The goals of comScore’s research, of course, is to make the case for panel data in accurately measuring audience. Fred’s conclusion is more general:

You cannot rely on your own analytics data. You need third party data as well. That’s not to say that third party data (primarily panel data) is perfect either. You have to triangulate between all the numbers to get a decent view of what’s actually going on.

Undercounting conversions

All of that said, I titled this post “undervaluing web audiences” because I think there is an interesting flipside to the big “audience is overcounted by 2.5x” message of the study. If audiences are overcounted by this much, and those overcounts apply to ad impressions as well as overall unique visitor counts (according to the study, unique ad impressions were indeed part of the analysis), then there is likely some depression of conversion rates in many of the cookie-based analytics tools.

I’m sure that some simple conversion paths are exempt from this problems: a click on a search ad that results in a conversion during the same browser session is unlikely to suffer from any of the cookie-related issues outlined in the study. More complex paths, however, such as those based on brand impressions, repeated display ad impressions or deferred conversions, are likely to be undercounted by the same measure as the unique audience.

The behavioral ad networks are known for the application of their technology to targeting. Another key asset, however, is the ability to measure the value and ROI of online brand advertising. They use their networks, based largely on cookies, to track the deferred conversions that prove the value of a brand impression campaign.

If they are undercounting these conversions by 2.5x, perhaps current impressions are undervalued such that a correction for overcounting of audience would need to be somewhat offset by an adjustment to effective CPM for the brand ads run on the site. In any case, I’m sure advertisers doing brand impression campaigns, as well as the ad networks, will want to figure out how to more effectively measure deferred conversions if cookies present such significant accuracy problems. It sounds like Tacoda might be using comScore’s data to try to adjust.

‘On behalf of’ logins

LinkedIn and Plaxo are examples of sites doing this to import contact information. In fact, Plaxo makes this functionality available as a service to developers of other applications. Slide, RockYou, Photobucket and a bunch of other widget publishers do this to smooth the process of getting their widgets on users’ pages on MySpace, Bebo, Hi5 and the others. Also, some of the more interesting mashups involve data from the deep web, and require usernames/passwords to get it from 3rd party sites.

API-based authentication

Contrast the ‘on behalf of’ approach with that of Facebook, which exposes APIs providing for access by 3rd party applications, on behalf of users, through a direct authentication by the user to Facebook. As long as the APIs support the access required, this eliminates the need for the 3rd party to collect usernames and passwords.

The fact that MySpace and others don’t have API access (or complete enough APIs) to their sites is what has driven developers to collect credentials and act on behalf of users.

Some sites actually have APIs but don’t take advantage of the fact that they could use them to tighten up security. While Salesforce could use the Facebook-style authentication for 3rd party apps, they instead have those apps solicit and store user credentials (by policy, they allow only “certified” apps to do so).

Why are ‘on behalf of’ logins a problem?

If the 3rd party site is deserving of users’ trust, and everything works properly, there should be nothing wrong with these logins. We don’t worry much about local applications doing this type of thing: blog editors, web design programs, browsers and countless other local apps all store user credentials for 3rd party apps and sites. In fact, this type of login is enabling startups to drive innovation in the new social network ecosystem; if they had to wait for the MySpaces of the world to publish APIs or enable new functionality, these companies would be dead in the water.

In reality, there are some real problems to think about. In addition to a couple of shared issues, the key differences from local applications are also the problems here:

• Trust of the application and vendor - an issue with both web and local applications. The decentralized and volatile nature of web applications, and the lack of user-centric security infrastructure (such as local anti-virus and anti-malware software), make this a tough problem for web applications.
• Authorization of the specific actions that apps take on behalf of their users - an issue with both web and local applications; if this is done really well, the problem of trust of the app and vendor is diminished.
• Location of user credentials - in web applications, these credentials live ‘in the cloud’ somewhere. The vendor claims and reality of the security of those credentials are at best hard to verify.
• Scale - the barriers of installing, and updating, local software limit the scale of this problem in that world. Web applications are easy to sign up for and can be updated multiple times a day, leading to a lot of complexity in managing overall user security.

It looks like a solution probably starts with a way to give users centralized control and management of:

• Authentication credentials
• Authorization of ‘on behalf of’ logins
• Authorization of specific ‘on behalf of’ actions

What about OpenID?

OpenID is a framework for decentralized identity. It supports decentralized authentication and structured sharing of personal information.

‘Decentralized’ in OpenID terms means decentralized from the perspective of web applications; this can in fact mean centralized from the user’s perspective. OpenID could be used to do logins on behalf of users without the collection of credentials, but it does not address the problem of authorization of those ‘on behalf of’ actions. The structured sharing of personal information involves a narrow kind of authorization, but too limited to solve this problem.

The transparency of ‘on behalf of’ action is itself a pretty complex problem - it requires giving the user a way to see and understand what the 3rd party app will go and do for them on the other site. I’m not sure whether this is a problem OpenID is interested in tackling. If it develops momentum as an identity standard, it would certainly be nice to see it go beyond authentication and identity to a more complete view of security (something Microsoft’s virtually dead Passport initiative and the Liberty Alliance project both failed to do).

• Not valuable enough to the publisher to justify looking for advertisers or even signing up for a network
• Not valuable enough to advertisers or networks as inventory based on the low number of views

I think there are a number of things to talk about around advertising on the long tail, but I’m going to focus in this post on what happens when the tail wags. In other words, what happens when a chunk of content in the long, skinny part of the tail suddenly moves toward the fat part.

There are some interesting numbers in an analysis of the results of Digg and Reddit homepage hits for one long tail page. The author describes a site with less than 100 uniques per day growing to a total of 234,000 uniques over 5 days, and describes the process of adding AdSense ads to the site:

After being Dugg, our Adsense account was finally approved 36hrs later, and some adsense ads went on the front page. … Over the four days we used adsense, we made a total of 71.87 [dollars]. Our average click through rate was a dismal 0.24%, although the ads on our site seemed to be fairly highly targeted.

The first problem is the 36 hour delay in getting AdSense ads up on the site; this is a common issue with this type of content, as the ‘wag’ of the long tail content to high visibility can happen very quickly. I’m sure Google could optimize this somewhat, but the nature of long tail content is such that the publisher may not even know about the rush of traffic until days later. The only real solution is for the long tail content to somehow be enabled for advertising before the traffic comes.

The AdSense clickthrough rate of 0.24%, and thus the overall value to the publisher, is another problem: That site’s ad space was only worth a very low $0.70 on a CPM basis. This could be due to a lack of any historical data in AdSense to improve targeting, it could due to the differences in reader behavior for Digg/Reddit/etc referrals versus organic search referrals, or it could be something related to the specific content.

In all likelihood, there is an opportunity for publisher and ad network to get a lot more value from this content. Were Digg, for example, to create a new kind of ad network where signing up was just about as easy as putting a “Digg It” button on a page, they would have a good stab at signing up long tail publishers beforehand, and solving the problem that caused a 36 hour delay in monetization in the example above.

Digg, like similar sites, also has access to some great raw data about content. They know categorization, topics and tags, along with the momentum of individual content moving out of the long tail. Given an ad network, they would also be able to create multiple-impression campaigns across member sites, adding value for ad buyers. I’m betting the value of the space on each popular content page would be higher in the context of a common ad network across the Digg site and many of those linked pages. Consider the value to advertisers of being able to buy, in advance, ad space on the sites that will be on Digg’s front page in the future.

The real value may be the power of the social bookmarking sites’ community to, implicitly or explicitly, control the ads associated with each linked page. This could be as simple as doing what any smart ad network does, and showing the better performing ads more often on a given page. A more interesting approach might be to make the control explicit by giving users the ability to vote up or down the various ads associated with a page, or by showing how many previous users had clicked an ad.

I’m curious to see how directly the user generated content wave impacts advertising, and how sites like Digg evolve to increase the ad value of the long tail content that they rocket to prime time.