Last week, online social media giant Facebook announced an expansion of its online advertising business to include serving ads on the Internet to users who are not members of Facebook. Under a press posting titled “Bringing People Better Ads,” Facebook decried ads that are “annoying, distracting or misleading” and talked about its efforts to do better. The move turns focus again to the sometimes contentious topic of Internet ads and ad-blocking technology. Internet advertising and the technological and social aspects of ad-blocking have important consequences for user privacy and data security, both for individuals and for enterprises.

In the press information posted on its news site, Facebook talked about some of the issues raised by “bad” advertising. Much of the discussion of ads and ad-blocking has focused on user inconvenience and consumer ethics. On the one hand, Internet advertising slows the retrieval of requested content, utilizes megabytes of expensive bandwidth, drains power-thirsty mobile batteries, and annoys users with unexpected sound and video. On the other hand, some ask whether it is right to block ads but still consume ad-supported content when, as Facebook noted, “apps rely on advertising to pay the bills.”

The ad-blocking debate also has an “us” versus “them” element, as Internet companies dependent on advertising revenue are pitted against those that profit from device sales. Indeed, the expansion of ad-blocking to some mobile platforms last year was seen by some as a competitive step by smartphone providers aimed at search and social network companies.

The technology and business of Internet advertising can be extremely complex. In addition to ad networks, like Facebook’s, selling and viewing an Internet ad can involve ad mediation firms and ad exchanges that introduce another intermediary in order to allow publishers to benefit from multiple ad sources.

In the time between when a user clicks on a website (or asks the device’s virtual assistant to load one), about a half-dozen different Internet information exchanges can occur, sending information and receiving software from ad exchanges or ad networks, advertisers and others. Privacy and security are dependent on all of them. In a typical ad-exchange scenario, when an Internet page is requested, several steps ensue. First, available tracking information is collected, retrieving “cookies” and often engaging in “cookie syncing,” by which different providers can aggregate their information. Next, the availability of an advertising slot (describing the content to be displayed and available demographics or other tracked information about the user), is broadcast to the ad exchange. A software-mediated online auction then takes place with multiple advertisers bidding to place the ad. Once the winner is selected and payment is secured, the ad content is supplied to the user’s device.

The information exchange at each step of that ad process exposes the user’s information and online habits to third parties the user did not seek to transact with, and exposes the device (and any network to which it has access) to the software transmitted as part of the exchange. Insecurely written or ill-intentioned software can often be part of the exchange. Indeed, in recent years there have been several occurrences of virus-infected advertising finding its way into high-profile, mainstream websites through the multistage process of user-tracking and ad exchanges.

While ad-blocking software cannot eliminate the risks, it can narrow the impact of such “malvertising” and may also have a number of other potential consequences, some of them unfortunate:

  • Intrusive Ads. In the near term, additional ad-blocking will decrease the value of online advertising for advertisers and encourage more intrusive techniques to garner user attention. Intrusive ads, though, may also be self-defeating for advertisers by bringing competitors such as Facebook further into the market. Facebook’s sophisticated privacy controls may be a benefit for users.
  • Arms Race. More ad-blocking will certainly lead to an escalating arms race between advertising technology and ad-blocking technology, potentially increasing user inconvenience and costs.
  • Revenue Loss. While ad-blocking may alleviate some privacy and security concerns, more ad-blocking will certainly lead to a disruption of advertising-based business models on the Internet. This is likely to do more harm to independent and specialty content sites than it will to large search engines and social networks that have the ability, as demonstrated by last week’s announcement, to provide their own ad content without reliance on third-party ad networks and exchanges. Further concentration of content simplifies tracking, however, and can expand databases of user information, actually exacerbating privacy issues in the long run.
  • Micropayments. Pressure on advertising models may also encourage the development of systems by which end users automatically make very small payments for access to content. One possible vehicle for this would be Bitcoin or a variation based on Bitcoin’s blockchain technology. (McGuireWoods’ white paper for lawyers on Bitcoin is available at Bitcoin Basics for Corporate Counsel).

Internet advertising and Internet ad-blocking technology continues to be a churning and often complex field with very important consequences for online security and privacy. Continuing developments reflect an ongoing evolution of business models, technology, privacy and security on the Internet.