df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing. Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

New customer acquisitions channels await if you can walk the tightrope between B2B and B2C.

> Customer acquisition costs can make or break a business. 

The more it costs to acquire a customer, the more value businesses have to get from that customer to make a profit. If the value of each customer is less than the money it takes to acquire them, no investor's wallet will be deep enough to sustain the company for the long term. 

Some companies are turning to other businesses to acquire customers, developing business models that tie mutually beneficial links between the companies and their customers. In this model, called B2B2C, one business offers a service to a business that needs it, but the first business retains the customers it gains. 

Grubhub, a popular delivery app, is an example. When you order your dinner through Grubhub, you can access dozens of restaurants in your local area. You're simultaneously the customer of Grubhub and whichever restaurant you choose. GrubHub didn't sell their product to the restaurant (B2B), nor did they make the food you're about to eat (B2C). This is the B2B2C business model in action. 

B2B2C offers a compelling mix of B2B and B2C advantages to startups searching for product-market fit and to established companies looking to acquire new customers. When done right, it's win-win-win for both of the businesses and their customers. 

## What is B2B2C?

B2B2C describes a business model where your company sells a product or service to another business, which gets you access to customers you get to keep and use. Here are the key differentiators for B2B2C:

1. Your business offers a horizontal solution to another business's problem.
2. The other business's customers recognize that they're also your customers.

![Image of Business to business to consumer acronym (B2B2C)](https://images.ctfassets.net/23aumh6u8s0i/u2b5DKGwQGoT0HFSNvDwq/50d62116826610c3c7734a26a9903c40/b2b2c-separator-01.png)

Take another look at Grubhub: It sells a horizontal feature to the restaurants around you. Many of them can't offer delivery, and most of them don't have the funds to build out a consumer-facing app—much less provide customer support for it. 

If a restaurant partners with Grubhub, they get to offer their previous customers a new feature, potentially resulting in more orders and higher customer satisfaction. When Grubhub partners with a restaurant, they get access to those customers and can maintain that relationship as they order from other restaurants in other locations. 

The B2B2C model is more than a mutually beneficial relationship between businesses: It requires that customers develop direct but separable relationships with both brands. 

Your local grocery store didn't form a B2B2C relationship with Coca-Cola to sell soda. This is a vendor relationship: Coca-Cola sells their product at wholesale to another business, which sells it to you for a marked-up price; Coca-Cola doesn't sell soda to you directly. 

Another easy-to-mix-up B2B relationship is white labeling. Take [Bread, for example](https://www.getbread.com/blog/truth-about-white-labeling/). Bread offers a white-labeled product for stores that want to offer financing. You might notice a horizontal value here. But the nature of a white-label relationship is that customers don't know they're using Bread; they just know there's a new button when they check out. 

In a true B2B2C deal, the business you're selling to gets a problem solved, and your business gets access to a new customer base that isn't fixed to the prior business. 

## Why B2B2C Can Create Strategic Customer Growth

B2B2C deals combine two of the best features from B2C and B2B models: network effects and predictable growth plans. 

If you acquire entire customer bases through B2B2C deals, you can use that data to fuel further acquisition and iteration. The more you know about your customers, the better you can find them and serve them. 

Network effects are typically the domain of B2C companies — Facebook and Google being [prime examples](https://stratechery.com/2018/the-moat-map/). Unfortunately for other B2C companies, network effects have discouraging, downstream influences. Google's product improves as it acquires users, which means that any Google competitors have to find ways to improve their product without the same access to feedback. 

With a B2B2C model, you can get around some of those effects. Each B2B2C deal offers you customers and data, but you can build on those network effects in chunks rather than drips. With this kind of acquisition, you can plan for network effects. 

OpenTable, a B2B2C company that offers online reservations with restaurants, builds network effects into its email marketing. Initial user acquisition typically starts with users seeking a reservation to a local restaurant, but once users join the service, they get restaurant recommendations tailored to them based on users in their area. 

![OpenTable web site screenshot](https://images.ctfassets.net/23aumh6u8s0i/4UXoeaHxiRqDirf84Nx5Xm/7759092d29a0a3794befa9da5ea8e1f7/open-table)

With network effects providing a tailwind, OpenTable's horizontal service shows users that they're now OpenTable customers and that there's value in being an active participant in the service. 

By making deals with businesses instead of navigating waves of consumer trends, you can also make a more predictable, long-term growth plan. 

Hero, another company with a B2B2C business model, has this planning potential. Hero enables retail employees in physical stores to connect with online shoppers through chat and live video. 

![Hero live from showroom application](https://images.ctfassets.net/23aumh6u8s0i/2GtFDECEq6H2GISKqnJ3x7/a4acaa4798fc466e589d33721715eaf6/hero-showroom)
*[Source](https://blog.usehero.com/selling-iconic-designs-online-how-jonathan-adler-maximizes-its-stores-potential-with-hero-e344f5c94694)*

Hero provides a digital layer for physical retailers. That way, physical retailers can still interact with online consumers by showing them products and sharing information.

Instead of acquiring users directly, Hero can chart its growth against a much smaller selection of stores and chains. 

This growth plan is advantageous because B2B companies [tend to have less churn](https://www.profitwell.com/blog/how-b2b-and-b2c-companies-solve-churn-for-different-customers) than B2C companies. Consumers have a wide variety of services to turn to, and might churn because they lose interest, find a better product, or decide they could no longer afford it. B2B companies try to solve business problems, so client interest isn't as likely to wane and there might not be many alternatives if the market is niche. 

With B2B sales, you can focus on building a sales team that pursues and maintains fewer, but larger, accounts. As each B2B client offers a group of customers, you can still [get the data](https://auth0.com/blog/three-tools-to-improve-your-customer-intelligence/) that cultivates successful B2C growth. 

A B2B2C company can iterate its service with each customer but plan its growth with each client. 

## B2B2C Customers Need Identity Infrastructure

B2B2C business models rely on an infrastructure that enables cross-platform user management. With white-labeled [identity infrastructure](https://auth0.com/blog/what-is-identity-infrastructure/) from Auth0, you can make authentication seamless and secure so that customers can focus on using and enjoying your product.

### Single Sign On (SSO)

Asking users to remember another set of credentials is a big request. According to a Digital Guardian survey, [nearly a third of users](https://digitalguardian.com/blog/uncovering-password-habits-are-users-password-security-habits-improving-infographic) already have too many password-protected credentials to count. If they're trying your service out for the first time, you don’t want to create friction.

Look at the identity needs of a [company like GO1](https://auth0.com/learn/go1-adaptable-authentication-service-built-scale/), for instance. GO1 is a B2B2C company that works with learning management system providers to build a repository of compliance and professional development content. With one subscription, end-users get access to this volume of valuable content, and businesses can better enable employee growth. 

Seamless authentication is key for this level of engagement. Self-development isn’t always easy, and users facing a login screen every time they want to view a resource or test a new module could make the experience even harder. GO1’s long-term success rests on consistently showing users the value of new knowledge and making it simple for them to pursue it.

![The Go1 Site screenshot](https://images.ctfassets.net/23aumh6u8s0i/453YMGqqDX01MzeD1ETKmR/0aec12fee74f33cd95e9f24fc5f971a7/go1-site)

[Single Sign On (SSO)](https://auth0.com/blog/what-is-and-how-does-single-sign-on-work/) enables users to log in with one set of credentials — and stay logged in — creating a seamless experience that lets the GO1 product shine through. 

As GO1 expands to new use cases, such as enabling job search companies to prompt their applicants to complete training via GO1 before applying, the authentication experience becomes even more important. Expansion requires integrating with different authentication protocols, such as SAML and LDAP. An outsourced identity provider can help you consistently [scale a high-level authentication experience](https://auth0.com/blog/the-real-roi-of-auth0-part-2-innovation/) without consuming your developer resources. 

### Security and Privacy

A B2B2C business model also relies on the ability to safely manage users. 

If you want to sell another business on your service, the advantages of that deal need to outweigh the risk associated with introducing a third party. The network effects that make a B2B2C deal valuable depend on data, so your customers need to be able to trust you with that data. 

Since B2B2C typically involves one business positioning its service as an add-on to another business's service, a [data breach](https://auth0.com/blog/what-is-a-data-breach/) can be especially dangerous. Users are already getting value from the main service, so if your security practices develop a poor reputation, you'll be easy to avoid. And if the [data breach is high profile](https://auth0.com/blog/11-of-the-worst-data-breaches-in-media/), the main business might drop your service to keep its users safe. 

Auth0 is a trusted, vetted identity provider, as proven by our adherence to best-in-class [compliance frameworks](https://auth0.com/security/). By offering robust security features, you can demonstrate to users, and the business offering them to you, that you can treat their data with care. 

Counterintuitively, adding security also grants you the opportunity to learn more about your users. Auth0 offers [progressive profiling tools](https://auth0.com/blog/how-profile-enrichment-and-progressive-profiling-can-boost-your-marketing/) so that you can learn more about your customers over time. Rather than barrage them with questions all at once, you can get different bits of information every time they log in: their name the first time, their address the second, their industry the third, and so on. 

Security can bolster, not slow down, your network effects. 

### Branding and White Labeling 

An essential feature of a successful B2B2C relationship is that your newly acquired customers actually identify as your customers. If your brand name merely flashes by as customers proceed with their normal flows, then you're not getting the full value of the B2B2C deal. 

The B2B2C relationship is already fairly complex, and customers are liable to confuse which business they need to contact for support in different contexts. If you can white label any of the supporting infrastructures you need to manage users, your relationship with them will be simpler. 

With Auth0's [Guardian](https://auth0.com/multifactor-authentication), you can build a multi-factor authentication application that matches your brand's look and feel. Combined with an extensive JavaScript library, you can further customize Guardian to your specific needs. 

Branding is powerful, and with the right tools, your customers are better able to see your service and remember its value. 

## Is Your Business Right for B2B2C?

B2B2C relies on aligned incentives and on businesses that can maintain that alignment. 

The business you're selling to has to want another brand involved, not just your service or solution. If that business only wants a new feature, a true B2B2C deal will be difficult to strike and hard to maintain. 

Look for these deals by pursuing companies that already offer a range of services or products. They'll likely be more open to adding yours to their portfolio. If you come into the deal with a well-run customer success team, you can [pitch that support](https://blog.getbase.com/sales-support-drive-acquisition). The less that business has to worry about the problems your solution might introduce for their customers, the better. 

B2B2C can be your core business model, or it can be a growth stage. Uber started as a digital, on-demand cab service; now it offers delivery at scale through Uber Eats. Instacart started as a grocery delivery service, but there's speculation it might [pivot to B2C](https://www.forbes.com/sites/brittainladd/2019/02/11/killing-instacart-why-the-company-is-at-risk-of-crashing-to-the-ground/#551d52d536e8) by leveraging user data to open its own grocery stores. 

To strike a B2B2C deal, your service has to offer horizontal value. To succeed with a B2B2C deal, new users have to identify as your customers. 

Getting the deal depends on a good sales team and the right product alignment. Succeeding with the deal depends on supporting users with the right identity infrastructure and the best authentication experience. 

<include src="asides/AboutAuth0" />

B2B2C Customer Acquisition Needs Identity Infrastructure

ec1c9350c3d2306e7c42b9307bea93de?s=480&r=pg&d=https%3A%2F%2Fcdn avatar

ec1c9350c3d2306e7c42b9307bea93de?s=480&r=pg&d=https%3A%2F%2Fcdn

I like working at Auth0 because I’m interested in how to scale a startup and training the next generation of identity experts.

Strategic Operations and Technical Field Enablement Director

Yvonne Wilson

Learn how to create a realistic project plan to have a good Identity Management project deployment.

Pick up almost any book on project oversight and you’ll quickly see a pattern to advise about how to have a successful project. Certainly, all the usual advice, such as the items below, apply to identity-related projects.

- Ensure the project has clearly defined objective and scope
- Identify and obtain input from representative stakeholders
- Define clear ownership and roles for all parts of the project
- Create a realistic project plan based on stakeholder input
- Track progress regularly to quickly identify causes of any delays

That is excellent advice, but in order to create a realistic project plan, you have to know what typically needs to be done for a particular type of deployment. What if your project team does not have that knowledge? A frequent cause of project issues and delays is simply not accounting for certain requirements. Many an Identity Management project has been delayed by overlooking requirements at the beginning.

Have no fear &mdash; this post will outline several of the most common oversights and pitfalls for identity projects and how to avoid them. These can be grouped into roughly three categories:

- Identify requirements for the entire identity management lifecycle, not just logging in
- Plan for identity failure and change, so you are ready for such events
- Address security and compliance requirements

If you consider the above at the beginning of your project, you’ll have fewer surprises along the way to derail your project.

![Illustration of how to have a succesful Identity Management Project](https://images.ctfassets.net/23aumh6u8s0i/5jn0njMm1bewSR23umVL05/7493c9c60e54aca5b61737fca77d3075/idm-project-dismantle-02)

## Guidelines to Identify IDM Project Requirements

The first thing to check is that your requirements specification takes into account the entire identity management lifecycle. I often tell people that they’ll spend more time on implementing how to log out than how to log in, so they should define how logging out should work early in the project and allow plenty of time in a project plan for testing and implementation. Beyond logging in and logging out, there are several other requirements which may lead to unpleasant surprises and delays if forgotten at the beginning. The following list may help you surface requirements early on:

### How Will User Accounts Be Created?

Will users need to sign up or do they already exist somewhere else and need to be migrated? If users need to sign up, where will that occur, and will all information be collected at once or is [_progressive profiling_](https://auth0.com/docs/user-profile/progressive-profiling) needed? If users need to be migrated, consider that passwords are usually hashed and not transferable from one system to another as-is, necessitating a [_trickle-migration_](https://auth0.com/docs/users/migrations/automatic) approach or [_password reset._](https://auth0.com/docs/connections/database/password-change)

### Will User Profiles Need to Be Synchronized?

Will user profile information need to be synchronized between a system of record (authoritative source) and other points, such as application user stores? It simplifies operations if synchronization can be avoided but legacy systems may require this.

### Username Uniqueness

Identify the attribute used to identify users when logging in as well as across all applications and ensure that the username identifier will be unique for all users. You'll need to especially consider any mergers and acquisition activity that could occur. This will help identify if any mapping of identifiers might be needed across systems.

### How Will Users Log In?

Okay, no one forgets this one, but the devil’s in the details. Be sure to think about what forms of authentication are appropriate for your use case: username and password? [_Passwordless_](https://auth0.com/passwordless) forms of authentication? If your application deals with sensitive data or transactions, is [_multi-factor authentication_](https://auth0.com/docs/multifactor-authentication/) appropriate?

> Auth0 Passwordless is a drop-in authentication system based on Email or SMS, that improves security and user experience. Check it out at [auth0.com/passwordless](https://auth0.com/passwordless).

![Screen showing different passwordless authentication methods with Magic Link selected](https://images.ctfassets.net/23aumh6u8s0i/4y4Kb6Sx3JEwxEGaxTR5xU/49137e92bae8c15bfe3c48b1a35eeacb/magic-link)

### What Devices Will Be Used?

Authentication flows do not work identically across mobile and desktop types of devices. Sadly, in this day and age, this is still a thing. Security configurations, such as browser configuration for trusted sites or mobile device management software can impact the use of cookies, fingerprinting and such &mdash; all of which can impact authentication flows. Be sure to identify the devices that users will use and test across all of them early on in the development cycle.

### Is Single Sign-On Needed?

If you offer multiple applications to users, should users be able to log in once and then access other applications without signing in again? If yes, be sure to consider whether all the applications in a [_single sign-on_](https://auth0.com/docs/sso/current) circle use the same authentication mechanism and user repository. If there are multiple user repositories, will authentication against any of them suffice for access to all the applications or are the requirements more granular?

> Auth0 supports [universal login](https://auth0.com/blog/authentication-provider-best-practices-centralized-login/) on customer apps. In contrast to embedded login, this offers increased security and a shorter setup time.

![Auth0 Universal Login offerings](https://images.ctfassets.net/23aumh6u8s0i/21BR2xIUfU721nga9W1FqO/184597f0a961d89938bb9923b08e6a73/centralized-embedded-diagram)

### Should Multi-Factor Authentication (MFA) Be Used and If So, When?

MFA offers a higher level of authentication for better protection of sensitive assets. Be sure to consider if it will be used upon initial authentication or only when the user accesses more sensitive content/transactions. There are many forms of MFA available, so be sure to experiment with several and select a form that is suitable for your user population. Be sure to test the usability of the initial registration, as well as any reset processes needed if users change devices, phone numbers or any other aspect of the MFA flow. Cumbersome processes can cause user frustration and support headaches.

> [Learn everything about Multifactor Authentication (MFA)](https://auth0.com/learn/get-started-with-mfa/) and how you can start using it right now in your application.

![Eanbling Multi-factor Authentication (MFA) from Auth0](https://images.ctfassets.net/23aumh6u8s0i/5aPgE6GMpGdmaThY8OOHth/a615c93e951b8b648431d86101b81033/enabling-mfa.png)

### What Should Happen When the User Decides to Log Out?

Handling clicks on the [_Logout_](https://auth0.com/docs/logout) button may be trickier than it seems, so pay attention to it early in the design. At a minimum, any session maintained by the application should be terminated. If an application delegates authentication to an external identity provider/authorization server, there may be additional sessions to terminate. Terminating those additional sessions, however, may pull the proverbial rug out from the user’s activity in other applications. Be sure to understand all the sessions that are created when a user authenticates as well as any other applications that depend on the same sessions, before finalizing desired logout behavior.

### How Will Browser Configuration Influence Sessions?

Be sure to understand the impact of browser configuration on sessions. Some browsers have configuration options to reconstitute previous sessions after the browser has been shut down and restarted. Do not rely on browser shutdown to terminate user’s login sessions. In troubleshooting user issues, support teams will need to be aware of such browser configuration options and how to instruct users to start a clean new session when troubleshooting. In addition, be sure to ask if your application will be accessed from shared devices and if so, consider how to protect users that forget to log out.

### Session Timeouts

When users log in, for how long should their session remain valid? If they forget to log out, should their session be terminated after some period of time? You may want to have an idle timeout that occurs when a user has been inactive for some period of time, as well as a maximum timeout that occurs regardless of user activity. Don’t forget to consider the appropriate timeouts for MFA sessions and whether users should be allowed to bypass MFA from known or frequently used devices. Similarly, you should specify whether users should go through the MFA flow every time they log in or will be allowed to only do it periodically, such as every 30 days.

> Learn more about how [_session timeouts_](https://auth0.com/docs/dashboard/dashboard-tenant-settings#session-timeout) are managed with Auth0.

![Login session management at Auth0](https://images.ctfassets.net/23aumh6u8s0i/6zsFj7vQJuZliTFfCNImrl/135fa606ee2c7cc3c9d78b9120551e9f/auth0-dashboard-session-timeout)

### Deprovisioning: What Happens When It’s Over?

Parting is such sweet sorrow… or not. You should consider whether there will be a need to terminate or suspend a user’s account. You should consider audit needs which may dictate that accounts be suspended, but not deleted so that if fraud is detected at a later time, you have sufficient information to tie a user ID in a log file back to a real person. You should also take into account your data retention policy - you do have one, right?

Last but not least, you should ensure specifications in this area align with any relevant [_privacy regulations, such as the GDPR_](https://auth0.com/docs/compliance/gdpr/features-aiding-compliance#conditions-for-consent), that apply to your target user population. Be sure to research and comply with any “right to be forgotten” clauses in privacy legislation for relevant jurisdictions.

### Password Reset

Nothing lasts forever, and passwords are no exception. Be sure to design flows for users to reset passwords, both when they remember the old password and when they do not. You should also specify the requirements for password complexity and whether passwords should expire, requiring rotation, and if so, how often. There is now a debate about whether password expiration and rotation is helpful or not, so you should read up on that and consider the[_ latest recommendations on that front_](https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/). Forgotten password reset flows are a common attack vector for hackers, so be sure to include these flows in your security testing.

> Additional reading: [Easy Ways to Build a Better P@$5w0rd](https://www.nist.gov/blogs/taking-measure/easy-ways-build-better-p5w0rd).

![NIST Password Tips](https://images.ctfassets.net/23aumh6u8s0i/OMVAJJhH11CKwrtI7qNvI/e1df75bbc6682600d48c6bed683f8eaf/password_tips)

[_Source_](https://www.nist.gov/sites/default/files/styles/960_x_960_limit/public/images/2017/10/04/password_tips.jpg?itok=uhqF7cwb)

### Blocked Users

It’s a fact of life that, well… life happens. Be sure to consider whether there will be situations where users need to be suspended for a period of time. This could be due to delinquent bills or something as innocuous as someone being on temporary medical leave. Consider the situations that might arise and how to flag users impacted by such situations as well as the process to [_unblock_](https://auth0.com/docs/user-profile#block-and-unblock-a-user) them when the situation has ended.

### Anomaly Detection

To protect your application you may want to automatically [_detect anomalous situations_](https://auth0.com/docs/anomaly-detection) such as:

- A particular user having a large number of failed logins.
- A user logging in from two widely separated geographic locations within a short amount of time.
- Users whose credentials have been compromised and published on the internet in databases of hacked passwords, such as Troy Hunt’s [_haveibeenpwned_](https://haveibeenpwned.com/).

> Auth0 provides three built-in shields that [detect anomalies](https://auth0.com/docs/anomaly-detection) among users in an app's system.

![Anomaly detection example - offered by Auth0](https://images.ctfassets.net/23aumh6u8s0i/61niknHzbOQhzVr96l3lvX/3eea80eace03aa11338ca81e2f102982/anomaly-detection-overview)

### Privacy/Compliance Requirements

Be sure to dig into privacy and compliance requirements up front as they can be time-consuming to fully understand and can impact core processes such as user signup, use of user profile information, and data retention practices as well as logging and backups. There may be several processes you’ll need to implement to respond to user queries such as what information you hold about a user and processing a user’s request to be forgotten. Requirements differ somewhat by user location, so you’ll need to consider the jurisdictions that apply based on where your users are located.

### Audit Logs

You will want to define your requirements for [_logging_](https://auth0.com/docs/logs) and ensure that you will be capturing the information needed for security and audit needs as well as any marketing analytics or charge-back purposes. Consider how long you need to keep logs, weighing audit, security and privacy needs. Logs are most useful when they are actually checked, so you’ll also want to consider how to [_export and analyze logs_](https://auth0.com/docs/extensions#export-auth0-logs-to-an-external-service) data with any of the powerful logs analytics tools that exist today.

### Consider How Identity Information Might Change Over Time

Don’t forget to consider how identity information might change over time. Will usernames need to change for any reason such as legal name changes? Might a user’s status change, such as in the case of a temporary worker becoming a permanent employee and if so, will the process result in overlaps of state where the user has two profiles in existence at once?

## Recap

Auth0 has written some guides for typical customer scenarios that may help you flesh out additional requirements:

- [_B2C scenario_](https://auth0.com/docs/architecture-scenarios/b2c)
- [_B2E scenario_](https://auth0.com/docs/architecture-scenarios/b2e)

The above list of points should give you a running start for what requirements to specify for an Identity Management project focused on authentication and authorization for your applications. By identifying and planning ahead for critical requirements, you’ll reduce the number of project delays caused by critical requirements surfacing part-way through the project. You can further reduce risk by identifying the requirements that will be hardest to meet or involve the most unknowns, and scheduling work on those areas early in the project plan.

![Illustration of how to have a succesful Identity Management Project](https://images.ctfassets.net/23aumh6u8s0i/3xcfKK8nNxOokMAfLlleRt/0bd242d10db9f3195af953a66fa63612/idm-project-dismantle-01)

In part 2, we will cover some things that can change over time or go wrong with the identity aspects of a project. [Read How To Have a Successful IDM Project (Part 2)](https://auth0.com/blog/how-to-have-a-successful-idm-project-part-2/)

<include src="asides/AboutAuth0" />

How To Have a Successful IDM Project

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

An honest look at the Cambridge Analytica data breach numbers. What's next for social login authentication? Time to switch social providers?

In 2015 Facebook learned that Dr. Aleksandr Kogan, a psychology professor at the University of Cambridge, illegally passed Facebook data that he collected with his app, “thisisyourdigitallife,” to the political and military strategy firm SCL/Cambridge Analytica.

Kogan billed “thisisyourdigitallife” as a research app used by psychologists and achieved [270,000 downloads](https://newsroom.fb.com/news/2018/03/suspending-cambridge-analytica/). Each user consented for Kogan to access their personal information, including location, Facebook content they had liked, and friends and connections. 

Cambridge Analytica also obtained data without users' consent from an [additional ~87 million](https://www.wired.com/story/facebook-exposed-87-million-users-to-cambridge-analytica/) accounts and sold their findings to political campaigns, including those of [Ted Cruz](https://www.theguardian.com/us-news/2015/dec/11/senator-ted-cruz-president-campaign-facebook-user-data), Ben Carson, and [Donald Trump](https://www.nytimes.com/2018/03/17/us/politics/cambridge-analytica-trump-campaign.html).

![Cambridge Analytica data breach internal email discussion](https://images.ctfassets.net/23aumh6u8s0i/1a5Zw2zcAYDYMVCjt3ZTSy/4f08f19dfef754ebe3269046a1770238/Cambridge-Analytica-internal-email)

[Source](https://www.nytimes.com/2018/03/17/us/politics/cambridge-analytica-trump-campaign.html)

This data leak is one of the largest and most upsetting for users to date, given the strong evidence of how Cambridge Analytica used their information to influence divisive elections.

For the millions of companies that use [Facebook Login](https://auth0.com/learn/social-login/) to authenticate their users, this investigation poses new business and ethical challenges. This article will help teams grapple with how the scandal could affect their operations and offer solutions for moving forward.

## Should You Stop Using Facebook Login with Your Apps?

Shortly following news of the breach, [Facebook launched an apology ad campaign](https://www.fastcompany.com/40563382/facebook-says-sorry-sort-of-in-its-biggest-ever-ad-campaign) aimed at helping users steer clear of dishonest accounts on its platform that could be attempting to steal their information.

![Facebook post-data-breach apology ad campaign](https://images.ctfassets.net/23aumh6u8s0i/6XPV549H4eXuYj4K8w7mUK/72619ae21946bb22a584b0426037442f/apology-ad-campaign)

 [Source](https://www.wired.com/story/facebook-launches-a-new-ad-campaign-with-an-old-message/)

While the campaign provided some good insights, it also highlighted staggering issues within Facebook — particularly how the company has scaled without paying close enough attention to certain user behaviors. 

From fake accounts to clickbait, spam, and more, it appears like [Facebook could be a messy platform to continue to authenticate](https://auth0.com/learn/social-login/) with — at least in the near-term. 

Moreover, it could be a challenge to explain to your users why you are continuing to collect their Facebook data.

### Solution 1: Use Other Forms of Social Login

You have a series of other options for authenticating your users.

![Auth0 Social Connections dashboard](https://images.ctfassets.net/23aumh6u8s0i/4YehQWoR0H6GnHZjbj5H5D/e834bc799a7c04035ff4dc3e54ac6ce7/auth0-social-connectors)

[Auth0 supports 30+ social providers, including Twitter, Google, Yahoo, and LinkedIn](https://auth0.com/learn/social-login/). You can also just add any OAuth2 Authorization Server you need. Despite differences among each provider, Auth0 simplifies the process by unifying the way to call providers and the information you retrieve from them.

It's simple to switch providers in the Auth0 dashboard. If you haven't already, you can <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account here</a>. Then, simply click [Connections, then Social](https://auth0.com/learn/social-login/). To enable a new provider, just flip the switch next to their icon. You can then select the desired attributes and permissions you want to get from the provider in the configuration popup.

### Solution 2: Incorporate Simpler and More Visible Means of Obtaining User Information

[Progressive profiling](https://auth0.com/blog/progressive-profiling/) is another technique for gradually building up a profile of your customers. Each time they interact with your product, you display a short questionnaire. It can begin with something as simple as requesting a first and last name:

![Auth0 registration signup with expanded first and last name fields](https://images.ctfassets.net/23aumh6u8s0i/6c1CdEctffMU2WUx3oFDsQ/7cd3336e0c18ae25a94fa341b032c62f/auth0-registration-form)

From there, you can continue to get more specific — but in small increments:

![Auth0 progressive profiling form](https://images.ctfassets.net/23aumh6u8s0i/3FMpAM4y5mzmPPhgtu1hgf/da847942e43f5d4586f8b351f7484330/auth0-progressive-profiling-form)

Progressive profiling allows you to keep these forms short and to the point and collect data in a clear and transparent way. You will slowly build up a robust customer profile that affords you the same power as a Facebook profile does to send better, more targeted offerings to your customers.

### Employ Good Privacy Policy UX

Whichever authentication method you go with, make sure you clearly explain your process to your users. While this is critical for [complying with GDPR and related measures](https://auth0.com/docs/compliance/gdpr), it is also an opportunity to highlight the benefits of why you are doing so. Are you helping deliver to customers the content they actually want to receive? Avoiding showing them products or hyping services that are irrelevant? There is a lot of information you can incorporate alongside legal jargon that shines a light on how thoughtful your team is with its operations.

Starting gradually will help assure your users of your expertise at the outset without overwhelming them with technical information.
 
![Microsoft form explaining usage of birthdate](https://images.ctfassets.net/23aumh6u8s0i/5IHR68eJ55yVT7yvrtKEE1/855e00d6187589bdd8ae7297e0865da5/microsoft-form-explaining-usage-of-birthdate)

[Source](https://www.econsultancy.com/blog/69256-gdpr-how-to-create-best-practice-privacy-notices-with-examples)

Adding an automatic text window, like Microsoft does, that appears when requesting data points enhances the user experience in a clear and simple way. From there, you can prompt viewers to click through to a larger policy statement. If they continue to be curious, place links for them to dig even deeper:

![Microsoft privacy policy sample](https://images.ctfassets.net/23aumh6u8s0i/7cfutBnxv1JwnS9IFPvCE4/26deebc81cef26a3c02ce50e1f611060/microsoft-privacy-statement)

[Source](https://www.econsultancy.com/blog/69256-gdpr-how-to-create-best-practice-privacy-notices-with-examples)

If you're daunted by crafting all of this text yourself — ensuring it is both accurate and digestible — there are many privacy policy templates online. If you're an e-commerce company, for example, [Shopify](https://www.shopify.com/tools/policy-generator) offers a series of tips and tricks. 

Remember: investing in current customers can actually produce better results than attracting new ones. Taking the time to open up to those currently engaged will spur them to create more value for you in the long run.

## Just Because You Rely on Facebook Login, Doesn't Mean There Isn't a Way Forward

Although Facebook has frustrated many companies with its lack of oversight in the wake of the Cambridge Analytica data breach, it still has enormous resources at its fingertips to (hopefully) help it improve. While we wait for the tech titan to rebuild user trust (and perhaps become a beloved tool for business partners once more), the above solutions will help you continue to research, protect, and delight your users. 

<include src="asides/AboutAuth0" />

What Data Did Facebook Really Give Cambridge Analytica?

Unlock more value with Social Login, Progressive Profiling, and Profile Enrichment with Auth0.

Strong customer intelligence systems have been [proven](https://www.metrilo.com/blog/why-is-customer-intelligence-important-growing-ecommerce?ref=9d75) to drive growth. Collecting valuable data about your users' app behavior, including their login time(s) and duration(s), purchase histories, locations, and personal information, such as gender and interests, will go a long way toward crafting highly targeted marketing strategies and relevant product updates.

But what is the most efficient way to go about doing this? How do you collect this information without bothering your users? More importantly, given all of the pushback against Facebook and Cambridge Analytica's [collection of user data](https://auth0.com/blog/cambridge-analytica-and-facebook/), how do you assure your users that their information is safe and that you remain transparent about how you are capitalizing on it?

Outsourcing your customer intelligence can give you peace of mind, knowing that the process for amassing the data is well organized, efficient, and secure. Relying on a professional provider wholly focused on this task will also help you comply with rapidly approaching regulatory deadlines, like [GDPR](https://auth0.com/blog/get-ready-for-gdpr/) in Europe and a slew of [related laws](https://auth0.com/blog/gdpr-effect/) worldwide. If you're found to be out of compliance (i.e., your customer data is not secure), your business could face fines of up to €20 million or 4% of the global annual revenue (whichever is greater) — and this doesn't account for lasting damage to your brand and reputation.

Figuring out your system for customer intelligence will help you avoid potentially irreversible mistakes and underpin a strong foundation for growth.

## 1. Start with Social Login

[Social Login](https://auth0.com/learn/social-login/) is a feature that allows companies to have a comprehensive view of each of their customers and better understand their needs. By incorporating data from providers like LinkedIn, Amazon, Google, and many more, you can build a full image of these individuals as consumers — adding not only their names and photographs but also the specific brands they follow:

![Social login combines data about your user from multiple sources](https://images.ctfassets.net/23aumh6u8s0i/60MmcpnBYSRRfFKw3sO0MU/880a80f9bff7e4b12882c20673a54a49/social-login-incorperates-data-from-multiple-sources)

A manager like Auth0 supports 30+ social providers. Depending on your customer base and the type of information you're seeking, you might choose Facebook for personal data or PayPal for purchase history.

<include src="TweetQuote" quoteText="Auth0 supports 30+ social identity providers allowing you to access a comprehensive view of each of your customers and better understand their needs."/>

![Auth0 supports 30+ social identity providers](https://images.ctfassets.net/23aumh6u8s0i/15gOn35FNBq4hd4TgUFhsk/765b3a31cb1bb1894d3319fd8ab594c9/auth0-supports-over-30-social-identity-providers)

It's relatively simple to add a [Social Login feature](https://auth0.com/learn/social-login/) to your app. In Auth0’s Management Dashboard, click Connections and then Social. From there, just flip on the switch of the selected social network provider, and choose the applications you would like to use from this provider. Since each provider has already verified the users on their platform, this cuts down on the risk of letting in fake accounts.

Incorporating Social Login can be a simple fix that opens the door to numerous avenues for growth. For example, if you're creating [email campaigns](https://auth0.com/blog/5-killer-email-strategies-for-lifecycle-marketing/) to engage and upsell your current customers, it's critical that these be personal and not generic. Relying on subtle details that you've picked up on your customers via Social Login can make or break your ROI on such a campaign.

## 2. Incorporate Progressive Profiling to Collect Data Gradually

To reduce friction on your platform and avoid wasting users' time by having them fill out lengthy forms, [progressive profiling](https://auth0.com/blog/progressive-profiling/) is another tool for gradually building up a customer's profile each time they interact with your product. For example, you might begin with something as simple as requesting their first and last name, along with an email address:


 <img src="https://images.ctfassets.net/23aumh6u8s0i/24vgqp2L8eKEFwIjSazJ2s/9db1aa44455fda4f477db2d8d587b6aa/auth0-supports-progressive-profiling-to-build-up-user-data-over-time" alt="Auth0 supports progressive profiling to build-up user data over time" width="323"/>


From there, you might ask for additional details on the second or third login, such as:

* Address
* Birthday
* Phone number

All of these answers come together in a full view of each user:

![Auth0 user profiles have a data rich user experience](https://images.ctfassets.net/23aumh6u8s0i/4Q8gl93fS4HAr59B7hlVoT/38e5e4218bc1ddb6d57e765a8314ee93/auth0-user-profiles-have-a-data-rich-user-experience)

Rich user profiles can allow you to brainstorm appropriate product updates. For example, if a major subset of your users is located in a particular country, you might consider adding a language option to your app or website to smooth their experience.

User details can be as granular as the types of devices users are logging in with. You can harness this information to optimize the content you publish. If the majority of users are on mobile devices, you might consider full-screen advertising formats, such as Instagram, that can amplify your message and provide a more immersive brand experience.

If you are organized with your customer intelligence, opportunities to be creative with your user data are vast.

### 3. Add Profile Enrichment to Your CRM

To build an even more robust customer view, automatically grab publicly available information with a [profile enrichment](https://auth0.com/blog/how-profile-enrichment-and-progressive-profiling-can-boost-your-marketing/) tool. Integrating third-party data APIs, such as [Clearbit](https://clearbit.com/) or FullContact, into your application will allow you to cast an even wider net for customer information.

The quickly growing CRM tool [ProsperWorks](https://www.prosperworks.com/), for example, works with the [FullContact Person API](https://www.fullcontact.com/developer/customers/prosperworks/) to allow users to add names, photos, and additional data from social profiles into sales contacts.


 <img src="https://images.ctfassets.net/23aumh6u8s0i/5IvzWDciRT2xHmmm1YeoL2/2e041b63a64178e9b8ed0deffc48d659/display-contact-details-next-to-messages-for-a-richer-understanding-of-your-users" alt="Display contact details next to messages for a richer understanding of your users" />
 
 <a href="https://www.fullcontact.com/developer/customers/prosperworks/">[Source]</a>
 


When an email exchange appears with an external contact, that contact's personal details are displayed next to the message, allowing a sales representative to have a richer understanding during an exchange and brainstorm ways to connect on a more meaningful level. Deeper engagement between sales and prospects or converted customers will only support acquisition and retention down the line.

At the end of the day, a CRM tool helps you manage data quickly and effectively — but you can utilize it for far more than the sales function. Adding a customer intelligence feature on top of an existing CRM will expand your knowledge base and help you gain more value from what you had considered a single-function piece of software.

Your ability to cross-check each of your customers with profile enrichment will cut down on fake or unwanted accounts. Each time you expand your understanding of your users with a new data capture, you can weed out profiles that return errors or anomalies — or investigate them further.

<include src="TweetQuote" quoteText="Auth0 can give you #CustomerIntelligence and allow you to innovate like never before. Closely observing user behavior can bring to light new ideas for your business."/>

## Innovate with Customer Intelligence

Enhanced customer intelligence systems can help your company innovate in myriad ways. Closely observing user behavior can bring to light new ideas for your business. The online dating app [Bumble](https://bumble.com/), for example, recently picked up on the trend that many of its users were also searching for new jobs and friends and exchanging money with subscriptions on other apps. This allowed Bumble to roll out a new line of services:


 <img src="https://images.ctfassets.net/23aumh6u8s0i/5p18jiIuKSSXSCG68SkNuN/f4a426ea2aae9716fd684b3c74cca594/bumble-releases-new-products-based-on-user-trends" alt="Bumble releases new products based on user trends" />
 
 <a href="https://bumble.com/">[Source]</a>
 


Deliberate, professional, and tight customer intelligence can allow you to develop entirely new revenue streams. While you can try to do this in-house, many find that it is an excellent capability to turn over to an external provider that spends 24/7 staying on the cutting edge of their specific software, making sure it is as efficient and safe as it can be for customers and end users.

3 Tools to Improve Your Customer Intelligence

Explore how staying a step ahead of your customers can revolutionize your company.

**TL;DR:** Predictive analytics is the term used to describe using data to make highly informed guesses about future outcomes. In this article, we will explore the technique and see the benefits.


During the 2010 FIFA World Cup, soccer fans around the world were absolutely captivated — by a German octopus. Paul, as he became known, correctly [predicted](https://en.wikipedia.org/wiki/Paul_the_Octopus) the outcomes of all the games that the German national team played in *and* correctly predicted Spain would win the entire tournament. 

He was heralded as a soothsayer, an oracle, a being somehow able to see into the future. The Spanish Prime Minister even offered him state protection! 

But Paul was just an octopus picking flags on a whim. It was just luck — nobody can predict the future, right?

![Paul the Octopus](https://images.ctfassets.net/23aumh6u8s0i/6ZtFUCadPJZI5AdPzSZNlP/4964b213b71586ed52dfa4b054484d3e/paul-the-octopus)

Well, an octopus probably can't, even if Paul gave it one heck of a run. But the odds that your business could might be higher than you think. That's in large part due to the huge amount of data that businesses are now privy to, and the tools we have available to analyze it. 

These ideas are encompassed by the term *predictive analytics*, and it's what we'll talk about today. How do they work? What types of prediction can your business expect? And how do you get the right data to make good predictions? While Paul may keep his mystical secrets, the answers to all these questions are yours for the taking.

## What is predictive analytics?

Simply put, predictive analytics is using data to make highly informed guesses about future outcomes. For businesses, the most common application of this is in [user behavior](https://amplitude.com/blog/2016/06/14/10-steps-behavioral-analytics/). By observing what past users have done, you should be able to better understand what future users will do. Businesses use this to shape users' paths to increase predictability. 

For example, Tesco, a UK grocer, [used](https://hbr.org/2011/12/know-what-your-customers-want-before-they-do) user behavior data to see what their rewards program members were buying together. They noticed that “Clubcard shoppers who buy diapers for the first time at a Tesco store are mailed coupons not only for baby wipes and toys but also for beer.” Why? “Data analysis revealed that new fathers tend to buy more beer because they are spending less time at the pub.”

This is a clean example, and to get to a place where your business can boast good predictive modeling requires a couple of things that are implicit in the mascara/eyeliner scenario:

- **Good data collection** from all parts of your business at all times.
- **Deep understanding of customer behavior** that is based in data and not gut feeling or supposition
- **Predictive analytics tools** that makes your data workable and tracks your experiments

This forms the groundwork of success with predictive analytics. There's no reason why any company can't start utilizing their data in order to make predictive analytics work for them, and most companies will have some — if not all — of these systems set up already. 

But whether you're all set up or just starting out, you probably aren't fulfilling your predictive analytic potential. For example, how are you using your identity management (IAM) to help with predictive modeling? Are you using it at all? If you really want to get serious about your predictive capability, then you can't overlook it as a powerful avenue for predictive analytics. 


## How does IAM contribute to predictive analytics?

There are a number of ways that IAM can contribute to predictive analytics, but one of the biggest and most underutilized is gathering information with your identity management system. Login can give you a window into who your users are, what they're doing, when they're doing it and how often. 

Some of the data that your IAM can collect is:

* Location
* Device type
* IP Address
* Number of logins
* Timestamp of logins

These are all important factors when figuring out user behavior, especially number of logins, behavioral data which shows how engaged a user is with you. 

But that's not all that an IAM can help you learn. Beyond the obvious, an IAM can help you gather information by:

- **Gathering social data** by requesting access to all of the preferences and information stored in a user's social platform of choice if they're using social login.
- **Customizing profiles** by automating questions to be asked at login. When done properly, [progressive profiling](https://auth0.com/blog/how-profile-enrichment-and-progressive-profiling-can-boost-your-marketing/) can give you the data *you *want about your customers without inconveniencing them or invading their privacy. 
- **Enabling demographic research** by running your users through 3rd-party data APIs to get more information about them. With Auth0, you can automate this process by integrating APIs into profile creation with [Rules](https://auth0.com/docs/rules/current), automated functions that trigger at login. If you want more data about, say, the professions, company sizes and professional roles of your users, for example, you could use Auth0 Rules to automatically run users' emails through [Clearbit](https://clearbit.com/), an API that pulls professional information. 

All of these types of data can be directly funneled into predictive models. Remember that one of the key components to creating predictive analytics for your company is *good data collection* and another is a *deep and unbiased understanding of your users*. If you aren't utilizing your IAM to help you get both of these things, you're missing a huge opportunity and setting yourself back in the process. 


## Easy ways to use predictive analytics

The potential of predictive analytics is huge, but it's a complex field that can be intimidating to unravel. Here are some of the easier ways to use predictive analytics — but keep in mind that even the simplest application will still require that rigorous back-end work to be successful. 

### Marketing

Our Tesco example was a hint at this, but one of the most predominant ways to utilize predictive analytics is marketing. This helps you tailor your marketing efforts to better sell to specific customers by looking at past data on what similar customers have bought or done. 

A great example of tailoring your marketing efforts based on data is Geckoboard's [system](https://clearbit.com/books/data-driven-sales/inbound-lead-qualification) for qualifying leads. They realized that their template for their “ideal customer” was leaving out the majority of the leads they were generating, leaving marketing with a soup of people to manually sort through. 

They decided to enrich their data to get a more complete view of their users, and use new information about the types of leads they were pulling in to autoscore leads with a more complex system:

![Point Based Lead Scoring](https://images.ctfassets.net/23aumh6u8s0i/1MF3y7XfyBsXfbyekdEdmC/8c66234ffd6d7c9cc5ae2c938393bd53/advanced-point-based-lead-scoring_1x)

This system was developed based on a combination of user behavior and good data that they automated into their system through the Clearbit API. 

These tactics are obviously not limited to discounts or leads — they could be different email copy, coupons, or ads that speak to the likely purchases, desires and vulnerabilities of a given consumer. 

### Sales revenue

Predictive analytics can lead to better sales projections because you are making a more concerted effort to collect data on customers and use it to predict outcomes. 

Take [Microsoft](https://www.microsoft.com/itshowcase/Article/Content/770/Predictive-analytics-improves-the-accuracy-of-forecasted-sales-revenue) — the company recently revealed that they've ramped up predictive analytics in their sales department in a big way. By integrating predictive analysis into their sales process, they're getting more accurate sales predictions from top down. Here's what they say about how individual reps are helped by predictive analytics: 


> “[Our most recent] model uses machine-learning algorithms and opportunity-scoring data for near real-time win/loss predictions of a sale. It helps sellers prioritize by showing whether an opportunity is hot, warm, or cold, and advises them about actions to take.”

### IAM security

<include src="TweetQuote" quoteText="When you have a good IAM in place, you can use predictive analytics to help keep you and your users more secure."/>

One of the best examples of this is anomaly detection, a security measure that flags unusual behaviors to keep users safe. For example, Auth0 offers [brute force protection](https://auth0.com/docs/anomaly-detection), which allows you to trigger security measures if someone makes too many attempts on a login. 

This type of security relies on regular user behavior — like not trying to sign in to their account 20 times in a row — and uses it to help keep users safe. You've probably been the beneficiary of protection based on your behavior without even realizing it. An email that says, “we got a login from a new computer or location — is this you?” is another type of identity protection that relies on predicting user behaviors. 

![Dropbox Signin Warning](https://images.ctfassets.net/23aumh6u8s0i/JByzpyhEpMxeLqYfUYucK/9f8ee66d608c0265c0a69d8500d8aad7/dropbox-signin-warning)

*A security email from Dropbox notes what location, time, web browser and computer are used in a login attempt that doesn't match a users' predicted (i.e. previous) behavior.*

With an IAM system like Auth0, turning on security features like brute force protection is as simple as choosing a couple of preset options, and should be a no-brainer to incorporate this type of predictive analytics technology into your business. 


## Keep looking into the crystal ball

<include src="TweetQuote" quoteText="When you start to see the power of what your data can do, you'll want to dive in with both feet."/>

Predictive analytics isn't a short-haul adventure. And when you start to see the power of what your data can do, you'll want to dive in with both feet. 

Yes, it takes time to collect good data, devise a pipeline for sorting through it, and find your correct predictive variables. That fact is probably not going to change anytime soon. You can make an easy start by getting your current software tools — like your IAM — to work for you.

Predictive Analytics: Why Is It Important?

ryan-chenkie

Ryan is a full-stack JavaScript developer and trainer who mainly works with React, Angular, Node, and GraphQL. He runs a consultancy where he builds apps for companies and also helps established dev teams with their modern JavaScript challenges. Ryan is a Google Developer Expert, the host of the Entrepreneurial Coder Podcast, the author of Securing Angular Applications, and an all-around fanatic about application security.

Developer

Ryan Chenkie

For B2C companies, nothing beats knowing who your customers are and what they want.

---

**TL;DR**: Knowing your customers is key when it comes to effectively selling to them. In this article we'll explore four ways that you can put user data to work to get to know who your customers are, what they want, and how to serve them better.

---

Business challenges exist in all industries, which is a reality that organizations need to contend with and work past. However, for businesses that are strictly consumer-facing, such as retail, some challenges can be greater than they would in others industries. For most companies, it doesn’t make any sense to target all consumers with a given offering because there’s no way to serve absolutely everyone. As the saying goes, if you try to cater to everyone you’ll end up serving no one. What B2C companies are left with, then, is the need to get specific and target a subset.

Narrowing down to a smaller target audience isn’t a silver bullet though. Even at that point, it can be difficult to find optimizations for how to market to this subset because the crowd might still be quite diverse. Perhaps your retail business has stats that say your signature women’s jacket is most popular amongst 25 - 34 year olds in Europe. Chances are good that your total audience doesn’t solely consist of this niche group. A challenge that exists in this case is how to optimize the marketing process so that effort isn’t wasted on those who likely won’t be interested in your offering.

There are many different ways that B2C companies can optimize their marketing processes, but one that can easily be overlooked is through the user authentication process. Assuming you run a website to either augment or act as the sole source of your sales, it turns out that there are a lot of ways your B2C company can use the login process to benefit your overall marketing. The key to it is insightful user data.

## 1 - Build Up Your Customers’ Profiles with Social Data

While it may be true that your customers are all unique individuals with their own hopes, fears, and dreams, there are some attributes that will be shared amongst most of them. Things like age, gender, location, and product preferences are just a few examples of user details that can be common to more than one of your customers. These are pretty typical details for companies to collect, so perhaps you’re already gathering this kind of information.

While this info is great to have and can be helpful, it really doesn’t give you the full picture of your customers. The good news, however, is that you can do better at building up a profile for your customers by leveraging their social data that comes from providers like Facebook, Google, and Twitter.

### How it Works

Chances are good that you’ve come across a website or application that allows you to log in with one of your social accounts. It’s all made possible through OAuth 2.0, a specification that enables a third party (such as a social provider) to authorize users on behalf of the requesting application.
While this is great for the user experience because logging in is a snap, there’s an even greater upside that can be realized by your company if you implement social authentication: you can collect information about your users from their social accounts. Lots of it--valuable bits of info like what events your customers have attended, which ads they’ve read and responded to, and much more.

Did a red light just go off for you? You might be wondering if this infringes on your users’ privacy. Surely your customers wouldn’t want you to know this much information about them and use it for your own marketing purposes, right?.

The key here is that your users all need to consent to sharing this information with you in the first place. When you request that they share it, they are asked very clearly if they’re ok with it. For some users, the answer is no. But for many, the answer is yes, and if it’s a yes, you now know that customer better than you did before.

### The Benefits

The benefits of having more user information for marketing purposes are probably obvious: you can use that information to target your offers to specific customers. Instead of marketing to your customers en masse, you can pick out very specific subsets and craft offers that are specific to them, all while having confidence that there’s a better chance they will respond to these offers because you have data which says so. You can analyze this enriched user information and pull out insights that wouldn’t be possible without social data.

![customer data dashboard](https://images.ctfassets.net/23aumh6u8s0i/3O0KLdg0zMCROLOjF31Zuj/15b74b19efbd8cb8f4bfb931dd4aba64/customer-data-1)

## Social Data is Easy with Auth0

Enabling social login is easy with Auth0, especially when you use the [Lock widget](https://auth0.com/lock) in your application. After <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">signing up for Auth0</a>, select the social identity providers you want to allow your users to log in with. You get to choose which pieces of profile information you’d like your customers to share with you.

![customer data facebook](https://images.ctfassets.net/23aumh6u8s0i/kdHOoDphw5DxTvPzsaeog/d92ff7959a3b9494f843fa1814f0a140/customer-data-2)

When users log in with the social providers you have enabled, their data will be sent back and stored in their Auth0 profile. With this raw data in place, you’ve got a lot of options for using it to support your marketing efforts. For example, you can use the [Auth0 management API](https://auth0.com/docs/api/management/v2) to query your user data for parameters that match what you need for your campaign.

## 2 - Enhance Your Customer Info with Progressive Profiling

When enriching your customers’ profiles with social data, there are times when it’s just not possible to get all the information that you’d like. Perhaps the customer isn’t willing to share their information, or maybe they just don’t have a very robust social profile to begin with. In these cases, there’s another option: progressive profiling.

If you’re a LinkedIn user then you’ve probably already seen progressive profiling in action. In essence, progressive profiling is all about collecting user information in small quantities over time, all while providing messaging to the user which encourages them to do so. There’s nothing worse than needing to fill out dozens of form fields all at once just to start using an application. It makes for a terrible user experience, and is certainly a point of friction that can drive many customers to look for something better. With progressive profiling, you ask for just a tiny amount of information from your customers each time they log in to your app, which greatly reduces the perceived burden of filling out form fields.

### Benefits of Progressive Profiling

While it takes longer to collect user information through progressive profiling, it’s well worth the wait. It makes for a much better for user experience, so the chances of you not losing a new customer right off the bat due to a poor experience are greatly diminished.

More than this though, it provides a way for you to get the same (or similar) information you would from your customers’ social providers. You have control over the questions you ask, and just like a customer can choose to disclose information from their social profiles or not, they have the option of providing an answer to your questions or passing. Could your marketing efforts benefit by you knowing which new movies your customers have watched in the last month? Ask them the next time they log in. Sure, some might pass, but others will give you this information because they are primed to do so through consistency and commitment.

![progressive profiling question](https://images.ctfassets.net/23aumh6u8s0i/5vnD7NjR6Q06SnDjcYUKT2/a33eb7cb3d39965e8c38f2df56ed3f3c/customer-data-3)

![progressive profiling question](https://images.ctfassets.net/23aumh6u8s0i/6rs6KgXFAGwzgsQeNy6BgO/5a287c0918773a57f97814daab2eae93/customer-data-4)

## Progressive Profiling is Easy with Auth0

Auth0 gives you full control over the data stored in your users’ profiles and it can be modified by using the [Auth0 management API](https://manage.auth0.com). To create progressive profiling for your application, you can create a series of “drip” questions you’d like your users to answer and then check whether or not the answers to those questions exist in your users’ profiles when they log in. If the user hasn’t answered a question, you can prompt them for it and save the answer in the user’s profile via the API.

## 3 - Get More Info with Third Parties

Social data and progressive profiling are great ways to enrich your customers’ profiles, but the story doesn’t need to end there. If you’d like to go even further, you can also get creative by consulting third parties for even more user information. There are a lot of options in this area, some of which are free. For example, if you want to know what the median income is for your users’ zipcode, you can query the US Census Bureau API. Or, if you’d like more personalized information, you can use an app like [FullContact](https://www.fullcontact.com/).

FullContact gathers and reports publicly available user information that comes from a multitude of sources. This is really helpful because although your customers likely have multiple social accounts, chances are they’re only going to use one preferred provider to log into your application, meaning you can only get social data from that single provider. Since FullContact gathers data for any visible social accounts a user has, the information in your customers’ profiles becomes a lot more robust.

![auth0 rules](https://images.ctfassets.net/23aumh6u8s0i/61nTgqgbBXLygWQ0awUIBo/592054382ea129e51c74337ce86d158e/customer-data-6)

### Further Enrichment is Easy with Auth0

Auth0 provides a robust [rules engine](https://auth0.com/docs/rules) which allows you to augment the authentication pipeline any way you like. This pipeline is the perfect spot to add logic to send your user’s data to a third party. For example, if you want to use FullContact, you can use a rule which sends the user’s email address to it when they sign up. You can also choose to save the information that comes back from FullContact in the user’s Auth0 profile. In fact, this rule--and many others like it--are already written for you and can be enabled with a click.

![auth0 rules](https://images.ctfassets.net/23aumh6u8s0i/3Q20GjBGwU2lEKytfoj85o/653ab3af136323655d5bb8dff4137c4e/customer-data-5)

## 4 - Go Even Further: Analyze Your Customer Data

Services that provide additional information about your users such as FullContact can be very helpful, but another way to get to know your customer base better is by slicing and dicing your own data. There are plenty of services that can help you manage your customer data, and one great example is [Lytics](https://www.getlytics.com/). Lytics allows you to upload or send your user information to their service where it can be collected and later analyzed.

![auth0 lytics](https://images.ctfassets.net/23aumh6u8s0i/5jvgV8f5bXQmISvH3k4CwG/75d13402acc8447a7626ab7b45e3795d/customer-data-7)

### Sending Customer Data is Easy with Auth0

Sending user information to a service such as Lytics can be cumbersome, and in many implementations you might be required to write a fair amount of code to arrange communication with their API. With Auth0, however, this is a breeze. In much the same way that you can use Auth0’s rules engine to send data to services like FullContact, you can create your own custom rules to send data to Lytics when a user authenticates in your application. Simply write (or modify) a little bit of JavaScript to create a [rule](https://auth0.com/docs/rules) which augments the authentication pipeline to send data to the REST API that Lytics exposes, and you're good to go.


## Wrapping Up

Rich customer identity data is becoming one of the most important ways for B2C businesses to market and sell effectively. Not only is this data important for marketing purposes, but it’s also key to knowing your customers better in general. 

If you’re not yet using social data to enrich your customer’s profiles then you’re missing out on some important opportunities. The good news is that Auth0 can make this process very easy and also solve many important authentication problems in your apps at the same time. If you’re interested in knowing more about how customer identity can benefit your company, [get in touch](https://support.auth0.com)--we’d love to chat.

"progressive-profiling"