27 August 2003
The Wall Street Journal, August 27, 2003
By JAMES R. HAGERTY and DENNIS K. BERMAN
Staff Reporters of THE WALL STREET JOURNAL
PLAINFIELD, N.J. -- Meg Kolaya, a librarian who lives in this prosperous suburb, recently found herself in the midst of the latest war over online privacy.
Each time she switched on her home computer, a software program silently flickered into action, keeping track of the Web sites she clicked on and the ones she used to make a purchase. Later, when she went to certain other Web sites, the program would go to work and show "pop up" ads. But these weren't typical pop-up ads, which are generated by the visited Web site itself, and which are the same for every user. Instead, these ads were tailored to Ms. Kolaya's particular interests, based on a database of her Web-surfing history that the program had been keeping.
Ms. Kolaya was appalled when a technician detected the snooping software on her PC. Figuring that one of her children had inadvertently downloaded the program while wandering the Web, Ms. Kolaya told the technician to erase that "nasty thing" from her hard drive.
Marketers are perfecting novel ways to implant their own software into other people's computers, then peppering them with carefully targeted advertising. This software, dubbed "spyware," often installs itself on people's computers when they download free programs -- such as those that provide weather information or facilitate the swapping of recorded music. But consumers are gradually catching on, and many of them are angry.
Spyware isn't just an issue for consumers. Big companies are lining up on both sides of this technology. Many advertisers love the idea of being able to target consumers more precisely by watching where they go on the Web, but some major companies are shying away from spyware, at least for now, because they see it as too controversial.
That controversy has been stoked by owners of Web sites who claim that spyware threatens the whole multibillion-dollar business model of selling online advertising by diverting their customers' eyeballs from the banner ads already there -- much like a rival TV news channel suddenly scrawling its own messages across the bottom of CNN.
Companies that rely on Web sites to reach many of their customers, including Hertz Corp. and Dow Jones & Co., publisher of The Wall Street Journal, have filed suits against spyware makers, arguing that they are violating copyright and trademark laws by popping up ads when people visit the plaintiffs' sites.
Cookie on Steroids
Spyware represents a twist on "cookies," a simple form of tracking technology that first stirred fears over Internet privacy several years ago. Cookies, snippets of text that are automatically downloaded when a computer visits certain Web sites for the first time, can let marketers know some of the sites a consumer regularly visits. Spyware, by contrast, is like a cookie on steroids: It can track each click you make as you negotiate the Net.
The software that was tracking Ms. Kolaya's Web browsing came from Gator Corp., based in Redwood City, Calif. Formed five years ago, closely held Gator is one of the most ambitious and sophisticated companies using new technology to target pop-ups and other online ads. Gator's software is running on about 35 million computers world-wide, more than half of them in the U.S., according to the company.
Portraying itself as a model citizen in a segment of the advertising world sometimes associated with porn and gambling, Gator has attracted hundreds of big advertisers, including such well-known companies as Verizon Communications Inc., American Express Co. and Allstate Corp. Gator bills its advertisers in various ways, sometimes on the basis of how many purchases result from an ad. Gator executives say the company, with about 150 employees, is profitable, though they won't provide specifics.
Far from being a spy, says marketing chief Scott Eagle, Gator is helping consumers find bargains. He vehemently rejects the "spyware" label and says Gator doesn't put its software on personal computers without permission and that it protects privacy by not keeping records of consumers' identities. He says Gator's formula is the future of Internet advertising. "Spraying ads across everybody" on the Web, without Gator-style targeting, is "a crazy, inefficient model," says Mr. Eagle.
Other companies are pursuing more limited forms of targeting. For example, The Wall Street Journal Online recently began sending ads to subscribers based on the parts of the WSJ.com site they frequent.
Gator's chief executive officer, Jeff McFadden, 49, says he was frustrated with the limitations of online ads when he worked at the portal company Excite Inc. in the mid-1990s. To him, the banner ads of that period were dull and puny compared with the lavish pitches in magazines and on TV.
When he helped found Gator in 1998, the plan was to exploit the Internet's ability to do things that TV and print media couldn't match: monitoring, click by click, how and why people bought things on the Web. He figured that makers of minivans, for instance, would pay a premium to put their twinkling ads on screens just as Web shoppers were clicking for information on such vehicles at automotive sites.
Gator's first few years of operation coincided with a noisy public debate about privacy and cookies. Often, cookies are used merely to signal that a regular user is returning to a site and to remember such things as passwords. But companies selling ad space on numerous sites could also do more with the cookies: Collect information on visits to all the sites served by the same internet advertising company. That provides clues about a consumer's interests that could be used in deciding which ads to display.
The cookie controversy reached a fever pitch in 1999 when DoubleClick Inc., a big seller of Internet ads, proposed to link people's names, addresses and other personal information with data about where they surf on the Web to make a profile that could be used in marketing. Under pressure from state and federal regulators, DoubleClick dropped that plan and took other steps to protect privacy.
Undeterred, Gator aimed to gather far more Web-surfing data than DoubleClick could by implanting software that could monitor any commercial site visited, not just those served by a single ad company. At the same time, Gator figured it could bury the privacy issue by promising not to combine the Web-surfing profiles it creates with names, addresses or other information that would personally identify the user of a computer. Instead, Gator says, it assigns a number to each computer that downloads the software.
Mr. Eagle, Gator's marketing chief, says the data his company keeps doesn't create any privacy threat because "I don't know who you are." Even so, Gator does collect a huge amount of information, including many of the sites visited, how much time is spent at them, whether anything is purchased and in some cases the first name, country and five-digit ZIP Code of the user.
Gator entices people to download its tracking software by slipping it inside other programs, which are offered free via Web ads.
It developed a program called eWallet, designed to remember passwords and automatically fill in online shopping forms. Gator also bundles its advertising service with Weatherscope, which provides local weather data, and with music-swapping software, among other things.
When people click to accept those programs, the Gator ad software downloads to their hard drives. Then, when the consumer goes back online, the software sends Gator information via the Internet on which Web sites are being visited.
While users do get a warning about what Gator involves, it isn't always completely clear. For instance, people who call up a Web site to download DivX Pro video-playing software are offered a version for $19.99 or one described as "free (adware)." If they click to download the free version, they get information about how Gator works, including a warning that it delivers ads "based on Web sites you view." If at that point a person clicks "cancel," up pops an ambiguous warning that doing so means "the DivX 5.0.5 Pro Bundle will not be properly installed. Are you sure you want to quit setup?"
In one recent ad campaign for an auto maker, which it won't identify, Gator searched its data base and found 1.3 million computers whose users had recently been clicking through automotive sites to look at certain types of vehicles, Mr. Eagle says. Gator then sent ads to those computers, varying the message based partly on whether users' behavior suggested they were close to making a purchase and whether they were looking at competitors' cars.
Unlike many other online advertising companies, Gator puts labels on its pop-up ads allowing people to click for more information about why the ads are showing up and how to get rid of them.
Yet critics say some of Gator's efforts to get people to download its software have been deceptive. Recent visitors to a Web site featuring lyrics from the rock band U2, for example, were greeted by an official-looking blue box headed "Security Warning," suggesting that they needed to do something to protect their computers. Under that heading, in fine print, was a pitch for free calendar and time-keeping software that comes bundled with Gator's ad-spawning service. People impatient to get to the U2 lyrics might click to accept that package without bothering to read more than 15 pages of text on the privacy policy, terms and conditions.
Paul Elbourne, who sells television advertising in Queensland, Australia, says he never agreed to accept Gator software yet found it on his hard drive anyway. "I consider your company a leech on the Internet," he said in a recent e-mail to Gator.
Gator's Mr. Eagle says the company always asks for permission, adding that misunderstandings sometimes occur when people forget that they accepted the program in the course of downloading something else, or don't realize that another member of the household downloaded it. But he acknowledges that three or four years ago, when the company was struggling to build critical mass, it worked with some affiliates whose Web pages sent Gator software into users' computers without sufficient warning. Those affiliates have all been cut off, he says.
Many people boot Gator out of their computers once they see what the software is doing. There's a mini-industry of firms that have cropped up to supply purging programs for irritated consumers, with catchy names such as Spybot Search & Destroy, Ad-aware and Pest Patrol.
Mr. Eagle says more than 100 million copies of the ad software have been downloaded over the past four years, but only about 35 million are currently running on computers. This suggests at least 65 million people have purged the program or didn't download it again after buying new computers. Yet Gator is connected to enough computers to boast a diverse audience that attracts hundreds of advertisers, many of them with familiar names.
Verizon has advertised its broadband Internet connections through Gator for the past year, says John Bonomo, a spokesman for the big phone company. He says the rate of response to Gator ads is better than normal for online campaigns. He discounts privacy concerns of people targeted for Verizon ads, noting that "we don't know who the person is."
Other big advertisers are less sure. Units of both Ford Motor Co. and Toyota Motor Corp. have experimented with Gator ads but both companies say they aren't using them now. Paige Johnson, a Ford spokeswoman, says the company found the ads "kind of intrusive." In addition, she says, the company was uncomfortable with the idea that its ads might show up when people are looking at rivals' sites. "We would appreciate not having everybody do that on our sites," she says. "We sort of have the Golden Rule."
Diana DeJoseph, a Toyota spokeswoman, says her company decided to stop using Gator, partly because it wanted to wait until "they get their legal situation sorted out."
Gator still faces legal challenges from some Web-site operators. Hertz, for instance, was angered when it noticed a few years ago that some people calling up its Web site would be greeted by Gator-generated pop-ups touting rival car-rental companies. Hertz filed a lawsuit accusing Gator of infringing its trademarks and copyrights. The case has been grouped with similar litigation into a consolidated case pending in the U.S. district court for northern Georgia.
Such legal disputes involve two very different visions of how Web surfing should work. The Web-site operators argue that they should be able to control what is displayed when someone calls up their content. Hertz in its lawsuit says the car-rental company's customers prefer an "ad-free, uncluttered Web site."
A dozen media companies, including Washington Post Co. and Dow Jones, also jointly sued Gator last year alleging copyright and trademark violations. The complaint described Gator as a "parasite" and argued that the company was taking a "free ride" by selling ads that would appear when people called up their expensively produced content.
Gator has denied violating any copyrights or trademarks. Gator also argues that its ads are invited guests on computers, providing useful information for shoppers who want to compare prices. Visitors to the Hertz site, for instance, might be interested to know about competing car-rental deals, Gator reasons. What's more, Gator says, the computer user -- not the Web-site operator -- should have the right to decide whether pop-up ads can appear when he or she visits a particular site.
A U.S. district court judge in the eastern district of Virginia issued a preliminary injunction in July 2002 barring Gator from launching pop-up ads atop the media companies' Web sites. Gator later reached a settlement with those companies. Terms of the settlement were not disclosed.
Write to James R. Hagerty at bob.hagerty@wsj.com and Dennis K. Berman at dennis.berman@wsj.com
Updated August 27, 2003