Google closed its purchase of DoubleClick this month, and the interesting thing about it is that it puts two fundamentally different businesses under one roof while everyone continues to call both of them advertising.
Search advertising works because you announce what you want. You type a phrase, and a phrase typed into a search box is a statement of intent so clear that matching an advertisement to it barely requires inference. Nobody feels watched, because nobody is being watched. You volunteered the information one query at a time, and the transaction is legible in both directions.
Display advertising has none of that. Nobody visits a page in order to declare an interest in anything. So the industry infers, and inference at this scale means following individuals from site to site, building a record of where they went, and deciding from the pattern what they might be persuaded to buy.
The cookie that makes this work sits on thousands of sites that have no relationship with each other and no relationship with the company reading it.
The sharper version of the same idea is happening in Britain, where a company has been signing agreements with internet providers to inspect subscriber traffic directly and sell advertising against what it finds. Not a cookie on a site you visited. The connection itself, examined at the provider, for everything you do.
I have read the defences and they all rest on the data being anonymised and aggregated, and I would take that more seriously if anonymisation had a good track record. A browsing history is a fingerprint. The set of sites a specific person visits in a week is close to unique, and re-identifying an anonymous record against anything else you happen to hold is not a research problem, it is an afternoon.
What makes this hard to resist is that the incentives all point one way. Better targeting genuinely does earn more per impression, which funds sites that would otherwise close, which the readers of those sites would rather have. Nobody in the chain is doing anything they consider wrong, and the person being profiled has no place to object that anyone is obliged to read.
My guess is this runs unchecked until a specific incident makes it concrete for people who do not think about technology. A leaked database, a divorce case, a journalist demonstrating what a browsing record reveals about somebody who agreed to be the example. Then the rules arrive quickly and badly, written by people reacting to one story.