19 ms·

I left the ad industry because of data tracking

342 points by Ygg2 7y ago

everdrive 7y ago
Another very frustrating article about advertising. I don't doubt any of his conclusions, or his moral claims. But, I do want more details. What are the various tracking and correlation mechanisms, what do they look like practically? Does anyone actually really use canvas the way we all fear, or are smartphone apps and Android itself doing all the heavy lifting? Would a user's privacy settings in their phones mitigated any of this? Why or why not? I appreciate that we know in general what the answers to some of these questions might be, but I'd really like if more of these articles got into specifics.
- raxxorrax 7y ago
  That the ad industry tries to justify its data harboring with questionable consent is certainly a factor. Ads mostly suck, that is why people have blockers and why those are so successful. If I do not want to get tracked or targeted by ads, I have to jump through many hoops that are not manageable by average users. This is why I plainly hate this industry. I don't really care about your models, while they might provide interesting data, I do not want to be part of it. Oh, and the ad industry is currently in the process of sanitizing the larger platforms, because you do not want to be associated with losers. It is the great ad industry we are talking about. I don't like them because of that too. These are the larger issues that prevent useful discussion about specific tracking mechanisms.
- mobjack 7y ago
  Tracking still mainly relies on unique identifiers on cookies and mobile apps. The main thing I see fingerprinting used for is tracking users between mobile apps and websites. That mainly relies on IP addresses. The best way to track users is just to ask for information. Ask for a users email address to log in and you have a simple means to track a user across devices.
- ohitsdom 7y ago
  > Does anyone actually really use canvas the way we all fear I think I missed something, what do you mean by this? Are there some data leaking privacy concerns with HTML canvas elements?
  - everdrive 7y ago
    My understanding is that websites use Canvas to generate a unique or semi-unique fingerprint of your browser, whether or not a cookie has been set. It's absolutely true that this is technically possible. Most people don't have your exact resolution/cpu speed/fonts installed/etc, so you are somewhat unique even if you have the same browser and OS as other people. If you block Canvas, you can actually see some websites request it as you log in. Amazon produces a popup asking permission to do canvas-y things during the login progress on my computer, for instance. I think the tone of most of the conversations around Canvas I've seen are a bit more catastrophic. Their argument usually goes something like: "Most websites are making UUIDs of your Canvas profile and tracking you everywhere, and therefore your cookie blocking and VPN are useless!" Bear in mind, I don't mean to strawman here, that's just a version of the argument I see most often. What I personally suspect is that Canvas fingerprinting is used to supplement other tracking or verification. For example, I have a valid amazon account, an Amazon cookie is properly set, and Amazon also checks my Canvas information to make sure nothing looks too out place. ie, my cookie was probably not replayed since my Canvas, IP address, and credentials check out. Presumably, my Canvas information cannot generate a true UUID, but it is something like 1 in 10,000. Enough to use it for additional verification. Now, is any of this correct? Are folks' most paranoid fears accurate? Is my belief that Canvas is supplementary fraud detection accurate? Whatever answer is correct, it's unlikely to be broadly uniform across all websites. But, the point is, I'd really like to hear from an engineer about how Canvas is used.
dvfjsdhgfv 7y ago
There are many reasonable proposals in the article but they are only wishful thinking: there is no way the USA passes a law similar to GDPR, no matter what people want and how many similar articles appear.
- scarejunba 7y ago
  Well, we'll see what CCPA looks like by the end. If someone else makes a different law then a federal law will come so as to harmonize the requirements. If no one else makes a different law, CCPA will become a de facto federal law because you ignore California to your own detriment.
- luckylion 7y ago
  As for GDPR: at least in Germany it's problematic. Our system typically relies on competitors to enforce law abidance in companies (so called "Abmahnungen" based on the "Gesetz gegen den unlauteren Wettbewerb", UWG for short, a set of laws regarding unlawful competition). One court recently ruled that GDPR violations don't fall under those laws (https://www.datenschutzbeauftragter-info.de/landgericht-stuttgart-zur-abmahnfaehigkeit-von-dsgvo-verstoessen/ https://www.datenschutzbeauftragter-info.de/landgericht-stut...). That leaves us with: - reporting violations to the officials. They are chronically understaffed, have little technical expertise and it takes months to years for them to act. They are very hesitant to hand out fines, but theoretically can. - individual citizens suing a company to force them to abide by the law. This is rare because the citizen will have to cough up the money to go to court, and even if he wins, the company will only be forced to abide by the laws regarding this citizen, not in general. - publicly shaming companies into compliance. A higher court might have different opinions, and I very much hope they will, because GDPR quickly becomes meaningless without enforcement. Edit: I have literally no idea why this is downvoted. Unless it's just because you personally don't like me, please leave a comment explaining what is incorrect.
  - icebraining 7y ago
    Unless the site is only available to German users, you should be able to file a complain with any of EU member state regulators, and not all are so timid as that. NOYB, the non-profit org founded by Max Schrems, has already been filing complaints with the French, Austrian, Belgian and German authorities: https://noyb.eu/ https://noyb.eu/
Vagantem 7y ago
Had a similar experience - worked in a big ad agency who hired a new web-developer for one of our clients. As they are one of the biggest website providers, they could identify most of the people that visited a client's site - it even automatically saved the identified user's profile pic from facebook into their database.
- user17843 7y ago
  > it even automatically saved the identified user's profile pic from facebook into their database. Please share more information. Did that require the user to be logged into FB?
  - zed88 7y ago
    Here is a hint https://docs.fullcontact.com/#enrich-api https://docs.fullcontact.com/#enrich-api
    - Aromasin 7y ago
      As an engineer, I'm amazed. As a person who doesn't want the person on the other end of every website I visit to know who exactly I am, I feel violated. At this point though, all I feel I can do as a hapless consumer is to desensitize myself to said violation. I use a VPN, Pi-Hole, Ghostery and Firefox. All of these a relatively recent additions though, so if a website can get my email and that links to an already existing database of all my collected data up to that point, I'm buggered anyway.
      - pure-awesome 7y ago
        Just making sure you're aware of the discussion around Ghostery that's happened here on HackerNews, so you can make an informed decision: https://news.ycombinator.com/item?id=15969525 https://news.ycombinator.com/item?id=15969525 https://news.ycombinator.com/item?id=16809625 https://news.ycombinator.com/item?id=16809625 https://news.ycombinator.com/item?id=13652126 https://news.ycombinator.com/item?id=13652126 https://news.ycombinator.com/item?id=9617827 https://news.ycombinator.com/item?id=9617827
zeristor 7y ago
The Pwned website shows you which websites your account details have been leaked for. Is there one to show you what the ad industry has on you, and perhaps how it can by it? If people had insight to this for how much longer would this be a problem? I imagine there’s a website that does this which was launched five years ago.
- user17843 7y ago
  the thing is, in theory all of this data is pseudonymous, or even anonymous, as the industry creates all of these profiles and does not attach real names to it.
  - A2017U1 7y ago
    Even government departments trying their very best to anonymise data tend to mess it up, what makes you think an advertising company has any interest in doing the same? Their entire existence is built upon deanonymising and monetising that data.
    - user17843 7y ago
      Nothing makes me think this. But since officially everything is pseudonymous, how would it be possible to have a website dedicated to showing the data someone has about me? Privacy International did a piece on this kind of ad-tech data survaillance and they were saying "Here is the shocking details what an ad-company knew about me when I asked them to share everything with me in line with GDPR" Then I emailed Privacy International, asking: How did they even knew your real name? To which they replied "Oh, yes, we forgot to add that to the article, I actually gave them my name and my cookies, so they could tie all their cookie IDs to my name" PI promised to add this "small detail" to the article. They never did: https://privacyinternational.org/long-read/2433/i-asked-online-tracking-company-all-my-data-and-heres-what-i-found https://privacyinternational.org/long-read/2433/i-asked-onli... They also promised to write an article about the implications of pseudonymous data and the possible link to real identities, which they also never did.
user17843 7y ago
I have yet to see a real whistleblower report by someone deep into the ad industry revealing whats really going on there. There are almost no details about what's really happening on a technical level (beyond the little things we already know), and whether large data sets are abused in the sense that they get routinely de-anonymised.
- otabdeveloper3 7y ago
  There's nothing to whistleblow. Advertising is applied sociology. As such, advertisers want to aggregate large data sets into large segments that are easy to manipulate statistically. (Where the central limit theorem starts working.) There is no demand for personal data or de-anonymization because that stuff doesn't sell. The personal data collection is done by Google, Facebook at al not for advertising purposes. They're collecting it because they view it as a resource and a currency in the future de-anonymized world. (Think China's "social capital" except on a larger scale.) Source: I've worked in the ad industry for over 15 years.
  - everdrive 7y ago
    I think in some circles the meaning of the term "whistle-blowing" has drifted enough that people use it interchangeably with "reveal." Given your 15 years of experience, what resources do you recommend to HN so that we can learn more? Can you give us a "life of an advertising bit," eg: A person visits a website on their phone, that information is accompanied by x data on their phone, goes to the initial ad server, this information is compiled against data from sources a,b,c, etc ...
  - user17843 7y ago
    My question to someone from the ad-industry would be if there are known "intersections" between these anonymised data sets ad-tech is using to sell as much as possible, and companies who buy these data-sets to connect them to real identities. Especially because the web is full of Privacy notices people agree to, and I guess in some of those people actually agree to have their anonymous browsing data connected to their real identities.
mrhappyunhappy 7y ago
Any company that offers “lead enrichment “ data has already crossed the privacy line. Google that term to see the companies involved if you care to know.
titzer 7y ago
We need to stand up and demand that all devices capable of surveillance run only open source software. Period.
- jefftk 7y ago
  Open source doesn't fix much. Most ad tracking today happens via well understood open technology, and then adtech companies build profiles server side. Here's something very simple and fully opensourceable that would still provide lots of tracking capability: * Get lots of sites to put an img tag that references your site, perhaps by paying them a tiny amount per visitor * When you get a request, assign a cookie if there isn't one. Log the cookie and the referrer. * Sort your logs by cookie. Each cookie represents someone's browsing history, and the more complete your distribution of pixels is the more complete your view is. You can opt out of this client side by blocking the requests (adblocker) or by using a browser that blocks 3rd party cookies (ex: Safari) but open source doesn't do much here.
  - thedevilslawyer 7y ago
    In the parent post's defense, open source would actually allow for looking at exactly what data is sent how. And hold the companies accountable. This would be dead easy, without the need for whistle-blowing, or reverse engineering
    - IggleSniggle 7y ago
      Most of the surveillance I am concerned about is website surveillance, as I don’t install apps. JavaScript is “source code available.”
  - titzer 7y ago
    At the basic level, you have no idea what the system software is gathering from sensors, like the accelerometer, barometer, GPS, wifi signals, etc, how it is processed, and how often it is sent, and to whom. After you find out how that works, then the next logical step is to ask just what the heck the other side is doing with it.
datenhorst 7y ago
As a citizen of the EU, I really want to find out what the advertising industry has on me. I once filed a GDPR Art. 5 request with Quantcast but forgot about it - they give you a link to S3 with a promise that there will be a ZIP containing data within 30 days. What other hidden players are out there? I know next to nothing about the ad industry
- kasey_junk 7y ago
  IAB Europe is the industry group representing ad tech in Europe. Their member list will give you tons of organizations that makeup the internet ad ecosystem. Note these are not “hidden” they are the above board members. Shady operators likely have no interest in joining industry groups but if they want to be able to credibly sell to big advertisers they will be. https://www.iabeurope.eu/membership/member-directory/ https://www.iabeurope.eu/membership/member-directory/
- DoctorMckay 7y ago
  Any tips for a fellow curious European who wants to fill one of those with his ISP? Like, how do I start?
jccalhoun 7y ago
What are they doing with all this data tracking because it sure isn't giving me relevant ads. In addition to the often noted situation where you buy something online and then get ads for that thing you already bought, I routinely see totally irrelevant ads and recommendations. I've been on Facebook since around 2003. I've had an Amazon account for even longer. Their ads and recommendations for me are terrible. Two recent examples from facebook: they recommended I join a group for progressive christian asian-americans. I am not christian or of asian descent. More recently they gave me an ad for maximizing tax right offs for nannies. I have no children and make way too little to even consider hiring a nanny. Facebook has my picture. They know my relationship status. They have the text of all my posts where I have never mentioned children. They even know my occupation. Whatever they are doing with this data isn't working.
- m463 7y ago
  On relevant ads. You see ads from companies with the most to gain from getting to your eyeballs. These companies are not the ones you are interested in, who will probably get your business anyway.
- DougBTX 7y ago
  I wonder how much of this is a scam on the advertisers too, sure the platform might have great detail for targeting ads, but if someone comes along and outbids on generic terms it isn’t going to do you much good as an advertiser either.
  - nerdponx 7y ago
    Judging from some of the comments I've seen here, quite a lot.
    - mattkevan 7y ago
      I used to lead the product team for a publisher that makes the majority of its income from ads. It was a constant fight between the commercial teams and us. Commercial wanted to stuff every page with as many ads and trackers as possible. We wanted to ensure the user didn’t have a miserable experience. As the company liked getting money, we, and the user, generally lost. I kept an instance of Chrome blocker-free to see the site in all its ad-stuffed glory, but after learning a bit about how things work, I block all the things with extreme prejudice for personal browsing. And ensure friends & family do too.
freen 7y ago
And yet banning nazis on Facebook is sooo hard...
nerdponx 7y ago
Good, as software engineers, machine learning researchers, etc. we have the real power here. Just stop working for these companies. There are jobs and good incomes to be had in other industries. Tell recruiters you are not interested in ad industry.
- luckylion 7y ago
  Somebody else will work for them though. While I'm not saying "so it might as well be you" (unless you're going undercover), "not doing it" might not be enough. Actively undermining their efforts may be necessary.
  - britch 7y ago
    Actively undermining is good! Specifically fighting for new regulations and laws around this issue. I think people in tech have an obligation around this. We understand it better than most people. It's our responsibility to explain it in ordinary terms and champion reigning it in.
  - nerdponx 7y ago
    This is literally what collective action is for.
2Ccltvcm 7y ago
Hedge funds and intelligence agencies are fingerprinting all groups within our society by monitoring the responses of various target audiences to engineered stimuli. This comes in the form of observing the response to selective dissemination of content with a known effect on observers (you). A few years ago we heard about some outrage nobody did anything about when it became clear Facebook was manipulating reader emotional depression by showing some groups engineered posts. This has become a higher dimensional problem since then. It is no longer just "Facebook is making some groups of people sad." Now these orgs are reinforcing complex concepts in our minds subconsciously. One that comes to mind is a motif you will see in advertisements once you are more aware of it: strong healthy black man rescues white woman from a bumbling and pathetic white male. The whole point is to exploit fracture points in society and shift the overton window. Being able to establish behavioral patterns triggered by engineered information dissemination helps them control groups of people for their own benefit. It's a psychological intelligence operation on an unprecedented scale. Hedge funds stay ahead of new trends to invest in to maximize ROI. Intelligence agencies similarly identify threats to their power structures and steer the minds of the consumers of social media to further their agenda and steer the beliefs of any group in a controlled direction.
- nycdatasci 7y ago
  Your post is also an attempt to “reinforce complex concepts in our minds subconsciously” isn’t it? The entire field of marketing is an attempt to influence people to engage in a particular behavior. Why single out hedge funds and intelligence agencies?
  - 2Ccltvcm 7y ago
    The difference is those have the power to make dissidents vanish and make it seem like everything is perfect.
    - jamespo 7y ago
      Hedge funds make dissidents vanish?
hmhrex 7y ago
Me and a few other people have been pushing for ethical advertising. It doesn't have to be this way. We meet monthly to give each other advice and help each other out. It's hard, it can take more time, but it's been a great experience, and I hope that this starts to become the norm over time. Here's the group: - Eric Berry with CodeFund (https://codefund.io https://codefund.io) - David Fischer with ReadTheDocs (https://docs.readthedocs.io/en/stable/advertising/ethical-advertising.html https://docs.readthedocs.io/en/stable/advertising/ethical-ad...) - Roberto Galoppini with Filezilla (https://filezilla-project.org/ethical_ads.php https://filezilla-project.org/ethical_ads.php) - Harley Hicks (Me) with RoutineHub (https://routinehub.co/ads https://routinehub.co/ads)
- AllegedAlec 7y ago
  > - Harley Hicks (Me) with RoutineHub (https://routinehub.co/ads https://routinehub.co/ads) Heads up: in Firefox Quantum 67, when I attempt to open your page in a new tab, it instantly closes again.
  - hmhrex 7y ago
    I use Firefox as my main driver and just tested this, and it does exactly as you're saying. Thanks, I'll take a look.
- taormina 7y ago
  I absolutely love this. Have y'all been collecting your advice? I'd love to learn what has and hasn't worked so far for your projects.
  - hmhrex 7y ago
    I've been trying to do a monthly report on the RH blog, but I'm behind by a couple months. I've actually been thinking more about how to get more info about this. If you have any specific questions, I can try and answer them for you or bring them back to the others.
    - 7y ago
fumar 7y ago
The whole thing is an ad for a new service.
- headsoup 7y ago
  Seems so. I also find it interesting that people have sudden moral realisations working in industries designed not to be morally respectful. Ad industry is about convincing people to buy things they don't want using any trick available, the result here is entirely predictable and inevitable.
- rchaud 7y ago
  These days I expect nothing less from these "mea culpa" type of articles.
TimMurnaghan 7y ago
This became obvious a few years ago. I went to a startup pitch event (actually to get pointers on how to write my own) and was genuinely horrified at what all of the ad-tech guys were up to. There is no reason to assume any moderation or morals here. The naked greed of surveillance capitalism is such that all of the precautions that might have looked like the province of tinfoil hat wearers are now justified.
deleted 7y ago
[deleted]
jstewartmobile 7y ago
This whole "article" is a slimy, PR-firm-injected ad. Hell would freeze over before I touched this guy's "privacy" "filter" with a 10-foot pole.
throwayEngineer 7y ago
Edit, remember not to shoot the people asking questions I'm not sure why that data is so horrifying. I work a job that I willing put on Facebook, and I live in a house i am a registered voter at. You can probably guess my route to work. I'm unsure why this is bad, it sounds more useless than anything.
- majewsky 7y ago
  Ah, the old "I have nothing to hide". Just one of many obvious rebuttals: We need to be a large anonymous crowd to protect those among us most in need of anonymity: whistleblowers, activists, stalking victims, to name a few.
  - throwayEngineer 7y ago
    Hmm a stalking victim could not use Android / Google maps. This sounds like potential for profit. Interesting. I'm assuming this already exists but 95% of people don't need it?
- michaelt 7y ago
  Location data tells me how often you go to the gun shop and the shooting range, when your house is empty, which political protests you go to, how often you visit the pharmacy/doctor, what prostitutes you visit, what gay bars you visit, how often you break the speed limit, how much sleep you get, when you visit your lawyer or your STD clinic, whether you've kept up going to Alcoholics Anonymous, what restaurants you go to and how often, how often you're late for work, and how often you visit your grandma. I'm not an Iranian gay gun owner, but I still have a problem with an advertising company assembling a database of Iranian gay gun owners.
  - throwayEngineer 7y ago
    Why? Don't you want to hear your different lawyer options, STD check options, gun options, alcohol help, etc? Or rather, would you rather have useful advertisement or spammy advertisement? I still could not relate that those would be bad. The only thing I can imagine is blackmail. Which is cultural and not moral.
SPGWhistler 7y ago
This is fear mongering. I work in the ad industry as well - and I can promise you - 99% of the companies in the ad industry are NOT leading the way when it comes to tracking you and your data. They are incompetent and can barely do their jobs. Just take a look at any display advertising for belly fat ads and you know for sure they aren't targeting you. The 1% however (Google, Microsoft, Amazon, Apple, Facebook) ARE tracking you and are damn good at it. Google and Apple being the main offenders here, due to their cell phones. And when you browse around the web you WILL see those ads following you. But as much as it sounds terrifying - there just isn't much of a market for geo tracking individuals. Targeted ads aren't the enemy here anyway - its governments using this data in ways the infringe on our freedoms that is the issue. (Like freedom of press, for example....) And THIS is what we should be worried about. To be clear: It is not the ad industry we have an issue with here. It is the data collectors - Google - Apple - Facebook. They are the irresponsible parties at fault.
- enraged_camel 7y ago
  >> 99% of the companies in the ad industry are NOT leading the way when it comes to tracking you... The 1% however (Google, Microsoft, Amazon, Apple, Facebook) This representation by percentages is a bit disingenuous. Yes, numbers-wise you may be correct, but if you consider the companies' enormous resources and amount of influence and impact, Google et al make up the 90+%.
  - SPGWhistler 7y ago
    My point was that most ad tech companies are not the issue. It is the big boys which is the issue. And, that ad tech wasn't the issue. Ads using targeting data is a symptom of the problem, not the problem it self. The collecting of the data (by the 1%) is the problem.
- jhookham 7y ago
  This sounds a little too far in the other direction to me. From working with a handful of advertising platforms interested in the web property that I've worked with for the past 8 years, I agree with your point re: incompetence. However, I disagree that it's _only_ the big boys who are gathering large portfolios of data on individuals that span multiple web properties, apps and spheres of data. It seems to me that your data is part of the marketplace and anyone can play. Regulations would be nice. A technological solution that fundamentally obfuscates an individual so that they can buy their groceries without being big-brothered would nicer.
stunt 7y ago
It becomes scary when you realize this is just the beginning of it. They will go too far with it in the next ten years.
jorams 7y ago
At some point companies like Fast Company have to accept that they are a significant part of the problem, and just writing articles about it is not enough. This page contains a ridiculous number of trackers. The site pulls in content from the following 3rd-party domains: s.skimresources.com, sb.scorecardresearch.com, secure-cdn.mplxtms.com, z.moatads.com, ml314.com, secure-us.imrworldwide.com, www.googletagservices.com, www.google-analytics.com, www.dianomi.com, d1z2jf7jlzjs58.cloudfront.net, static.chartbeat.com, assets.adobetm.com, platform.twitter.com, www.queryly.com, cdn.polyfill.io, www.lightboxcdn.com, content.jwplatform.com, platform.instagram.com, www.inc.com, images.fastcompany.net, connect.facebook.com, cdn.conversant.mgr.consensu.org, cdnjs.cloudflare.com. images.fastcompany.net is probably just used to serve static content from a cookieless domain and some of the others are CDNs for libraries, but the rest are all there for tracking purposes. If you don't like what the ad industry is doing with people's personal data, please don't keep giving them ways to get to it.
- m463 7y ago
  CDNs absolutely identify and track you on the backend.
- godshatter 7y ago
  They also have the distinction of being the first page I've ever run across where temporarily enabling javascript on their domain causes the page not to load, whereas leaving it off does make it load. Makes "forbid fastcompany.com" an easy choice.
  - mixmastamyk 7y ago
    Many of the "disable your ad blocker" dialogs are implemented in JavaScript, which is why this happens. Silly, but that's where we are.
  - ahje 7y ago
    This is surprisingly common. They keep the content on the page in order to make it available for crawlers, and then use JS to hide the content until it's determined you don't have an ad-blocker, or you've accepted some draconian terms, or whatnot. Better to leave JS off if the site works without it. :)
briandear 7y ago
Data tracking actually terrified the author? As in “filled with terror?” It seems hyperbolic to be afraid and “terrified” over refrigerator ads. Being trapped in a well for hours, being lost at sea — terrifying, but ad data? Either millennial era people are more fragile or prone to writing hyperbolic clickbait, or the author doesn’t understand what “terrified” means. On this 75th anniversary of Normandy, some person being terrified of an advertising company stands in stark relief to men storming a beach or dropping in to fight Nazis — an activity that must have been actually terrifying. Even almost getting hit by a car could be terrifying; but advertising tech? Annoying, and intrusive maybe, but hardly panic inducing.
ssivark 7y ago
The author of this post seems to be running a Kickstarter now, for a hardware privacy device: https://www.kickstarter.com/projects/winstonprivacy/winston-the-worlds-most-advanced-online-privacy-device https://www.kickstarter.com/projects/winstonprivacy/winston-... I dunno enough; can folks comment on its technical capabilities vis-a-vis other solutions available now?
bobblywobbles 7y ago
This is why you should block these trackers by modifying your hosts file (https://debugandrelease.blogspot.com/2019/01/how-to-block-online-ads-with-hosts-file.html https://debugandrelease.blogspot.com/2019/01/how-to-block-on...). It doesn't just block ads, but trackers too.
JSeymourATL 7y ago
This FastCo article is really a brilliant advertorial for Winston. Upvote for their cheeky video > https://winstonprivacy.com/ https://winstonprivacy.com/

342 points by Ygg2 7y ago

Another very frustrating article about advertising. I don't doubt any of his conclusions, or his moral claims. But, I do want more details. What are the various tracking and correlation mechanisms, what do they look like practically? Does anyone actually really use canvas the way we all fear, or are smartphone apps and Android itself doing all the heavy lifting? Would a user's privacy settings in their phones mitigated any of this? Why or why not? I appreciate that we know in general what the answers to some of these questions might be, but I'd really like if more of these articles got into specifics.

raxxorrax 7y ago
That the ad industry tries to justify its data harboring with questionable consent is certainly a factor. Ads mostly suck, that is why people have blockers and why those are so successful. If I do not want to get tracked or targeted by ads, I have to jump through many hoops that are not manageable by average users. This is why I plainly hate this industry. I don't really care about your models, while they might provide interesting data, I do not want to be part of it. Oh, and the ad industry is currently in the process of sanitizing the larger platforms, because you do not want to be associated with losers. It is the great ad industry we are talking about. I don't like them because of that too. These are the larger issues that prevent useful discussion about specific tracking mechanisms.
mobjack 7y ago
Tracking still mainly relies on unique identifiers on cookies and mobile apps. The main thing I see fingerprinting used for is tracking users between mobile apps and websites. That mainly relies on IP addresses. The best way to track users is just to ask for information. Ask for a users email address to log in and you have a simple means to track a user across devices.
ohitsdom 7y ago
> Does anyone actually really use canvas the way we all fear I think I missed something, what do you mean by this? Are there some data leaking privacy concerns with HTML canvas elements?
- everdrive 7y ago
  My understanding is that websites use Canvas to generate a unique or semi-unique fingerprint of your browser, whether or not a cookie has been set. It's absolutely true that this is technically possible. Most people don't have your exact resolution/cpu speed/fonts installed/etc, so you are somewhat unique even if you have the same browser and OS as other people. If you block Canvas, you can actually see some websites request it as you log in. Amazon produces a popup asking permission to do canvas-y things during the login progress on my computer, for instance. I think the tone of most of the conversations around Canvas I've seen are a bit more catastrophic. Their argument usually goes something like: "Most websites are making UUIDs of your Canvas profile and tracking you everywhere, and therefore your cookie blocking and VPN are useless!" Bear in mind, I don't mean to strawman here, that's just a version of the argument I see most often. What I personally suspect is that Canvas fingerprinting is used to supplement other tracking or verification. For example, I have a valid amazon account, an Amazon cookie is properly set, and Amazon also checks my Canvas information to make sure nothing looks too out place. ie, my cookie was probably not replayed since my Canvas, IP address, and credentials check out. Presumably, my Canvas information cannot generate a true UUID, but it is something like 1 in 10,000. Enough to use it for additional verification. Now, is any of this correct? Are folks' most paranoid fears accurate? Is my belief that Canvas is supplementary fraud detection accurate? Whatever answer is correct, it's unlikely to be broadly uniform across all websites. But, the point is, I'd really like to hear from an engineer about how Canvas is used.

dvfjsdhgfv 7y ago

There are many reasonable proposals in the article but they are only wishful thinking: there is no way the USA passes a law similar to GDPR, no matter what people want and how many similar articles appear.

scarejunba 7y ago
Well, we'll see what CCPA looks like by the end. If someone else makes a different law then a federal law will come so as to harmonize the requirements. If no one else makes a different law, CCPA will become a de facto federal law because you ignore California to your own detriment.
luckylion 7y ago
As for GDPR: at least in Germany it's problematic. Our system typically relies on competitors to enforce law abidance in companies (so called "Abmahnungen" based on the "Gesetz gegen den unlauteren Wettbewerb", UWG for short, a set of laws regarding unlawful competition). One court recently ruled that GDPR violations don't fall under those laws (https://www.datenschutzbeauftragter-info.de/landgericht-stuttgart-zur-abmahnfaehigkeit-von-dsgvo-verstoessen/ https://www.datenschutzbeauftragter-info.de/landgericht-stut...). That leaves us with: - reporting violations to the officials. They are chronically understaffed, have little technical expertise and it takes months to years for them to act. They are very hesitant to hand out fines, but theoretically can. - individual citizens suing a company to force them to abide by the law. This is rare because the citizen will have to cough up the money to go to court, and even if he wins, the company will only be forced to abide by the laws regarding this citizen, not in general. - publicly shaming companies into compliance. A higher court might have different opinions, and I very much hope they will, because GDPR quickly becomes meaningless without enforcement. Edit: I have literally no idea why this is downvoted. Unless it's just because you personally don't like me, please leave a comment explaining what is incorrect.
- icebraining 7y ago
  Unless the site is only available to German users, you should be able to file a complain with any of EU member state regulators, and not all are so timid as that. NOYB, the non-profit org founded by Max Schrems, has already been filing complaints with the French, Austrian, Belgian and German authorities: https://noyb.eu/ https://noyb.eu/

Vagantem 7y ago

Had a similar experience - worked in a big ad agency who hired a new web-developer for one of our clients. As they are one of the biggest website providers, they could identify most of the people that visited a client's site - it even automatically saved the identified user's profile pic from facebook into their database.

user17843 7y ago
> it even automatically saved the identified user's profile pic from facebook into their database. Please share more information. Did that require the user to be logged into FB?
- zed88 7y ago
  Here is a hint https://docs.fullcontact.com/#enrich-api https://docs.fullcontact.com/#enrich-api
  - Aromasin 7y ago
    As an engineer, I'm amazed. As a person who doesn't want the person on the other end of every website I visit to know who exactly I am, I feel violated. At this point though, all I feel I can do as a hapless consumer is to desensitize myself to said violation. I use a VPN, Pi-Hole, Ghostery and Firefox. All of these a relatively recent additions though, so if a website can get my email and that links to an already existing database of all my collected data up to that point, I'm buggered anyway.
    - pure-awesome 7y ago
      Just making sure you're aware of the discussion around Ghostery that's happened here on HackerNews, so you can make an informed decision: https://news.ycombinator.com/item?id=15969525 https://news.ycombinator.com/item?id=15969525 https://news.ycombinator.com/item?id=16809625 https://news.ycombinator.com/item?id=16809625 https://news.ycombinator.com/item?id=13652126 https://news.ycombinator.com/item?id=13652126 https://news.ycombinator.com/item?id=9617827 https://news.ycombinator.com/item?id=9617827

zeristor 7y ago

The Pwned website shows you which websites your account details have been leaked for. Is there one to show you what the ad industry has on you, and perhaps how it can by it? If people had insight to this for how much longer would this be a problem? I imagine there’s a website that does this which was launched five years ago.

user17843 7y ago
the thing is, in theory all of this data is pseudonymous, or even anonymous, as the industry creates all of these profiles and does not attach real names to it.
- A2017U1 7y ago
  Even government departments trying their very best to anonymise data tend to mess it up, what makes you think an advertising company has any interest in doing the same? Their entire existence is built upon deanonymising and monetising that data.
  - user17843 7y ago
    Nothing makes me think this. But since officially everything is pseudonymous, how would it be possible to have a website dedicated to showing the data someone has about me? Privacy International did a piece on this kind of ad-tech data survaillance and they were saying "Here is the shocking details what an ad-company knew about me when I asked them to share everything with me in line with GDPR" Then I emailed Privacy International, asking: How did they even knew your real name? To which they replied "Oh, yes, we forgot to add that to the article, I actually gave them my name and my cookies, so they could tie all their cookie IDs to my name" PI promised to add this "small detail" to the article. They never did: https://privacyinternational.org/long-read/2433/i-asked-online-tracking-company-all-my-data-and-heres-what-i-found https://privacyinternational.org/long-read/2433/i-asked-onli... They also promised to write an article about the implications of pseudonymous data and the possible link to real identities, which they also never did.

user17843 7y ago

I have yet to see a real whistleblower report by someone deep into the ad industry revealing whats really going on there. There are almost no details about what's really happening on a technical level (beyond the little things we already know), and whether large data sets are abused in the sense that they get routinely de-anonymised.

otabdeveloper3 7y ago
There's nothing to whistleblow. Advertising is applied sociology. As such, advertisers want to aggregate large data sets into large segments that are easy to manipulate statistically. (Where the central limit theorem starts working.) There is no demand for personal data or de-anonymization because that stuff doesn't sell. The personal data collection is done by Google, Facebook at al not for advertising purposes. They're collecting it because they view it as a resource and a currency in the future de-anonymized world. (Think China's "social capital" except on a larger scale.) Source: I've worked in the ad industry for over 15 years.
- everdrive 7y ago
  I think in some circles the meaning of the term "whistle-blowing" has drifted enough that people use it interchangeably with "reveal." Given your 15 years of experience, what resources do you recommend to HN so that we can learn more? Can you give us a "life of an advertising bit," eg: A person visits a website on their phone, that information is accompanied by x data on their phone, goes to the initial ad server, this information is compiled against data from sources a,b,c, etc ...
- user17843 7y ago
  My question to someone from the ad-industry would be if there are known "intersections" between these anonymised data sets ad-tech is using to sell as much as possible, and companies who buy these data-sets to connect them to real identities. Especially because the web is full of Privacy notices people agree to, and I guess in some of those people actually agree to have their anonymous browsing data connected to their real identities.

mrhappyunhappy 7y ago

Any company that offers “lead enrichment “ data has already crossed the privacy line. Google that term to see the companies involved if you care to know.

titzer 7y ago

We need to stand up and demand that all devices capable of surveillance run only open source software. Period.

jefftk 7y ago
Open source doesn't fix much. Most ad tracking today happens via well understood open technology, and then adtech companies build profiles server side. Here's something very simple and fully opensourceable that would still provide lots of tracking capability: * Get lots of sites to put an img tag that references your site, perhaps by paying them a tiny amount per visitor * When you get a request, assign a cookie if there isn't one. Log the cookie and the referrer. * Sort your logs by cookie. Each cookie represents someone's browsing history, and the more complete your distribution of pixels is the more complete your view is. You can opt out of this client side by blocking the requests (adblocker) or by using a browser that blocks 3rd party cookies (ex: Safari) but open source doesn't do much here.
- thedevilslawyer 7y ago
  In the parent post's defense, open source would actually allow for looking at exactly what data is sent how. And hold the companies accountable. This would be dead easy, without the need for whistle-blowing, or reverse engineering
  - IggleSniggle 7y ago
    Most of the surveillance I am concerned about is website surveillance, as I don’t install apps. JavaScript is “source code available.”
- titzer 7y ago
  At the basic level, you have no idea what the system software is gathering from sensors, like the accelerometer, barometer, GPS, wifi signals, etc, how it is processed, and how often it is sent, and to whom. After you find out how that works, then the next logical step is to ask just what the heck the other side is doing with it.

datenhorst 7y ago

As a citizen of the EU, I really want to find out what the advertising industry has on me. I once filed a GDPR Art. 5 request with Quantcast but forgot about it - they give you a link to S3 with a promise that there will be a ZIP containing data within 30 days. What other hidden players are out there? I know next to nothing about the ad industry

kasey_junk 7y ago
IAB Europe is the industry group representing ad tech in Europe. Their member list will give you tons of organizations that makeup the internet ad ecosystem. Note these are not “hidden” they are the above board members. Shady operators likely have no interest in joining industry groups but if they want to be able to credibly sell to big advertisers they will be. https://www.iabeurope.eu/membership/member-directory/ https://www.iabeurope.eu/membership/member-directory/
DoctorMckay 7y ago
Any tips for a fellow curious European who wants to fill one of those with his ISP? Like, how do I start?

jccalhoun 7y ago

What are they doing with all this data tracking because it sure isn't giving me relevant ads. In addition to the often noted situation where you buy something online and then get ads for that thing you already bought, I routinely see totally irrelevant ads and recommendations. I've been on Facebook since around 2003. I've had an Amazon account for even longer. Their ads and recommendations for me are terrible. Two recent examples from facebook: they recommended I join a group for progressive christian asian-americans. I am not christian or of asian descent. More recently they gave me an ad for maximizing tax right offs for nannies. I have no children and make way too little to even consider hiring a nanny. Facebook has my picture. They know my relationship status. They have the text of all my posts where I have never mentioned children. They even know my occupation. Whatever they are doing with this data isn't working.

m463 7y ago
On relevant ads. You see ads from companies with the most to gain from getting to your eyeballs. These companies are not the ones you are interested in, who will probably get your business anyway.
DougBTX 7y ago
I wonder how much of this is a scam on the advertisers too, sure the platform might have great detail for targeting ads, but if someone comes along and outbids on generic terms it isn’t going to do you much good as an advertiser either.
- nerdponx 7y ago
  Judging from some of the comments I've seen here, quite a lot.
  - mattkevan 7y ago
    I used to lead the product team for a publisher that makes the majority of its income from ads. It was a constant fight between the commercial teams and us. Commercial wanted to stuff every page with as many ads and trackers as possible. We wanted to ensure the user didn’t have a miserable experience. As the company liked getting money, we, and the user, generally lost. I kept an instance of Chrome blocker-free to see the site in all its ad-stuffed glory, but after learning a bit about how things work, I block all the things with extreme prejudice for personal browsing. And ensure friends & family do too.

freen 7y ago

And yet banning nazis on Facebook is sooo hard...

nerdponx 7y ago

Good, as software engineers, machine learning researchers, etc. we have the real power here. Just stop working for these companies. There are jobs and good incomes to be had in other industries. Tell recruiters you are not interested in ad industry.

luckylion 7y ago
Somebody else will work for them though. While I'm not saying "so it might as well be you" (unless you're going undercover), "not doing it" might not be enough. Actively undermining their efforts may be necessary.
- britch 7y ago
  Actively undermining is good! Specifically fighting for new regulations and laws around this issue. I think people in tech have an obligation around this. We understand it better than most people. It's our responsibility to explain it in ordinary terms and champion reigning it in.
- nerdponx 7y ago
  This is literally what collective action is for.

2Ccltvcm 7y ago

Hedge funds and intelligence agencies are fingerprinting all groups within our society by monitoring the responses of various target audiences to engineered stimuli. This comes in the form of observing the response to selective dissemination of content with a known effect on observers (you). A few years ago we heard about some outrage nobody did anything about when it became clear Facebook was manipulating reader emotional depression by showing some groups engineered posts. This has become a higher dimensional problem since then. It is no longer just "Facebook is making some groups of people sad." Now these orgs are reinforcing complex concepts in our minds subconsciously. One that comes to mind is a motif you will see in advertisements once you are more aware of it: strong healthy black man rescues white woman from a bumbling and pathetic white male. The whole point is to exploit fracture points in society and shift the overton window. Being able to establish behavioral patterns triggered by engineered information dissemination helps them control groups of people for their own benefit. It's a psychological intelligence operation on an unprecedented scale. Hedge funds stay ahead of new trends to invest in to maximize ROI. Intelligence agencies similarly identify threats to their power structures and steer the minds of the consumers of social media to further their agenda and steer the beliefs of any group in a controlled direction.

nycdatasci 7y ago
Your post is also an attempt to “reinforce complex concepts in our minds subconsciously” isn’t it? The entire field of marketing is an attempt to influence people to engage in a particular behavior. Why single out hedge funds and intelligence agencies?
- 2Ccltvcm 7y ago
  The difference is those have the power to make dissidents vanish and make it seem like everything is perfect.
  - jamespo 7y ago
    Hedge funds make dissidents vanish?

hmhrex 7y ago

Me and a few other people have been pushing for ethical advertising. It doesn't have to be this way. We meet monthly to give each other advice and help each other out. It's hard, it can take more time, but it's been a great experience, and I hope that this starts to become the norm over time. Here's the group: - Eric Berry with CodeFund (https://codefund.io https://codefund.io) - David Fischer with ReadTheDocs (https://docs.readthedocs.io/en/stable/advertising/ethical-advertising.html https://docs.readthedocs.io/en/stable/advertising/ethical-ad...) - Roberto Galoppini with Filezilla (https://filezilla-project.org/ethical_ads.php https://filezilla-project.org/ethical_ads.php) - Harley Hicks (Me) with RoutineHub (https://routinehub.co/ads https://routinehub.co/ads)

AllegedAlec 7y ago
> - Harley Hicks (Me) with RoutineHub (https://routinehub.co/ads https://routinehub.co/ads) Heads up: in Firefox Quantum 67, when I attempt to open your page in a new tab, it instantly closes again.
- hmhrex 7y ago
  I use Firefox as my main driver and just tested this, and it does exactly as you're saying. Thanks, I'll take a look.
taormina 7y ago
I absolutely love this. Have y'all been collecting your advice? I'd love to learn what has and hasn't worked so far for your projects.
- hmhrex 7y ago
  I've been trying to do a monthly report on the RH blog, but I'm behind by a couple months. I've actually been thinking more about how to get more info about this. If you have any specific questions, I can try and answer them for you or bring them back to the others.
  - 7y ago

fumar 7y ago

The whole thing is an ad for a new service.

headsoup 7y ago
Seems so. I also find it interesting that people have sudden moral realisations working in industries designed not to be morally respectful. Ad industry is about convincing people to buy things they don't want using any trick available, the result here is entirely predictable and inevitable.
rchaud 7y ago
These days I expect nothing less from these "mea culpa" type of articles.

TimMurnaghan 7y ago

This became obvious a few years ago. I went to a startup pitch event (actually to get pointers on how to write my own) and was genuinely horrified at what all of the ad-tech guys were up to. There is no reason to assume any moderation or morals here. The naked greed of surveillance capitalism is such that all of the precautions that might have looked like the province of tinfoil hat wearers are now justified.

deleted 7y ago

[deleted]

jstewartmobile 7y ago

This whole "article" is a slimy, PR-firm-injected ad. Hell would freeze over before I touched this guy's "privacy" "filter" with a 10-foot pole.

throwayEngineer 7y ago

Edit, remember not to shoot the people asking questions I'm not sure why that data is so horrifying. I work a job that I willing put on Facebook, and I live in a house i am a registered voter at. You can probably guess my route to work. I'm unsure why this is bad, it sounds more useless than anything.

majewsky 7y ago
Ah, the old "I have nothing to hide". Just one of many obvious rebuttals: We need to be a large anonymous crowd to protect those among us most in need of anonymity: whistleblowers, activists, stalking victims, to name a few.
- throwayEngineer 7y ago
  Hmm a stalking victim could not use Android / Google maps. This sounds like potential for profit. Interesting. I'm assuming this already exists but 95% of people don't need it?
michaelt 7y ago
Location data tells me how often you go to the gun shop and the shooting range, when your house is empty, which political protests you go to, how often you visit the pharmacy/doctor, what prostitutes you visit, what gay bars you visit, how often you break the speed limit, how much sleep you get, when you visit your lawyer or your STD clinic, whether you've kept up going to Alcoholics Anonymous, what restaurants you go to and how often, how often you're late for work, and how often you visit your grandma. I'm not an Iranian gay gun owner, but I still have a problem with an advertising company assembling a database of Iranian gay gun owners.
- throwayEngineer 7y ago
  Why? Don't you want to hear your different lawyer options, STD check options, gun options, alcohol help, etc? Or rather, would you rather have useful advertisement or spammy advertisement? I still could not relate that those would be bad. The only thing I can imagine is blackmail. Which is cultural and not moral.

SPGWhistler 7y ago

This is fear mongering. I work in the ad industry as well - and I can promise you - 99% of the companies in the ad industry are NOT leading the way when it comes to tracking you and your data. They are incompetent and can barely do their jobs. Just take a look at any display advertising for belly fat ads and you know for sure they aren't targeting you. The 1% however (Google, Microsoft, Amazon, Apple, Facebook) ARE tracking you and are damn good at it. Google and Apple being the main offenders here, due to their cell phones. And when you browse around the web you WILL see those ads following you. But as much as it sounds terrifying - there just isn't much of a market for geo tracking individuals. Targeted ads aren't the enemy here anyway - its governments using this data in ways the infringe on our freedoms that is the issue. (Like freedom of press, for example....) And THIS is what we should be worried about. To be clear: It is not the ad industry we have an issue with here. It is the data collectors - Google - Apple - Facebook. They are the irresponsible parties at fault.

enraged_camel 7y ago
>> 99% of the companies in the ad industry are NOT leading the way when it comes to tracking you... The 1% however (Google, Microsoft, Amazon, Apple, Facebook) This representation by percentages is a bit disingenuous. Yes, numbers-wise you may be correct, but if you consider the companies' enormous resources and amount of influence and impact, Google et al make up the 90+%.
- SPGWhistler 7y ago
  My point was that most ad tech companies are not the issue. It is the big boys which is the issue. And, that ad tech wasn't the issue. Ads using targeting data is a symptom of the problem, not the problem it self. The collecting of the data (by the 1%) is the problem.
jhookham 7y ago
This sounds a little too far in the other direction to me. From working with a handful of advertising platforms interested in the web property that I've worked with for the past 8 years, I agree with your point re: incompetence. However, I disagree that it's _only_ the big boys who are gathering large portfolios of data on individuals that span multiple web properties, apps and spheres of data. It seems to me that your data is part of the marketplace and anyone can play. Regulations would be nice. A technological solution that fundamentally obfuscates an individual so that they can buy their groceries without being big-brothered would nicer.

stunt 7y ago

It becomes scary when you realize this is just the beginning of it. They will go too far with it in the next ten years.

jorams 7y ago

At some point companies like Fast Company have to accept that they are a significant part of the problem, and just writing articles about it is not enough. This page contains a ridiculous number of trackers. The site pulls in content from the following 3rd-party domains: s.skimresources.com, sb.scorecardresearch.com, secure-cdn.mplxtms.com, z.moatads.com, ml314.com, secure-us.imrworldwide.com, www.googletagservices.com, www.google-analytics.com, www.dianomi.com, d1z2jf7jlzjs58.cloudfront.net, static.chartbeat.com, assets.adobetm.com, platform.twitter.com, www.queryly.com, cdn.polyfill.io, www.lightboxcdn.com, content.jwplatform.com, platform.instagram.com, www.inc.com, images.fastcompany.net, connect.facebook.com, cdn.conversant.mgr.consensu.org, cdnjs.cloudflare.com. images.fastcompany.net is probably just used to serve static content from a cookieless domain and some of the others are CDNs for libraries, but the rest are all there for tracking purposes. If you don't like what the ad industry is doing with people's personal data, please don't keep giving them ways to get to it.

m463 7y ago
CDNs absolutely identify and track you on the backend.
godshatter 7y ago
They also have the distinction of being the first page I've ever run across where temporarily enabling javascript on their domain causes the page not to load, whereas leaving it off does make it load. Makes "forbid fastcompany.com" an easy choice.
- mixmastamyk 7y ago
  Many of the "disable your ad blocker" dialogs are implemented in JavaScript, which is why this happens. Silly, but that's where we are.
- ahje 7y ago
  This is surprisingly common. They keep the content on the page in order to make it available for crawlers, and then use JS to hide the content until it's determined you don't have an ad-blocker, or you've accepted some draconian terms, or whatnot. Better to leave JS off if the site works without it. :)

briandear 7y ago

Data tracking actually terrified the author? As in “filled with terror?” It seems hyperbolic to be afraid and “terrified” over refrigerator ads. Being trapped in a well for hours, being lost at sea — terrifying, but ad data? Either millennial era people are more fragile or prone to writing hyperbolic clickbait, or the author doesn’t understand what “terrified” means. On this 75th anniversary of Normandy, some person being terrified of an advertising company stands in stark relief to men storming a beach or dropping in to fight Nazis — an activity that must have been actually terrifying. Even almost getting hit by a car could be terrifying; but advertising tech? Annoying, and intrusive maybe, but hardly panic inducing.

ssivark 7y ago

The author of this post seems to be running a Kickstarter now, for a hardware privacy device: https://www.kickstarter.com/projects/winstonprivacy/winston-the-worlds-most-advanced-online-privacy-device https://www.kickstarter.com/projects/winstonprivacy/winston-... I dunno enough; can folks comment on its technical capabilities vis-a-vis other solutions available now?

bobblywobbles 7y ago

This is why you should block these trackers by modifying your hosts file (https://debugandrelease.blogspot.com/2019/01/how-to-block-online-ads-with-hosts-file.html https://debugandrelease.blogspot.com/2019/01/how-to-block-on...). It doesn't just block ads, but trackers too.

JSeymourATL 7y ago

This FastCo article is really a brilliant advertorial for Winston. Upvote for their cheeky video > https://winstonprivacy.com/ https://winstonprivacy.com/