Secrets of online marketing: cookie syncing

This blog takes a peak into the world of cookie syncing, sometimes also referred to as cookie matching. For those of you who think I'm referring to chocolate chip cookies here, I'm not. Cookies are small bits of information that your browser stores on your computer at the request of the sites that you visit. This allows these sites to recognise you when you come back a second time, allowing them to auto log you in for example. But that's not all cookies are used for. Cookies are what make the online marketing world go round. Cookies are the cash cow for internet banners. Without cookies, the "free" internet would probably rapidly become a lot less "free".

Why? Well cookies allow sites to keep track of you and your interests, and to remember what you have or have not done/seen. This allows sites to show you advertisements (banners) that are (hopefully) of more interest to you than a randomly select ad, thereby increasing the chances that you will click on the advertisement and end up actually buying something (and that's what it's all about after all).

You can check which cookies are being placed by which site using your browser setting/options/tools/etc and you can actually block cookies, thereby disabling your behaviour to be tracked and your ads to be more targeted. If you make the effort to see what cookies are being placed by whom you might be surprised/shocked. It's not uncommon for a highly visited commercial site to place over 30+ cookies for one page visit.

Why so many? Well, the site is not the only one placing cookies, there are plenty of online marketing companies hitch hiking along for the ride. These are cookies for "sites" you are not even visiting, and it is happening without you knowing about it (unless you have configured your cookies settings). Underwater this is achieved by what are called pixels, small pieces of html code that you do not visibly see on the site, but which underwater cause web requests to be made to servers of other companies, thereby allowing them to place cookies on your pc.

Why are these other companies hitching along? Well some (ad servers) are keeping track of the advertisements shown and/or clicked (see my earlier blogs on ad impressions and banner clicks). But others, let's call them data collectors, are tracking you to build up a profile of which sites you visit. So for example, if you visit a Toyota forum on a car site, and then visit a travel site to check out flight prices from Amsterdam to Rome, then a data collecting company will store that 1) you are interested in cars, 2) probably own a toyota, 3) are interested in flying, 4) probably want to fly from Amsterdam to London soon (and probably even more info).

How can they do this? Well they have deals with the car site and the travel site, ensuring that these sites will place data collection cookies on your pc, allowing the data collector to recognise you across different sites and link your interests together into a profile of "you". So these data collectors are like spiders that have spun a web across multiple sites in the internet, and any time you visit on of "their" sites you send a tiny trembling down the web. What's in it for the sites? Well they get money for allowing the data collector to collect this information.

But how do the data collectors make money to pay for all this? Well, this kind of information about you is worth it's (virtual) weight in gold. To whom? The companies advertising on the internet of course. For someone who has a car rental company in Rome offering Toyotas, you are now a prime target. After all, if you are indeed flying to Rome and drive a Toyota, chances are that you might want to rent a Toyota in Rome again. Or maybe you hadn't thought about it much, but if you sudddenly saw a banner pop up on a site offering you a great rental rate on a Toyota in Rome, it might not seem such a bad idea. Bingo!

Ok, so what's this cookie syncing? Well, there are some technical hurdles to be leapt when it comes to "sharing" or selling the profile data stored in the cookies on your pc. Cookies are set up that only the "owner" of the cookie can actually read the information stored in them. This (believe it or not) was thought up to protect your privacy. This means, for example that a data collector can place a cookie on your pc, but that the advertiser cannot read it.

So how does an advertiser know what your profile is if he cannot read the data collector cookie containing it? The answer is he can't. But what he can do is cookie sync. The concept is quite simple, here's how it works.

The goal of cookie syncing is that a common "id" describing you is shared between the data collector and the advertiser. This allows both parties to talk about you using this common id and thus for the data collector to sell your profile information to the advertiser.

One way this common id is achieved is for example as follows. The advertiser has a pixel on a site which you visit. The pixel places an underwater request to the server of the advertiser (ad server) allowing him to place a cookie with id1 on your pc. The ad server now redirects this request (302) to the data collector server (data server), passing along id1 as a value in the url. The data server now places a cookie on your pc with it's own id2, and also stores the mapping (id1, id2).

Voila! At this point, the data collector now knows both ids and id1 can be used as the shared id to communicate with the advertiser about your interests. The data collector can sell all the profile information it has for you (id2) to the adverstiser as belonging to id1.

Another alternative is the other way round, that the ad server learns both ids instead of the data server. But a symetrical option is also possible, in which both servers learn the mapping of the ids involved. In this case, after the first redirect with the first id, a second redirect follows with the second id being passed along. Anyway, which ever variant is used, the end game is that there is one id known by all that can be used to exchange the profile information and target you with more relevant ads.

A bit confused? In a subsequent blog entry, I will try to work out a real life example of the above to illustrate.