Privacy-preserving data accumulation

Abstract

A method, apparatus and system of data distribution in a computer network, the method is executed by a server computer in communication with client devices, the method comprising: defining distributable data comprising content data and policy data, the policy data comprising a randomized rule restricting a presentation of the content data on a client device based on a random factor. The policy data comprises a targeting rule restricting the presentation of the content data on the client device according to local data retained on the client device. The method comprises distributing the distributable data to the client devices, thereby enabling each client device to use the distributable data for restrictively presenting the content data according to the randomized rule or the targeting rule.

Description

PRIVACY-PRESERVING DATA ACCUMULATIONCROSS-REFERENCE TO RELATED APPLICATION

[0001] This application claims the benefit of Provisional Patent Application No. 63 / 616,636 filed December 31, 2023, titled “PREVENTING SINGLING OUT”, which is hereby incorporated by reference in its entirety without giving rise to disavowment.TECHNICAL FIELD

[0002] The disclosed subject matter relates to data communications, and more specifically but not exclusively, to accumulating data over a computer network in a privacy preserving manner.BACKGROUND

[0003] Privacy-preserving regulations may prohibit the accumulation, analysis, and storage of sensitive information. For example, sensitive information may include geolocation data, acceleration patterns, connectivity data, sensor-based data, or the like.

[0004] In certain cases, these regulations address the practice of singling out individuals based on personal attributes or behavior patterns. Identifying or isolating individuals for targeted actions or content presentation could result in privacy violations, especially when such actions are based on data that can uniquely identify a person.BRIEF SUMMARY

[0005] One exemplary embodiment of the disclosed subject matter is a method of data distribution in a computer network, the method comprising steps executed by a server computer in communication with a plurality of client devices, the steps comprising: defining distributable data, wherein the distributable data comprises content data and policy data, the policy data comprising a randomized rule restricting a presentation of the content data on a client device of the plurality of client devices based on a random factor, the policy data comprising a targeting rule restricting the presentation of the content data on the client device according to local data retained on the client device; and distributing at least a part of the distributable data to the plurality of client devices, thereby enabling each client device of the plurality of client devices to use the part of the distributable data for restrictively presenting the content data according to at least one of the randomized rule or the targeting rule.

[0006] Optionally, the part of the distributable data comprises only the targeting rule, and the method further comprises a subsequent step of sending update data comprising the randomized rule to the plurality of client devices.

[0007] Optionally, said distributing comprises distributing the distributable data with activation settings of the randomized and targeting rules, the activation settings indicating whether the randomized and targeting rules are activated, wherein the plurality of client devices is instructed to restrictively present the content data according to activated rules and not according to deactivated rules.

[0008] Optionally, the method comprises sending update data subsequently to said distributing, wherein the update data comprises a change to the activation settings.

[0009] Optionally, the activation settings provided by said distributing indicate a deactivation of the randomized rule and an activation of the targeting rule, wherein the change to the activation settings in the update data comprises activating the randomized rule.

[0010] Optionally, the method comprises sending second update data subsequently to said sending the update data, the second update data comprises a second change to the activation settings, the second change comprises deactivating the randomized rule.

[0011] Optionally, the activation settings provided by said distributing indicate an activation of the targeting rule and the randomized rule, wherein the change to the activation settings in the update data comprises deactivating the randomized rule.

[0012] Optionally, the distributable data further comprises data defining a criterion for adjusting the activation settings, said adjusting comprises deactivating or activating a rule in the policy data.

[0013] Optionally, the targeting rule restricts the presentation of the content data according to an estimated relevancy of the content data to a user of the client device, wherein compliance with the estimated relevancy is determined locally by the client device based on the local data, wherein the content data is estimated to be relevant to the user of the client device in case the local data complies with the targeting rule.

[0014] Optionally, the method comprises obtaining reports from the plurality of client devices, the reports indicating a number of presentations of the content data to the plurality of client devices.

[0015] Optionally, the method comprises calculating a number of end users that were exposed to the content data based on the reports, and sending data updating the distributed data to the plurality of client devices, based on said calculating.

[0016] Optionally, the local data retained on the client device comprises at least one of: demographic data of a user of the client device, location data, or data extracted from a reading of at least one sensor of the client device.

[0017] Optionally, the at least one sensor comprising a gyroscope, a Wi-Fi receiver, a Bluetooth receiver, a charger connection sensor, an accelerometer, a Global Positioning System (GPS) receiver, a camera, a magnetometer, a proximity sensor, an ambient light sensor, a microphone, a touchscreen sensor, a fingerprint sensor, a pedometer, a barometer, a thermometer, an air humidity sensor, or the like.

[0018] Optionally, the content data comprises campaign data.

[0019] Optionally, the targeting rule is defined by an administrative user, wherein the content data is defined by the administrative user, and wherein the randomized rule is defined, at least partially, automatically by a software entity.

[0020] Another exemplary embodiment of the disclosed subject matter is an apparatus of a server computer comprising a processor and coupled memory, the server computer is in communication with a plurality of client devices, said processor being adapted toperform a method of data distribution in a computer network, the method comprising: defining distributable data, wherein the distributable data comprises content data and policy data, the policy data comprising a randomized rule restricting a presentation of the content data on a client device of the plurality of client devices based on a random factor, the policy data comprising a targeting rule restricting the presentation of the content data on the client device according to local data retained on the client device; and distributing at least a part of the distributable data to the plurality of client devices, thereby enabling each client device of the plurality of client devices to use the part of the distributable data for restrictively presenting the content data according to at least one of the randomized rule or the targeting rule.

[0021] Yet another exemplary embodiment of the disclosed subject matter is a computer program product comprising a non-transitory computer readable medium retaining program instructions, which program instructions, when read by a processor, cause the processor to perform a method of data distribution in a computer network, wherein the processor is executed by a server computer in communication with a plurality of client devices, the method comprising: defining distributable data, wherein the distributable data comprises content data and policy data, the policy data comprising a randomized rule restricting a presentation of the content data on a client device of the plurality of client devices based on a random factor, the policy data comprising a targeting rule restricting the presentation of the content data on the client device according to local data retained on the client device; and distributing at least a part of the distributable data to the plurality of client devices, thereby enabling each client device of the plurality of client devices to use the part of the distributable data for restrictively presenting the content data according to at least one of the randomized rule or the targeting rule.

[0022] Y et another exemplary embodiment of the disclosed subject matter is a computer network comprising: a plurality of client devices; a server computer in communication with the plurality of client devices, wherein the server executes a method of data distribution in the computer network, the method comprising: defining distributable data, wherein the distributable data comprises content data and policy data, the policy data comprising a randomized rule restricting a presentation of the content data on a client device of the plurality of client devices based on a random factor, the policy data comprising a targeting rule restricting the presentation of the content data on the clientdevice according to local data retained on the client device; and distributing at least a part of the distributable data to the plurality of client devices, thereby enabling each client device of the plurality of client devices to use the part of the distributable data for restrictively presenting the content data according to at least one of the randomized rule or the targeting rule.

[0023] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. The materials, methods, and examples provided herein are illustrative only and not intended to be limiting.

[0024] Implementation of the method and system of the present invention involves performing or completing certain selected tasks or steps manually, automatically, or a combination thereof.

[0025] Moreover, according to actual instrumentation and equipment of preferred embodiments of the method and system of the present invention, several selected steps could be implemented by hardware or by software on any operating system of any firmware or a combination thereof.

[0026] For example, as hardware, selected steps of the invention could be implemented as a chip or a circuit. As software, selected steps of the invention could be implemented as a plurality of software instructions being executed by a computer using any suitable operating system. In any case, selected steps of the method and system of the invention could be described as being performed by a data processor, such as a computing platform for executing a plurality of instructions.THE BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS

[0027] The present disclosed subject matter will be understood and appreciated more fully from the following detailed description taken in conjunction with the drawings in which corresponding or like numerals or characters indicate corresponding or like components. Unless indicated otherwise, the drawings provide exemplary embodiments or aspects of the disclosure and do not limit the scope of the disclosure. In the drawings:

[0028] Figure 1 illustrates a flowchart diagram of a method, in accordance with some exemplary embodiments of the disclosed subject matter;

[0029] Figure 2 illustrates a schematic illustration of an exemplary architecture, in accordance with some exemplary embodiments of the disclosed subject matter;

[0030] Figures 3A-3C illustrate exemplary sequence diagrams, in accordance with some exemplary embodiments of the disclosed subject matter; and

[0031] Figure 4 illustrates a block diagram of an apparatus, in accordance with some exemplary embodiments of the disclosed subject matter.DETAILED DESCRIPTION

[0032] One technical problem dealt with by the disclosed subject matter is facilitating effective accumulation of data over computer networks. It may be desired to overcome issues that limit effective accumulation of data in computer networks, such as the demand for privacy-preserving technologies. In some cases, privacy-preserving regulations may prohibit the accumulation, analysis, and / or storage of sensitive information from end devices.

[0033] For example, sensitive information may comprise geolocation data, acceleration patterns, connectivity data, sensor-based data, or the like. As another example, sensitive information may comprise Personally Identifiable Information (PII), such as the home location of the end-user, along with sensitive information, such as the user's comings and goings. Sensitive information may comprise data that, in large quantities, can be used to track activities, activity patterns, PII, or to obtain any private or personal information of users which may be sensitive to the user, which may be used to uniquely identify the user, or the like. As another example, sensitive information may comprise any type of user data that is continuously monitored, periodically monitored, monitored based on instructions, monitored based on detecting real time events, or the like. As an example, sensitive information may include geolocation data received from satellite-based sensors such as from a Global Navigation Satellite System (GNSS) receiver of a user device, or from non-satellite-based positioning modules which may be embedded in the user device. As another example, sensitive information may include connectivity information, e.g., Received Signal Strength Indicator (RSSI) indications, which may indicate a connectivity level of user devices to connectivity providers such as Wi-Fi access points, hotspots, cellular towers, or the like. As another example, sensitive information may include data obtained from sensors such as accelerometers and gyroscopes of the user device, e.g., which may indicate a speed, an orientation, a direction, or the like, of the user devices. As another example, sensitive information may include network-based data such as browsing history, purchase history, dialed numbers, chat history, or the like.

[0034] In some exemplary embodiments, protecting regulations may be governed by different rules and regulations such as the European Union (EU) General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), the UK Information Commissioner’s Office (ICO) guidance with respect to “personal information”, the UKGDPR, or the like. Such regulations may aim to protect individual’ privacy, and may govern data accumulation, data storage, data analysis, or the like.

[0035] In some exemplary embodiments, it may be desired to facilitate effective accumulation of data over computer networks in a manner that does not enable to track or identify users operating their user devices (also referred to as “clients”, “client devices”, and “end devices”).

[0036] Another technical problem dealt with by the disclosed subject matter is facilitating effective accumulation of data while complying with strict privacy regulations, e.g., regulations that prohibit singling out individuals.

[0037] In some exemplary embodiments, strict privacy regulations may prohibit singling out individuals, even if they cannot be recognized, identified, or the like. In some exemplary embodiments, “singling out” may refer to identifying or distinguishing individuals from others based on their personal data. This can be done by using direct identifiers, such as names or social security numbers, or by using indirect identifiers, such as images or location data, that can provide context to single out an individual. A person may be considered to be singled out if identified in a specific small audience segment, such as a single person, a group of no more than a minimal threshold number of members (e.g., 10 people or any other defined number of members), or the like, as defined by relevant laws and regulations. Legislators may forbid or limit singling out because singling out can violate the individual’s right to privacy and expose the individual to potential harm, such as discrimination, fraud, or identity theft.

[0038] In some exemplary embodiments, some privacy regulations, such as the prohibition of singling out individuals, may be stricter than others, and ensuring that users cannot be identified may not suffice for such regulations. In some exemplary embodiments, the prohibition of singling out individuals may incur significant burden on content distributors, publishers, or the like, who may wish to accumulate data regarding the performance of distributed content (e.g., the number of opportunities, impressions, click rates, or the like). In some cases, the prohibition of singling out individuals may limit not only the accumulation of data regarding the performance of distributed content, but also the accumulation of data regarding the number of users to which distributed content was actually presented.

[0039] Yet another technical problem dealt with by the disclosed subject matter is facilitating targeted distribution of content while complying with strict privacy regulations. In some exemplary embodiments, targeted distribution of content may refer to making the distribution of data more targeted to the audience, such that the data is less likely to be presented to irrelevant users or client devices.

[0040] In some exemplary embodiments, distribution-related entities such as advertising parties may desire to perform an effective targeted distribution of content, basing the targeting of the content on sensitive information from user devices, such as for identifying opportunities. Simultaneously, distribution-related entities may desire to comply with privacy requirements. For example, it may be desired to enable an effective targeted distribution of content while ensuring that the server- side is prevented from singling out individuals.

[0041] In some exemplary embodiments, a targeted distribution of content may be considered to be effective based on its measured performance, based on the ratio of content presented to irrelevant users, based on wasting bandwidth and other computing resources allocated for irrelevant users, or the like. For example, users may be considered irrelevant in case they do not match criteria found by a targeting calculation. The targeting calculation may comprise a manual and / or automatic process attempting to identify criteria of users for which the content is relevant, criteria of users that are estimated to be interested in the content, criteria of users that are estimated to interact with the content, or the like. In some exemplary embodiments, as the ratio of relevant users from the audience is greater, the targeted distribution may be considered more effective, and vice versa.

[0042] In some exemplary embodiments, when distributed content is targeted, the content is less likely to cause unnecessarily excessive consumption of bandwidth and other networking or other computing resources. For example, instead of sending and presenting content such as marketing campaign materials, software update information, or other content to users that have no real need, interest or use for the content, which may not be useful for a distributer of the content, targeted content distribution may aim to send and present the content to relevant users. As another example, instead of communicating monitoring data related to user reactions to the data when the data is presented toirrelevant users, targeted content distribution may aim to communicate monitored user reactions of relevant users.

[0043] In some exemplary embodiments, targeted content distribution may be useful in many scenarios. For example, software developers that wish to introduce a number of changes to their clients’ software Graphical User Interface (GUI), may attempt to distribute the changes gradually, in several phases, such that in each phase, only users that are most likely to use the GUI in a particular way are exposed to a change made to the GUI in that phase. According to this example, the more targeted the presentation of the GUI changes becomes, the less the computer networks will be overloaded with data that records reactions of irrelevant users. As another example, data that is indicative of reactions (such as hypertext click throughs) of users that are presented the distributer’s content, may be communicated back to a server of the distributer, to be used for marketing analysis or other purposes. According to this example, a poorly targeted presentation of the content (i.e. one that involves many instances of presentation to irrelevant users), results in unnecessary and excessive overloading of computer networks with the reaction data related to irrelevant users. According to this example, a targeted presentation of the content that communicates reaction data of relevant users may result with a reduced overload of computer networks.

[0044] In some exemplary embodiments, in order to facilitate targeted content distribution effectively, the process may in many cases incorporate violations of privacy laws and regulations. For example, the targeting of data distribution can be achieved based on information about the users or client devices, by making such information available on a server (e.g., an accumulating server) that is configured to accumulate and analyze such data. In some exemplary embodiments, a server may be configured to accumulate, or crowd- sense, information regarding the performance of the content distribution, the user interactions therewith, the number of exposed users, or the like, and to retain such data in a database, repository, or the like. Such accumulated data may violate privacy regulations since, when used in large quantities, it may be utilized to identify activity patterns of users, such as driving times, walking times, working times, working places, shopping habits, or the like, which may enable to single out individuals.

[0045] Consequently, there is a need for systems that prevent the ability to target or single out specific individuals, track their behavior patterns, or the like, while still enabling effective targeted delivery of content.

[0046] Yet another technical problem dealt with by the disclosed subject matter is providing a targeted distribution of distributable campaigns to user devices, without violating strict privacy regulations. In some exemplary embodiments, distributable campaigns may be designed to provide a functionality with respect to an audience. One notable example is an electronic executable campaign that is aimed at providing to the audience with executable content items, such as campaign advertisements, organic content, sponsored content, a video clip, informative data sheets, or the like.

[0047] In some exemplary embodiments, campaigns may be designed to target specific audience segments identified as relevant by the campaign provider. These segments can be defined by various targeting criteria, including mobility-based information (e.g., location, movement patterns), demographic details (e.g., gender, age), non-personally identifiable information (non-PII) about the end device or user, or activities of the end device. The targeting may involve offline information about the end device, allowing real-time identification of user activities that align with the rules for serving the campaign. As an example, a campaign provider may aim to target users in a specific location or age group to maximize the relevance of their content. This targeting process is detailed in Patent Application No. 17 / 759,524, titled “Distributed Content Serving,” filed on 07 / 27 / 2022, which is hereby incorporated by reference in its entirety for all purposes without giving rise to disavowment (hereinafter the “Distributed Content Serving Application”). In some exemplary embodiments, delivery rules for serving content of campaigns, which aim to target relevant users, may be referred to as “targeting rules”.

[0048] In some exemplary embodiments, campaign targeting may comprise setting audience segmentation, defining a segment of audience that targeted for the campaign (e.g., is estimated to be relevant thereto), and targeting rules for defining when content from the campaign should be served to audience with the selected segment. In some exemplary embodiments, campaigns may be generated with defined targeting rules for a delivery context. In some exemplary embodiments, content from the campaign may be set to be served in case the delivery context at an end device complies with at least onetargeting rule. For example, the delivery context may comply with at least one targeting rule at night time, while commuting from work, or the like. In the present disclosure, unless explicitly written otherwise, the audience segmentation may be considered as part of the targeting rules.

[0049] In case the criteria of the targeting rules are never be fulfilled by a member of the selected segment, the campaign will not be served to such member. For example, a campaign targeting a “sporty person” when he or she is abroad (e.g., the delivery context is when the user is abroad) would not be served to non-sporty users due to the definition of the audience segmentation, but also would not be served to sporty people who are always located in their home state due to the delivery context not complying with targeting rules.

[0050] In some exemplary embodiments, campaign targeting using audience segmentation and targeting rules may place a restriction on the presentation of content data, which may be carried out on a client device that is in receipt of the content data rather than on the server computer (also referred to as “distribution server”) of the content’s distributer. For example, locally-collected data regarding the delivery context of the client device may be used to determine compliance with targeting rules, and may restrict the presentation of the content data to events of compliance only. According to this example, the targeting may be enhanced without making the context data itself available on the server.

[0051] In some cases, basing the content presentation on the local delivery context of the client devices may in some cases still result in a singling out of a user of one of the client devices, or in a singling out of a small group of users or client devices, such that the number of users that are presented the content, is lower than a minimal threshold (a defined threshold that prevents singling out). It may be desired to overcome this challenge.

[0052] For simplicity of disclosure, the present disclosure focuses on a scenario in which the distributable data comprises a campaign with one or more content items that is provided to the end devices. However, the disclosed subject matter should not be construed to be limited to such embodiment, and it may be applicable to other types of distributable data, as well as to other types of campaigns. For example, the disclosed subject matter may be applicable to campaigns with covert functionality. A covertfunctionality campaign may be a campaign, in which the functionality is implemented behind the scenes. The audience may not be aware of the campaign being executed (or “served”). For example, a covert campaign may update a value in the backend for specific audiences (e.g., updating in a Customer Relationship Management (CRM) software a value regarding users having a NISSAN™ car and drive more than 7 times a week; such information may be acted upon later on in interactions with the same customers). As another example, a covert campaign may plant a FACEBOOK™ pixel, a cookie, or implement another tracking functionality to the users for which the campaign is served, and may be utilized to target those users with specific content-based campaign. As yet another example, the campaign may update information useful for analytics.

[0053] Yet another technical problem dealt with by the disclosed subject matter is providing a targeted distribution of distributable campaigns to user devices using microsegmentation, without violating strict privacy regulations.

[0054] In some cases, audience segmentation may be performed based on microsegmentation. In some exemplary embodiments, targeting campaigns according to microsegmentation may involve tailoring campaign delivery to highly specific and detailed population categories, known as micro- segments. These segments go beyond traditional demographic data and delve into nuanced aspects of user behavior, activities, and interactions. Micro-segments may be used to define high-resolution detailed population categories, and may enhance the accuracy of campaign targeting.

[0055] In some cases, the application of micro -segmentation and delivery context may have an elevated risk of singling out certain users and serving a campaign to a single user or a small group of users. For example, in case the number of users or client devices presented with the content is smaller than a predefined threshold (e.g., a minimal threshold set by one or more regulations), this may result with singling out individuals. It may be desired to overcome such challenges, and prevent singling out of users that are targeted using micro- segmentation or targeting rules.

[0056] Yet another technical problem dealt with by the disclosed subject matter is providing a system that balances between safety and privacy requirements on the one hand, and is useful for advertising, navigation, or any other third-party applications, on the other hand.

[0057] One technical solution provided by the disclosed subject matter is to incorporate a random factor into targeted content distribution, in order to prevent the ability of servers to single out any client devices. In some exemplary embodiments, a distribution of campaigns to a plurality of end devices may be facilitated such that at least some serving of campaign content is performed randomly to end devices that are not targeted by the campaign segments and the targeting rules defined by the campaign provider.

[0058] In some exemplary embodiments, serving campaigns strictly based on microsegmentation criteria and / or defined targeting rules for the delivery context may be referred to as “pure targeting” or “pure mode”. For example, in case pure targeting is performed, and the micro- segmentation criteria and the targeting rules of a content item of a campaign define that the content item should be served only for women with blond hair above the age of 45 when they return home from work after 8PM, then the content item will not be served unless all of the defined requirements are complies with. In case the number of users that end up being served with the content item is smaller than a predefined threshold, which may become more likely as the micro-segmentation criteria and targeting rules are more precise, singling out of individuals may become feasible.

[0059] In some exemplary embodiments, targeting campaigns according to microsegmentation involves tailoring campaign serving based on specific user characteristics, behaviors, and patterns. Micro- segments may finely define population categories, such as demographics, physical activities, online behaviors, or combinations thereof, to whom the campaign is designated. The campaign provider may define the micro -segments, ensuring a granular understanding of user attributes. The campaigns may be activated for specific micro-segments, allowing advertisers to deliver content tailored to the unique characteristics of each group.

[0060] In some exemplary embodiments, instead of utilizing pure targeting, the disclosed subject matter may employ at least part time implementation of “hybrid targeting”, also referred to as “hybrid mode”. In some exemplary embodiments, hybrid targeting may refer to serving campaigns according to a combination of the criteria used for pure targeting, with one or more additional criterions that are based on randomness, stochastic-driven, or the like. In some exemplary embodiments, when hybrid mode is applied, content items will be served upon determination of compliance with the criteriaof the pure targeting, and also upon determination of compliance with the additional criterions.

[0061] In some exemplary embodiments, hybrid targeting may apply randomized rules that are generated randomly, or that take into consideration a random determination, a random factor, a random function, a random trigger, a random event, or the like. For example, randomized rules may define that content serving is to be performed every defined number of opportunities, e.g., every 50 opportunities, 100 opportunities, 200 opportunities, every randomly selected number of opportunities, or the like, regardless of the pure targeting criteria. According to this example, the application of content serving that is not based on pure targeting criteria may incorporate randomness into the content distribution, making it impossible for the server to determine whether content serving indicates compliance with pure targeting criteria or not.

[0062] As another example, randomized rules may define that content serving is to be performed every defined number of opportunities, only to client devices that comply with a subset of the pure targeting criteria. For example, every 100 opportunities content serving may be performed in case the client device complies with a subset of the pure targeting criteria, which may be selected randomly, according to defined settings, a combination thereof, or the like. For example, in case pure targeting criteria relates to serving a content item for men above the age of 55 when drinking beer, a randomized rule may define that content serving should be performed every 150 opportunities in case the client device is associated with a user that drinks beer, even if not compliant with the remaining criteria (e.g., not a man, not above the age of 55), thereby expanding the scope of the pure targeting criteria.

[0063] As another example, randomized rules may define that content serving is to be performed every defined number of opportunities, only to client devices that comply with criteria that is related or similar to the pure targeting criteria. For example, criteria may be considered similar if associated with a same category as at least a subset of the pure targeting criteria, if determined to be similar by a semantic analyzer, a machine learning predictor, or the like. For example, in case pure targeting criteria relates to serving a content item for men above the age of 55 when drinking beer, a randomized rule may define that content serving should be performed every 100 opportunities in case the clientdevice is associated with a user above the age of 50. According to this case, the age being above 50 may be considered similar to the original condition of the age being above 55.

[0064] As another example, randomized rules may define that content serving is to be performed every defined number of opportunities, only to client devices that comply with a condition that is not associated to the pure targeting criteria. The condition may be determined randomly, by a user, or by a combination. For example, a randomized rule may define that every 100 opportunities content serving may be performed in case the client device has an International Mobile Equipment Identity (IMEI) number that ends with the characters “92”. According to this example, the characters “92” may be selected randomly or manually by a user, and may represent a condition that is random in the sense that it is not targeted and is not associated with any part of the pure targeting criteria. In some exemplary embodiments, the condition may or may not be defined based on locally retained data of the respective end device.

[0065] In some exemplary embodiments, instead of strictly adhering to pure targeting criteria, and exclusively serving campaigns to devices that precisely match the pure targeting criteria, the disclosed subject matter incorporates randomized rules that introduce randomness to the targeting process. In some exemplary embodiments, a hybrid targeting to utilizes both pure targeting criteria and randomized rules may serve content to an increased range of end devices, even those that do not comply with targeting criteria outlined by the campaign provider. In some exemplary embodiments, the hybrid targeting may not replace the pure mode, but may constitute an addition to it. This incorporation of random serving as a component of the campaign serving, may enable to prevent the concentration of serving campaigns to a specific audience that can be singled out, and broadens the reach of the campaigns to additional audience.

[0066] In some exemplary embodiments, the ratio of hybridization in distributing the campaign may be determined based on different characters, such as size of the audience, the number of end devices that are served with content after a timeframe in pure mode, the diversity of the pure targeting criteria, or the like.

[0067] In some exemplary embodiments, a server may instruct end devices to switch between pure mode and hybrid mode dynamically, e.g., back and forth, according to various factors. In some exemplary embodiments, the modes may be dynamicallyswitched at the end devices, such as according to local rules or instructions from the server.

[0068] In some exemplary embodiments, upon obtaining a campaign at a client device, e.g., from a distributing server, the client device may decide whether to serve the campaign or not, when to serve the campaign, or the like, in accordance with the pure mode or with a hybrid mode. In some exemplary embodiments, the client devices may apply pure mode or hybrid mode according to settings of an obtained campaign, instructions, according to activations and deactivations of rules within an obtained campaign, according to the absence or presence of randomized rules within an obtained campaign, or the like.

[0069] In some exemplary embodiments, each client device that serves a content item of a campaign, may be configured to report such events back to the server, indicating whether it served the item or not, the number of servings according to targeting rules and the number of servings according to randomized rules, and without exposing local data of the device such as PII information. This feedback mechanism may be used for tracking the effectiveness of the hybrid targeting approach. For example, the reporting may occur periodically, every time a campaign is presented, in case a campaign was presented a defined number of times, or the like. In some cases, end devices may not report whether a specific serving of content was according to targeting rules or randomized rules.

[0070] In some exemplary embodiments, the client devices may switch between pure mode and hybrid mode in one or more scenarios. For example, a client device may initially apply hybrid mode, and once a minimal threshold of users is reached, the server may notify the end devices to transition to pure targeting. In some exemplary embodiments, the minimal threshold may be set to ensure that a sufficient number of devices received and responded to the campaign such that singling out users is not feasible, is prevented, or the like, before returning to pure mode.

[0071] As another example, a client device may initially apply pure mode, and in case a minimal threshold of users is not reached until a defined timeframe, the server may notify the end devices to transition to hybrid targeting. In some exemplary embodiments, the decision to engage in hybrid targeting may be based on estimations of the target audience, the rate at which the campaign is distributed, or similar factors. Once a predetermined threshold of end-devices is reached, the server may instruct the device torevert from hybrid targeting back to pure targeting, thereby enhancing the precision of the targeting process. This dynamic decision-making process may ensure flexibility in adapting the targeting strategy based on evolving circumstances.

[0072] One technical effect of the disclosed subject matter is enabling distributors of content to accumulate performance data of their content, while preventing singling out of individuals. The performance data may allow the analysis of campaign data, such as evaluating the effectiveness of served content, bookkeeping against other entities, the reach of served data, or the like. Applicant notes that although the disclosed subject matter is exemplified using campaigns, the disclosed subject matter is not limited to such content, and any distributable content or data may be provided to the users, as well as any functionality, including covert functionality of a covert campaign.

[0073] Another technical effect of the disclosed subject matter is enabling to analyze behavior patterns of users based on accumulated user information that cannot be used to single out individuals. Specifically, the number of impressions and interactions of a campaign may be determined based on reports obtained from user devices, e.g., without retaining user identifiers that match the users to any microsegment or other classification, and without enabling to single out any users.

[0074] Yet another technical effect of utilizing the disclosed subject matter is enabling to introduce randomness to the system while minimizing the effect of the randomness on the prediction of the targeting. For example, by switching back to pure mode upon reaching sufficient end users, the disclosed subject matter ensures that the highly precise microsegments and targeting rules are applied immediately after ensuring that singling out is presented.

[0075] Yet another technical effect of utilizing the disclosed subject matter is complying with strict privacy requirements. In some cases, although accumulated performance data may be shared with third-party stakeholders, the data may not enable to single out any specific individual or group.

[0076] Yet another technical effect of utilizing the disclosed subject matter is reducing the wasting of computational resources and network resources on presenting the data to irrelevant users of client devices and / or communicating reaction data from such users over computer networks, while also ensuring that singling out users is prevented. Thedisclosed hybrid mode, which combines targeted content distribution with randomized rules, provides a framework that balances between accurate targeting of distributable data, and between compliance with strict privacy regulations.

[0077] The disclosed subject matter may provide for one or more technical improvements over any pre-existing technique and any technique that has previously become routine or conventional in the art. Additional technical problems, technical solutions and technical effects may be apparent to a person of ordinary skill in the art in view of the present disclosure.

[0078] Referring now to Figure 1 showing a flowchart diagram of a method, in accordance with some exemplary embodiments of the disclosed subject matter.

[0079] The exemplary method of Figure 1 includes steps that at least one computer processor, such as a computer processor that is a part of a circuit (i.e. hardware and associated circuitry) or of two or more circuits of one or more respective computer(s), is / are programmed to perform.

[0080] On Step 110, distributable data may be defined, determined, generated, obtained, or the like. In some exemplary embodiments, the distributable data may be generated to comprise campaign data such as advertisement campaign data, content data such as technical software documentation data or a software update, content items, policy data, or the like. For example, the content data may comprise commercial content that is made of advertisement campaign materials, promotional messages or other content items, and that may be created, for example, by an administrator user of a distributer of the commercial or other content. As another example, the content data may comprise technical content that is made of a user guide, technical support data, software version update data, or the like, that is created by a software vendor or distributer. In some exemplary embodiments, campaign data may be obtained from a campaign manager, a campaign database, a publisher, an advertiser, a software vendor, or the like. For example, campaign data may be obtained from a remote server, cloud, or the like.

[0081] In some exemplary embodiments, the distributable data may be generated to comprise or be associated with “policy data”. In some exemplary embodiments, the policy data may comprise microsegments and targeting rules for each campaign, metadata for each campaign, or the like. For example, targeting rules of a campaign may define when and whether content of the campaign should be served at an end device, e.g.,using a local delivery context of each end device, local data thereof, or the like. In some exemplary embodiments, a presentation of content according to the policy data, may be referred to as an “impression”.

[0082] In some exemplary embodiments, the policy data may be defined on a server computer that is in communication with a plurality of client devices. In some exemplary embodiments, the server computer may be configured to distribute the distributable data, including the policy data, to the client devices, to be presented to users of the client devices. In some cases, the policy data may be defined manually by an administrator user, an operator associated with a content distributor, an operator associated with a campaign manager, a publisher, an advertiser, a software vendor, or another party, an employee of an advertiser or of a software vendor, or the like. In some cases, the policy data may be defined automatically, such as by machine learning models, data driven models, statistical model, or the like.

[0083] In some exemplary embodiments, the targeting rules of the policy data may restrict the presentation of the content data according to local data that is retained on the client device, data regarding a user of the client device, data regarding interactions of the user with the client device, data regarding sensor readings of the client device, data regarding a locally stored profile of the user on the client device, or the like. For example, compliance with targeting rules may be identified using client devices’ locally-retained data that is not available on the server computer (for privacy reasons), and may be configured to personalize the presented impressions to be well targeted, such that content items will be presented in case they are relevant to the user.

[0084] In some exemplary embodiments, the policy data may rely on locally retained data on the client device, to determine compliance with the targeting rules, which in turn may trigger impression events. In some exemplary embodiments, the locally retained data may comprise data extracted from one or more readings of sensors of the client device (e.g., a Global Positioning System (GPS) sensor, an accelerometer, a camera, a light sensor, an ambient light sensor, a gyroscope, a Wi-Fi receiver, a Bluetooth receiver, a charger connection sensor, magnetometer, a proximity sensor, a microphone, a touchscreen sensor, a fingerprint sensor, a pedometer, a barometer, a thermometer, an air humidity sensor, a combination thereof, or the like). In some exemplary embodiments, the locally retained data may comprise private data regarding the user of the client device,such as a user profile, demographic user information (e.g., gender and age), data about the client device, or the like, which may not be accessible to the server computer that distributes the distributable data. In some exemplary embodiments, the locally retained data may be made unavailable to the server computer in order to comply with privacy regulations.

[0085] In some exemplary embodiments, in case the client device reports to a server the number and type of impressions that are performed on the client device, the server may become capable of singling out a specific user, even if not having access to identifying information of the user (e.g., his name, address, driving license number, or the like). In some exemplary embodiments, in order to overcome this problem, the policy data of the distributable data may be adjusted to comprise, in addition to targeting rules, one or more randomized rules.

[0086] In some exemplary embodiments, the randomized rules may be configured to randomly restrict the presentation of the content data on the client device. In some exemplary embodiments, the randomized rules may increase the scope of targeted users, to include users that do not match the targeting rules. For example, a randomized rule may define that content serving should be performed every defined number of impressions in case one or more conditions are detected. According to this example, the conditions may comprise a subset of the targeting rules, similar criteria to the targeting rules, randomly selected microsegments, randomly selected criteria that is not based on local data, randomly selected criteria that is based on local data, or the like. Randomized rules may be based on a random function, a random variable, a random selection of indices from a database of rules or micro segments, or the like. In some cases, one or more randomized rules may be defined using local data. For example, a randomized rule may be generated to select a random section of the storage of the client device, and use the selected storage for defining a triggering event (e.g., a delivery context).

[0087] On Step 120, generated distributable data, including the defined policy data, may be distributed from one or more servers to a plurality of client devices. In some exemplary embodiments, the data may be distributed over a computer network.

[0088] In some exemplary embodiments, the policy data may be configured to manage, at each client device, a selective presentation of content items according to the rules of the policy data, e.g., the randomized and targeting rules. In some cases, on each one ofthe client devices that are in receipt of the distributable data, the data’s presentation may be restricted according to the policy data.

[0089] In some exemplary embodiments, the policy data may be distributed once, periodically, or the like. For example, the policy data may be distributed with randomized and targeting rules. As another example, the policy data may be initially generated to include randomized or targeting rules, not both, and the server may update the client devices with additional rules after a time period, in case the number of impressions of different client devices is below a threshold, or the like. For example, a first batch of rules in the policy data may comprise targeting rules, and a second batch of rules in the policy data may comprise randomized rules.

[0090] On Step 130, content items from the distributable data may be presented to client devices, in accordance with the policy data. In some exemplary embodiments, the content items may be presented in a pure mode, a hybrid mode, or the like, e.g., in accordance with Sub-Steps 132-134.

[0091] On Sub-Step 132, content items may be presented in a pure mode. In some exemplary embodiments, a “pure” mode may refer to activating only the targeting rules on a client device. For example, a targeting rule may define that content items of a specific campaign are to be presented to a user only if the user frequences a predefined geographical region, e.g., in case the content items are relevant to the geographical region. According to this example, the user’s location may be locally determined based on readings of a GPS of the device, analyzed to determine compliance with the targeting rule (e.g., triggering presentation of the content items), and retained locally on the user’s device without providing access to such data.

[0092] In some exemplary embodiments, targeting rules may be defined by an administrator user as expecting to target relevant end users, may be defined automatically by an algorithm that is configured to target relevant end users, or the like. For example, a targeting rule may define that content items of a specific campaign are to be presented to a user only if he is above a certain age, and the ages of users of end devices may be inferred from local data such as a local user profile, photos of the user, text messages of the user, or the like. As another example, a targeting rule may define that content items of a specific campaign are to be presented to female users that swim at least three times a week, e.g., in case the campaign relates to a female swimming costume for professionalswimmers. Accordingly to this example, the gender and swimming frequency of users of end devices may be inferred from local data such as location reading over time, a local user profile, photos of the user, text messages of the user. Such data may be correlated with external non-private data such as maps that show swimming facilities.

[0093] On Sub-Step 134, content items may be presented in a hybrid mode. In some exemplary embodiments, a “hybrid” mode may refer to activating both the targeting rules and the randomized rules on a client device. In some exemplary embodiments, during hybrid mode, a content item may be presented in scenarios in which the targeting rules are not complied with, if the randomized rules are complied with. In case the targeting rules are complied with, the content item may be served as well. By serving content items in case targeting rules are complied with, and in case randomized rules are complied with, increases the number of impressions of content items over the end devices.

[0094] For example, continuing with the above swimming example, the hybrid mode may activate the above targeting rule, defining that content items are to be presented if the user frequences a predefined geographical region, and in addition to this targeting rule the hybrid mode may activate a randomized rule. For example, the randomized rule may define that users should be presented with the content item every 50 opportunities in case they are males between ages of 62-68, in case they send messages before 6 AM at least twice a week, in case they are female users that swim at least once a week, or the like. According to this example, the randomized rule may not be defined by an administrator user or algorithm attempting to target relevant end users, but instead may be generated randomly, such as by randomly combining microsegments, targeting rules, demographic parameters, or the like.

[0095] In some exemplary embodiments, the policy data may dynamically switch between pure and hybrid modes, e.g., between activation of randomized and targeting rules, between Sub-Steps 132-134, or the like. In some exemplary embodiments, the mode switching may comprise activating randomized rules, or deactivating randomized rules. In some cases, the mode switching may comprise executing a different policy data.

[0096] In some exemplary embodiments, the switching between modes may be performed based on one or more criterions, settings, rules, or the like. For example, the switching may be performed in response to an instruction from a distributing server, e.g., the server that provided the distributable data on Step 120. For example, in case thedistributing server determines that a sufficient number of users were exposed to a content item, sufficient for preventing singling out of any user, the server may instruct the client devices to move to a pure mode, e.g., to deactivate the randomized rules.

[0097] In some cases, the server may determine that a sufficient number of users were exposed to a content item in case the number complies with a minimal threshold. For example, the threshold may be set to prevent singling out users, and may be defined to include 100 users, 200 users, or the like. As another example, the threshold may be dynamically set and adjusted according to updates in safety regulations aiming to prevent a singling out of users. In some cases, ensuring that the number of users that are exposed to content data complies with a predefine threshold, may ensure that the server will not be able to single out any end users.

[0098] As another example, the client devices may be configured to initially present content items in a pure mode in accordance to Sub-Step 132 (e.g., by default or in response to server instructions), and, if after a predefined time period the content data was presented only to a number of users that is lesser than the minimal threshold, the client devices may be instructed to switch to a hybrid mode in accordance to Sub-Step 134, e.g., in order to activate one or more randomized rules. For example, the time period may be set (e.g., by an administrator user) to be a time period such as an hour, a day, a week, a month, or the like. In some cases, the hybrid mode may increase the number of impressions, at least since it may add additional trigger events that trigger impressions, in addition to the events triggered by targeting rules.

[0099] As another example, the client devices may be initially provided with rules that correspond to a single mode, e.g., either hybrid or pure mode, and may present content items according to the corresponding mode. According to this example, the distributing server may update the client devices with one or more additional rules, e.g., after a time period, in case the number of impressions of different client devices is below a threshold, in case the number of interactions of different users with the content items is below a threshold, in response to an instruction from the server, or the like. For example, the additional rules may comprise rules of the alternate mode (e.g., a randomized rule in case the initial mode is pure), rules corresponding to the initial mode, or the like.

[0100] On Step 140, the client devices may report statistics regarding the number of impressions of each content items, user interactions with content items, numbers ofconversions, number of servings that were based on randomized rules, number of servings that were based on targeted rules, or the like. For example, a client device may report that the user clicked or otherwise selected a hyperlink that is a part of a presented content item, presented in accordance with the policy data.

[0101] In some exemplary embodiments, based on reports from the client devices, the server may infer the number of users to which each content item was presented, overall click rates of content items, conversion rates, or the like. In some exemplary embodiments, the server computer may keep track of the number of client devices on which a content item is presented, the number of users to which the content is presented, the number of reactions to a content item, or any other statistical or quantitative measure relating to data presentation and response thereto.

[0102] In some exemplary embodiments, based on reports from the client devices, the server may not be able to infer unique identifiers of users, or to single out a group of one or more users, e.g., due to the application of hybrid mode and / or the measures taken to ensure that sufficient users are exposed to each content item. For example, in case the campaign is directed to a microsegment of “users that swim 5 times a week”, “users that are older than 85”, “users that live in the city center of NYC”, “users that work as medical clowns”, and “users that come to swim before 5 AM every time”, targeting such users without applying hybrid mode or ensuring that sufficient users are targeted, may enable to single out one or more specific people, even if not enabling to identify them. In some exemplary embodiments, employing the disclosed hybrid mode and / or the measures taken to ensure that sufficient users are exposed to each content item, may overcome this challenge and ensure strict compliance to singling out restrictions.

[0103] In some exemplary embodiments, the server may utilize determined statistics, inferred from reports from the client devices, to determine updates to the policy data of one or more client devices.

[0104] For example, if after a defined time period (e.g., three hours), the tracked number of impressions to different users falls below a certain threshold, the server computer may instruct the client devices to switch to hybrid mode. For example, client devices may switch to hybrid mode by activating at least one randomized rule that is incorporated as a deactivated rule in their existing policy data, may obtain updates with at least one randomized rule from the server, or the like. In some exemplary embodiments, switchingto hybrid mode may increase the audience size of the respective content item, such that a singling out of users or client devices may become impossible.

[0105] As another example, the server computer may instruct the client devices to switch to pure mode, in case singling out is determined to be impossible. In one scenario, the client devices may initially activate hybrid mode, and switch to pure mode in response to a server instruction, e.g., in case the tracked number of impressions of different users exceeds a threshold. In another scenario, the client devices may initially activate a pure mode, may be instructed to switch to a hybrid mode in case the tracked number of impressions to different users falls below a certain threshold after a defined time period, and may be instructed by the server to switch back to pure mode after the number of impressions reaches the threshold.

[0106] Referring now to Figure 2 showing schematic illustration of an exemplary architecture, in accordance with some exemplary embodiments of the disclosed subject matter.

[0107] As depicted in Figure 2, Architecture 200 may comprise at least one server, e.g., Server 210. In some exemplary embodiments, Server 210 may retain, or have access to, a database of campaigns, such as Campaigns 251-252. In some exemplary embodiments, each of Campaigns 251-252 may comprise one or more content items such as commercial content that is made of advertisement campaign materials, promotional messages, organic content, sponsored content, a video clip, informative data sheets, or the like.

[0108] In some exemplary embodiments, Campaigns 251-252 may comprise policy data, including metadata and rules associated with the distributing Campaigns 251-252, implementing Campaigns 251-252 at end devices, or the like. For example, the policy data may indicate a target audience, content delivery rules, information regarding whether the hybrid mode is enabled or disabled, a selected biasing for randomized rules and / or artifacts, or the like. Each campaign may define a content thereof that is configured to be served to an end device when the campaign is provided to the end device and when at least one delivery rule is complied with by the end device.

[0109] In some exemplary embodiments, the campaign may comprise a designation criterion, defining at least one micro-segment to which the campaign is designed to be served, targeted, or the like. For example, the micro-segment may define that the campaign is targeted towards married men that travel to France frequently. In someexemplary embodiments, the designation criterion may correspond, at least in part, to the matching decision disclosed in the “Distributed Content Serving Application”, which is performed at the end user device and without exposing PII and micro-segmentation information to a server such as Server 210.

[0110] In some exemplary embodiments, a micro-segment may be a definition of population based on an activity, behavior, pattern of behavior, demographic, or the like. As an example, a micro-segment may be “male over the age of 20”, based on demographic properties only. Another example of a micro- segment, may be “flew at least once abroad, in the last month”, based on physical activity and tracked behavior. As yet another example, a micro-segment may be “walking at least 30 minutes in a week for the last month”, “riding a bus at least twice a month”, “skiing at least twice a year”, or the like based on tracked physical activities. The micro -segments may be defined based on online interaction, such as “accessing news apps or websites at least twice a day”, “surfing the net at least one hour a day during the evening time”, or the like. Additional examples of micro-segments may be based on a number of working hours of the user, a number of flights each year the user takes, or the like. Additionally, or alternatively, micro- segments may be based on physical location of the user, such as being “located within 100m from a restaurant”, “visiting 1km from a beach”, or the like. Additionally or alternatively, the campaign may be defined to users that are members of several conjuncting micro- segments. Additionally or alternatively, a set of operations may be used to define the audience for which the campaign should be served. In some cases, a campaign may be defined to be activated for a specific micro-segment or a set of alternative micro- segments. The targeting determination may be provided by the owner of the campaign, or any other entity.

[0111] In some exemplary embodiments, Server 210 may distribute one or more campaigns, e.g., Campaigns 251-252, to end devices, e.g., Devices 220-290. In some exemplary embodiments, a Distributer 215 of Server 210 may distribute Campaigns 251- 252 to Devices 220-290. As an example, each device of Devices 220-290 may be a mobile device, such as a smartphone, a Personal Digital Assist (PDA), a laptop, a tablet, a desktop computer executing a web browser, an AR glasses, a wearable device, or the like.

[0112] In some exemplary embodiments, Campaigns 251-252 may be executable computer program products, encapsulating the functionality of the campaign. In some exemplary embodiments, Campaigns 251-252 may comprise policy data describing the campaign and utilized by Devices 220-290 in implementing the campaign, such as by describing the target audience, the targeting rules for content delivery, providing information regarding whether randomized rules are enabled or disabled, indicating desired biasing of randomized rules, or the like.

[0113] In some exemplary embodiments, Devices 220-290 may obtain Campaigns 251- 252, and present content items therefrom according to policy data of each campaign, e.g., according to the designation criterion of each campaign and the delivery rules. For example, a campaign may be activated by Device 220 if the designation criterion is met. In some exemplary embodiments, in case a designation criterion of a campaign is determined to match to the user of the device, the campaign may be served to the user in accordance with the delivery rules, e.g., when defined events that comply with the delivery rules are identified.

[0114] In some exemplary embodiments, at least a subset of Devices 220-290 may have respective Matching Agents 225-295 installed and executed thereon. As one example, Matching Agents 225-295 may be a component of a Software Development Kit (SDK) that is integrated into an application, a program, or the like, of Devices 220-290. In some exemplary embodiments, Devices 220-290 may comprise or otherwise be operatively coupled to one or more sensors for sensing activity related to the users, such as but not limited to a gyroscope, a Wi-Fi receiver, a Bluetooth receiver, charger connection, an accelerometer, a GPS receiver, a camera, a magnetometer, a proximity sensor, an ambient light sensor, a microphone, touchscreen sensors, a fingerprint sensor, a pedometer, a barometer, a thermometer, an air humidity sensor, or the like.

[0115] In some exemplary embodiments, Matching Agents 225-295 may obtain sensor readings over time and otherwise collect information about the respective user to determine activities of the user. Matching Agents 225-295 may be configured to identify offline real-world activities of the respective user by monitoring sensors of the end device such as locations sensors, barometers, accelerometers, or the like, in real time. Matching Agents 225-295 may be configured to track user activities such as driving, walking,cycling, flying, arriving home, leaving work, or the like. Matching Agents 225-295 may also be configured to monitor online activities such as “opened his email”. Matching Agents 225-295 may create for the respective user a local profile, based on the user activities and the user’s recurring activity patterns.

[0116] In some exemplary embodiments, Matching Agents 225-295 may utilize accumulated local data to determine compliance with the designation criterion of each campaign, and compliance campaigns may be activated. In some exemplary embodiments, Matching Agents 225-295 may utilize an Artificial Intelligence (Al) model, a Machine Learning (ML) model, a Deep Learning (DL) model, a classifier, a predictor, or the like, for predicting micro-segment to which the device or user belongs. For example, a model may be utilized to determine, based on available information about the user, including private information that may be located locally on the device, whether the user can be categorized as “VIP client”, “premium potential”, “High affluence”, “Churn risk”, or the like. The matching decision may be based on whether or not the user is categorized according to a desired model-determined category.

[0117] In some exemplary embodiments, Matching Agents 225-295 may determine, for the respective Devices 220-290, with which of the specified micro- segments of the obtained campaigns, the user of the device is associated with. The raw local information enabling the determination that the user belongs to the micro-segments may not be divulged to external devices, such as Server 210, hence preventing Server 210, even one controlled by an entity implementing the disclosed subject matter, from tracking PII information of the users of Devices 220-290. It is noted that all private information may remain locally within Devices 220-290 and may not be reported to Server 210.

[0118] In some exemplary embodiments, Matching Agents 225-295 may utilize accumulated local data to identify real time events that comply with delivery rules of each campaign that is activated. Each client device may perform a decision on whether and when to present the content items of an activated campaign on the client device, and selectively present the campaign’s content items(s) to a user of the client device accordingly.

[0119] In some exemplary embodiments, real-time serving may be implementable for activated campaigns even without network connectivity, as the campaign may be storedlocally and all decisions may be made locally on the local device, according to the policy data. In some exemplary embodiments, Devices 220-290 may perform a role of independent distributed content or advertising servers, by locally controlling the content item serving, timing thereof, or the like.

[0120] In this architecture, Devices 220-290 may report back to Server 210 which campaign was served, how many times, or the like, e.g., without providing private information such as location information, PIIs, or the like. Such information may be useful to compute campaign statistics including number of impressions, number of conversions, or the like.

[0121] In some exemplary embodiments, in order to further increase the privacy of the users of Devices 220-290, Architecture 200 may be configured such that a random factor is introduced to the policy data of Campaigns 251-252. For example, Distributer 215 may distribute Campaigns 251-252 to Devices 220-290, along with micro-segmentation-based designation criterion, and a random artifact, e.g., a randomly generated rule, number, factor, or the like. Devices 220-290 may determine whether or not to activate each of Campaigns 251-252 according to either the designation criterion or the random artifact.

[0122] For example, the random artifact may comprise a rule that devices with an International Mobile Equipment Identity (IMEI) number that ends with the characters “13” should activate a certain campaign, even if not compliant with any designation criterion of the campaign. For example, the designation criterion of this campaign may be: “female user, aged 25-35, located in NYC, USA”, but due to the random artifact, the campaign may be activated at devices of male users, of users at different age groups, of users who are not located in the USA, or the like.

[0123] In some exemplary embodiments, in addition to or instead of incorporating a random factor for the activation process of Campaigns 251-252, at least one randomized rule may be incorporated into the delivery rules of the policy data of Campaigns 251-252. In some exemplary embodiments, Devices 220-290 may monitor their compliance of with the delivery rules, including at least one randomized rule. In case one of the rules is met, Devices 220-290 may serve a content item of the respective campaign to the user. For example, in case the targeted rules within the delivery rules are not met, but a randomized rule is met, the content item may be served to the user.

[0124] In some exemplary embodiments, Server 210 may control the activation and deactivation of randomized rules, e.g., according to the steps of Figure 1. In some exemplary embodiments, in case Campaigns 251-252 incorporate randomized rules, Campaigns 251-252 may be configured to initialize their operation by activating the randomized rules, or deactivating them. For example, randomized rules may be deactivated by default, and if the number of impressions after a timeframe is below a threshold, Server 210 may instruct Devices 220-290 to activate their randomized rules, may provide randomized rules to Devices 220-290 to be activated, or the like.

[0125] In some cases, Campaigns 251-252 may not initially incorporate randomized rules, and the randomized rules may be provided as a subsequent updated policy data distributed by Distributer 215 to Devices 220-290, replacing a previous version of the policy data. It is noted that replacing the policy data may not affect the campaign statistics or its analysis.

[0126] Once the number of impressions exceed the minimal threshold, Server 210 may instruct Devices 220-290 to deactivate the randomized rules, switching back to a pure mode of operation. In some cases, after the issue of signaling out is prevented (due to reaching a sufficiently large audience), the random aspect may be mitigated, to increase the accurate targeting of users. In some exemplary embodiments, in case a device loses connectivity to Server 210, the activation and deactivation of randomized rules may be postponed until connectivity is re-established.

[0127] Matching Agents 225-295 may report to Server 210 which campaign was activated, which content items of a campaign were served and how many times, whether the serving was based on a randomized rule or not, which delivery rules were applied, information about the designation criteria, which modes of operation were activated and when (e.g., hybrid or pure), or the like. Such distinction may be useful for statistics, billing, analytics, or the like. As an example, the system may only bill for impressions that match the targeting rules. In some cases, although the percentage of random to nonrandom content serving may be made known to Server 210, signaling out users may still be prevented, at least since the server may not store data correlating the type of content serving to devices. In other cases, Matching Agents 225-295 may not report whether the serving was based on a randomized rule or not.

[0128] In some exemplary embodiments, the randomized rules and / or artifact may be biased, or fully random. For example, the random artifact for campaign activation may be biased towards targeting audience that is similar to the audience defined by the matching criterion. As another example, the randomized rules for content delivery may be biased to increase the probability of serving content to users that only partially satisfy a delivery rule. For example, a delivery rule may be defined as a conjunction of three requirements A & B & C. According to this example, the randomized rules for content delivery may be biased to have a higher likelihood of serving the campaign to users that exhibit A & B (but not C), than users that exhibit only A (and not B or C). In some cases, the biasing may be in inverse proportion to the size of the audience that matches the relevant criteria. For example, if requirement A is “male”, which is satisfied by -50% of the population, while requirement B is “having a rare skin condition” that is only exhibited by 0.0001% of the population, the biasing mechanism may be more likely to serve the campaign to a female with the skin condition (B but not A) than to a male without the skin condition (A but not B), as the first group is rarer than the second group. In other cases, any other biasing technique may be used.

[0129] In some cases, instead of a mere binary decision of whether a delivery rule is met or not, a broader approximated classification may be utilized. For example, consider a campaign targeting people speaking Hebrew. As most Hebrew speakers are located in Israel, an approximated segmentation could be located in Israel, and random selection may be biased towards such segments. As another example, negative segmentation may be utilized. As the chances of a Hebrew speaker to be located in Malaysia is low, the random selection may be biased against serving the campaign with respect to users that are located in Malaysia. In some cases, big-data information about segments may be useful to identifying potential correlations between different micro-segments and delivery contexts, which may be used to bias the random selection.

[0130] In some exemplary embodiments, the use of biasing mechanisms may enable to increase the efficiency of the targeting scheme, and may increase the privacy of individuals. For example, the server may not be able to distinguish between audience that randomly activated a campaign and audience that matches the designation criteria. In some exemplary embodiments, the use of biasing mechanisms may increase the difficulty of distinguishing between targeted audience and randomly selected audience, and therebyincrease the privacy, and further decrease the possibility of singling out users. For example, if a campaign is in Hebrew, but the randomization causes the campaign to be displayed to people in Malaysia, the server may potentially be able to distinguish between targeted audience and randomly selected audience. Incorporating a bias that corresponds at least in part to the targeted audience, may prevent the server from screening out the members of the micro-segment from the randomly selected audience members.

[0131] Referring now to Figures 3A-3C showing schematic illustration of an exemplary sequence diagrams, in accordance with some exemplary embodiments of the disclosed subject matter.

[0132] In some exemplary embodiments, Figure 3A depicts a scenario in which a campaign is distributed from Server 310 to a plurality of client devices such as Clients 322-326. In some exemplary embodiments, the campaign may comprise a hybrid campaign, e.g., a campaign in a hybrid mode, which activates at least one randomized rule or artifact.

[0133] In some exemplary embodiments, after the campaign is distributed to Clients 322-326, Clients 322-326 may determine whether to activate the campaign according to microsegments of the campaign, a random artifact, or the like. For example, Clients 322- 326 may activate the campaign, only Clients 322 and 324 may activate the campaign, or the like.

[0134] In some exemplary embodiments, an agent executing on Clients 322-326 may monitor real life events, and may determine their compliance with random and nonrandom delivery rules, e.g., with targeting rules and randomized rules. For example, an agent executing on Client 322 may determine compliance with a randomized rule, e.g., based on locally retained data, a random function, or the like. According to this example, the agent may serve a corresponding content item on Client 322 to the user, and report to Server 310 that content was served, which content item was served, whether the delivery rule was randomized, or the like.

[0135] As another example, an agent executing on Client 324 may determine compliance with a non-random delivery rule, e.g., a targeting rule, based on locally retained data, a context of a rendered page on Client 324, or the like. According to this example, the agent may serve a corresponding content item on Client 324 to the user, andreport to Server 310 that content was served, which content item was served, whether the delivery rule was a targeting rule or a randomized rule, or the like.

[0136] In some exemplary embodiments, Server 310 may obtain reports from Clients 322-326, from additional client devices, or the like, and determine whether the number of impressions that were served on different client devices and / or to different users complies with a minimal threshold. In some cases, the counting of impressions may be based on user-uniqueness, such that the number of users that were exposed to a content item is counted. Once sufficient impressions of the campaign were served, Server 310 may determine to deactivate randomized rules, e.g., switching the hybrid mode of the campaign with a pure mode.

[0137] In some exemplary embodiments, Server 310 may instruct Clients 322-326 to deactivate their randomized rules, such as by transmitting a new pure campaign with modified policy data, transmitting the modified policy data independently, transmitting an instruction to deactivate existing randomized rules that are stored in the local memory of Clients 322-326, or the like.

[0138] In some exemplary embodiments, following that point in time, content items may be served by Clients 322-326 to users only using pure mode, e.g., based on nonrandomized rules. In some cases, in case an entire campaign was activated due to a random artifact, the campaign may be deactivated in response to the communication from Server 310.

[0139] In some exemplary embodiments, Figure 3B depicts a connectivity loss scenario that corresponds, at least in part, to the scenario of Figure 3A.

[0140] In some exemplary embodiments, after Server 310 distributes the campaign to Clients 322-326, Clients 322-326 may monitor real life events, and may determine their compliance with targeting rules and randomized rules of the campaign. For example, an agent executing on Client 322 may determine compliance with a randomized rule, serve a corresponding content item on Client 322 to the user, and report to Server 310 that content was served, which content item was served, whether the delivery rule was random, or the like.

[0141] In some exemplary embodiments, at some point in time, such as after Client 322 servers a content item, Client 326 may lose its connectivity to Server 310. In some exemplary embodiments, the content serving functionality of Client 326 may not depend on its connectivity, but rather on local data monitored on Client 326 and on the policy data of the campaign, stored locally on Client 326. In some exemplary embodiments, after Client 326 loses its connectivity to Server 310, Client 326 may continue to execute the campaign, and serve content items thereof based on compliance with targeting rules and randomized rules.

[0142] In some exemplary embodiments, while Client 326 is disconnected, Server 310 may determine that the number of impressions complies with a threshold, and instruct Clients 322-326 to deactivate their randomized rules. In some exemplary embodiments, since Client 326 is disconnected, Client 326 may not obtain such instructions, and thus the randomized rules of Client 326 may continue to be activated after Clients 322 and 324 stop applying the randomized rules. For example, an agent executing on Client 326 may determine compliance with a randomized rule, and serve a corresponding content item on Client 326 to the user, after Server 310 instructed Clients 322-326 to deactivate their randomized rules, after Clients 322-326 deactivated their randomized rules, or the like.

[0143] In some exemplary embodiments, once Client 326 regains connectivity to Server 310, Client 326 may obtain the instructions to deactivate the randomized rules from Server 310. In such cases, Client 326 may deactivate the randomized rules, in response. In some exemplary embodiments, once the connectivity of Client 326 to Server 310 is reestablished, restored, or the like, Client 326 may report to Server 310 any impressions that were served to the user when Client 326 was offline. For example, the impressions may comprise content serving with accordance to randomized rules, which may be performed before or after Server 310 provided the instructions to deactivate the randomized rules.

[0144] In some exemplary embodiments, Figure 3C depicts a scenario in which a pure campaign is initially distributed from Server 310 to Clients 322-326

[0145] In some exemplary embodiments, in contrast to the scenario of Figure 3A, the campaign may comprise, at an initial stage, a pure campaign, e.g., a campaign in a puremode, that is absent of explicit randomity. In some exemplary embodiments, the pure campaign may only attempt pure targeting, according to defined microsegments and delivery contexts.

[0146] In some exemplary embodiments, an agent executing on Clients 322-326 may monitor real life events, and may determine their compliance with the defined delivery rules, e.g., non-random rules such as targeting rules. For example, an agent executing on Client 324 may determine compliance with a targeting rule, e.g., based on locally retained data, a context of a rendered page on Client 324, or the like. According to this example, the agent may serve a corresponding content item on Client 324 to the user, and report to Server 310 that content was served, which content item was served, whether the delivery rule was random, or the like. In case any of Clients 322-326 comply with a randomized rule, no content serving may be performed.

[0147] In some exemplary embodiments, Server 310 may obtain reports from Clients 322-326, from additional client devices, or the like, and determine whether the number of impressions that were served on different client devices and / or to different users complies with a minimal threshold. In some exemplary embodiments, in case the number of impressions does not reach the minimal threshold until a defined deadline, e.g., an hour, two hours, or the like, Server 310 may determine to activate randomized rules, e.g., switching the pure mode of the campaign with a hybrid mode. In some exemplary embodiments, the lower bound on the impressions may defined to ensure that singling out is prevented.

[0148] In some exemplary embodiments, Server 310 may instruct Clients 322-326 to activate randomized rules, such as by transmitting a new hybrid campaign with modified policy data (including randomized rules), transmitting the modified policy data independently, transmitting an instruction to activate existing randomized rules that are stored in the local memory of Clients 322-326, or the like.

[0149] In some exemplary embodiments, subsequently to activating the randomized rules, content items may be served by Clients 322-326 to users based on both targeting rules and randomized rules. For example, an agent executing on Client 322 may determine compliance with a randomized rule, serve a corresponding content item onClient 322 to the user, and report to Server 310 that content was served, which content item was served, whether the delivery rule was random, or the like.

[0150] In some exemplary embodiments, once sufficient impressions of the campaign were served, e.g., the number of impressions reaching the minimal threshold, Server 310 may instruct Clients 322-326 to deactivate their randomized rules, such as by transmitting a pure campaign with modified policy data (the same pure campaign that was initially distributed or a revised pure campaign), transmitting the modified policy data independently, transmitting an instruction to deactivate existing randomized rules that are stored in the local memory of Clients 322-326, or the like.

[0151] In some exemplary embodiments, following that point in time, content items may be served by Clients 322-326 to users only using pure mode, e.g., based on nonrandomized rules such as targeting rules.

[0152] Referring now to Figure 4 showing a block diagram of an apparatus, in accordance with some exemplary embodiments of the disclosed subject matter.

[0153] In some exemplary embodiments, an Apparatus 400 may comprise a Processor 402. Processor 402 may be a Central Processing Unit (CPU), a microprocessor, an electronic circuit, an Integrated Circuit (IC) or the like. Processor 402 may be utilized to perform computations required by Apparatus 400 or any of its subcomponents. Processor 402 may be configured to execute computer-programs useful in performing the methods of Figure 1, in implementing the sequence diagrams of Figures 3A-3C, or the like.

[0154] In some exemplary embodiments of the disclosed subject matter, an Input / Output (I / O) Module 405 may be utilized to provide an output to and receive input from a user. I / O Module 405 may be used to transmit and receive information to and from the user or any other apparatus, e.g., a plurality of user devices, in communication therewith.

[0155] In some exemplary embodiments, Apparatus 400 may comprise a Memory Unit 407. Memory Unit 407 may be a short-term storage device or long-term storage device. Memory Unit 407 may be a persistent storage or volatile storage. Memory Unit 407 may be a disk drive, a Flash disk, a Random Access Memory (RAM), a memory chip, or the like. In some exemplary embodiments, Memory Unit 407 may retain program codeoperative to cause Processor 402 to perform acts associated with any of the subcomponents of Apparatus 400. In some exemplary embodiments, Memory Unit 407 may retain program code operative to cause Processor 402 to perform acts associated with any of the steps in Figure 1.

[0156] The components detailed below may be implemented as one or more sets of interrelated computer instructions, executed for example by Processor 402 or by another processor. The components may be arranged as one or more executable files, dynamic libraries, static libraries, methods, functions, services, or the like, programmed in any programming language and under any computing environment.

[0157] In some exemplary embodiments, Data Definer 410 may be configured to obtain distributable data, such as one or more distributable campaigns, from a content server, a publisher, a remote database, a cloud, a server associated with for a distributer of commercial content, a software vendor or distributer, or the like. In some exemplary embodiments, each distributable campaign may comprise one or more content items, content data, or the like, which may be configured to be rendered on end devices. For example, content items may comprise commercial content that is made of advertisement campaign materials, promotional messages, technical content associated with a user guide, technical support data, software version update data, or the like.

[0158] In some exemplary embodiments, the distributable data may be obtained with or without policy data. For example, each distributable campaign may have separate policy data. In some exemplary embodiments, Data Definer 410 may be configured to obtain and / or determine policy data for each distributable campaign. For example, Data Definer 410 may obtain policy data for a distributable campaign defining microsegments for which the campaign is relevant, and may adjust policy data to introduce randomness therein. In some exemplary embodiments, Data Definer 410 may introduce randomness to rules of the policy data that relate to activating campaigns, that relate to delivering content items, or the like.

[0159] In some exemplary embodiments, Data Definer 410 may define a default behavior associated with the introduced randomness. For example, Data Definer 410 may define that initially at least some of the random components of the policy data should be activated, deactivated, or the like.

[0160] In some exemplary embodiments, Data Distributor 420 may be configured to obtain distributable campaigns with randomness introduced by Data Definer 410, and distribute the campaigns to a plurality of end devices, e.g., Devices 220-290 of Figure 2. In some exemplary embodiments, the end devices may be enabled to execute locally obtained campaigns, in accordance with the policy data and with local data of each device (e.g., monitored geographic locations of the client device over time, sensor readings, an estimated gender, hair color, age the user of the client device estimated based on local data, or the like).

[0161] In some exemplary embodiments, Policy Adjuster 430 may be configured to monitor the performance of the distributed campaigns on the end devices, to analyze reports from end devices regarding the performance of the distributed campaigns at each end device, and to calculate overall statistics regarding the performance of the distributed campaigns. For example, Policy Adjuster 430 may determine whether a number of end devices and / or users that were exposed to a campaign, or to content items thereof, during a timeframe, is sufficient to prevent singling out. According to this example, Policy Adjuster 430 may adjust the policy data in response to such calculations.

[0162] For example, in case Policy Adjuster 430 determines that the number of impressions by different users to a campaign is lesser than a singling out threshold, Policy Adjuster 430 may adjust the policy data of the campaign to activate randomized rules thereof, and may instruct Data Distributor 420 to distribute the adjusted policy data independently or as part of a transmission of an entire campaign, e.g., by re-delivering the entire campaign with the adjusted policy data. As another example, in case Policy Adjuster 430 determines that the number of impressions by different users to a campaign is greater than a singling out threshold, Policy Adjuster 430 may adjust the policy data of the campaign to deactivate randomized rules thereof, and may instruct Data Distributor 420 to distribute the adjusted policy data independently or as part of a transmission of an entire campaign.

[0163] The disclosed subject matter may be a system, a method, and / or a computer program product. The computer program product may include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the disclosed subject matter.

[0164] The computer readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device. The computer readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non- exhaustive list of more specific examples of the computer readable storage medium includes the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or raised structures in a groove having instructions recorded thereon, and any suitable combination of the foregoing. A computer readable storage medium, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted through a wire.

[0165] Computer readable program instructions described herein can be downloaded to respective computing / processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and / or a wireless network. The network may comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and / or edge servers. A network adapter card or network interface in each computing / processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing / processing device.

[0166] Computer readable program instructions for carrying out operations of the disclosed subject matter may be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object orientedprogramming language such as Smalltalk, C++ or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The computer readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field- programmable gate arrays (FPGA), or programmable logic arrays (PLA) may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the disclosed subject matter.

[0167] Aspects of the disclosed subject matter are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the disclosed subject matter. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer readable program instructions.

[0168] These computer readable program instructions may be provided to a processor of a general-purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks. These computer readable program instructions may also be stored in a computer readable storage medium that can direct a computer, a programmable data processing apparatus, and / or other devices to function in a particular manner, such that the computer readable storage medium having instructions stored therein comprises an article of manufacture including instructions which implement aspects of the function / act specified in the flowchart and / or block diagram block or blocks.

[0169] The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process, such that the instructions which execute on the computer, other programmable apparatus, or other device implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0170] The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the disclosed subject matter. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions, which comprises one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and / or flowchart illustration, and combinations of blocks in the block diagrams and / or flowchart illustration, can be implemented by special purpose hardwarebased systems that perform the specified functions or acts or carry out combinations of special purpose hardware and computer instructions.

[0171] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosed subject matter. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0172] The corresponding structures, materials, acts, and equivalents of all means or step plus function elements in the claims below are intended to include any structure,material, or act for performing the function in combination with other claimed elements as specifically claimed. The description of the disclosed subject matter has been presented for purposes of illustration and description, but is not intended to be exhaustive or limited to the disclosed subject matter in the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the disclosed subject matter. The embodiment was chosen and described in order to best explain the principles of the disclosed subject matter and the practical application, and to enable others of ordinary skill in the art to understand the disclosed subject matter for various embodiments with various modifications as are suited to the particular use contemplated.

Claims

CLAIMSWhat is claimed is:

1. A method of data distribution in a computer network, the method comprising steps executed by a server computer in communication with a plurality of client devices, the steps comprising: defining distributable data, wherein the distributable data comprises content data and policy data, the policy data comprising a randomized rule restricting a presentation of the content data on a client device of the plurality of client devices based on a random factor, the policy data comprising a targeting rule restricting the presentation of the content data on the client device according to local data retained on the client device; and distributing at least a part of the distributable data to the plurality of client devices, thereby enabling each client device of the plurality of client devices to use the part of the distributable data for restrictively presenting the content data according to at least one of the randomized rule or the targeting rule.

2. The method of Claim 1, wherein the part of the distributable data comprises only the targeting rule, the method further comprising a subsequent step of sending update data comprising the randomized rule to the plurality of client devices.

3. The method of Claim 1, wherein said distributing comprises distributing the distributable data with activation settings of the randomized and targeting rules, the activation settings indicating whether the randomized and targeting rules are activated, wherein the plurality of client devices is instructed to restrictively present the content data according to activated rules and not according to deactivated rules.

4. The method of Claim 3 further comprising sending update data subsequently to said distributing, wherein the update data comprises a change to the activation settings.

5. The method of Claim 4, wherein the activation settings provided by said distributing indicate a deactivation of the randomized rule and an activation of thetargeting rule, wherein the change to the activation settings in the update data comprises activating the randomized rule.

6. The method of Claim 5 further comprising sending second update data subsequently to said sending the update data, the second update data comprises a second change to the activation settings, the second change comprises deactivating the randomized rule.

7. The method of Claim 4, wherein the activation settings provided by said distributing indicate an activation of the targeting rule and the randomized rule, wherein the change to the activation settings in the update data comprises deactivating the randomized rule.

8. The method of Claim 3, wherein the distributable data further comprises data defining a criterion for adjusting the activation settings, said adjusting comprises deactivating or activating a rule in the policy data.

9. The method of Claim 1, wherein the targeting rule restricts the presentation of the content data according to an estimated relevancy of the content data to a user of the client device, wherein compliance with the estimated relevancy is determined locally by the client device based on the local data, wherein the content data is estimated to be relevant to the user of the client device in case the local data complies with the targeting rule.

10. The method of Claim 1 further comprising obtaining reports from the plurality of client devices, the reports indicating a number of presentations of the content data to the plurality of client devices.

11. The method of Claim 10 further comprising calculating a number of end users that were exposed to the content data based on the reports, and sending data updating the distributed data to the plurality of client devices, based on said calculating.

12. The method of Claim 1, wherein the local data retained on the client device comprises at least one of: demographic data of a user of the client device, location data, or data extracted from a reading of at least one sensor of the client device.

13. The method of Claim 12, wherein the at least one sensor comprising at least one of the group consisting of: a gyroscope, a Wi-Fi receiver, a Bluetooth receiver, acharger connection sensor, an accelerometer, a Global Positioning System (GPS) receiver, a camera, a magnetometer, a proximity sensor, an ambient light sensor, a microphone, a touchscreen sensor, a fingerprint sensor, a pedometer, a barometer, a thermometer, and an air humidity sensor.

14. The method of Claim 1, wherein the targeting rule is defined by an administrative user, wherein the content data is defined by the administrative user, and wherein the randomized rule is defined, at least partially, automatically by a software entity.

15. An apparatus of a server computer comprising a processor and coupled memory, the server computer is in communication with a plurality of client devices, said processor being adapted to perform a method of data distribution in a computer network, the method comprising: defining distributable data, wherein the distributable data comprises content data and policy data, the policy data comprising a randomized rule restricting a presentation of the content data on a client device of the plurality of client devices based on a random factor, the policy data comprising a targeting rule restricting the presentation of the content data on the client device according to local data retained on the client device; and distributing at least a part of the distributable data to the plurality of client devices, thereby enabling each client device of the plurality of client devices to use the part of the distributable data for restrictively presenting the content data according to at least one of the randomized rule or the targeting rule.

16. The apparatus of Claim 15, wherein the part of the distributable data comprises only the targeting rule, the processor is further adapted to perform a subsequent step of sending update data comprising the randomized rule to the plurality of client devices.

17. The apparatus of Claim 15, wherein said distributing comprises distributing the distributable data with activation settings of the randomized and targeting rules, the activation settings indicating whether the randomized and targeting rules are activated, wherein the plurality of client devices is instructed to restrictivelypresent the content data according to activated rules and not according to deactivated rules.

18. The apparatus of Claim 15, wherein the targeting rule restricts the presentation of the content data according to an estimated relevancy of the content data to a user of the client device, wherein compliance with the estimated relevancy is determined locally by the client device based on the local data, wherein the content data is estimated to be relevant to the user of the client device in case the local data complies with the targeting rule, wherein the local data retained on the client device comprises at least one of: demographic data of a user of the client device, location data, or data extracted from a reading of at least one sensor of the client device.

19. The apparatus of Claim 15, wherein the processor is further adapted to obtain reports from the plurality of client devices, the reports indicating a number of presentations of the content data to the plurality of client devices.

20. A computer network comprising: a plurality of client devices; a server computer in communication with the plurality of client devices, wherein the server executes a method of data distribution in the computer network, the method comprising: defining distributable data, wherein the distributable data comprises content data and policy data, the policy data comprising a randomized rule restricting a presentation of the content data on a client device of the plurality of client devices based on a random factor, the policy data comprising a targeting rule restricting the presentation of the content data on the client device according to local data retained on the client device; and distributing at least a part of the distributable data to the plurality of client devices, thereby enabling each client device of the plurality of client devices to use the part of the distributable data for restrictively presenting the content data according to at least one of the randomized rule or the targeting rule.

Images