Random Thoughts – Randocity!

How is marketing related to Facebook and data privacy? These all fall under the same umbrella. Should you be concerned? Yes, you should be. Let’s explore.

Email Marketing

Let’s start with email marketing first, the precursor to social marketing. I’ve worked in the email marketing industry for the last 17 years at an operational level. I’ve worked on general email systems for over 25+ years. So, I fully understand at all levels how email and email marketing works and what is required to make it continue to work in today’s world.

Email marketing became a “thing” in the mid-late 1990s in earnest. Before that, people dabbled in email marketing to the chagrin of many early internet users. It was around this time that the term ‘spam’ was coined to denote unwanted / unsolicited email.

Over the years, email marketing has evolved into a big business with firms now utilizing marketing automation systems. These systems help you marketers manage their email marketing campaign efforts.

In the beginning, as a marketer, you had a list of emails and you sent content to those addresses. The content was the same to each user. There was no thought to personalization, tailored content or privacy of any of this data. Emails were sent using cron jobs via command line tools using Sendmail. This was initially the most basic form of email marketing. This would have been in 90s.

Evolution of Email Marketing

By the 2005, email marketing had evolved from its simplistic roots into more sophisticated systems using dedicated email marketing software from companies like Port 25 and OmniTI. These email server solutions facilitated the trend of building sophisticated marketing automation UI systems on top of these robust, fast, scalable and customizable email delivery systems.

By 2018, these underlying email softwares now include the ability to send push notifications to apps and also offer sophisticated clustering systems to allow for highly scalable, highly available infrastructure offering incredibly fast delivery times.

On top of these infrastructures sit today’s marketing automation solutions. These systems offer such features as list management, drip marketing, recipient nurturing, automagic feedback reporting and detailed reporting of how each campaign is doing.

List Management

Back in the early days, list management was a chore. You had to deal with adding and removing new entries yourself manually. In reality, few marketers ever practiced real list hygiene. Most would add new entries, but never remove people who didn’t want to see that content. It was just too much of a hassle culling through thousands of email addresses. This is why email marketing got such a bad rap. Marketer didn’t take the time to remove users from their lists.

As of today, it is now legally required to remove recipients timely from lists in most countries. If you don’t remove addresses timely, your company (and possibly even you personally) may be held liable for failure to remove an address.

If you use a legitimate email marketing company today (one that upholds legal compliance), they will automatically handle opt-out requests for every email you send. No need to worry about if you’re compliant as email marketing firms automatically add links to handle all of this for you, as long as you use their database.

Recipient Likes and Preferences

Email marketing has a huge drawback (well, two actually). The first and biggest drawback, the inability to understand the user’s likes and wants. There’s just no real way to get that level of detail out of a particular recipient simply because email interactions are so few and far between. You can’t get what you need out of email marketing to effectively target each individual user in a way that makes sense for their likes, product preferences, location and personal information…. at least, not without using more advanced features like drip marketing and advanced real-time feedback. Email marketing is typically just too hands-off for this type of experience. Enter the second problem…

Evolution of Social Marketing

The second drawback is that while email marketing today is still a very valuable form of communication, it is becoming old and dated technologically. Email clients haven’t been updated in a very long time, technologically and interactively speaking. Basically, the features that were commonplace in email by the late 90s are still the standards that we’re rocking today. In other words, email clients don’t support updated technologies like video and audio content right in the email. You have to click to a web page to see this type of interactive content. The best an email can do is an animated GIF, and that’s of little consolation when you’re wanting to offer much, much more interactive content.

In comes social media. Sites like Twitter and Facebook and Snapchat and, to some degree, even YouTube offer better ways to find like-minded folks and advertise to them. Marketers also have a lot of the same tools at their disposal, like list upload to find their existing users on Facebook. Unlike email which is pretty much a one-way system, social media offers two way interaction. People share their family information, their favorite products, their favorite restaurants, their friend information and so on. All of this sharing means more ways for marketers to mine that information about a specific individual. This information is, in fact, a gold mine for advertisers. It means that instead of the mostly one-way interactions and guessing with email, advertisers can now utilize the two way interactions of social media and find out what a user likes very quickly.

Amazon follows this trend with its own systems by targeting users with product ads that third parties purchase. It’s a way to target users with products and services the user is most likely to be interested in.

Of course, these are not perfect systems. There’s still a certain amount of guessing involved. Social marketing are only offering seemingly relevant best guess suggestions based on other people’s social and purchasing habits. However, social guesses at least based on actual data of purchase history and other shared information, rather than a near completely blind guess that email marketing uses.

Facebook and Privacy

In order for these suggestion systems to work, they must have enough information about your buying habits, what you already own, how many people are in your family, their ages, if you have pets, what car you drive and so on. The more companies know about your personal habits, the more they can target products that make sense to you. It’s a catch-22 though. The more they know, the more dangerous it is for you. Sharing your personal information means someone could learn about you and your habits and then steal your identity.

Enter Facebook. Facebook collects all of this data and more about you. They then mine this data on behalf of their advertisers. Advertisers submit their product(s) to Facebook for advertisement on its platform. The system then finds folks, based on their shared content and interests and displays an ad for a product you might be interested in. If you talked about cancer in a wall post, an ad might pop up for oncology services.

This heavily personalized advertisement system is a far cry from the old cold guess email marketing. However, social marketing was born from the idea of email. Email has now been trying to catch up and compete with this more interactive and interest-based advertising system. Unfortunately, email is firmly entrenched in the past. It’s great for individual communication. For predictive communication, email sorely lacks. Worse, it’s not likely to ever catch up in this area. Though, it’s still a good medium when combined with social marketing. Meaning, if you can mine people’s interests out of social platforms, you can then target them with products and services via email.

Data Privacy

Here’s where Facebook has failed time and time again. When someone uses a social platform to share information, it is expected that that information will remain private and only be shared with those folks whom have been allowed to see it. Or, more specifically, shared with people licensed to see it based on the agreed terms and conditions.

However, Facebook only offers a very basic permissions system. Extensive permissions systems have been available on operating systems for years. Yet, Facebook’s platform didn’t start out that way and still isn’t anywhere close. Facebook started with no privacy at all. Your data was published for everyone to see. As time progressed and people complained, Facebook added more and more user controllable permissions.

For each step that Facebook took, it consisted of tiny baby steps. They’d add incremental protection of that data, just enough to satisfy a single complaint. But, they’d leave plenty of other data exposed. As they would take more baby steps, they would implement one more control, then another, then another and on and on to where we are today. Instead of designing a system that offered robust privacy from the beginning, Facebook opted to build it piece by piece as they went along… sometimes backtracking in certain areas,

While Facebook’s user privacy controls were fairly robust by 2014 (user to user), Facebook still didn’t have much in the way of privacy when using its application programming interface (API). Developers could sign up and extract data via this API with far fewer boundaries. It wouldn’t be until later when Facebook, yet again, took another baby step that they would limit what developers could extract. By then, it was too late for Facebook to do anything about Cambridge Analytica, a company whose data brokerage business model is all about selling collected data.

Abuse

Email marketing has long recognized abuse to be a big factor in the industry. Handling abuse is what distinguishes good actors from bad. Sites such as Spamhaus exist to watchdog and prevent such email abuse and enforce industry best practices. While email marketers have had to grow much more knowledgeable about email marketing best practices, Facebook is entirely new territory for marketers with no such outside policing as Spamhaus. Even new email tools such as DMARC, DKIM and SPF have grown to help protect and legitimize the email marketing industry. Nothing like these exist for social marketing.

While Spamhaus helps to protect and prevent unwanted spam from random third parties, there is no such watchdog to protect your data from unwanted prying eyes within companies like Facebook or Twitter. With email abuse, there are also organizations like MAAWG to also help manage that email abuse. Again, there’s nothing offered on Facebook, except whatever Facebook decides is necessary. You’re at the mercy of Facebook to give you those tools, and currently their solutions are limited and swayed entirely to Facebook’s best monetary interests.

On the one hand, most people are very protective of giving out their email address to random people. Yet, on the other these same folks are completely willing to log into Facebook, Instagram, Snapchat, Whatsapp and Twitter and give up their every day lives, their pet’s name, their employer, their spouse’s name, their location and sometimes even their phone number, email address or other personally identifying information (PII). Worse, Facebook now requires the use of what appears to be a valid First and Last name, though you can put any data you want into those fields and there’s no way for Facebook to verify this. Other social platforms don’t require this. This Facebook requirement ensures the lack of privacy and that users can be targeted by outside third parties. It also ensures that data can be e-pended by outside parties.

Abuse of email has real tangible penalties behind it. Abuse of social networks only has a single company behind it, like Twitter or Facebook. There are no industry standard watchdog groups out there helping guide marketing organizations towards best practices. In fact, such a watchdog group couldn’t really exist because, unlike email, there are no sanctions that could work to stop bad actors short of asking their ISPs to stop routing traffic for those companies. Such a move would likely be met with a huge legal backlash from the company. After all, the ISP did sign contracts to supply service to Facebook. If they cut off peering to them, Facebook would have them for legal lunch. Nope, there’s no sanction against a company like Facebook that could work. Not even a lawsuit could be all that effective.

Instead, these unstoppable organizations are in it to make money off of your data. For this reason, this is why companies like Cambridge Analytica can come to exist on Facebook and steal 87 million (or more) users’ data. This is why there’s nothing Congress can do to Facebook. No laws means nothing to enforce. The only thing Congress (or each state) can do is enact laws to protect each person’s data and force Facebook to become legally compliant with those laws. Of course, Facebook might face other laws they could have run afoul, but because the US has no real data privacy laws, there’s nothing here to enforce… even with companies like Cambridge Analytica.

Protecting Your Privacy

Only you can protect your privacy and your data. You can’t leave it to companies to do this for you… particularly if you live in the United States. If you want to share everything you do with the world, then you can’t easily protect your privacy. Note that even if you never put a single piece of personally identifying information online, you still may have shared enough other minimally identifying information that when put together, someone can eventually identify you.

For example, if you visit Starbucks every day to take a photo of your coffee cup each morning, someone could find that particular Starbucks and stalk your movement there. They could hear you give the cashier your name or other personal information. They might listen for your name to be called. They might bump into you intentionally to make you drop your stuff. They might watch you get into your car and take down your plate number. They might even follow you home. This is why sharing your everything you do online can be dangerous.

Even if you never give your real first name, last name, address, phone number or other information, you (or your friends) may have shared enough photos, locations and friend information to eventually identify you. This information isn’t considered personally identifying information alone, but when pieced together, it is. With enough data pieced together, someone might find out who you are, where you live, your address and possibly even your phone number… maybe even other data such as SS#, CC# or anything else were they to obtain some of your mail.

This is, of course, all made worse by companies like Facebook that don’t take data privacy seriously and only produce half-baked “security theater” mechanisms designed to look like they protect you, but that in reality they don’t. You’re continually putting your data into the hands of folks like Mark Zuckerberg who has, time and time again, shown that his platform cannot be trusted to store personal data.

Security Theater

While email marketing now has a robust set of industry checks and balances, technological measures, industry watchdogs, laws and best practices… social marketing offers very limited controls. The reason for this 1) it’s so young, 2) it doesn’t interact with third parties like email and 3) Systems like Facebook won’t offer such controls. Email must interact with many unrelated parties along the way to get your email to an inbox. Social marketing has a captive audience inside a single platform operated by a single company, whether inside of Twitter’s network or Facebook’s network or whomever.

This means that while email marketers must comply with laws, technical standards, best practices and other data collection and use controls, sites like Facebook face far fewer data handling laws. This means that your data is effectively open to the highest bidder. Yes, Facebook claims to have taken strides to help protect and safeguard your personal data, but you don’t know if that’s true or not. No one audits Facebook to make sure these claims are, in fact, true.

With email marketing, it’s crystal clear when a customer uses an inappropriately collected list. With Facebook, there is no way to know whether your data has been appropriately or inappropriately used because Facebook gets to make the rules. Rules that can change one day to the next.

I’ve worked for enough high tech companies to know that most companies create lot of security and data privacy theater in place of actual mechanisms. Meaning, they state in their policies that they do something, but the technological measures to back up those policies don’t always exist. This facade, otherwise known as “theater”, is what let’s companies get away with policy breaches unaware. It’s usually driven by a case of “Easier said than done”. Implementing technical measures to enforce a policy isn’t always easy, particularly if said data is terabytes in size. Instead, companies perform it on a case-by-case basis. It also might take them weeks to complete the task. The policy is may be written into the legal terms and conditions. However, when a customer actually wants to know if that policy is enforced, the company will then manually enforces that policy on that person’s data, assuming they even give you an honest response to your question.

You’d be surprised to find that this situation happens a lot more often than you might be aware. Even many legal teams are unaware of this situation in their own companies. They think that what’s in the policy is always carried out every time. In fact, that’s not true much of the time. This is simply because legal teams rarely carry out internal audits to ensure that written, published policies are being followed internally. Even then, some legal teams are both aware and complicit in allowing the technical teams to not follow the policies to the letter.

I would also be remiss by not mentioning that some legal teams write data policies without informing the necessary internal teams of the policy changes or additions. Without buy-in and support from the appropriate technical teams, the written word can’t always be translated into functional technical procedures. This means that the legal team is out of step with what is technically feasible. Legal teams should always propose and write policy in conjunction with the teams that must support those policies. As a lawyer on an in-house legal team, you can’t just write policy because it sounds good and then assume it can be implemented easily. That doesn’t always work. Hence, security theater.

Data Deletion and Right to be Forgotten Laws

Here’s the outcome of security and data privacy theater. If you request a company to delete your data, you won’t know if your data has been irrevocably deleted. Many companies hang onto long term backups for exceedingly long periods of time. This means that while your personal data may no longer exist on a live hard drive and may not longer be visible via a web interface, it could still exist on a long term data backup solution the company uses. It might even exist via an API system. Note that some data backup solutions exist on live disks, such as using the Cassandra or Elastic database system or even such reporting systems like Splunk or Elastic’s ELK. Some of these internal systems may never or rarely get purged. Even basic text log files, which may contain some or all of your personal data, may be retained for years due to Sarbanes Oxley and other data retention requirements.

Early in the life of email marketing, you might not expect to be unsubscribed. Today, laws require email marketers to remove your email address from their list within 10 days. The word remove is subjective. The actual term is unsubscribe. Even after unsubscribing, the company can continue to hold onto your email address in their database so long as they never email you. In fact, an opt-out request is simply to unsubscribe you from their mailings. It doesn’t ensure your email address will be deleted from their list. This is how your email address can accidentally be mailed again in the future despite a previous opt-out request.

Data deletion has no laws in effect in the US. US companies are not obligated to delete your data even if you so request it. They can leave it on systems within their organization. This, unfortunately, leaves your information vulnerable to data breaches by unauthorized persons. This is why you can request a company to delete your data and later find out your data was involved in a data breach years later. Or, you may find identity theft from a data breach where you had asked a company to delete your data. There are no laws that require companies to delete data when requested… at least, not in the United States. In the UK and EU, the right to be forgotten laws have been written and will apply to UK and EU citizens under the GDPR. Whether those laws continue to exist after Brexit in the UK, I’m unsure. Canada appears to be working towards (or has enacted) a similar data purge law for its citizens.

However, no such ‘right to erasure / right to be forgotten’ law has been enacted in the US. Companies in the US are still free to store and keep your personal data for as long as they see fit. Yes, even after your deletion request. This means that your data is still at risk of a data breach, even after you’ve requested Facebook, Snapchat, Whatsapp, Instagram, YouTube, Google or Twitter to delete your data. US companies are just not obligated to irretrievably delete your data. Even in the EU, the laws may not fully protect you from irrevocable deletion of your data. Meaning, it may be enough for a company to actively delete visibility of your data on their web site, but that doesn’t ensure irrevocable erasure from all media in that company’s possession. Worse, as long as that data never surfaces in the future, that company can hold onto it… even if they are considered ‘breaking laws’. The only way to make sure irrevocable deletion occurs is by adding incredibly stiff penalties when the laws are willfully broken.

Social Networks and Marketing

Facebook, Twitter, Instagram, Whatsapp and more bank on their ability to collect your data, store it and use it freely. As long as you digitally agree to their terms and conditions regarding their data collection and use, then you have little recourse against them when a situation like Cambridge Analytica occurs.

In email marketing, selling of lists has been taboo for years and has always been considered an email marketing dubious practice. In fact, list purchasing is considered one of the worst email marketing practices. In Social Marketing, no such rules have been laid down. Facebook has been hitting these walls one-by-one since at least 2008. Each time, they put up yet another road block to stop that particular practice (aka, baby steps). Facebook doesn’t want to stop these practices, they’re just forced to by public outcry, the media and the government each and every time.

They knee-jerk by enacting new policies each time, but only because of duress. Policies, I might add that email marketers have been adhering to for years. Policies that now have laws like the CAN-SPAM Act and individual state laws. Yet, here we are again, reliving this same abuse pattern over again in another form.

Marketing Today

Marketers have always wanted to do the least work possible and gain the most money from their efforts. That’s the whole reason email marketing exists. That’s the reason advertising exists. They want to create the most effective campaign and Facebook allows them to do this with their personalized marketing.

Cambridge Analytica took that one step further. They mined Facebook’s data and stored it in their own offsite database. A database that Facebook claims they thought had been deleted. They then combined that data with other data to create an even more comprehensive profile of each person. Yes, even more comprehensive than Facebook alone. If they had first and last name along with at least one piece of identifying information, they could have gone to LexisNexis and gotten even more identifying information. Who knows, they might have?

Marketers today are looking for the easiest way to target ads to the people they need. Hence, the reason Cambridge Analytica can even exist as an organization. There are many, many data brokerage services available to buy list and user data. Data that can be populated into databases and targeted with ads. Most of these outside brokerage services sell with the intent of using email marketing, but there may be more today that are using Facebook to present their ads. Cambridge Analytica is but one in many data brokerage services that exist on the Internet. You can bet many others also exist and may have taken advantage of Facebook’s situation, just the same as Cambridge Analytica.

That Facebook claimed to believed that a data brokerage service, whose sole business is in selling data, would ever delete data they had legitimately collected from Facebook is entirely naïve and disingenuous. Facebook had to have known the business Cambridge Analytica was in at the time they were extracting data from the platform. One only needs to visit Cambridge Analytica’s web site for a few minutes to understand their line of work. Even then, if you weren’t certain, you could certainly pick up the phone, call them and ask what it is they do. Companies are always eager to talk about their line of business, particularly if they think they’re about to make a sale.

Ad targeting is not going away and is only likely to grow as artificial intelligence systems grow. The data privacy issue will continue to be ever more important as time goes on. To protect yourself, you must ask yourself, what should I share and what should I not? For example, publishing a single cute puppy or kitty photo or video is probably fine. However, many cameras today also add EXIF data to store location data and possibly other information about where and when photo or video was created. Data that might be used to link you to that photo. However, taking a photo every day of your cup of coffee might reveal things about the location that you visit (names, people, location identifiers, etc). These are things when you need to be cautious before posting. Even if the photo appears innocuous, you might want to think twice because someone else might see something that you don’t see.

Social platforms, while fun, are big business for their owners. Don’t be fooled into thinking it’s all fun and games. Those games and fun have a price to pay. That price is what they get to do with your user data. As has been said, if the service is free, you are the product… or more specifically, your data.