4 ms·

Everyone mourning the death of targeted ads: It's perfectly possible to do targeted ads without collecting personal data! You just keep personal data where it

by ajb 8y ago

Everyone mourning the death of targeted ads: It's perfectly possible to do targeted ads without collecting personal data! You just keep personal data where it belongs - on the user's computer/phone - rather than stealing it. Keep the personal data in local storage, have the logic that chooses ads run locally, and you have targetted ads without invading anyone's privacy. I don't know if that satisfies the GDPR - not a lawyer. But it would satisfy me.

xamuel 8y ago
Careful about unintended consequences. I saw a project where someone built a version of "Asteroids" where certain fake asteroids would appear or not based on ":visited" css or something. Then by recording where players shot at, the site was able to infer which of various websites you had visited.
- ajb 8y ago
  Yes. If you're trying to build an honest ad network, you're not going to do that; but you still have to worry about leaking information to less honest clients. If the information is in the browser, someone will try to exfiltrate it.
- ubernostrum 8y ago
  Mozilla experimented with the idea you're replying to -- a system that would download a bundle of disparate ads from a central server, and then decide based on information in the browser which ones to show. Take away active content from the ads, or (very distant second best) sandbox them, and you can do targeting without the advertisers or even the distributor being able to figure out why a particular ad was shown.
zerostar07 8y ago
you need to ask permissions if you re processing them, locally or not. plus then you dont have control on data deletion, with the user leaving their data on public computer etc.
- ajb 8y ago
  An excellent point about public computers. I can't immediately see how to deal with that.
pjc50 8y ago
> do targeted ads without collecting personal data You're still processing the data on your system, even if you're not storing it. This approach takes care of deletion rights but not processing. (Unless you move the entire list of ad inventory to the user's computer and let it pick the ad to load?)
pdkl95 8y ago
> have the logic that chooses ads run locally Unless you are unconditionally loading all possible ads into that code that runs locally, it still betrays the result of the local code's analysis when it loads the specific ad. This kind of request is already used to exfiltrate personal information. Even if it isn't explicitly sending personal encoded into the choice of ad, simply sending coarse data about someone is still an unacceptable betrayal of privacy. Small, currently insignificant pieces of data become revealing specific life details when joined with other databases. In addition to the choice of ad, the server can also log at least a timestamp, the IP Source Address, the {TCP,UDP} Source and Destination Ports, and any other interesting features in the IP protocol headers[1]. With some effort, this is probably enough to allow the ad requests to be correlated with other sources of personal data. > you have targetted ads without invading anyone's privacy. No, you only made it very slightly more difficult to invade privacy. This would only result in a minor rate limit to exfiltrate personal data, and added the need for a few more INNER JOIN clauses. [1] This may include a significant amount of identifying entropy. For example, nmap's -O uses the variations in the IP headers and protocol implementation to guess the remote host's OS (sometimes to specific versions).
- XorNot 8y ago
  Not storing the logs though would make you compliant.
hshehehjdjdjd 8y ago
Yeah, you could imagine something like this. You could train a model about the types of ads that would be effective using the online data of those who consent (or Americans). You could download the model on each EU person’s computer, evaluate the model against local history, then request ads from resulting categories. It wouldn’t require moving their personal data off of their device. You could pay a small subset of people to serve as trainers for the model. Yes, it would be hugely challenging to implement, but it definitely seems possible to do something along these lines.

by ajb 8y ago

xamuel 8y ago

Careful about unintended consequences. I saw a project where someone built a version of "Asteroids" where certain fake asteroids would appear or not based on ":visited" css or something. Then by recording where players shot at, the site was able to infer which of various websites you had visited.

ajb 8y ago
Yes. If you're trying to build an honest ad network, you're not going to do that; but you still have to worry about leaking information to less honest clients. If the information is in the browser, someone will try to exfiltrate it.
ubernostrum 8y ago
Mozilla experimented with the idea you're replying to -- a system that would download a bundle of disparate ads from a central server, and then decide based on information in the browser which ones to show. Take away active content from the ads, or (very distant second best) sandbox them, and you can do targeting without the advertisers or even the distributor being able to figure out why a particular ad was shown.

zerostar07 8y ago

you need to ask permissions if you re processing them, locally or not. plus then you dont have control on data deletion, with the user leaving their data on public computer etc.

ajb 8y ago
An excellent point about public computers. I can't immediately see how to deal with that.

pjc50 8y ago

> do targeted ads without collecting personal data You're still processing the data on your system, even if you're not storing it. This approach takes care of deletion rights but not processing. (Unless you move the entire list of ad inventory to the user's computer and let it pick the ad to load?)

pdkl95 8y ago

> have the logic that chooses ads run locally Unless you are unconditionally loading all possible ads into that code that runs locally, it still betrays the result of the local code's analysis when it loads the specific ad. This kind of request is already used to exfiltrate personal information. Even if it isn't explicitly sending personal encoded into the choice of ad, simply sending coarse data about someone is still an unacceptable betrayal of privacy. Small, currently insignificant pieces of data become revealing specific life details when joined with other databases. In addition to the choice of ad, the server can also log at least a timestamp, the IP Source Address, the {TCP,UDP} Source and Destination Ports, and any other interesting features in the IP protocol headers[1]. With some effort, this is probably enough to allow the ad requests to be correlated with other sources of personal data. > you have targetted ads without invading anyone's privacy. No, you only made it very slightly more difficult to invade privacy. This would only result in a minor rate limit to exfiltrate personal data, and added the need for a few more INNER JOIN clauses. [1] This may include a significant amount of identifying entropy. For example, nmap's -O uses the variations in the IP headers and protocol implementation to guess the remote host's OS (sometimes to specific versions).

XorNot 8y ago
Not storing the logs though would make you compliant.

hshehehjdjdjd 8y ago

Yeah, you could imagine something like this. You could train a model about the types of ads that would be effective using the online data of those who consent (or Americans). You could download the model on each EU person’s computer, evaluate the model against local history, then request ads from resulting categories. It wouldn’t require moving their personal data off of their device. You could pay a small subset of people to serve as trainers for the model. Yes, it would be hugely challenging to implement, but it definitely seems possible to do something along these lines.