6 ms·

I have a loosely imagined regulatory solution to the particular problem of secretive data brokerages and user targeting. It works at follows: * Targeted ads ar

by plorg 9y ago

I have a loosely imagined regulatory solution to the particular problem of secretive data brokerages and user targeting. It works at follows: * Targeted ads are required to include both a declaration that they are targeted to a user and what criteria were used to select the user. * Ad and data brokers are required to provide a chain of discovery detailing where the individual ad or data entity received information that contributed to the targeting of the user. (I think this was hit upon in TFA, but it was difficult to get through with the focus as it was mostly on credentials and PII). * Firms which hold user targeting information and information on individual user preferences are required to allow users to have their records removed from the firm's database. I'm sure this seems punitive to the companies it would affect, but I'm not sure that's a problem overall. It allows people to control the information that is collected about them and puts the onus on the companies benefiting from that information. If user targeting really does help in product discovery and user preference marching, then the ad and data companies will be rewarded, and the price of regulation will be the cost of information transparency. If it turns out that users really don't want to have dozens of companies tracking their every move then the advertising business model will be starved and make way for companies with more innovative, user-friendly business models. Edit: autocorrect fucking up words that autocomplete originally predicted correctly.

michaelbuckbee 9y ago
If you haven't already, you might enjoy reading the EU's forthcoming GDPR regulations [1] they cover all of this and much, much more including things like: - data should be exportable in digital formats - you can request what information a company has about you regardless if you're a full "user/customer" (think of things like how FB tracks anyone who visits a webpage with a Like button). - you have the right to request a manual review of computer made decisions (ex: a credit approval) - right to have your data corrected/fixed if it's listed incorrectly - right to escalate to each country's "supervisory authority" (this is the agency within each country that handles things) - serious fines in case of non compliance (% of revenue, not a flat amount) 1 - https://blog.varonis.com/gdpr-requirements-list-in-plain-english https://blog.varonis.com/gdpr-requirements-list-in-plain-eng...
- evrydayhustling 9y ago
  Agree about the overlap, but want to call to attention OP's requirement that I don't believe is part of GDPR: > Targeted ads are required to include both a declaration that they are targeted to a user and what criteria were used to select the user. This makes a massive difference! GDPR currently revolves around informed users making a request. OP's requirement would force companies to educate users about their methods. I see an analogy to the health warnings on tobacco ads. Incidentally, as someone who thinks targeted ads can be beneficial, I think this would help me interpret and engage with "sincere" targeting.
  - michaelbuckbee 9y ago
    This is a part of the GDPR - the language is so generic that I think much of this will come out in future court cases, but check out Article 21 and 22 of the GDPR which I think addresses this (but IANAL) https://blog.varonis.com/gdpr-requirements-list-in-plain-english/#article21 https://blog.varonis.com/gdpr-requirements-list-in-plain-eng... People can object to be profiled and can ask a person for help like: "Why am I seeing this? Please stop"
    - evrydayhustling 9y ago
      Belated thanks for the really useful link! I hadn't looked into these opt-out/review requirements before. But, FWIW, I still think there's an important difference between a user-driven opt-out (which I also don't read as a guarantee of explanation) and proactive publication of the personalization criteria. It's still possible for an uninformed individual to never even realize content is being personalized for them, much less pass the threshold of asking how.
- sethammons 9y ago
  I was unaware of the percent of revenue fine. What happens to a company with negative revenue? Seems like Hollywood Accounting could be pervasive here.
  - 9y ago
TAForObvReasons 9y ago
> what criteria were used to select the user. One of the "failures" of modern AI is "human-friendly explanation": how do you explain the process behind a decision when it was based on a very complex model? At least, without having to explain the entire model being employed.
- lossolo 9y ago
  It dosen't matter which model were used or which algorithm, what matters is based on which information about this particular user it was decided what to show. If you only have his IP then ok, but if you have his browsing history then you should disclose that your targeting was based on exact browsing history or any other data you have concerning this user that was used.
  - theoh 9y ago
    Yeah, but if the entire history (some large part) is available, then it is in the interests of advertisers to run their algorithm against that. It's not informative. Needless to say, there is a lot of work being done in academia on the problem of making AI decisions comprehensible to humans. It is not clear yet AFAIK whether any ML techniques (even the most prominent approaches) are ever going to be susceptible to a simple explanation.
    - nitrogen 9y ago
      Couldn't you just pick the top N paths (maybe ordered by how sensitive they are to changes in input) back through the neural net, then list the data sources they ultimately trace to? "Visited aaa.example one day ago, .34; visited abc.example three days ago, .27; therefore display ad for zzz.example"
    - wolfgke 9y ago
      > Yeah, but if the entire history (some large part) is available, then it is in the interests of advertisers to run their algorithm against that. If they had to disclose what information was used to show the ad, this would at least give a small disincentive to do that.
specialist 9y ago
My proposed regime is somewhat more simple: All services are opt-in. If anyone anywhere is charging for (or profiting from) my data, I get my cut.
- deleted 9y ago
  [deleted]
y03a 9y ago
Fuck that, I have a better regulation: Targeted ads are illegal, punishable by death. Let's force a different (I don't care if it's "better") business model.
wemdyjreichert 9y ago
Adding that information could be considered an undue burden... see the recent court ruling on California anti-abortion clinics.

by plorg 9y ago

michaelbuckbee 9y ago

If you haven't already, you might enjoy reading the EU's forthcoming GDPR regulations [1] they cover all of this and much, much more including things like: - data should be exportable in digital formats - you can request what information a company has about you regardless if you're a full "user/customer" (think of things like how FB tracks anyone who visits a webpage with a Like button). - you have the right to request a manual review of computer made decisions (ex: a credit approval) - right to have your data corrected/fixed if it's listed incorrectly - right to escalate to each country's "supervisory authority" (this is the agency within each country that handles things) - serious fines in case of non compliance (% of revenue, not a flat amount) 1 - https://blog.varonis.com/gdpr-requirements-list-in-plain-english https://blog.varonis.com/gdpr-requirements-list-in-plain-eng...

evrydayhustling 9y ago
Agree about the overlap, but want to call to attention OP's requirement that I don't believe is part of GDPR: > Targeted ads are required to include both a declaration that they are targeted to a user and what criteria were used to select the user. This makes a massive difference! GDPR currently revolves around informed users making a request. OP's requirement would force companies to educate users about their methods. I see an analogy to the health warnings on tobacco ads. Incidentally, as someone who thinks targeted ads can be beneficial, I think this would help me interpret and engage with "sincere" targeting.
- michaelbuckbee 9y ago
  This is a part of the GDPR - the language is so generic that I think much of this will come out in future court cases, but check out Article 21 and 22 of the GDPR which I think addresses this (but IANAL) https://blog.varonis.com/gdpr-requirements-list-in-plain-english/#article21 https://blog.varonis.com/gdpr-requirements-list-in-plain-eng... People can object to be profiled and can ask a person for help like: "Why am I seeing this? Please stop"
  - evrydayhustling 9y ago
    Belated thanks for the really useful link! I hadn't looked into these opt-out/review requirements before. But, FWIW, I still think there's an important difference between a user-driven opt-out (which I also don't read as a guarantee of explanation) and proactive publication of the personalization criteria. It's still possible for an uninformed individual to never even realize content is being personalized for them, much less pass the threshold of asking how.
sethammons 9y ago
I was unaware of the percent of revenue fine. What happens to a company with negative revenue? Seems like Hollywood Accounting could be pervasive here.
- 9y ago

TAForObvReasons 9y ago

> what criteria were used to select the user. One of the "failures" of modern AI is "human-friendly explanation": how do you explain the process behind a decision when it was based on a very complex model? At least, without having to explain the entire model being employed.

lossolo 9y ago
It dosen't matter which model were used or which algorithm, what matters is based on which information about this particular user it was decided what to show. If you only have his IP then ok, but if you have his browsing history then you should disclose that your targeting was based on exact browsing history or any other data you have concerning this user that was used.
- theoh 9y ago
  Yeah, but if the entire history (some large part) is available, then it is in the interests of advertisers to run their algorithm against that. It's not informative. Needless to say, there is a lot of work being done in academia on the problem of making AI decisions comprehensible to humans. It is not clear yet AFAIK whether any ML techniques (even the most prominent approaches) are ever going to be susceptible to a simple explanation.
  - nitrogen 9y ago
    Couldn't you just pick the top N paths (maybe ordered by how sensitive they are to changes in input) back through the neural net, then list the data sources they ultimately trace to? "Visited aaa.example one day ago, .34; visited abc.example three days ago, .27; therefore display ad for zzz.example"
  - wolfgke 9y ago
    > Yeah, but if the entire history (some large part) is available, then it is in the interests of advertisers to run their algorithm against that. If they had to disclose what information was used to show the ad, this would at least give a small disincentive to do that.

specialist 9y ago

My proposed regime is somewhat more simple: All services are opt-in. If anyone anywhere is charging for (or profiting from) my data, I get my cut.

deleted 9y ago
[deleted]

y03a 9y ago

Fuck that, I have a better regulation: Targeted ads are illegal, punishable by death. Let's force a different (I don't care if it's "better") business model.

wemdyjreichert 9y ago

Adding that information could be considered an undue burden... see the recent court ruling on California anti-abortion clinics.