Computer Networks 79 (2015) 17–29
Contents lists available at ScienceDirect
Computer Networks
journal homepage: www.elsevier.com/locate/comnet
A privacy-aware framework for targeted advertising ⇑ Wei Wang a, Linlin Yang b, Yanjiao Chen a, Qian Zhang a, a Department of Computer Science and Engineering, Hong Kong University of Science and Technology, Hong Kong b Fok Ying Tung Graduate School, Hong Kong University of Science and Technology, Hong Kong article info abstract
Article history: Much of today’s Internet ecosystem relies on online advertising for financial support. Since Received 21 June 2014 the effectiveness of advertising heavily depends on the relevance of the advertisements Received in revised form 6 November 2014 (ads) to user’s interests, many online advertisers turn to targeted advertising through an Accepted 27 December 2014 ad broker, who is responsible for personalized ad delivery that caters to user’s preference Available online 7 January 2015 and interest. Most of existing targeted advertising systems need to access the users’ pro- files to learn their traits, which, however, has raised severe privacy concerns and make Keywords: users unwilling to involve in the advertising systems. Spurred by the growing privacy con- Targeted advertising cerns, this paper proposes a privacy-aware framework to promote targeted advertising. In Privacy Game theory our framework, the ad broker sits between advertisers and users for targeted advertising and provides certain amount of compensation to incentivize users to click ads that are interesting yet sensitive to them. The users determine their clicking behaviors based on their interests and potential privacy leakage, and the advertisers pay the ad broker for ad clicking. Under this framework, the optimal strategies of the advertisers, the ad broker and the users are analyzed by formulating the problem as a three-stage game, in which a unique Nash Equilibrium is achieved. In particular, we analyze the players’ behaviors for the scenarios of independent advertisers and competing advertisers. Extensive simulations have been conducted and the results validate the effectiveness of the proposed framework by showing that the utilities of all entities are significantly improved compared with tra- ditional systems. Ó 2015 Elsevier B.V. All rights reserved.
1. Introduction behaviors [1]. Targeted advertising is beneficial to both advertisers and users: advertisers can gain higher revenue Online advertising provides financial support for a large by advertising to users with a strong potential to purchase, portion of today’s Internet ecosystem, and is displayed in a and the users in turn receive more pertinent and useful ads variety of forms embedded in web sites, emails, videos and that match their preferences and interests. A recent survey so on. As the effectiveness of advertising largely depends [2] revealed that targeted advertising brings 2.68 times on the relevance between the delivered advertisements revenue per ad compared with non-targeted advertising. (ads) and users’ interests, a popular paradigm for current Due to the increased effectiveness and benefits, a number online advertising system is targeted advertising, where of advertisers around the world have already turned to advertisers hire an ad broker to deliver ads to potentially online targeted advertising systems. Examples of such interested users by analyzing users’ online profiles or advertising systems include Google AdWords [3] that deli- ver customized ads based on search items, and Ink TAD [4] that pushes ads according to location information revealed ⇑ Corresponding author. Tel.: +852 23588766. in user’s emails. E-mail address: [email protected] (Q. Zhang). http://dx.doi.org/10.1016/j.comnet.2014.12.017 1389-1286/Ó 2015 Elsevier B.V. All rights reserved. 18 W. Wang et al. / Computer Networks 79 (2015) 17–29
Although targeted advertising benefits both advertisers compensation, are inclined to click ads of interests. On and users, it has raised severe privacy concerns. A recent the other hand, as the compensation can improve click- survey [5] of 2253 participates conducted in 2012 reported through rate and bring the ad broker more revenue, the that the majority of respondents expressed disapproval of ad broker is willing to provide certain amount of compen- targeted advertising due to privacy disclosure. Such pri- sation for users whose ad clicks reveal their private inter- vacy threats come from the fact that ad brokers aggres- ests. However, to support this framework, there are still sively track users’ online behaviors to obtain their several questions that need to be answered. First and fore- preferences and interests, which can be sensitive to the most, in order to compensate privacy loss, it is essential to users. For example, the behavior of searching for a certain quantify privacy information leakage in ad clicks. Second, kind of medicine implies that the user is likely to have cer- how much compensation should be provided for each tain relevant disease, whose disclosure is considered as a user? The more compensation provided, the more inclined violation of the user’s privacy. Moreover, ad brokers rarely users are to click ads; while the ad broker pays more for have clear statements about how the obtained behavioral the users’ privacy loss. Moreover, how should advertisers data will be used and whom the data will be shared with. pay the ad broker for the ad clicks they benefit from? Untrusted ad brokers may sell such personal information The amount of payment to the ad broker has an impact to some adversaries without the user’s permission. Being on the privacy loss compensation allocated to users, which aware of such privacy risks, users are reluctant to embrace in turn affects the click-through rates and advertisers’ rev- the practice of targeted advertising [6], which hinders the enue. In this paper, we answer all these questions via game effectiveness of online advertising systems. theory analysis. In particular, we propose an ad dissemina- To maintain the merits brought by targeted advertising, tion protocol to protect the users’ privacy to a large extent, it is essential to incentivize users to participate in such sys- and formulate the interactions among all entities as a tems. Existing studies [7–9] have focused on privacy pre- three-stage game, where each entity aims to maximize serving mechanisms to encourage users to involve in the its own utility. targeted advertising systems. These mechanisms either The main contributions of this paper are summarized as assume another trusted entity sitting between users and follows. ad brokers [7,8], or require users to send perturbed clicking information to hide users’ true data. However, these We propose a privacy-aware framework for targeted changes made on the framework of existing targeted advertising to motivate users, the ad broker, and adver- advertising systems provide privacy protection at the cost tisers to be engaged in the targeted advertising systems. of the benefits of ad brokers or advertisers. The ad brokers This framework requires no modifications on existing may not be in favor of introducing an extra entity to share targeted advertising systems, and takes the incentives their ad targeting duty, which is the main source of their of all parties into consideration. In our framework, the revenue. Similarly, the advertisers may be dissatisfied with ad broker provides a certain amount of compensation the perturbed clicking information as perturbation under- for the users’ privacy leakage from ad clicks in order mines the accuracy of click information, which normally to encourage users to click their interested ads, which determines their payments [10]. Without guaranteed reve- in turn improves the click-through rate and brings in nue, the advertisers and ad brokers naturally tend to main- more revenue for the ad broker and advertisers. tain the adoption of traditional targeted advertising We model the framework as a three-stage Stackelberg systems instead of upgrading the systems to provide pri- game, in which all entities are considered to be selfish, vacy protection. This conflict between users and advertis- targeting at maximizing their own utilities by selecting ers/ad brokers hinders the adoption of privacy-aware optimal strategies. We analyze the cooperation and mechanisms in advertising. To promote the adoption of competition relationship among users, the ad broker, the privacy-aware advertising systems, the interests of all and advertisers, and derive the Nash Equilibrium. entities should be guaranteed, which, unfortunately has We further analyze the competition among advertisers not yet been addressed by existing proposals. who share the whole market. We model the market In this paper, we propose a privacy-aware framework to sharing scenario as a non-cooperative game and prove boost the adoption of privacy preserving targeted advertis- the existence of the Nash Equilibrium. ing systems. Users, the ad broker and advertisers are We conduct numerical simulations to evaluate the pro- assumed to be rational and selfish entities, who care only posed framework. The results verify that the utilities of about their own interests. To ensure the interests of all all entities are notably enhanced, which provides strong entities, our framework introduces an economic compen- motivation for the ad broker and advertisers to imple- sation mechanism for privacy leakage. Such economic ment the compensation policy and users to embrace compensation for privacy loss has already been widely the targeted advertising. considered in the literature [11,12]. Besides, many compa- nies, including Bynamite, Yahoo, and Google, are also The rest of the paper is organized as follows. Section 2 engaging in the purchase of users’ private information in describes the system model. Section 3 introduces the com- exchange for monetary or non-monetary compensation pensation framework. In Section 4, we model the frame- [13,14,12]. Under the proposed framework, the ad brokers work as a three-stage game and analyze the optimal compensate economically for the users’ privacy leakage in strategies of advertisers, the ad broker and users. We fur- order to incentivize users to click their interested ads. On ther discuss the competition among advertisers for market the one hand, the users, with the expectation of receiving sharing. Numerical results are shown in Section 5 and W. Wang et al. / Computer Networks 79 (2015) 17–29 19 related works are reviewed in Section 6, followed by the To preserve users’ privacy, we assume that the user pro- conclusion in Section 7. files are kept on their local devices and cannot be accessed by the ad broker or advertisers [9]. In line with the privacy 2. System model preserving online advertising systems [8,9,15], we focus on privacy leakage via ad click, while we do not consider the In this section, we describe the system model, including privacy leakage via web browsing tracking as it occurs out- the targeted advertising system and privacy sensitivity. side the advertising system. To predict the users’ prefer- ences, the ad broker collects the ad click information, 2.1. Targeted advertising system which, however, may compromise users’ privacy. In the following section, we quantify privacy leakage from ad We adopt the most popular advertiser–broker-user clicks. We also assume that there is no click fraud, as click advertising architecture on today’s Internet. Fig. 1 illus- fraud can be addressed by existing solutions [16,17]. trates such a targeted advertising system which comprises of a set of advertisers, one ad broker and a group of users. 2.2. Privacy sensitivity Advertisers are interested in displaying ads to the users of potential interests, and are willing to pay a certain amount On the one hand, the privacy level of ad click behavior is money for the ads that are viewed by the interested users. considered to be content-dependent: clicking different Ads are delivered by an advertising platform (e.g., Google’s kinds of ads leads to different levels of privacy leakage. AdWords) run by the ad broker. The advertising platform For example, clicking a medical ad may imply that you collects ads from advertisers and disseminate ads to the have a certain kind of disease, which is normally very sen- targeted users according to the ad broker’s scheduling sitive to the users; whereas, clicking an umbrella ad usu- algorithm. ally leaks little privacy of the users. To quantify the Ad dissemination is scheduled over a series of time content-dependent privacy level, we introduce a privacy slots. In each time slot, there are a set of active users, that factor aj to present the sensitivity of an ad Aj. The content is, the users who are viewing a device that can display an of an ad with larger aj is more sensitive. For example, the ad in that time slot. A set of ads from different advertisers privacy factor aj1 of a medical ad Ajm is normally larger than are selected based on the preferences of the active users in the privacy factor aj2 of an umbrella ad Aju . that time slot. We assume that the ad broker selects at On the other hand, the privacy level of ad click behavior most one ad from an advertiser in each time slot. In order is also related to the total number of users who have to keep notation simple, we consider the ad dissemination clicked it. According to the notion of k-anonymity [18], in one time slot. We denote the set of active users and when a user’s information is identical with more users (k the set of ads in a time slot as fSi : i ¼ 1; ...; Ng and is larger), it is harder for adversaries to identify the user fAj : j ¼ 1; ...; Kg, respectively. by looking at the clicking behavior, meaning that less
2. Push Ads Ad Broker
1. Send Ads 4. Click Statistics 3. Click Information
Users Advertisers
Fig. 1. Structure of privacy-aware targeted advertising system. 20 W. Wang et al. / Computer Networks 79 (2015) 17–29 information is leaked. Thus, we define the privacy leakage user Si decides to clickP ad Aj. Then, the total number of of clicking an ad Aj as aj=nj, where nj is the total number of clicks for ad Aj is nj ¼ qRq;j. The overall compensation that users clicking Aj. user Si receives is X R C ¼ M P i;j : ð3Þ i j R 3. The compensation framework j q q;j Studies have shown that different users have different In this section, we propose a privacy-aware compensa- levels of privacy sensitivity [31,32]. As described earlier, tion framework to promote targeted advertising with the ad clicks leak users’ preferences to the ad broker. The pri- consideration of privacy leakage. The target of the frame- P vacy leakage of clicking ad A is a =n ¼ a = R . There- work is to establish a win–win situation among all entities j j j j q q;j fore, the total amount of user’s privacy leakage is in the targeted advertising system. In the framework, with the promise of privacy leakage compensation, the sensitive a R L ¼ Pj i;j : ð4Þ users are incentivized to view their interested ads. The ad i qRq;j broker and advertisers earn more revenue from more ad clicks. It is noteworthy that our proposed framework is Then, the utility of user Si is defined as the amount of built on top of the existing advertiser–broker-user adver- money it receives from the ad broker minus the amount tising architecture as described in Section 2, and intro- of money needed to compensate the user for privacy duces no new parties. leakage The ad broker assists advertisers to target interested X R X a R users and deliver ads to those users. Advertisers yield Us ¼ C x L ¼ M P i;j x Pj i;j ; ð5Þ i i i i j R i R higher revenue by delivering ads to desired users via the j q q;j j q q;j ad broker [1]. In return, the ad broker charges the advertis- where x is defined as the equivalent amount of compen- ers for each ad click. This business model is prevalent in i sation desired by user S for every unit of privacy loss. the current Internet ecosystem. Recall that users are reluc- i tant to click their interested ads when the ad contents are sensitive and their private preferences can be revealed to 4. Game theory analysis the ad broker. To motivate users to click their interested ads, the proposed framework introduces a compensation In this section, we cast the targeted advertising under mechanism in which the ad broker puts forward a total the compensation framework as a three-stage Stackelberg sum of Mj compensation amount, which is distributed to game, and analyze the best strategies of all entities based users who have clicked sensitive ads. on their utilities. We consider two advertising scenarios: Under the compensation framework, all entities are independent advertisers who are engaged in independent considered to be rational and aim to maximize their own markets and market sharing advertisers who compete utilities. Advertisers gain revenue from clicks. Since in each against each other. time slot, each ad corresponds to one advertiser. For sim- plicity, we use Aj to denote the advertiser who distributes ad Aj. For every click on Aj, the corresponding advertiser gains an average revenue of Q j. The expense of advertisers is the money they pay to the ad broker. We denote the Stage I: Adver sers announce click prices amount of payment for each click on Aj as Pj. The utility of advertiser Aj is defined as its revenue from clicks minus the fee it pays to the ad broker, which is expressed as Stage II: The Ad broker determines the a total amount of compensa on Uj ¼ njQ j njPj; ð1Þ where n is the total number of clicks on ad A . j j Stage III: Users decide their clicking The ad broker receives money from advertisers and decides the total amount of compensation Mj to be paid behaviors to all users for clicking ad Aj. The compensation Mj is then allocated evenly to each user who has clicked ad Aj. The utility of the ad broker is defined as the total revenue from all advertisers minus the total money paid to users. Compensa on is allocated among users X X b U ¼ njPj Mj: ð2Þ User Click Decision Subgame j j
Users decide whether to click their interested ads that Targeted Adver sing Game are delivered to their devices based on the amount of com- pensation and their privacy loss. Let Ri;j ¼ 0 denote that user Si decides not to click ad Aj and Ri;j ¼ 1 denote that Fig. 2. The procedure of targeted advertising and ad clicking. W. Wang et al. / Computer Networks 79 (2015) 17–29 21
The targeted advertising game consists of three stages, Proof. From Eq. (5), we have as illustrated in Fig. 2. In the first stage of the game, adver- X tisers announce the price of each ad click they will pay to Ri;j Us ¼ ðM x a Þ P : ð9Þ the ad broker. In the second stage, observing the price it i j i j R j q q;j receives for every click, the ad broker determines the amount of money it compensates all users. In the last When Mj P xiaj, selecting Ri;j ¼ 1 can increase Si’s utility. stage, users decide whether or not to click the ads. All play- Whereas, if Mj < xiaj, selecting Ri;j ¼ 0 can avoid decreas- s ers act in a non-cooperative way as they make decisions ing Si’s utility. So Ui can be maximized when Si determines independently. the value of Ri;j according to Eq. (8), which is Si’s optimal The whole game can be viewed as the combination of a strategy. Note that Eq. (7) guarantees that the denominator user click decision subgame and a targeted advertising of Eq. (9) is non-zero. Every user can obtain its optimal subgame. In the user click decision subgame, the ad broker strategy by this mechanism. Thus, Nash Equilibrium is acts as the leader because it determines the total amount reached when they all adopt the optimal strategy. h of compensation, and leads the ad delivery procedure. The ad broker first announces the total amount of compen- 4.1.2. Optimal compensation strategy of ad broker sation and pushes ads to intended users according to its When the ad broker decides its strategy fMj : j ¼ 1; ...Kg, scheduling algorithm. The users play as followers, and users will make their decisions according to Theorem 1. decide their clicking behavior based on their evaluation Accordingly, the ad broker can determine the optimal of privacy loss and expected compensation. In the targeted strategy. As the leader of the user click decision subgame, advertising subgame, the advertisers play as leaders, as the ad broker is aware of the impact of the total compen- they initiate the whole advertising procedure and pay the sation amount on users’ decisions. Taking into account ad broker to distribute their ads. The ad broker acts as users’ possible responses, the ad broker can obtain its opti- the follower to initiate the user click decision subgame. mal strategy to maximize its profit.
4.1. Targeted advertising for independent advertisers Proposition 1. The ad broker has a unique optimal strategy that can maximize its utility. We first analyze the targeted advertising game for inde- pendent advertisers, and use backward induction to derive Proof. Based on Eq. (2), we have Nash Equilibrium, where the optimal strategies for adver- X b tisers, the ad broker and users are obtained accordingly. U ¼ ðPjnj MjÞ; ð10Þ j no P 4.1.1. User clicking behavior analysis 6 Mj where nj ¼ iRi;j ¼ xi : i ¼ 1; 2 ...; N . Assume We first analyze users’ decision making process. Note aj fx1; x2; ...; xNg follow a certain kind of distribution, that user Si’s utility not only depends on its own decisions, whose probability distribution function is f ðxÞ.AsN is a but also on other users’ choices. Let fRi;j : j ¼ 1; ...; Kg very large number (there are many end users in the sys- denote user Si’s strategy and fR i;j : j ¼ 1; ...; Kg denote tem), nj can be calculated in this way the strategies of all the other users. The utility of user Si Z Mj s a is Ui ðRi;j; R i;jÞ. Then, the best response of Si is given by j nj ¼ N f ðxÞdx: ð11Þ 0 s Ri;j ¼ arg maxUi ðRi;j; R i;jÞ: ð6Þ So we have Ri;j 0 1 Z Mj X a b @ j A Given the strategies of other users, the best response of U ¼ PjN f ðxÞdx Mj ; ð12Þ j 0 Si is its optimal strategy. Si will not deviate from its best response unilaterally as it can gain nothing. If every user dUb X P N M adopts the best response, Nash Equilibrium is reached. ¼ j f j 1 ; ð13Þ dM If every user employs the best response with regard to j j aj aj other users’ decisions, no users have motivation to deviate ! 2 b X from its best response unilaterally. As such, Nash Equilib- d U PjN 0 Mj 2 ¼ 2 f : ð14Þ rium is reached. dMj j aj aj a As N is very large, there exists two points where f ðxÞ¼ j . Theorem 1. When the following condition PjN Only the right one has a negative derivative, so there exists Mj=aj P minfxig; ð7Þ dUb i a unique set of fMj : j ¼ 1; ...Kg, that makes ¼ 0 and dMj 2 is satisfied, there exists a Nash Equilibrium for the game d Ub < 0. To sum up, the ad broker can maximize its utility dM2 among users and the optimal strategy of S is j i by the following unique strategy 6 1; xi Mj=aj a R ¼ ð8Þ 1 j i;j Mj ¼ ajf ; ð15Þ 0; xi > Mj=aj: PjN 22 W. Wang et al. / Computer Networks 79 (2015) 17–29 a where we select the larger value of f 1 j . h 4.2. Targeted advertising for market sharing advertisers PjN
To obtain a closed-form of the ad broker’s optimal strat- In the model analyzed above, we assume that for every egy Mj , we assume that users’ privacy sensitivities follow click advertiser Aj gains a constant revenue of Q j, which Gaussian distribution Nðl; r2Þ, which is commonly used only stands for independent advertisers. For competing to model real-value random variables. In accordance with advertisers who send ads about similar products or ser- the three-sigma rule, the probability that a variable lies vices, the whole market size is limited and shared by those within ½l 3r; l þ 3r is 99.74%, and thus the values out- advertisers. Therefore, in this subsection, we discuss a side this interval can be neglected. Hence, we can use more realistic model, for which we assume the whole mar- 2 Gaussian distribution Nðl; r Þ to model users’ privacy sen- ket size is Q. The market size for advertiser Aj is positively sitivities with the constraint l > 3r. In this circumstance, related to the proportion of clicks on its ad to the total Pnj the ad broker’s optimal strategy is expressed as clicks on all similar ads, that is . So the utility of Aj is nq sffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi! q a Pnj Uj ¼ Q Pjnj: ð22Þ 2 PjN M ¼ aj l þ 2r ln pffiffiffiffiffiffiffiffiffiffiffiffi : ð16Þ qnq j 2 aj 2pr As advertisers are aware of the ad broker’s reaction to 4.1.3. Optimal ad pricing strategy of advertiser their strategies, they can decide their optimal strategies In the targeted advertising subgame, advertisers deter- accordingly. mine their optimal strategies based on the ad broker’s compensation strategy. Proposition 3. There exists a unique optimal strategy for an advertiser when users’ privacy sensitivities follow Gaussian Proposition 2. There exists optimal strategies for advertisers, distribution and other advertisers’ strategies are fixed. and when users’ privacy sensitivities follow Gaussian distri- bution, the optimal strategy for every advertiser is unique. Proof. When fxi : i ¼ 1; ...; Ng follow the Gaussian distri- bution Nðl; r2Þ, we have 0 1 P Proof. From Eqs. (1) and (11), we have a Nrf Mj dðUj Þ B q–jnj C aj M @Q P A rffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi n : 23 Z j ¼ P 2 j j ð Þ a dPj P N a j n pffiffiffiffiffiffiffiffij q q Pj 2ln 2 Uj ¼ðQ j PjÞN f ðxÞdx: ð17Þ aj 2pr 0 dðUaÞ a It can be easily seen that j is a decreasing function with It can be seen that Uj ðPjÞ is a continuous function and its dPj d2ðUaÞ upper bound is Q . So there exists P , which is the optimal j j j regard to Pj,thatis 2 < 0, and the following two Equations a dPj strategy that maximizes Uj . We further analyze the circumstance where dðUaÞ lim j ¼þ1; ð24Þ fxi : i ¼ 1; ...; Ng follow the Gaussian distribution þ Pj !0 dPj Nðl; r2Þ. To simplify analysis, it is equal to consider function ln Ua. We have j d Ua ð j Þ M M lim < 0; ð25Þ a f j d j Pj ! 1 dPj dðln Uj Þ 1 aj aj d2ðUaÞ ¼ þ M ; ð18Þ j dPj Q j Pj j dPj hold. So there is one unique Pj , where 2 ¼ 0, and this Pj R a dP j f ðxÞdx j 0 is the unique optimal strategy for advertiser Aj when other advertisers’ strategies are fixed. h where Pj 2ð0; Q jÞ. Together with Eq. (16), we obtain dðln UaÞ 1 a r2 j j : Proposition 3 shows that when given other players’ ¼ þ rffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi M dPj Q j Pj j R a strategies P , advertiser A has one unique optimal strat- 2 2 NPffiffiffiffiffiffiffiffij j j j NP 2r ln p f ðxÞdx j a 2pr2 0 j egy Pj . As it is a non-cooperative game among advertisers, ð19Þ we next prove that in some situations Nash Equilibrium exists for this game, that is. dðln UaÞ It is obvious that j is a decreasing function with dPj d2 ln Ua ð j Þ Theorem 2. When the total number of users N is large, there regard to Pj, that is 2 < 0, and the following two dPj exists a strategy profile P ¼ðP1; P2; ...; PkÞ, for which the equations following condition holds
a a a dðln Uj Þ 8j; P : U ðP ; P Þ > U ðP ; P Þ: ð26Þ lim ¼þ1; ð20Þ j j j j j j j þ Pj!0 dPj Proof. The Gaussian error function erf ðxÞ can be approxi- dðln UaÞ mated with elementary functions lim j ; 21 ¼ 1 ð Þ Pj!Q j dPj a 1 dðln U Þ j erf ðxÞ¼1 16 ; ð27Þ hold. So there is one unique Pj , where ¼ 0, and this Pj 2 6 dPj ð1 þ a1x þ a2x þ þa6x Þ is the unique optimal strategy for advertiser Aj. h W. Wang et al. / Computer Networks 79 (2015) 17–29 23
where faig are approximate coefficients [19]. by the compensation framework. To cope with such cases, Then, we have governments have made efforts to regulate the behaviors "# sffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi! Z Mj of entities in online advertising. The White House has pro- a j N PjN l nj ¼ N f ðxÞdx ¼ erf ln pffiffiffiffiffiffiffiffiffiffiffiffi þerf pffiffiffiffiffiffiffiffiffi posed a Consumer Privacy Bill of Rights as part of a strat- 0 2 a 2pr2 2r2 " j egy to improve consumers privacy protection, and has N 1 made an agreement with the Digital Advertising Alliance, ¼ 2 including Google, Yahoo!, Microsoft, etc., to regulate their 2 ð1þa xþa x2 þ þa x6Þ16 1 2 #6 advertising behaviors [20]. The Advertising Regulation 1 Department of Financial Industry Regulatory Authority ; 2 6 16 (FINRA) reviews broker-dealers’ advertisements and other ð1þa1yþa2y þ þa6y Þ rffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi communications with the public to ensure that they are fair, PjN l pffiffiffiffiffiffiffiffi pffiffiffiffiffiffi where x ¼ ln 2 and y ¼ 2. As the total number of balanced and not misleading [21]. As such, the regulation aj 2pr 2r users N is large, x > 1. Note that we assume that l > 3r so from governments can ensure the all parties follow the rules defined in the proposed compensation framework. that y > p3ffiffi. Thus n ! N. The derivative of n with regard to 2 j j 5. Numerical results Pj is ÀÁ 2 5 In this section, we conduct extensive simulations to dðn Þ 8Na1 þ 2a2x þ 3a3x þ þ6a6x j ¼ : ð28Þ demonstrate the performance gain of the proposed com- 2 6 17 dPj ð1 þ a1x þ a2x þ þa6x Þ pensation framework, and the impact of the system parameters on the performance. And we have ÀÁ 2 5 dðnjÞ 8 a1 þ 2a2x þ 3a3x þ þ6a6x 5.1. Simulation setup ¼ dPj: ð29Þ 2 6 17 nj ð1 þ a1x þ a2x þ þa6x Þ We consider a system with 107 users, 50 advertisers and dðnjÞ As x > 1; ! 0. So when advertiser Aj changes its strat- nj an ad broker, where users are randomly allocated to 10 dif- egy, the change in the number of users who click the ad can ferent preference profiles. A user is interested in an ad if the be ignored, which means the optimal strategy of every ad matches the user’s profile [9]. Ads are delivered over advertiser does not change when other advertisers change multiple time slots. In each time slot, an activity level, i.e., their strategies. When all advertisers adopt their unique the fraction of users that are active to view ads, is randomly optimal strategies, their utilities are optimized, that is chosen in ½0; 1 . Unless explicitly otherwise stated, privacy factor is randomly distributed in 0; 1 , and the revenue 9P ¼ðP1; P2; ...; PkÞ a ð Þ a a of each click Q ¼ 1. The privacy factor a implies the relative s:t: 8j; Pj : Uj ðPj ; P jÞ > Uj ðPj; P jÞ: content sensitivity of ads. An ad with larger a contains more sensitive content, and a user clicking it leaks more private From the proof of the above theorem, we can easily information. An ad with a ¼ 1 refers to the ad containing derive the following proposition. the most sensitive content, while an ad with a ¼ 0 refers to the ad containing no sensitive information. Users’ pri- vacy sensitivities x follow Gaussian distribution Nðl; r2Þ Proposition 4. The optimal strategy of every advertiser does where l ¼ 1; r ¼ 0:01. Recall that the users’ privacy sensi- not change when other advertisers change their strategies. tivities x is defined as the equivalent amount of compensa- tion desired by the user for every unit of privacy loss. A user 4.3. The adoption of the compensation framework with larger x values more about its private information, and thus needs stronger incentives to click sensitive ads. The previous analyses have focused on analyzing the To evaluate the performance gain of privacy-aware com- compensation framework under the advertiser–broker- pensation, we compare our framework with the traditional user architecture, while our framework can be easily paid-to-click (PTC) model, which is a popular online busi- extended to the advertiser-user architecture, where adver- ness model that motivates users to view ads. In the tradi- tisers directly deliver ads to users without the assistance of tional PTC model, a certain price is paid to users for every ad brokers. Our framework can be easily extended to this click, while the diversities of ad content and user’s sensitiv- architecture. In this architecture, instead of paying fees to ity are not considered. For fair comparison, we enhance the the ad broker, advertisers directly compensate users for PTC model by implementing it in our privacy-aware setting. In particular, the enhanced PTC model employs a privacy their privacyP loss. ToP this end, we can simply set an extra dependent pricing scheme where click price is determined constraint jnjPj ¼ jMj in ourP formulation. As such, all optimally according to the user’s privacy sensitivity. the fees paid by theP advertisers jnjPj become the privacy loss compensation jMj paid to users. The compensation framework motivates the users, 5.2. Results advertisers and the ad broker to participate in the targeted advertising system via economic incentives. However, We first evaluate the overall performance of our frame- there may exist malicious entities whose target is not max- work by comparing it with the PTC model in Section 5.2.1. imizing their utilities but trying to violate the rules defined Then, we evaluate our framework under various settings of 24 W. Wang et al. / Computer Networks 79 (2015) 17–29 privacy related parameters, i.e., the privacy factor a and x 105 user’s privacy sensitivity x in Section 5.2.2. Finally, we 5.1 study the impact of competition among advertisers in 5 Section 5.2.3. 4.9 4.8 5.2.1. Comparison of different frameworks We first show the overall merits of the proposed com- 4.7 pensation framework by comparing it with the traditional 4.6 PTC framework. To show that our framework can incentiv- 4.5 ize different kinds of users, that is, users with different sen- PTC 4.4 sitivities, we vary the average privacy sensitivity l.In Compensation 4.3 particular, we compare the number of ad clicks, the reve- Revenue of advertiser nue of advertisers, and the revenue of the ad brokers in 4.2 Figs. 3–5, respectively. 4.1 Comparing the number of ad clicks achieved by differ- 4 ent frameworks. Fig. 3 compares the number of ad clicks 0 1 2 3 4 5 6 7 8 9 10 11 for users with different levels of privacy concerns. Number Average privacy sensitivity of ad clicks, which determines click-through rate, is con- sidered as an essential indicator for the efficiency of adver- Fig. 4. Revenue of advertisers versus average privacy sensitivity. tising. In all cases demonstrated, the number of ad clicks achieved by the compensation framework is larger than that in the PTC framework, which means that our frame- 25 work outperforms the PTC in terms of the efficiency of advertising. The number of ad clicks decreases with aver- 20 age privacy sensitivity under the PTC framework, but remains almost unchanged under the compensation Compensation framework framework. This is because the PTC framework pays users 15 based a unified pricing model, while the compensation pol- PTC icy considers the privacy loss of different users and is tai- lored to different ads, which can motivate more users. 10 Comparing the revenue of advertisers achieved by dif-
ferent frameworks. Fig. 4 shows that when the average pri- Revenue of ad broker vacy sensitivity increases, the revenue of advertisers drops 5 significantly under the PTC framework, while the advertis- ers under the compensation framework still maintains 0 their revenue at a high level, which implies that the pro- 0 1 2 3 4 5 6 7 8 9 10 11 posed compensation framework successfully incentivizes Average privacy sensitivity highly sensitive users and brings more revenues to adver- tisers. The trends of advertisers’ revenue are consistent Fig. 5. Revenue of the ad broker versus average privacy sensitivity. with the trends of number of ad clicks as depicted in Fig. 3. The reason is that the revenue of advertisers is much Eqs. (11) and (15) that when the shape of distribution determined by the number of ad clicks. It is indicated in f ðxÞ does not change, the relationship between nj and Pj
stays the same. Advertiser Aj’s revenue is only affected by x 105 5.1 Q j; nj and Pj, where Q j is a constant number, so that its strategy remains the same with the increase in , which 5 l in turn makes nj and advertiser’s profit constant. The 4.9 results of Fig. 4 further validate that the compensation 4.8 framework brings more profits to advertisers. 4.7 Comparing the revenue of the ad broker achieved by 4.6 different frameworks. Fig. 5 illustrates the revenue of the ad broker with different level of average privacy sensitiv- 4.5 ity. In all cases demonstrated, the compensation frame- 4.4 Compensation framework work brings considerably more revenue to the ad broker
Number of ad clicks 4.3 PTC compared to the PTC framework, which indicates that the 4.2 compensation framework can better motivate the ad bro- ker to involve the advertising systems. With higher aver- 4.1 age privacy sensitivity, the performance gain of the 4 compensation framework is larger. The reason is that in 0 1 2 3 4 5 6 7 8 9 10 11 Average privacy sensitivity our framework, the amount of compensation is tailored to each click according to the ad content and user’s sensi- Fig. 3. Number of ad clicks versus average privacy sensitivity. tivity, and leads to more ad clicks, which makes advertisers W. Wang et al. / Computer Networks 79 (2015) 17–29 25 pay more to the ad brokers. An interesting observation is The amount of compensation under various privacy that the revenues of the ad broker decrease under both settings. The amount of compensation is an important fac- frameworks with higher privacy sensitivity. This is because tor that affects the revenue of the ad broker. We study the the price to compensate user’s privacy loss is higher for amount of compensation in Fig. 7. The amount of compen- high sensitive users. As such, a larger portion of the ad bro- sation grows with privacy factor, as the ad broker needs to ker’s income is used to motivate users. pay more to stimulate users to click ads of higher privacy factor. For larger l and r, the average privacy loss for users with privacy sensitivity higher than l is larger, which 5.2.2. Impact of privacy parameters determines larger amount of compensation to motivate In this subsection, we evaluate the proposed compensa- users. tion framework under various privacy settings. In particu- The revenues under various privacy settings. Fig. 8 lar, we show how privacy factor of an ad and user’s privacy depicts the revenue of advertisers against the privacy fac- sensitivity affect the revenues of advertisers and the ad tor and privacy sensitivity. The results are consistent with broker. In Figs. 6–9, we vary the privacy factor a of each Fig. 6 as the number of clicks largely determines the reve- ad from 0.1 to 1, and select different values of the mean nue of advertisers. An interesting observation in Fig. 8(b) is and standard deviation of user’s privacy sensitivity. that the revenue of advertisers diminishes as the standard The number of clicks under various privacy settings. deviation of privacy sensitivity increases. With larger stan- Fig. 6 reports the number of clicks achieved by the com- dard deviation of privacy sensitivity, advertisers have the pensation framework with different values of privacy fac- incentive to increase its offer to encourage the ad broker tor a and distributions of privacy sensitivity. The privacy to pay more to users. As analyzed in Section 4, the optimal factor of an ad determine the privacy level of an ad and point is on the right half of the probability distribution the privacy loss of an click. The compensation amount is function, which means that advertisers and the ad brokers adjusted according to each ad’s privacy factor to stimulate are more concerned about 50% of the users whose privacy users. It can be seen that the number of ad clicks stay sensitivities are higher than average, as the other half are unchanged with different values of privacy factor, which always stimulated to click. With the increment of the stan- demonstrate the effectiveness of the stimulation for differ- dard deviation, the privacy sensitivity level of the ‘‘con- ent kinds of ads. In Fig. 6(a), we observe that the value of l cerned group’’ is rising so that both advertisers and the has little impact on the number of clicks, which is consis- ad broker raise their offers. tent with the results shown in Fig. 3. Fig. 6(b) shows that Fig. 9 shows the impact of privacy factor and the pri- when the standard deviation of users’ privacy sensitivity vacy sensitivity on the revenue of the ad broker. An coun- varies from 0.1 to 1, the number of ad clicks declines. ter-intuitive observation is that the revenue of the ad When the standard deviation of users’ privacy sensitivity broker grows with privacy factor. This is because the pay- is large, it costs more for the advertisers and the ad broker ment from advertisers dominates the revenue of the ad to incentive users, as analyzed in Section 4. As such, less broker, and for ads with higher privacy factor, advertisers compensation is allocated to users, resulting in less ad tend to pay more to motivate the ad broker to allocate clicks. This observation reveals that for users with very more compensation to users. Combining the results in diverse privacy sensitivities, it is more effective to catego- Figs. 7 and 9, we find that although larger l and r lead rize users according to their privacy sensitivity and employ to more compensation, while the revenue of the ad broker dedicated strategy for each category. diverges in such two cases: the revenue of the ad broker
5 x 105 x 10 5.1 5.1
5 5 4.9
4.9 4.8
4.7 4.8 4.6 σ = 1 4.7 4.5 σ = 0.1 μ = 10 σ = 0.01
Number of ad clicks 4.4 μ = 1 Number of ad clicks 4.6 μ = 0.1 4.3
4.5 4.2 0 0.2 0.4 0.6 0.8 1 0 0.2 0.4 0.6 0.8 1 Privacy factor Privacy factor (a) Varying the mean of users’ privacy sensi- (b) Varying the standard deviation of users’ tivities privacy sensitivities
Fig. 6. Number of ad clicks. 26 W. Wang et al. / Computer Networks 79 (2015) 17–29
12 4.5
4 10 μ = 10 3.5 σ = 1
8 3
2.5 6 2 σ 4 1.5 = 0.1
μ = 1 1 Amount of compensation Amount of compensation 2 μ = 0.1 0.5 σ = 0.01 0 0 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 Privacy factor Privacy factor (a) Varying the mean of users’ privacy sensi- (b) Varying the standard deviation of users’ tivities privacy sensitivities
Fig. 7. Amount of compensation.
5 x 105 x 10 5.1 5.1 5 5 4.9 4.8 4.9 4.7 4.6 4.8 4.5 σ = 0.01 4.4 σ = 0.1 4.7 σ = 1 μ = 10
Revenue of advertiser 4.3 μ = 1 Revenue of advertiser 4.6 μ = 0.1 4.2 4.1 4.5 4 0 0.2 0.4 0.6 0.8 1 0 0.2 0.4 0.6 0.8 1 Privacy factor Privacy factor (a) Varying the mean of users’ privacy sensi- (b) Varying the standard deviation of users’ tivities privacy sensitivities
Fig. 8. Revenue of advertisers. declines with larger l, but increases with larger r. The rea- scenario where there are two similar advertisers sharing son is that as l increases, advertisers maintain a constant one market, which can be easily visualized. profit as shown in Figure Fig. 8(a), and it is the ad broker First, we study the case where both advertisers deliver who pays for the users’ higher privacy loss; while as r ads of the same privacy factor, which is set to be 1. grows, users with more diverse privacy sensitivities make Fig. 10 shows the impact of both advertisers’ strategies, advertisers pay more to the ad broker to indirectly moti- i.e. the price of every click, on advertiser 1’s revenue. The vate users, as discussed earlier. results show that advertiser 2’s price has little impact on advertiser 1’s optimal price, which verifies our theoretical results in Proposition 4. 5.2.3. Impact of competition among advertisers Then, we study the case where advertisers deliver ads of Note that the above evaluations focus on independent very different privacy factors. We set the privacy factor of advertisers, e.g., advertisers for irrelevant contents. Next ad 2 as 30 while ad 1’s remains at 1. Recall that the privacy we discuss how the competition among advertisers affect factor of an ad implies its content sensitivity. As such, ad 2 their decisions and revenues. In the competition model, is much more sensitive than ad 1. Fig. 11 shows that advertisers deliver similar ads and share one market. In although the revenue of advertiser 1 no longer keeps con- this subsection, we present the simulation results of the stant when the price of advertiser 2 changes as Fig. 10 W. Wang et al. / Computer Networks 79 (2015) 17–29 27
40 400
35 350 μ = 0.1 σ = 1 30 300
μ = 1 25 250
20 μ = 10 200
15 150 σ = 0.1 10 100 Revenue of ad broker Revenue of ad broker σ 5 50 = 0.01
0 0 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 Privacy factor Privacy factor (a) Varying the mean of users’ privacy sensi- (b) Varying the standard deviation of users’ tivities privacy sensitivities
Fig. 9. Revenue of ad broker.
2
4 0
2
0 −2
−2
−4 −4 −6
−8 −6 −10 Revenue of advertiser 1 −12 1.2 −8 1 6.5 −5 0.8 6 x 10 5.5 −5 0.6 5 x 10 0.4 4.5 −10 4 0.2 3.5 0 3 Price of every click from advertiser 1 Price of every click from advertiser 2
Fig. 10. Revenue of advertisers with the same privacy factor. Privacy factors for both advertisers’ ads are 1. shows, the optimal price of advertiser 1 maintains con- online profiles or behaviors, and incentive mechanism stant, which demonstrates that the Nash Equilibrium can designs for advertising and trading privacy. also be achieved when different ads have different privacy Targeted Advertising Mechanisms. Targeted advertis- factors. Another observation from Fig. 11 is that the reve- ing mechanisms mainly focus on the strategies of advertis- nue of advertiser 1 decreases with the increment of adver- ers or the ad broker to deliver ads to matched users. tiser 2’s price. This is because advertisers are competing Chakrabarti et al. [22] studies the problem of displaying with each other, advertiser 1 loses its user when advertiser relevant ads to web pages and proposes a new class of 2 offers higher price. models to combine relevance and click feedback for con- textual advertising. Mechanisms for search engine to match ads with queries are discussed in [23–25]. These 6. Related work studies model the interactions between the ad broker and advertisers as an auction problem, in which advertis- Existing studies related to privacy-aware targeted ers bid for ads displayed on the search results pages. Pro- advertising can be classified into three categories: targeted vost et al. [26] study the problem of targeted advertising advertising mechanisms, privacy preservation on user’s in the context of social networks, and introduce a frame- 28 W. Wang et al. / Computer Networks 79 (2015) 17–29
10 5
5
0 0
−5
−5 Revenue of advertiser 1 −10
−15 −10
1 6.5 6 −5 5.5 x 10 0.5 5 4.5 −5 4 x 10 3.5 0 3 Price of every click from advertiser 1 Price of every click from advertiser 2
Fig. 11. Revenue of advertisers with very different privacy factor. Privacy factors for advertiser 1’ ads and advertiser 2’s ads are 1 and 30, respectively. work to select users based on page visitations. These works privacy as a commodity, and derive truthful auctions for have focused on the strategies of advertisers and the ad private data trading. Riederer et al. [33] propose an auction broker, while our framework take into account the impact mechanism to sell user’s personal information to multiple of user behaviors on targeted advertising. information aggregators. Our framework is inspired by Privacy Preservation. Many recent works have investi- these studies. Nevertheless, they are different from the tar- gated privacy issues in user’s online profiles and behaviors, geted advertising problem studied in this paper, where all which are involved in targeted advertising. Privad [8] advertisers, users, and the ad broker are decision makers, keeps the users’ profile at their local devices, and intro- and their interactions are modeled and analyzed through duces an anonymizer sitting between users and the ad bro- different stages [11,12]. ker to anonymize user’s clicks. Kodialam et al. [9] propose a targeted advertising system in which users are allowed to send perturbed click statistics to preserve privacy. Adnos- 7. Conclusion tic [7] offloads the ad broker’s task, i.e., behavioral profiling and targeting, to user’s local browser. Privad [15] introduce This paper has studied the privacy-aware targeted an extra proxy to preserve user’s privacy. These privacy- advertising problem, and proposed a compensation frame- preserving systems protect user’s privacy at the cost of work to encourage users to view ads of interest. The com- advertisers’ or the ad broker’s interests, and ignore their pensation framework aims to promote targeted advertising incentives to promote such systems. Our compensation by creating a win–win situation. Under this framework, we framework is built based on their basic privacy-preserving analyze the interactions among advertisers, the ad broker, architecture, that is, keeping users’ profile at local devices, and users through a three-stage game modeling. Simula- and aims to fill the gap between user’s privacy protection tion results demonstrate the efficacy of the proposed and the economic incentives of advertisers and the ad bro- framework, under which users are motivated to click more ker. There are also many privacy preserving techniques for interested ads and both the advertiser and the ad broker user’s online behaviors [27–29]. These techniques nor- achieve considerable gains in their revenues. Therefore, mally perturb user’s actions to hide their precise behaviors, with proper design, the compensation framework can pro- which, however, cannot be directly applied to the targeted mote the adoption of targeted advertising and bring merits advertising as precise clicking information is a prerequisite for all entities. to determine advertiser’s payment. Incentive Mechanism Design. Several incentive mech- anisms are proposed for advertising and trading user’s pri- Acknowledgements vate data. Ning et al. [30] formulate the ad forwarding problem in delay-tolerant networks as a two-player coop- The research was support in part by grants from 973 erative game, and devise an incentive scheme to motivate project 2013CB329006, China NSFC under Grant users to forward ads. The privacy-aware mechanism was 61173156, RGC under the contracts CERG 622613, first proposed in [11] to include the valuation of privacy 16212714, HKUST6/CRF/12R, and M-HKUST609/13, as well as a part of player’s utility. Ghosh and Roth [12] consider as the grant from Huawei-HKUST joint lab. W. Wang et al. / Computer Networks 79 (2015) 17–29 29
References [33] C. Riederer, V. Erramilli, A. Chaintreau, B. Krishnamurthy, P. Rodriguez, For sale: your data: by: you, in: Proc. ACM HotNets, 2011. [1] J. Yan, N. Liu, G. Wang, W. Zhang, Y. Jiang, Z. Chen, How much can behavioral targeting help online advertising?, in: Proc. ACM WWW, 2009. Wei Wang is currently a Ph.D. candidate in [2] H. Beales, The value of behavioral targeting, in: Network Advertising Hong Kong University of Science and Tech- Initiative, 2010. nology. He received his B.E. degree in Elec- [3] Google Adwords.