online in a typical matching process.

"You're not getting everyone," she said, "but the people you get, it's great."

Hazelwood was one of the first to use this tactic. She worked with Resonate, a data and targeting company, to deliver online ads to groups of Louisiana voters during Bobby Jindal's 2007 gubernatorial campaign.

In a 2008 campaign supporting a California proposition to ban gay marriage, Republican firm Connell Donatelli targeted online ads at registered Democrats over the age of 55, Kate Kaye of Clickz News first reported. One of the firm's strategists compared online voter matching to "a stealth bomber."

This spring, the Federal Trade Commission, which maintains the national "Do Not Call" registry, called for Web companies to implement a "Do Not Track" mechanism "that would provide a simple, easy way for consumers to control the tracking of their online activities."

Microsoft, Yahoo and AOL have agreed to implement "Do Not Track," but how exactly websites and advertisers will have to respond to the setting isn't clear.

In a surprise move, Microsoft recently made "Do Not Track" the default setting for the latest version of Internet Explorer browser, a decision that has received fierce pushback from the advertising industry and a key policy group.

Defending its stance, Microsoft's chief privacy officer last week cited a recent Pew study that found that 68 percent of respondents "were 'Not OK' with targeted advertising."

By Lois Beckett, ProPublica