Journalism in the Public Interest

How Microsoft and Yahoo Are Selling Politicians Access to You

The personal information you gave Microsoft or Yahoo may be used to target you with online ads.


(File photo illustration by Justin Sullivan/Getty Images)

Microsoft and Yahoo are selling political campaigns the ability to target voters online with tailored ads using names, Zip codes and other registration information that users provide when they sign up for free email and other services.

The Web giants provide users no notification that their information is being used for political targeting.

In one sense, campaigns are doing a more sophisticated version of what they've always done through the post office — sending political fliers to selected households. But the Internet allows for more subtle targeting. It relies not on email but on advertisements that surfers may not realize have been customized for them.

Campaigns use voters records to assemble lists of people they're trying to reach — for instance, "registered Republicans that have made a donation," Yahoo's director of sales Andy Cotten told ProPublica. Microsoft and Yahoo help campaigns find these people online and then send them tailored ads.

These messages don't just pop up in Yahoo Mail or Hotmail. Because Microsoft and Yahoo operate huge networks that provide advertising on some of the most popular web destinations, targeted ads can appear when a voter visits a swath of different sites.

Microsoft and Yahoo said they safeguard the privacy of their users and do not share their users' personal information directly with the campaigns. Both companies also said they do not see the campaigns' political data, because the match of voter names and registration data is done by a third company. They say the matching is done to target groups of similar voters, and not named individuals.

According to Microsoft, President Obama's re-election campaign has recently done this kind of targeting, and both national political parties have done so previously.

The marketing site ClickZ, the Wall Street Journal, Slate and others have previously noted the ability of campaigns to target online ads to specific groups of voters. But what has not been detailed is which companies are now making the targeting possible by providing users' personal information — and which have decided it's off-limits.

Google and Facebook told ProPublica they do not offer this kind of political matching service.

Google's privacy policy classifies political beliefs as "sensitive personal information," which should not be used for online ad targeting. Facebook does allow political campaigns to target political advertisements, but only on the basis of political beliefs reported by the users themselves, rather than information culled from their voting records.

Jules Polonetsky, a former chief privacy Officer at AOL, and now the director of the Future of Privacy Forum, said political targeting has grown more aggressive in recent years.

Polonetsky recalls conversations within the online ad industry about "not wanting to do things like targeting users based on donor history" because "all of that was considered far too sensitive and likely to alarm users and set off privacy concerns."

"Today, those barriers have been leapt over with abandon," he said.

Industry experts argue targeted advertising can help campaigns save money by advertising more efficiently, a factor that could level the playing field for smaller campaigns.

Privacy advocates note that there's no way to track what messages campaigns are showing to different targeted groups — or whether politicians may be pandering to different voters.

"Whenever a campaign or other big organization knows much more about you and your habits than you know about them, any voter is open to manipulation," said Chris Calabrese, the privacy lobbyist for the American Civil Liberties Union.

Neither presidential campaign would comment on how it targets voters.

"We have no interest in telling our opponents our digital strategy," said Obama campaign spokeswoman Katie Hogan. "However, this campaign has always and will continue to be an organization that respects and takes care to protect information that people share with us."

Mitt Romney's campaign, which also uses sophisticated microtargeting tactics, did not respond to requests for comment. Targeted Victory, a firm that specializes in digital political targeting, had done nearly $4 million of work for Romney's presidential campaign as of March. Targeted Victory's advertised services include reaching voters online using voter registration data. The company's co-founder, Zac Moffat, currently serves as the Romney campaign's digital director. Neither Moffat nor Targeted Victory would comment on whether the Romney campaign is using voter records to reach potential supporters online.

Microsoft would answer questions about its targeting services only through a public relations spokesperson, who also asked that her name not be used. Microsoft's chief privacy officer, Brendon Lynch, did not respond to requests for comment.

Yahoo would not comment on specific clients, but said it has worked with Democrats and Republicans.

The Republican National Committee worked with both Yahoo and AOL to match Internet users to voter lists in 2007, according to Becki Donatelli, co-founder of Connell Donatelli, one of the most prominent Republican digital strategy firms. Contacted by ProPublica, AOL would not explain how its targeting service works.

The Republican National Committee also wouldn't provide details about its practices, but a spokeswoman said, "Targeting is one part of a larger playbook we have and will continue to employ. We follow legal guidelines and industry best practices." The Democratic National Committee did not respond to requests for comment.

When you see an online ad, you may assume it's comparable to a billboard — identical to everyone who walks by. But that's not the case for many ads. In the milliseconds it takes for a page to load, advertisers can identify a particular user visiting a site, and choose ads to display based on what they know about that user.

For instance, surfers may be shown a shoe ad if they recently visited a shoe site. Most of this sort of targeting doesn't require your name. Political targeting does. Campaigns may want to reach only reliable party members, or independents who might swing their way.

In order to do this, campaigns assemble lists of names from public records of voters they hope to reach, using such criteria as party registration, turnout history and previous donations. The campaigns often hire companies that harvest vast amounts of consumer data about individual Americans, further refining their voter lists with factors not publicly available such as income, education, magazine subscriptions, and purchasing habits.

Finding voters online is difficult, since no public record connects voters to a particular Internet address.

That's where Microsoft, Yahoo, AOL and other lesser-known companies come in. Their enormous stores of registration data can serve as the bridge between particular Internet users and their voter information.

Online advertising is delivered with the help of cookies, tiny files that companies place on surfers' browsers. Cookies can be used to track people as they move from site to site, helping specialized firms most users have never heard of create detailed records of the sites users visit and the links they click. This tracking is typically done through anonymous ID numbers; the tracking firms and advertisers don't know you by name.

Microsoft and Yahoo's targeting service combines two crucial factors: their knowledge of users' personal information and their ability to add cookies to browsers. Over the years, Internet users have given these companies their name when they signed up for free programs like the Microsoft suite of services known as Windows Live, which includes Hotmail. (Microsoft said it does not sell campaigns access to information users provide when they register for Office or other Microsoft products they've bought.)

Microsoft and Yahoo both said the cookies aren't connected directly to names or other personally identifying information. Instead, they use a complicated process to match coded voter information back to anonymous cookies on particular users' browsers.

But many parts of the process remain unclear since the companies were reluctant to explain the details of their matching and targeting.

Microsoft said that the credit reporting giant Experian performs a "double-blind" match between Microsoft's data and campaigns' data. Yahoo uses another massive data company, Acxiom. Both Experian and Acxiom also offer similar matching for commercial clients who want to find previous customers online.

"They don't need your permission to do this," said William McGeveran, a data privacy expert at the University of Minnesota Law School. As long as a company has not explicitly promised users not to do this kind of matching, the process is legal for both political and commercial entities, McGeveran said.

Microsoft, Yahoo and AOL all point out that users who don't want to be targeted can opt out.

"At AOL, we take privacy very seriously," Caroline Campbell, a company spokeswoman, wrote in an email. "We strongly support self-regulation, consumer transparency and choice, and responsible uses of data."

The Network Advertising Initiative, an industry group, offers a one-page site that allows users to turn off targeted advertising from a long list of prominent companies. Another industry group, the Digital Advertising Alliance, also offers a one-page opt-out site.

But you need to realize you're being tracked before you can decide whether to opt out.

Under the online ad industry's self-regulations, most targeted ads are marked with a tiny blue triangle and a phrase like "Ad Choices." Web surfers can click on this icon, read some general information about targeted ads, and find a link to a page that will allow them to opt out of receiving such ads in the future. Few ever notice or understand the symbol.

Speaking to an industry audience at the CampaignTech conference in Washington, D.C., in April, Cotten, from Yahoo, said less than one percent of Yahoo's users have chosen to opt out of targeted advertising.

"Most users are not even cognizant that they're being targeted," he said.

Nor are the companies' privacy policies much help.

Microsoft's privacy policy makes no mention of matching people's names and Zip codes against voter lists.

The Microsoft online privacy highlights page notes that the company collects users' personal information, and that "We use the information we collect to provide the services you request. Our services may include the display of personalized content and advertising." Like Yahoo and other companies, Microsoft's privacy policy is broken up over several different Web pages.

In an "advertising privacy supplement" Microsoft explains it may target ads using data from other companies, as well as "demographic or interest data, including any you may have provided when creating a Windows Live ID (e.g. age, ZIP or postal code, gender)." It does not say whether it classifies users' first and last names as "demographic or interest data."

"You are in charge of deciding whether we know anything about you," Microsoft explains elsewhere. "But the more you tell us about yourself, the more we can help you find information or products you want."

Yahoo's more straightforward privacy policy on data matching explains that the company may combine its users' personally identifiable information with information from other companies in order to customize ads. It names CampaignGrid, a political targeting firm, as one company that helps Yahoo! "provide more relevant content and advertising." Yahoo told ProPublica users' registration data is "consensually provided."

AOL's advertising privacy policy explains that it may customize ads "by using the registration data or other household data you have provided or that we have acquired from other companies."

The voter matching process is still far from perfect. Blaise Hazelwood of Grassroots Targeting, a Republican firm, said that the process is expensive, and that it's typically only possible to locate 20 to 40 percent of a given list of voters online in a typical matching process.

"You're not getting everyone," she said, "but the people you get, it's great."

Hazelwood was one of the first to use this tactic. She worked with Resonate, a data and targeting company, to deliver online ads to groups of Louisiana voters during Bobby Jindal's 2007 gubernatorial campaign.

In a 2008 campaign supporting a California proposition to ban gay marriage, Republican firm Connell Donatelli targeted online ads at registered Democrats over the age of 55, Kate Kaye of Clickz News first reported. One of the firm's strategists compared online voter matching to "a stealth bomber."

This spring, the Federal Trade Commission, which maintains the national "Do Not Call" registry, called for Web companies to implement a "Do Not Track" mechanism "that would provide a simple, easy way for consumers to control the tracking of their online activities."

Microsoft, Yahoo and AOL have agreed to implement "Do Not Track," but how exactly websites and advertisers will have to respond to the setting isn't clear.

In a surprise move, Microsoft recently made "Do Not Track" the default setting for the latest version of Internet Explorer browser, a decision that has received fierce pushback from the advertising industry and a key policy group.

Defending its stance, Microsoft's chief privacy officer last week cited a recent Pew study that found that 68 percent of respondents "were 'Not OK' with targeted advertising."

This could be OK if we could also be given access to what the politicians are REALLY thinking. 

But I haven’t seen any news about hell freezing over so far.

I see nothing wrong with it as long as both sides get the same info.
We as americans are stupid, yes stupid, if we believe the garbage we see or hear these days.  Also, are we commoners so nieve to believe these sites aren’t fighting for every advantage to be domanant.. If our political world is doing it what makes anyone think this isn’t going on in the private sector? And pushing the law to it’s limits and even beyond.
As for this Here is what I have to say about my company but don’t say who reveiled this?  Would you risk your job by reveiling sensative info about whom you work for?

I am aware of this because on almost any website I visit, but especially on my e-mail which uses the Yahoo portal, I am constantly being harassed by ads for Barack Obama. They certainly do not have a blue triangle which would let me opt out of receiving them. I find this extremely irritating but console myself that he is using part of his huge financial industry re-election slush fund in vain as I would not vote for him under any circumstances, no matter who was running against him.

The disparity in the “arms race” is increasingly infuriating.  We’re forced to surrender more information for access to (sometimes required) services and content, with a government and private sector that’s more and more tight-fisted with its own information.

And there are two fundamental flaws with the microtargetting approach.

Preaching to the choir is a stupid way to spend advertising money.  If someone’s registered for a particular party and donated to the campaign, it takes a true idiot to sell him on the candidate unless something has gone catastrophically wrong.

Also, we don’t like advertising.  Lots of us block it, because it’s obnoxious, wastes bandwidth, and introduces security and privacy risks.  I recommend it.

Personally, I’m waiting for the personal drone to follow me around to make sure I can’t possibly miss the propaganda.

Of course, I guess when the alternative is actually engaging voters with real policy decisions and transparency is really hard, compared with firing up the Republican/Democrat tribal division.  I also guess that it’s hard to win on policy decisions when you’re pretty obviously going to make exactly the same decisions as the other guy.

Americans for sale; and how does Microsoft or Yahoo think it’s their right to allow or sell access to you? It’s your right, and should be yours alone.

...and all targeted phishers are sent directly to “suspected phishers” bin for scanning and relayed to many other “safe” sites.

OMG!!! they are doing what Google has been doing for years, and when Facebook becomes too big to fail and the Government bails them out they will have access to all of your Information!!!

I have a lot to tell later in this regard. The head of head-less Prime Ministers of some Western countries know it very well - how Yahoo and Microsoft is partially owned by ugly an old boss or a group of businessmen in control of a manipulative system operated by some thugs in disguise and kings, which are protected by stinky old books of rotten laws that in reality have no respect for the Truth and natural justice.
May you please later visit: Thanks ProPublica.

They can send as many adds as there are dollars and this includes political and commercial and I could care less! You see,I decide whom to vote for based on my review of the information about their voting record,business record and their general moral attitudes and this does not mean religous but how they view the ecology,freedom, the poor and other issues I support!  As to commercial adds,I have a very good mute on the teley and a quick delete for pop-ups and all ads in general!  As that great man,George Carlin once said:“Madison Ave.has been trying to sell us crap we do not need since the 1920’s”!

Nowadays you can’t avoid it because just to get a stupid email account you have to fill out all kinds of personal forms. Bullshit. Anyone know of any sites that don’t share? This is getting over the top. And people wonder why ID fraud is exploding. Every website knows half of your history these days.

Make yourself impervious to online trackers, install dnt+.

Problem solved.

It’s a sad day when email services demand more info than credit card companies or the loan officer at your bank.

no wonder I’m getting all this unwanted solicitation.

I would pay $10.00 a month to find out the same information on all of the politicians in an election year. I want to know where Nuncy Pelosi and other politicians shop and what she/others buys and where she/others invest. I bet they would tighten the privacy laws if that information were made available to the public.

David Rachford

June 11, 2012, 7:04 p.m.

Pros:  Targeting provides a more relevant advertising experience.  Being a man, how often should I be forced to look at advertisements for Summer’s Eve Douche or Tampax Tampons?  Likewise Republican vs. Democrat.  They want to touch issues that will motivate the voters to turn-out and participate.

Cons: It can seem a bit creepy.

But let’s get the real issue here:  The threat against our privacy is not likely as big with Yahoo/Microsoft/Google/Facebook…  it’s with our government:  TSA, Big Sis, Domestic drones, and the New NSA data center in Utah.

@ JoeX51 re: “they will have access to all of your Information” - read the terms…. it’s not your information!  It’s FB’s or Google’s, or whatever website you visit.

Perhaps a billion dollar lawsuit filed against Microsoft, Yahoo, the RNC, and DNC for invasion of personal privacy and soliciting for PII and selling same PII, would get their attention.

There is more to this than you think - pay atention sometime - notice that when you email someone you’ll often get spam email within the next few minutes with a portion of their name in it or sometimes regarding some topic you discussed in your email…  it’s down right scary soemtimes - I only noticed it because some of my acquantences have unusual names and then just a few minutes later I get a spam email caught in my junk box form someone with the same name… or uncommon key words that I used itn he earlier email show up int he subject lines of junk email and you open it and it has nothign to do with that subject…

What’s to sell. I will be voting against Obama. I would vote for a dead cat before I’d vote for Obama. Can I make this any clearer to any politician out there? Idiots.

This kind of abuse by insatiably greedy advertising companies will lead to regulations and controls being put on the internet, and they will have only themselves to blame.

Today, anyone who believes privacy to be anything other than an illusion is a complete fool.

Peter Anthony Reale, Ed.S         233 N. Main Street           Mount Pleasant Michigan 48858

Mr. and Mrs. Reale [plenary guardian for blind starved stomach fed by stomach tube [See We sicced the police on Marilyn Thorton, Ann Hardesty Silker, Janet Wight a Miss King forced to sign papers, to exterminate as Dachau, Buchinwald, Raymond Peter Reale’s interest, his blindness, his starvatioin, his parents literally jailed, muffled as atrocity incarnate, infamy; paren ts stupified;community interest, state of Michigan interest in Raymon Peter Reale dob 1961 reciprocal interest in each other;  Director George Rouman replacement Mental Health -  Linda Kaufmann and husband Al Kaufmann fiduciary director adult foster care Crapo St Isabella County for abusing, mobbing, abuse of as defined by the FBI Color of Law, Public Corruption (Squad) egregious petition surrender guaedian for reporting Todd Oliveri Corporation Builders concentration camp like seclusion of blind, mute traumatized, vexatiously “kept in bed’ to not walk appears drugged, fogged, blind other retaliation - reprisals suppression
[See 1972, WABC-TV in New York Geraldo Rivera l. Rivera documented the brutal and horrific living conditions of its resident children and adult -  “Willowbrook: The Last Great Disgrace”  - Peabody Award government inquiry.Signed Peter Anthony Reale

I don’t get any (email) ads at all from using Shaw mail (Canada) but my friend who uses Google gmail does… Also get no ads while surfing with the adblocker resident house geek installed. Cross my fingers that it lasts for a bit.

I use Do Not Track Plus.  As a reluctant consumer who is adverse to buying junk, they are wasting time and energy on me.

I don’t go for this Shit…

David, I’m not sure we share the same definition of benefit.  Partly, that’s because I’m not going to buy something purely because it’s advertised—does anybody?

But mostly, I don’t see an upside to someone (government or corporate) deciding what I should and should not see.  I don’t need to be shielded from the apparently-horrific world of feminine hygiene products or political messages I don’t agree with.  I don’t think I should be.  If there’s ever a need, I can turn away on my own, and don’t need my mother to cover my eyes for me.

Mary, the theory is that you’re exchanging that right for access to their service.  And “if you don’t like it, go somewhere else.”  They also don’t need to care about civil liberties, because they’re not a government, which is something I hope changes, given the control companies have over our lives.

It’s also getting worse, because the major ISPs signed an agreement with the big media companies to start monitoring and policing your downloads for pirated material.  Considering that my ISP a few years back tried to bust me for downloading the crappy Tom Cruise “War of the Worlds” movie when I was downloading the (long public domain) novel, this’ll be loads of fun.

(And I’m sure that information will be sold, too.)

Needless to say, I’m looking for an alternative ISP that wasn’t a party to such a thing.  If anybody has recommendations for the Long Island area that aren’t Cablevision or Verizon…

Adblock is your friend.  Do Not Track Plus is your *best* friend.

By the way, DNT+ shows eight ad networks, social networks, or companies tracking you on this very page.

Et tu, Pro Publica?

To be fair, this is exactly the same way Internet advertising is sold to businesses, and anyone else who will pay.

I have noticed ads following me around, political and commercial.  Frankly I expect it and reconciled to ignoring them, don’t even notice them anymore.  Advertisers are free to waste their money trying to get my attention; the more they send the less I see.  Especially all those Obama ads which have long ceased getting my attention.  They are truly over-reaching beyond stupidity.

I ignore most of the ads.  Those that I can’t ignore, I add to my “do not buy” list.

So what? Stopped by the police on the road you gotta show your ID, Driver’s license if driving. Name, address, citizenship. Every page sees who is selling you internet service and has every bit of personal info ur server does. Has no one ever went to a website that showed the town the visitor was coming from? Have you never had a ‘counter’ that shows who is looking at your page or blog and where THEY are?
Ever been pissed that no one pays any attention to what you say and think? Well, now they can and do. On the internet. One day, I will not be here anymore. Will you?

Mohloaka Tubman

June 19, 2012, 9:13 a.m.

its incredible that this article does not mention 2 or 3 of the web sites/programs that people can use to check which companies are snooping on and sharing information about people

This article is part of an ongoing investigation:
Buying Your Vote

Buying Your Vote: Dark Money and Big Data

ProPublica is following the money and exploring campaign issues you won't read about elsewhere.

Get Updates

Our Hottest Stories