But other half of what makes XooXooX CleanWare different is that your shopping preference data is stored and ad selections made client side. When you choose to use CleanWare, you have more control over your privacy. Today I would like to discuss how CleanWare is different from competing ad selection technologies and why it took so long for CleanWare solutions to become available.

Let’s start with the historical context that framed earlier user data privacy choices in the online ad business. I’ll look at two competing paradigms Adware/Spyware and Portalware, that both have been accused of treating your privacy inappropriately.

Adware & Spyware

As an example of the Adware approach we’ll consider the ad selection solutions pioneered by the company alternately known as Gator, Claria, and JellyCloud. The article: “Is the Original Spyware Company Finally Dead?” by Mike Masnick in the October 1st, 2008 edition of TechDirt, discussed how the Adware approach to user data privacy led this company to make two name changes before finally going out of business:

As the whole spyware [industry] (the companies in the space preferred the adware label) got a bad name, Gator first threatened to sue anyone who called its product spyware, and then eventually decided to shed the baggage of the Gator name and renamed itself Claria. — insisting that it was now a legitimate advertising firm. Except, the charges of spyware kept flying in Claria’s direction. The company tried and failed to go public, and then, once again, insisted that it was getting out of the adware business and moving into “behavioral advertising” — which, most people realized was just another term for what it had been doing in the past.

Plenty of folks were shocked when rumors started spreading that Microsoft wanted to buy Claria, though, the public backlash to the “leaked” rumor was so harsh that Microsoft very quickly backed away from those plans. So, without being able to IPO or sell itself — and with a still awful reputation as a spyware provider, the company tried to change once again.

The company insisted (yet again) it was getting out of that old sketchy business, and tried to launch a “portal” that would provide relevant content based on how you surfed. In other words: it was still in the spyware business, just positioning it under a better name. The company did try and fail to sell off its traditional adware business.

Portalware

Portalware is typified by Google, Yahoo and Microsoft, and the implications of their decisions concerning your data is discussed in the recent article by Kevin J. O’brien in the November 17, 2008 New York Times entitled Privacy Laws Trip up Google’s Expansion in Parts of Europe. Here is a brief extract

Data protection advisers to the European Commission in Brussels are questioning Google over how long the company retains user logs — the files containing an individual’s queries typed into Google search fields. A panel of regulators wants Google, as well as Yahoo and Microsoft, to purge the records after six months.

Google says it needs the data for nine months to hone its search engine to reflect the constant changes in contextual meaning caused by news and events. Before October, Google retained the records in the European Union for 18 months. Yahoo keeps records for 13 months and MSN, Microsoft’s search service, for 18 months. European officials are trying to persuade Google and the others to comply, but have not ruled out asking the commission to intervene.

Implications for user privacy

We have just seen reports concerning the two major paradigms for selecting web ads for the last ten years criticized for how they failed to protect user privacy. Can we do better?

Yes, CleanWare protects user privacy better.

So why didn’t Gator, Google, Yahoo and Microsoft design their ad selection technologies to better protect user privacy?

To answer these questions we have to look at the development of the World Wide Web technologies, as well as how web advertising evolved in it.

Competing Ad Selection Paradigms

When the Web was just in its 1.0 incarrnation (late 1990s), strategies for collecting user data and for making the decisions could be separated into two major paradigms shown in the first two rows of the table: Adware/Spyware and Portalware.

Recent Web2.0 technologies have introduced a new possible paradigm: CleanWare.

Let’s compare these paradigms.

Adware/Spyware: Client Side User Data Collection

Before the internet, all personal computers were basically stand alone. Personal computer users worked on their own personal data (e.g. email and documents) stored on their local machine (e.g. in folders and floppies) and worked on them using desktop applications like Microsoft Office. Because there was no data transmission to remote locations, the Graphical User Interfaces (GUIs) of these applications could be relatively responsive.

When the web arrived, most of the user’s data and applications were in the client. And with low speed data connections and only synchronous Web1.0 technologies, server applications couldn’t provide the same level of responsiveness. So Adware/Spyware developers tried to put their data collection engines on the clients where most of the data was. But Clients weren’t beefy enough to do a lot of processing on large amounts of data, so ad selection was best done on Servers, and that is where user’s data was sent. For users one of the real concerns about having an adware application on your computer was that it theoretically had access to everything on your computer and everything you did. It is no wonder that people feared adware as noted in the TechDirt article.

Portalware: Server Side User Data Collection

As responsiveness increased and the world became more interconnected, Portals were able to intercept a lot of data going through the portal, or stored within the portal (e.g. email like Hotmail, Gmail and Yahoo mail). This enabled the second paradigm, which I’ll call Portalware. At least with Portalware, the portals could only get access to some of your data — namely the data you shared with them when you used their services, and which they could track with cookies. But as people store more and more data on servers, this has become a concern as well, as noted in the NYT article. And when there are occasional accidental data leaks these concerns increase.

Life before Web2.0

To be fair, when adware and portalware debuted, they did not have web2.0 technologies available to us today, hardware was slower, broadband less common, screen sizes more limited, online purchases less common, and the widespread use of ads on content pages hadn’t happened yet. That meant software had to be downloaded, installed, and always running in the background on the client, degrading making the user’s computer slow. The background download and updating processes would further slow dial-up performance making web access seem even slower.

And since there were not many ad spaces available for purchase at the time, ads would be displayed in annoying pop-ups, or in special browsers that grabbed a large part of the already limited screen real estate for use displaying ads. Lastly, since few users had experience purchasing products online, and the ad companies were desperate enough for advertisers that advertisers weren’t limited to companies who could give the best customer service, users were often nervous about making purchases on line.

Brave New Web2.0 World:

The limitations that led to the creation of Adware and Portalware are gone now.

Advent of Client CPU Power

Web2.0 technologies don’t require download and installation, and are resident only when the pages they are embedded in are visible — avoiding CPU draining activity when those pages aren’t active. And typical client equipment is fast enough that it is reasonable to run Web2.0 technologies like Flash even on many mobile devices and handsets.

When client CPU performance was poor compared to today, ad selection work just wasn’t feasible on the average home desktop computer, so lots of user behavioral data was being sent to servers to make ad selections. But once on those servers, whether derived from adware or portalware users had no control over what those companies did with it.

Advent of High Speed Data Communications

Today, sending personal data to servers for ad selection is unnecessary since even mobile handsets have the CPU power to perform ad selection client side. At the same time, sending rich data asynchronously from the server to the client is now possible too. Broadband DSL, Cable, WiFi and3G cellular networks all have more than enough bandwidth suitable for displaying content pages containing rich web ads.

Advent of a robust Web Ad market

The web ad market is also now very robust. There is already so much web ad space embedded on the content web pages that people read daily that there is no need for additional annoying ads and pop up ads, such as those which Gator was infamous for.

Today the existing ad space already on content pages can just be made more interesting and more personally relevant — and that is XooXooX’s approach

Enter CleanWare™ — a new paradigm.

I saw the value of doing some kind of opt-in web ad solution years before I started XooXooX, but it wasn’t till I knew that we could do it without downloads and software installed on the user’s computer that I thought it was worth starting a company (XooXooX). Unless we could avoid installating software, I felt there was too large a risk that such a product would get smeared with the adware label and avoid getting picked and the executable profile would get added to aware databases and the software would be removed by some adware removal tool even if it was benign.

Keeping User Data safe — by never leaving the client

So I am really excited now that through our innovative use of Web2.0 technology we can now avoid the need for such an executable. In fact, not only can we now avoid the need for a client side executable running all the time, but we have constructed XooXooX in keeping with the principles of CleanWare. Because XooXooX stores the user’s private data on the user’s own computer in private Data Object storage, it can’t be lost or intercepted on it’s way to a server — because it never goes there. And it can’t be accidentally (or intentionally) revealed or hacked into by computer criminals while it sits on a server with thousands of other people’s data — because it never goes there.

Now it is time for the world to take stock of this new paradigm and decide how important user cata privacy really is.