5 ms·

This is not just facebook. This is what all the DMPs[1] in advertising do, and charge millions of dollars for it. There is BlueKai from Oracle, one from Adobe,

This is not just facebook. This is what all the DMPs[1] in advertising do, and charge millions of dollars for it. There is BlueKai from Oracle, one from Adobe, and various others. The core proposition is to collect as much data about the user to understand the interests (profiling) and then target that user or users like him to get a better conversion rate. Why facebook emerged as a big player in this field was because the other companies were really expensive for consumer apps and hence they were used only by the biggest players. Facebook made it cheap, automated the process and allowed for targeting without even telling the advertisers what audience needs to be targeted. All at the cost startups and smbs could afford. Google also does the same. Infact all the big advertising networks do it, or utilize a DMP to do it on their behalf. I realize that this discussion is about privacy, and in that regard, it should not be allowed by any company. However, this is just the tip of the iceberg. Almost all the big players in travel have huge customer profiles on us, gained by our credit card transactions, credit history, data from insurance and other friendly companies (you scratch my back and I scratch yours) and various other practices which frequently compromise on user's privacy. I dont know how one can solve this though. [1] http://www.bluekai.com/files/DMP_Demystified_Whitepaper_BlueKai.pdf http://www.bluekai.com/files/DMP_Demystified_Whitepaper_Blue... [2] https://www.adobe.com/analytics/audience-manager.html https://www.adobe.com/analytics/audience-manager.html

tgsovlerkhgsel 8y ago
I think this is going to continue until both a few of the app developers and some of the DMPs get bankrupted through GDPR fines for not obtaining proper consent. The entire business model is infeasible under GDPR.
- derefr 8y ago
  You don’t have to collect that much data from users in a given market (Europe), if you’ve already collected [and continue to collect] so much other data from users in other markets (America) that you’ve built up predictive models that only need a few hints in order to map a user to one of a well-known constellation of “profiles” that advertisers target their ads towards. Basically, GDPR only prevents DMPs from training their models using your app’s data (i.e. exfiltrating the user’s personal details from the client to a backend.) If, on the other hand, the DMP comes to you with an advertising library that runs entirely client-side and embeds a pre-trained model; where, when you call this library, it decides what profile of theirs a user slots into by doing things like e.g. “young or old based on how they type on a touch keyboard” (but in a much more clever ML-dictated fashion)... then there’s no violation here. You’re using the user’s personal data to derive a category to place them into; but you’re not recording or sending the user’s personal data anywhere. And when you, as an app, turn around and make a request to an ad network for ad media to display based on that profile, that’s not a violation of GDPR either: the derived profile is no longer information about a particular user, but is rather just a group that the user belongs to, with each profiling group being so large that that assertion-of-fact doesn’t help to de-anonymize the user any more than saying “they’re a human being” does—it’s not information that could be mapped back to the individual user. So it’s fine to send out. It can be taken a level further, as well; such “statistics that convert to a profile” can be aggregated into one per-app profile. At that point, you’re doing exactly what magazine publishers do: looking at the audience for a given magazine, building a summary profile of said audience, and then selling ad space to advertisers who want to target that summary profile. Of course, that same library will probably do a region check, and in the case that you’re not in the GDPR-affected area of the world, it will skip its (slightly crap) client-side detection logic and instead feed all your clicks and taps back to its (much smarter) backend, just like the previous version of the library was doing unilaterally.
  - keepmesmall 8y ago
    Derived user data is still user data? Up to the point where the client sends something mathematically indistinguishable from random noise to the server. At which point it's useless except for yet-to-be-discovered quantum effects. Which will then be outlawed. Either way, the whole advertising revenue model is sickening pile of "they technically didn't object and it's not technically illegal", luckily it will die along with DRM and copyright. In the meantime I sincerely wish all parties who profit from it a stomachache proportional to their standard of living.
username223 8y ago
From BlueKai/Oracle: > Behaviorally-targeted advertising is 2.7 times as effective as non-targeted advertising. Really? That's it? We're paying for a multi-billion-dollar surveillance apparatus to make ads 2.7 times as effective as the part of the website you automatically ignore, or the part of the newspaper you immediately throw in the trash?
- derefr 8y ago
  Those are kind of sucky examples of advertising, really. Better ones (in the sense of advertisers thinking they work better and being willing to pay more for them; not in terms of them being “better” ethically) would include YouTube pre-roll ads, product placement in movies and TV, and billboards on boring stretches of road (as observed by the passengers in a car, not the driver.)
  - Asooka 8y ago
    > YouTube pre-roll ads God those are so awful. I wasn't running adblock on youtube, but that shit made me install one. I could be listening to a nice playlist and suddenly some ad at 200% volume blares in my ear "YOU NEED TO BUY THIS TOOTHPASTE" or whatever. I wouldn't mind being forced to watch ads before being allowed to watch other videos, but let me bank watch time. Tell me how much time I have left before the next ad and let me watch enough ads that I don't see any in the next e.g. 3 hours. Or okay let's say the ads I get depend on the videos I watch, then put the ads on my tab and let me watch them later. Whatever arrangement works, just let me control when the ads happen, because right now it's maximum obnoxious.
    - derefr 8y ago
      > just let me control when the ads happen That is exactly what would make YouTube ads useless, from the advertisers' perspective. The key to "impressonability", from advertisers' PoV, is attention. You need to actually be looking at the ad. You don't have to think you're looking at the ad—you might think you're just looking at the "seconds until you can skip" timer—but you're looking (and listening) all the same, at least peripherally, and advertisers think that that's time they have power over you, in at least some subliminal sense. But if you let users bunch up twenty ads in a row? They're going to queue them up and then go get a drink. The audience won't be looking; won't be listening. The ability to control ads inherently means the ability to ignore ads. Ignored ads aren't impressions. The only valuable ad is an ad that sits on your attention stack on top of something that was getting your full attention, such that you have to (still with full attention) pop the ad from the stack to return your attention to the previous stack frame. Whether that's an ad in a newspaper between two columns where you have to pass "through" the ad content to find the next article; or an ad on YouTube where you have to wait; or a Google Sponsored link you have to read "past" to find the regular links; or a modal ad on a website that only appears five seconds after (the heuristic on the site says) you've started reading the content. The goal is to put the ad where your active attention is, such that the ad "impresses" upon your attention, however fleetingly. Anything else is a failed ad. And yes, it's obnoxious. But that's... what advertising is. Those are the only ads that are really doing their job. The ads that don't end up on top of your attention stack? Subtract those from your perception of the field—they're just cargo-cult attempts to advertise that persist because it's really hard to measure the success of ad campaigns. What's left when you subtract those nice, unobtrusive ads, is what advertising as a field is really "about." It's what advertising would be, exclusively, if they got better at measuring things. And it's awful.
sorokod 8y ago
Amusingly, uBlock blocks the bluekai link because you know: "||bluekai.com^"
caprese 8y ago
yeah but the DMPs were the ones who should have been hauled in front of Congress right now, legislatures are asking the wrong questions to the wrong people The CEO of the wrong company to ask can legitimately say "we don't record you I have no idea why you suddenly started seeing ads about that thing you were talking about"
- ankit219 8y ago
  I guess this is something new even for legislatures and they have been slow to catch up as well. Regarding asking the question to CEO, well, his company made that decision to integrate the SDK/Cookie with the product so he is partly accountable. It is a different scenario that he would not know anything specific about how the process works.
shostack 8y ago
Just wait until people read up on cookie onboarding. This is how some apps and sites that don't show ads or sell things can make money. They are literally selling your data. The irony is, I've seen quite a bit of industry chatter whenever the topic of 3rd party DMP audience segments comes up, and the general vibe is they are not at all accurate. And this is why so many large companies are investing in 1p and even 2p data. 1p in particular, depending on their business model, can give them the data they need to remain competitive in a post-GDPR world, assuming they can obtain consent and/or prove legitimate interest.

tgsovlerkhgsel 8y ago

I think this is going to continue until both a few of the app developers and some of the DMPs get bankrupted through GDPR fines for not obtaining proper consent. The entire business model is infeasible under GDPR.

derefr 8y ago
You don’t have to collect that much data from users in a given market (Europe), if you’ve already collected [and continue to collect] so much other data from users in other markets (America) that you’ve built up predictive models that only need a few hints in order to map a user to one of a well-known constellation of “profiles” that advertisers target their ads towards. Basically, GDPR only prevents DMPs from training their models using your app’s data (i.e. exfiltrating the user’s personal details from the client to a backend.) If, on the other hand, the DMP comes to you with an advertising library that runs entirely client-side and embeds a pre-trained model; where, when you call this library, it decides what profile of theirs a user slots into by doing things like e.g. “young or old based on how they type on a touch keyboard” (but in a much more clever ML-dictated fashion)... then there’s no violation here. You’re using the user’s personal data to derive a category to place them into; but you’re not recording or sending the user’s personal data anywhere. And when you, as an app, turn around and make a request to an ad network for ad media to display based on that profile, that’s not a violation of GDPR either: the derived profile is no longer information about a particular user, but is rather just a group that the user belongs to, with each profiling group being so large that that assertion-of-fact doesn’t help to de-anonymize the user any more than saying “they’re a human being” does—it’s not information that could be mapped back to the individual user. So it’s fine to send out. It can be taken a level further, as well; such “statistics that convert to a profile” can be aggregated into one per-app profile. At that point, you’re doing exactly what magazine publishers do: looking at the audience for a given magazine, building a summary profile of said audience, and then selling ad space to advertisers who want to target that summary profile. Of course, that same library will probably do a region check, and in the case that you’re not in the GDPR-affected area of the world, it will skip its (slightly crap) client-side detection logic and instead feed all your clicks and taps back to its (much smarter) backend, just like the previous version of the library was doing unilaterally.
- keepmesmall 8y ago
  Derived user data is still user data? Up to the point where the client sends something mathematically indistinguishable from random noise to the server. At which point it's useless except for yet-to-be-discovered quantum effects. Which will then be outlawed. Either way, the whole advertising revenue model is sickening pile of "they technically didn't object and it's not technically illegal", luckily it will die along with DRM and copyright. In the meantime I sincerely wish all parties who profit from it a stomachache proportional to their standard of living.

username223 8y ago

From BlueKai/Oracle: > Behaviorally-targeted advertising is 2.7 times as effective as non-targeted advertising. Really? That's it? We're paying for a multi-billion-dollar surveillance apparatus to make ads 2.7 times as effective as the part of the website you automatically ignore, or the part of the newspaper you immediately throw in the trash?

derefr 8y ago
Those are kind of sucky examples of advertising, really. Better ones (in the sense of advertisers thinking they work better and being willing to pay more for them; not in terms of them being “better” ethically) would include YouTube pre-roll ads, product placement in movies and TV, and billboards on boring stretches of road (as observed by the passengers in a car, not the driver.)
- Asooka 8y ago
  > YouTube pre-roll ads God those are so awful. I wasn't running adblock on youtube, but that shit made me install one. I could be listening to a nice playlist and suddenly some ad at 200% volume blares in my ear "YOU NEED TO BUY THIS TOOTHPASTE" or whatever. I wouldn't mind being forced to watch ads before being allowed to watch other videos, but let me bank watch time. Tell me how much time I have left before the next ad and let me watch enough ads that I don't see any in the next e.g. 3 hours. Or okay let's say the ads I get depend on the videos I watch, then put the ads on my tab and let me watch them later. Whatever arrangement works, just let me control when the ads happen, because right now it's maximum obnoxious.
  - derefr 8y ago
    > just let me control when the ads happen That is exactly what would make YouTube ads useless, from the advertisers' perspective. The key to "impressonability", from advertisers' PoV, is attention. You need to actually be looking at the ad. You don't have to think you're looking at the ad—you might think you're just looking at the "seconds until you can skip" timer—but you're looking (and listening) all the same, at least peripherally, and advertisers think that that's time they have power over you, in at least some subliminal sense. But if you let users bunch up twenty ads in a row? They're going to queue them up and then go get a drink. The audience won't be looking; won't be listening. The ability to control ads inherently means the ability to ignore ads. Ignored ads aren't impressions. The only valuable ad is an ad that sits on your attention stack on top of something that was getting your full attention, such that you have to (still with full attention) pop the ad from the stack to return your attention to the previous stack frame. Whether that's an ad in a newspaper between two columns where you have to pass "through" the ad content to find the next article; or an ad on YouTube where you have to wait; or a Google Sponsored link you have to read "past" to find the regular links; or a modal ad on a website that only appears five seconds after (the heuristic on the site says) you've started reading the content. The goal is to put the ad where your active attention is, such that the ad "impresses" upon your attention, however fleetingly. Anything else is a failed ad. And yes, it's obnoxious. But that's... what advertising is. Those are the only ads that are really doing their job. The ads that don't end up on top of your attention stack? Subtract those from your perception of the field—they're just cargo-cult attempts to advertise that persist because it's really hard to measure the success of ad campaigns. What's left when you subtract those nice, unobtrusive ads, is what advertising as a field is really "about." It's what advertising would be, exclusively, if they got better at measuring things. And it's awful.

sorokod 8y ago

Amusingly, uBlock blocks the bluekai link because you know: "||bluekai.com^"

caprese 8y ago

yeah but the DMPs were the ones who should have been hauled in front of Congress right now, legislatures are asking the wrong questions to the wrong people The CEO of the wrong company to ask can legitimately say "we don't record you I have no idea why you suddenly started seeing ads about that thing you were talking about"

ankit219 8y ago
I guess this is something new even for legislatures and they have been slow to catch up as well. Regarding asking the question to CEO, well, his company made that decision to integrate the SDK/Cookie with the product so he is partly accountable. It is a different scenario that he would not know anything specific about how the process works.

shostack 8y ago

Just wait until people read up on cookie onboarding. This is how some apps and sites that don't show ads or sell things can make money. They are literally selling your data. The irony is, I've seen quite a bit of industry chatter whenever the topic of 3rd party DMP audience segments comes up, and the general vibe is they are not at all accurate. And this is why so many large companies are investing in 1p and even 2p data. 1p in particular, depending on their business model, can give them the data they need to remain competitive in a post-GDPR world, assuming they can obtain consent and/or prove legitimate interest.