4 ms·

Where this analogy breaks down is that the people sent to track you are invisible and can't be seen without the aid of special technology. So what you end up te

Where this analogy breaks down is that the people sent to track you are invisible and can't be seen without the aid of special technology. So what you end up telling people is that they are being followed everywhere by invisible ghosts, who's only desire is to change what ads appear in their newspaper. And it appears that the reaction of most people is about what you'd expect. If a store has policy of "If you come into our store, we'll have employees follow you home" and you don't like that policy, then don't go to that store. That simple. It doesn't make sense to go into the store and have your goons beat up their employees. That might mean that you can't go to the stores you want to go to, but that's how it goes. It seems as clear online as it does in the physical world. (tldr without the analogy: The overwhelming majority of people don't care about being tracked online because there are no obvious ill effects. The problem with ad blockers is that it makes more sense to just avoid sites that show ads, but most people don't want to do this because it would exclude their favorite sites.)

jacquesm 11y ago
If that's all you got from it then I should really do my best to write better. One of the key parts - to me - is that the data silos start trading your data as if it is theirs to whoever pays for it, and that goes a lot further than a real time bidding on ad space, even if that was the initial drive to collect that data.
- WA 11y ago
  The sad part is: It doesn't even matter what I do about privacy. I'm obviously in someone's address book. That someone wants to play some stupid game that asks for all contacts. Maybe that someone used an app like Cobook, which pulls data from their social network sites (and I'm friends with them there). In the end, they get my data, along with a picture and whatnot and I personally wasn't even involved. Heck, I could even use a dumb phone and my phone number would be all over the place. Recently, Facebook asked me once again to add a phone number "to protect my account". One time, my real phone number was prefilled in the box! They pretend that they don't have it, but since some of my friends use messenger, they surely have it somewhere in my shadow profile (a download of "all my data" obviously didn't contain it).
  - jacquesm 11y ago
    Yes, these secondary network effects are maddening. See also: https://mako.cc/copyrighteous/google-has-most-of-my-email-because-it-has-all-of-yours https://mako.cc/copyrighteous/google-has-most-of-my-email-be... I've updated the post to reflect this problem.
- dhimes 11y ago
  Maybe an allegory about how, based on the tracking data, the price you pay for something (say airline tickets) changes. Or the availability of health insurance for your kids? I don't have any facts on which to base the latter, however, but I suspect it's either happening or only a matter of time.
  - jacquesm 11y ago
    That would require proof, and I don't have that proof. Maybe someone in either of these industries can point to something solid? edit: ok, found this: http://www.groovypost.com/howto/news/dynamic-pricing-use-chrome-pay-less/ http://www.groovypost.com/howto/news/dynamic-pricing-use-chr... But it's still a little weak as proof.
  - robbiemitchell 11y ago
    Health insurance is regulated way beyond what you would expect. At least for the individual market, many plans are standardized across all carriers as mandated by the ACA. And in New York (if not elsewhere), rates are proposed in advance to the state and either approved or rejected (and forced to adjust), which can happen for being too high or too low compared to other players. The rates are then set for the year. This is not something subject to real-time bidding.
- karmacondon 11y ago
  It is their data. What they sell is essentially their http access logs, the ip address and time of every page request. While that information may pertain to you, it's not yours. They own it and can do what they want with it, including selling it to the highest bidder. That's true for any website that keeps access logs. If the idea that some websites sell their access logs really disturbs you, don't request pages from websites that do that. Just like someone who is afraid of heights can't go to high places, people averse to ad tracking won't be able to go to most websites. Most people don't want to give up their favorite websites, so ad tracking persists. Many companies that produce or aggregate content do so with the expectation that their efforts will be rewarded with money from ads. When you use an ad blocker, you reap the benefits of their work while knowingly depriving them of what they expected to earn in return. It would be better if you just didn't read their content, effectively voting against their behavior with your feet. Blocking the ads is having your cake and eating theirs too. It's rather benign, there are much worse things, but it isn't really right either.
  - jacquesm 11y ago
    No company sells their http access logs, please don't talk nonsense. The data that is sold is sold to marketeers and is the highest grade profile data that you could get. See the 'schober' link on the page and try to at least be a little bit informed before you start throwing around such opinionated stuff. Schober is an easy target for me because they actually list what they sell, they are also a very old company (they were in business long before the web was born). But they are not the only ones. If you feel like reading a bit on what kind of information is being made available a good place to start would be the RTB spec: https://github.com/openrtb/OpenRTB https://github.com/openrtb/OpenRTB So your whole argument here is based on a strawman.
    - karmacondon 11y ago
      What do you think RTB is? There are websites that will sell demographic information from user profiles, but that's relatively rare. The overwhelming majority of the billions of RTB impressions are based only on location and website audience demographics. Those are things you get from cookies and ip addresses, information that comes entirely from access logs. No, companies don't sell their logs directly, but the vast majority of targeted impressions are sold solely on what is contained in a standard server log. You seem to be knowledgeable about online advertising and forthcoming with sources. Do you have any evidence that anything near 50% of online ad data sold is based on the highest grade profile data? Because I'm certain that is not the case. I think you're confusing the business of selling profile data on individuals, which is indeed very old, with modern ad targeting. It's hard to persistently match that up with an ip address and cookie, you see. Which is why major ad buyers prefer to buy cookies that tag large demographic buckets like "young males in the midwest with an interest in cars" instead of the names and profiles of individual people. It's common sense more cost efficient, and access log data is much more prevalent and reliable than profile data. I don't think that any of this works in the way that you think it does. Yes, re-targeting is creepy, cookies are rampant and the average page loads way too many external files. But companies do all of these things for a reason, whether you understand the details or not. If you don't like how they do business, you can just stop going to their websites.
- robbiemitchell 11y ago
  There is a giant difference between a site-specific tracker that helps a site owner understand her own visitors and ad networks that share cookie data. analytics != ads.
  - jacquesm 11y ago
    Yes, this is true. But: (1) the number of parties that only use site specific trackers is relatively small to the number of parties that use networks, (2) even those parties usually carry facebook/google and other embedded resources, effectively still leaking your data and (3) in the end, you can't be sure that they don't combine that data on the backside with data procured elsewhere.
    - robbiemitchell 11y ago
      I'm not sure whether we're talking about the same thing, but plenty of the web is people running sites tracking analytics on sites that have nothing to do with ads. Of those, Google Analytics would be the most common, and yes, Google is in the ads business. But there are numerous services that provide analytics and have no part in tracking you elsewhere. Is Mailchimp involved in cookie trading? Segment? Intercom? Mixpanel? To my knowledge, no, there is nothing there -- they only know you via session cookies in the browser, and those businesses do not make data available to third-party ad networks. Even in cases where they do bring in data, such as Intercom using FullContact to merge an email address with social data from Twitter, it's a one-way API call from Intercom, with nothing identifying the actual sites that will make use of it. I 100% agree with you on trackers/beacons like "Scorecard Research", and to a lesser extent, Google Analytics, but "you can't be sure" seems like weak ground on which to take a strong categorical stance against any use of analytics tracking. There are real differences to the value they provide and the ability they have to do beyond that even if the incentives are there.
      - jacquesm 11y ago
        Well, the 'you can't be sure' in practice translates into 'everybody does it' but I'd rather leave enough room for those that do not engage in these practices. Absolutes simply don't cut it. And the 'value they provide' is never provided to the users, always to their clients at the expense of those users.
- msellout 11y ago
  This concept of "your data as if it is theirs" is strange to me. Deciding who owns what information is difficult and not so obvious. I once heard a man on the radio saying that he "owned his face" meaning his likeness. Celebrities own their likenesses in that they can block people from using their likenesses to imply endorsement, but they can't block photographers from publishing a photo taken in a public area. Ownership is much more nuanced than you're making it seem. It depends on where and how the data was collected and further, how the data is used. Take car ownership. The department of motor vehicles tracks who owns what car, including non-dealership title transfers. That information gets sold to companies like Experian. Anyone can buy it (https://www.autocount.com/ https://www.autocount.com/). So a company like Yelp, who knows where you live (you do like restaurant reviews from "current location", right?) can cross-reference that with AutoCount data to figure out what car you own. Is that weird? Sure. Is that wrong? Maybe. But it's been going on from before the internet, so I don't understand what's so different now.
  - jacquesm 11y ago
    That data ownership is enshrined in law in the EU. Not that anybody cares.
    - msellout 11y ago
      Yeah, those pesky geographical boundaries make things strange on the internet.
Kristine1975 11y ago
>If a store has policy of "If you come into our store, we'll have employees follow you home" and you don't like that policy, then don't go to that store ... That might mean that you can't go to the stores you want to go to, but that's how it goes. Actually that depends on the laws of the country the store is in.
spobin 11y ago
I agree. This analogy is good up to the point where you consider that these trackers don't really know or care who you are. To them you're an anonymous hashed id. Yes, they 'follow' you around, but they are essentially invisible and mostly aim to improve the targeting of ads/information. It's easy to forget that a lot of this technology is very new and for a while there will be cases where it's seen as intrusive. Things will only get better over time.
- jacquesm 11y ago
  > To them you're an anonymous hashed id. You wish.
  - spobin 11y ago
    I've worked very closely with tracking companies. They are very strict about not storing any unhashed identifyable information such as email adddress, postcode etc.
    - jacquesm 11y ago
      Some are good, some are in compliance with the law and some are not. It's a mixed bag, and then of course there is the small detail that 'the law' is not the same from one place to another and that plenty of companies use this to their advantage.
    - inaccessible 11y ago
      Have you ever seen hotjar, inspectlet, mouseflow and many other service? I mean check out the demo page on the inspectlet site, type in your email address, check the recording and tell me they don't store it in plain text.
gglitch 11y ago
If ad-supported sites posted terms of use that precisely defined what info is to be collected, how long it's to be retained, and who will be able to access it, consumers would be able to make an informed decision about what sites to visit. As it is now, without defensive software, one is asked to just blindly trust the sites one visits.
- hrbrtglm 11y ago
  Great. You just inspired another european privacy law where website will be forced to ask you to read the terms before processing reading. What it will achieve is users will be annoyed and install a termblock extension to their browser, I mean kind of defensive software.
  - jacquesm 11y ago
    There are other options that lawmakers have.
- TravisLS 11y ago
  In the analogy (and online), the newspaper with blank spaces (aka the ad-supported site) is a small and insignificant data player. It's mostly advertisers that are collecting and retaining the data, and not just on websites but in all kinds of ways. The profiles are kept by advertisers, and sold on data exchanges, completely out of the reach and control of the ad-supported site. So unfortunately, ad-supported sites that offer up their ad inventory via real-time bidding can't provide the information you'd want. You would really need to opt-in at every point where data is collected, which is everywhere.
- dhimes 11y ago
  The problem is that people still don't understand what it is they are trading for a "free" web. It really takes a story like Jacques wrote to drive it home. It has to touch them emotionally, because what we are asking them to be wary of touches them with very strong emotions (facebook, for example).
kelseydh 11y ago
But tracking is more pernicious than this. I hope you realize that major political parties now buy this data and use it to target their campaign pitches to people in close elections. Do you buy diapers? You're probably interested in family issues. Do you buy gun parts? Let's classify you as leaning republican... It goes way beyond uses that you would imagine. (PS: this is why if you ever sign up for a membership card at a retailer you should just use a fake name / address...)

jacquesm 11y ago

If that's all you got from it then I should really do my best to write better. One of the key parts - to me - is that the data silos start trading your data as if it is theirs to whoever pays for it, and that goes a lot further than a real time bidding on ad space, even if that was the initial drive to collect that data.

WA 11y ago
The sad part is: It doesn't even matter what I do about privacy. I'm obviously in someone's address book. That someone wants to play some stupid game that asks for all contacts. Maybe that someone used an app like Cobook, which pulls data from their social network sites (and I'm friends with them there). In the end, they get my data, along with a picture and whatnot and I personally wasn't even involved. Heck, I could even use a dumb phone and my phone number would be all over the place. Recently, Facebook asked me once again to add a phone number "to protect my account". One time, my real phone number was prefilled in the box! They pretend that they don't have it, but since some of my friends use messenger, they surely have it somewhere in my shadow profile (a download of "all my data" obviously didn't contain it).
- jacquesm 11y ago
  Yes, these secondary network effects are maddening. See also: https://mako.cc/copyrighteous/google-has-most-of-my-email-because-it-has-all-of-yours https://mako.cc/copyrighteous/google-has-most-of-my-email-be... I've updated the post to reflect this problem.
dhimes 11y ago
Maybe an allegory about how, based on the tracking data, the price you pay for something (say airline tickets) changes. Or the availability of health insurance for your kids? I don't have any facts on which to base the latter, however, but I suspect it's either happening or only a matter of time.
- jacquesm 11y ago
  That would require proof, and I don't have that proof. Maybe someone in either of these industries can point to something solid? edit: ok, found this: http://www.groovypost.com/howto/news/dynamic-pricing-use-chrome-pay-less/ http://www.groovypost.com/howto/news/dynamic-pricing-use-chr... But it's still a little weak as proof.
- robbiemitchell 11y ago
  Health insurance is regulated way beyond what you would expect. At least for the individual market, many plans are standardized across all carriers as mandated by the ACA. And in New York (if not elsewhere), rates are proposed in advance to the state and either approved or rejected (and forced to adjust), which can happen for being too high or too low compared to other players. The rates are then set for the year. This is not something subject to real-time bidding.
karmacondon 11y ago
It is their data. What they sell is essentially their http access logs, the ip address and time of every page request. While that information may pertain to you, it's not yours. They own it and can do what they want with it, including selling it to the highest bidder. That's true for any website that keeps access logs. If the idea that some websites sell their access logs really disturbs you, don't request pages from websites that do that. Just like someone who is afraid of heights can't go to high places, people averse to ad tracking won't be able to go to most websites. Most people don't want to give up their favorite websites, so ad tracking persists. Many companies that produce or aggregate content do so with the expectation that their efforts will be rewarded with money from ads. When you use an ad blocker, you reap the benefits of their work while knowingly depriving them of what they expected to earn in return. It would be better if you just didn't read their content, effectively voting against their behavior with your feet. Blocking the ads is having your cake and eating theirs too. It's rather benign, there are much worse things, but it isn't really right either.
- jacquesm 11y ago
  No company sells their http access logs, please don't talk nonsense. The data that is sold is sold to marketeers and is the highest grade profile data that you could get. See the 'schober' link on the page and try to at least be a little bit informed before you start throwing around such opinionated stuff. Schober is an easy target for me because they actually list what they sell, they are also a very old company (they were in business long before the web was born). But they are not the only ones. If you feel like reading a bit on what kind of information is being made available a good place to start would be the RTB spec: https://github.com/openrtb/OpenRTB https://github.com/openrtb/OpenRTB So your whole argument here is based on a strawman.
  - karmacondon 11y ago
    What do you think RTB is? There are websites that will sell demographic information from user profiles, but that's relatively rare. The overwhelming majority of the billions of RTB impressions are based only on location and website audience demographics. Those are things you get from cookies and ip addresses, information that comes entirely from access logs. No, companies don't sell their logs directly, but the vast majority of targeted impressions are sold solely on what is contained in a standard server log. You seem to be knowledgeable about online advertising and forthcoming with sources. Do you have any evidence that anything near 50% of online ad data sold is based on the highest grade profile data? Because I'm certain that is not the case. I think you're confusing the business of selling profile data on individuals, which is indeed very old, with modern ad targeting. It's hard to persistently match that up with an ip address and cookie, you see. Which is why major ad buyers prefer to buy cookies that tag large demographic buckets like "young males in the midwest with an interest in cars" instead of the names and profiles of individual people. It's common sense more cost efficient, and access log data is much more prevalent and reliable than profile data. I don't think that any of this works in the way that you think it does. Yes, re-targeting is creepy, cookies are rampant and the average page loads way too many external files. But companies do all of these things for a reason, whether you understand the details or not. If you don't like how they do business, you can just stop going to their websites.
robbiemitchell 11y ago
There is a giant difference between a site-specific tracker that helps a site owner understand her own visitors and ad networks that share cookie data. analytics != ads.
- jacquesm 11y ago
  Yes, this is true. But: (1) the number of parties that only use site specific trackers is relatively small to the number of parties that use networks, (2) even those parties usually carry facebook/google and other embedded resources, effectively still leaking your data and (3) in the end, you can't be sure that they don't combine that data on the backside with data procured elsewhere.
  - robbiemitchell 11y ago
    I'm not sure whether we're talking about the same thing, but plenty of the web is people running sites tracking analytics on sites that have nothing to do with ads. Of those, Google Analytics would be the most common, and yes, Google is in the ads business. But there are numerous services that provide analytics and have no part in tracking you elsewhere. Is Mailchimp involved in cookie trading? Segment? Intercom? Mixpanel? To my knowledge, no, there is nothing there -- they only know you via session cookies in the browser, and those businesses do not make data available to third-party ad networks. Even in cases where they do bring in data, such as Intercom using FullContact to merge an email address with social data from Twitter, it's a one-way API call from Intercom, with nothing identifying the actual sites that will make use of it. I 100% agree with you on trackers/beacons like "Scorecard Research", and to a lesser extent, Google Analytics, but "you can't be sure" seems like weak ground on which to take a strong categorical stance against any use of analytics tracking. There are real differences to the value they provide and the ability they have to do beyond that even if the incentives are there.
    - jacquesm 11y ago
      Well, the 'you can't be sure' in practice translates into 'everybody does it' but I'd rather leave enough room for those that do not engage in these practices. Absolutes simply don't cut it. And the 'value they provide' is never provided to the users, always to their clients at the expense of those users.
msellout 11y ago
This concept of "your data as if it is theirs" is strange to me. Deciding who owns what information is difficult and not so obvious. I once heard a man on the radio saying that he "owned his face" meaning his likeness. Celebrities own their likenesses in that they can block people from using their likenesses to imply endorsement, but they can't block photographers from publishing a photo taken in a public area. Ownership is much more nuanced than you're making it seem. It depends on where and how the data was collected and further, how the data is used. Take car ownership. The department of motor vehicles tracks who owns what car, including non-dealership title transfers. That information gets sold to companies like Experian. Anyone can buy it (https://www.autocount.com/ https://www.autocount.com/). So a company like Yelp, who knows where you live (you do like restaurant reviews from "current location", right?) can cross-reference that with AutoCount data to figure out what car you own. Is that weird? Sure. Is that wrong? Maybe. But it's been going on from before the internet, so I don't understand what's so different now.
- jacquesm 11y ago
  That data ownership is enshrined in law in the EU. Not that anybody cares.
  - msellout 11y ago
    Yeah, those pesky geographical boundaries make things strange on the internet.

Kristine1975 11y ago

>If a store has policy of "If you come into our store, we'll have employees follow you home" and you don't like that policy, then don't go to that store ... That might mean that you can't go to the stores you want to go to, but that's how it goes. Actually that depends on the laws of the country the store is in.

spobin 11y ago

I agree. This analogy is good up to the point where you consider that these trackers don't really know or care who you are. To them you're an anonymous hashed id. Yes, they 'follow' you around, but they are essentially invisible and mostly aim to improve the targeting of ads/information. It's easy to forget that a lot of this technology is very new and for a while there will be cases where it's seen as intrusive. Things will only get better over time.

jacquesm 11y ago
> To them you're an anonymous hashed id. You wish.
- spobin 11y ago
  I've worked very closely with tracking companies. They are very strict about not storing any unhashed identifyable information such as email adddress, postcode etc.
  - jacquesm 11y ago
    Some are good, some are in compliance with the law and some are not. It's a mixed bag, and then of course there is the small detail that 'the law' is not the same from one place to another and that plenty of companies use this to their advantage.
  - inaccessible 11y ago
    Have you ever seen hotjar, inspectlet, mouseflow and many other service? I mean check out the demo page on the inspectlet site, type in your email address, check the recording and tell me they don't store it in plain text.

gglitch 11y ago

If ad-supported sites posted terms of use that precisely defined what info is to be collected, how long it's to be retained, and who will be able to access it, consumers would be able to make an informed decision about what sites to visit. As it is now, without defensive software, one is asked to just blindly trust the sites one visits.

hrbrtglm 11y ago
Great. You just inspired another european privacy law where website will be forced to ask you to read the terms before processing reading. What it will achieve is users will be annoyed and install a termblock extension to their browser, I mean kind of defensive software.
- jacquesm 11y ago
  There are other options that lawmakers have.
TravisLS 11y ago
In the analogy (and online), the newspaper with blank spaces (aka the ad-supported site) is a small and insignificant data player. It's mostly advertisers that are collecting and retaining the data, and not just on websites but in all kinds of ways. The profiles are kept by advertisers, and sold on data exchanges, completely out of the reach and control of the ad-supported site. So unfortunately, ad-supported sites that offer up their ad inventory via real-time bidding can't provide the information you'd want. You would really need to opt-in at every point where data is collected, which is everywhere.
dhimes 11y ago
The problem is that people still don't understand what it is they are trading for a "free" web. It really takes a story like Jacques wrote to drive it home. It has to touch them emotionally, because what we are asking them to be wary of touches them with very strong emotions (facebook, for example).

kelseydh 11y ago

But tracking is more pernicious than this. I hope you realize that major political parties now buy this data and use it to target their campaign pitches to people in close elections. Do you buy diapers? You're probably interested in family issues. Do you buy gun parts? Let's classify you as leaning republican... It goes way beyond uses that you would imagine. (PS: this is why if you ever sign up for a membership card at a retailer you should just use a fake name / address...)