6 ms·

They do specifically say "individual" browser history. Perhaps, they do sell aggregate data which I personally am not for or against. As long as they stick to

by dvdhnt 10y ago

They do specifically say "individual" browser history. Perhaps, they do sell aggregate data which I personally am not for or against. As long as they stick to this policy, I will appreciate it given their history of not showing compassion for individual customers. Update: it does specifically mention aggregate data.

monocasa 10y ago
Do they deanonymize aggregate data? Are they basically just saying "we won't sell to small fries", or is there an actual privacy concern here?
- dvdhnt 10y ago
  Good questions. I honestly can't come to a guess. On one hand, making the data anonymous would explain the interest in crazy fingerprinting methods and why companies that do that aren't very well known. On the other hand, I have no strong evidence to support the idea that an ISP would anonymize data given their history of activity in the name of profits and in spite of customer satisfaction.
- r00fus 10y ago
  Considering how capable de-anonymizing capabilities are even a few years ago [1], it doesn't matter if it's "personal" or aggregated, unless great pains [2] are taken to prevent that. Comcast selling any data is a concern, I will continue to assume my information is being collected and act as best as I can to prevent that (VPN, poisoning my dataflow,etc). [1] https://www.schneier.com/blog/archives/2007/12/anonymity_and_t_2.html https://www.schneier.com/blog/archives/2007/12/anonymity_and... [2] http://www.computerworld.com/article/3088179/apple-mac/what-apple-users-need-to-know-about-differential-privacy.html http://www.computerworld.com/article/3088179/apple-mac/what-...
- munchbunny 10y ago
  Ad industry person here. It's not really aggregate data in the sense that any records about you are still individually separated. You're not anonymized by getting mixed into a bigger pool of data points. The usual rule is that the buyer won't get your records by name but will know more or less where you live, how old you are, political leanings, hobbies and interests, etc. So you have some anonymized ID number or set of cookies attached to you. However, if you think about it, from the perspective of the advertiser your name is one of the less valuable things about you. So... you might be anonymous by name, but the name thing is a bit of a red herring.
  - eveningcoffee 10y ago
    And if you finally reach to point of any contract - your data is not anonymous any more (because you just gave a name to the id).
  - deleted 10y ago
    [deleted]
cbhl 10y ago
Selling users' browsing history is like selling the golden goose. It's more rational for corporations to sell ads that are targeted based on the browsing history (akin to selling eggs from the goose, one at a time). IIRC, AT&T basically has said they MITM all their fiber optic customers to insert ads and track browsing history.
- state 10y ago
  Would love a citation there, if you can find it.
  - wmf 10y ago
    https://arstechnica.com/information-technology/2016/09/att-to-end-targeted-ads-program-give-all-users-lowest-available-price/ https://arstechnica.com/information-technology/2016/09/att-t...
  - kirykl 10y ago
    Can confirm. Have AT&T Fiber and when I signed up they offered me the choice to pay extra to have my traffic excluded from monitoring
    - jerkstate 10y ago
      If this is already happening, what does this new bill that everyone is up in arms about actually doing that couldn't already be done?
munchbunny 10y ago
Nobody in the advertising space at least literally sells browsing histories. They usually sell inferred tags of which interest groups or demographics you fit into, selected from massive proprietary taxonomies. So in the literal sense of the word, Comcast can be both technically right and still do exactly what they always intended to do.
- a3n 10y ago
  With respect, this sounds a little like when Snowden broke, and the NSA said "besides, it's just metadata." Before I blocked ads, ads would follow me around. The information to do that was collected, and possibly sold, probably not by my ISP. It wasn't "my browser history," but it was as a result of my browsing activity. This news has thrown around "your browsing history," which is at once sensationalist (because, as you point out, no one is selling that) and obfuscating, because someone is collecting and selling data that comes from browsing activity.
  - deleted 10y ago
    [deleted]
  - munchbunny 10y ago
    The only thing I would add is that it's more than just browsing data. The data the ISPs sell might get cross-corellated with online purchase histories, search terms, etc. Right now your "data persona" is mostly obfuscated by market fragmentation and the fact that advertisers wouldn't know what to do with all of the data if they had it. As someone on the "inside", the AI push scares me because it will make actually reconciling all of the disparate data sources both feasible and profitable.
  - ryanworl 10y ago
    Ads following you around (retargeting) can sometimes be creepy, but no one had to buy and sell your browsing history to get there. It is entirely a by-product of the fact that ad slots are auctioned off while a page loads, and when someone wins that auction, they can run JavaScript in your browser. So if they cookie you on their website, then they get to run JavaScript from winning an ad auction on a different site, they can still see their cookies and know it is "you". Not trying to downplay any privacy implications here, but ad networks and sites where ads are placed don't actually need any of your browsing history to make this work. (I simplified this somewhat by ignoring the relationship between the actual advertisers and retargeting providers, but that is just more of an economies of scale/arbitrage thing.)
lumberjack 10y ago
Or maybe they just lie. It's not like there is a penalty for lying. They most definitely will sell your user history, irrespective of what they say.
exclusiv 10y ago
They've all been selling data for years and this goes into exchanges for the primary use-case of marketing. The data may not say John Doe, but it's tied to John Doe's device. You can already identify that a user saw an ad on their laptop at home and showed up at a physical location because the mobile device is tied to the laptop and the mobile device spits out GPS data. So yeah, they might not sell data that says this is John Doe, but it's John Doe and we know where he lives, where he travels, when he travels, etc.

by dvdhnt 10y ago

monocasa 10y ago

Do they deanonymize aggregate data? Are they basically just saying "we won't sell to small fries", or is there an actual privacy concern here?

dvdhnt 10y ago
Good questions. I honestly can't come to a guess. On one hand, making the data anonymous would explain the interest in crazy fingerprinting methods and why companies that do that aren't very well known. On the other hand, I have no strong evidence to support the idea that an ISP would anonymize data given their history of activity in the name of profits and in spite of customer satisfaction.
r00fus 10y ago
Considering how capable de-anonymizing capabilities are even a few years ago [1], it doesn't matter if it's "personal" or aggregated, unless great pains [2] are taken to prevent that. Comcast selling any data is a concern, I will continue to assume my information is being collected and act as best as I can to prevent that (VPN, poisoning my dataflow,etc). [1] https://www.schneier.com/blog/archives/2007/12/anonymity_and_t_2.html https://www.schneier.com/blog/archives/2007/12/anonymity_and... [2] http://www.computerworld.com/article/3088179/apple-mac/what-apple-users-need-to-know-about-differential-privacy.html http://www.computerworld.com/article/3088179/apple-mac/what-...
munchbunny 10y ago
Ad industry person here. It's not really aggregate data in the sense that any records about you are still individually separated. You're not anonymized by getting mixed into a bigger pool of data points. The usual rule is that the buyer won't get your records by name but will know more or less where you live, how old you are, political leanings, hobbies and interests, etc. So you have some anonymized ID number or set of cookies attached to you. However, if you think about it, from the perspective of the advertiser your name is one of the less valuable things about you. So... you might be anonymous by name, but the name thing is a bit of a red herring.
- eveningcoffee 10y ago
  And if you finally reach to point of any contract - your data is not anonymous any more (because you just gave a name to the id).
- deleted 10y ago
  [deleted]

cbhl 10y ago

Selling users' browsing history is like selling the golden goose. It's more rational for corporations to sell ads that are targeted based on the browsing history (akin to selling eggs from the goose, one at a time). IIRC, AT&T basically has said they MITM all their fiber optic customers to insert ads and track browsing history.

state 10y ago
Would love a citation there, if you can find it.
- wmf 10y ago
  https://arstechnica.com/information-technology/2016/09/att-to-end-targeted-ads-program-give-all-users-lowest-available-price/ https://arstechnica.com/information-technology/2016/09/att-t...
- kirykl 10y ago
  Can confirm. Have AT&T Fiber and when I signed up they offered me the choice to pay extra to have my traffic excluded from monitoring
  - jerkstate 10y ago
    If this is already happening, what does this new bill that everyone is up in arms about actually doing that couldn't already be done?

munchbunny 10y ago

Nobody in the advertising space at least literally sells browsing histories. They usually sell inferred tags of which interest groups or demographics you fit into, selected from massive proprietary taxonomies. So in the literal sense of the word, Comcast can be both technically right and still do exactly what they always intended to do.

a3n 10y ago
With respect, this sounds a little like when Snowden broke, and the NSA said "besides, it's just metadata." Before I blocked ads, ads would follow me around. The information to do that was collected, and possibly sold, probably not by my ISP. It wasn't "my browser history," but it was as a result of my browsing activity. This news has thrown around "your browsing history," which is at once sensationalist (because, as you point out, no one is selling that) and obfuscating, because someone is collecting and selling data that comes from browsing activity.
- deleted 10y ago
  [deleted]
- munchbunny 10y ago
  The only thing I would add is that it's more than just browsing data. The data the ISPs sell might get cross-corellated with online purchase histories, search terms, etc. Right now your "data persona" is mostly obfuscated by market fragmentation and the fact that advertisers wouldn't know what to do with all of the data if they had it. As someone on the "inside", the AI push scares me because it will make actually reconciling all of the disparate data sources both feasible and profitable.
- ryanworl 10y ago
  Ads following you around (retargeting) can sometimes be creepy, but no one had to buy and sell your browsing history to get there. It is entirely a by-product of the fact that ad slots are auctioned off while a page loads, and when someone wins that auction, they can run JavaScript in your browser. So if they cookie you on their website, then they get to run JavaScript from winning an ad auction on a different site, they can still see their cookies and know it is "you". Not trying to downplay any privacy implications here, but ad networks and sites where ads are placed don't actually need any of your browsing history to make this work. (I simplified this somewhat by ignoring the relationship between the actual advertisers and retargeting providers, but that is just more of an economies of scale/arbitrage thing.)

lumberjack 10y ago

Or maybe they just lie. It's not like there is a penalty for lying. They most definitely will sell your user history, irrespective of what they say.

exclusiv 10y ago

They've all been selling data for years and this goes into exchanges for the primary use-case of marketing. The data may not say John Doe, but it's tied to John Doe's device. You can already identify that a user saw an ad on their laptop at home and showed up at a physical location because the mobile device is tied to the laptop and the mobile device spits out GPS data. So yeah, they might not sell data that says this is John Doe, but it's John Doe and we know where he lives, where he travels, when he travels, etc.