2 ms·

Okay I presume you've never worked in the ad or tracking industry, because the data being sent to DoubleClick without notification is gold for tracking purposes

by 0xy 6y ago

Okay I presume you've never worked in the ad or tracking industry, because the data being sent to DoubleClick without notification is gold for tracking purposes. This can also be considered anti-competitive behavior. DoubleClick has access to orders of magnitude more tracking data than its competitors. IP Addresses cannot be used to differentiate devices. X-Client-Data can, easily. My concerns are: - Their statement is ambiguous, and does not rule out use for tracking or advertising purposes, nor does it rule out future use for individual user tracking. - This "feature" was added sneakily. No notification, there's no user disclosure. Nothing. That just screams suspicious, given the value of the data being sent. - It cannot be disabled. This is the key point. Why can't it be disabled? - DoubleClick is in the whitelist for no reason other than ad tracking purposes. The amount of websites who make calls to DoubleClick and not GTM or GA must be vanishingly small. So the argument that you want to collect the most data is disingenuous. 87%(!!!) of the top 100,000 websites globally make calls to GA. My concern is Google has sneakily added a feature that can be used for tracking purposes while refusing to disclose it to end users and making it impossible to disable.

joshuamorton 6y ago
> Okay I presume you've never worked in the ad or tracking industry Yes and no. I work on tooling very similar to the actual, intended, use of the x-client-data header (aggregate performance analysis). > because the data being sent to DoubleClick without notification is gold for tracking purposes What does it provide that other data that is accessible does not? > IP Addresses cannot be used to differentiate devices. Ah, I see, so in the case of multiple logged-out but non-incognito chrome users in the same household, x-client-data could be used to better target ads to specific devices in the household, instead of the household as a whole. That's the "gold" here? > - This "feature" was added sneakily. No notification, there's no user disclosure. Nothing. That just screams suspicious, given the value of the data being sent. Sure, sort of, in 2012[0]. Doubleclick was added a bit later, in 2014[1]. The reasoning, at the time, is provided in the linked bug[2]. Sure looks nefarious. So was this an 8+ year scheme? Now, there are (at least) two possible ways to look at this, either it's an almost decade long scheme, or alternatively no one on chrome had any intent of ever tracking individual users, and it wasn't even considered. The bug also provides some more insight, doubleclick and GA serve different types of data, and that might matter for measuring things about QUIC. > DoubleClick is in the whitelist for no reason other than ad tracking purposes. The amount of websites who make calls to DoubleClick and not GTM or GA must be vanishingly small. Literally the first website I picked, CNN.com, has doubleclick sources, but not GTM or GA (at least as far as I can tell). > and does not rule out use for tracking or advertising purposes I will once again ask for a scheme by which the header is both useful for tracking or advertising, and isn't used for tracking individual users. It seems like you're claiming that Google is attempting to split hairs and say that tracking individual devices is different from tracking individual users. I've explained before why something like x-client-data can actually be a useful privacy-preserving tool elsewhere[3] (since it allows you to join across a quasi-identifier instead of a PII-identifier). [0]: https://chromium.googlesource.com/chromium/src.git/+/f89fdab13152123f737dc84f5910362fa6569f7f%5E%21/chrome/browser/renderer_host/chrome_resource_dispatcher_host_delegate.cc https://chromium.googlesource.com/chromium/src.git/+/f89fdab... [1]: https://chromium.googlesource.com/chromium/src.git/+/64d617ec7c502ea5ce5ec8f6f97580000541a854 https://chromium.googlesource.com/chromium/src.git/+/64d617e... [2]: https://bugs.chromium.org/p/chromium/issues/detail?id=379341 https://bugs.chromium.org/p/chromium/issues/detail?id=379341 [3]: https://news.ycombinator.com/item?id=22244282 https://news.ycombinator.com/item?id=22244282
- d3nj4l 6y ago
  Well, you still aren't addressing why it can't be disabled.
  - joshuamorton 6y ago
    You're correct, I think that's a fair criticism. But "hey your should add an opt-out" is a far cry from "you're secretly and illegally using this to track people in a way you've explicitly denied", which is where the conversation started.
    - 0xy 6y ago
      I mean, it is secret. Hardly anyone on HN knows about this let alone the average Chrome user. Google made the deliberate decision to not disclose this tracking, right? That's the definition of secret. I won't speak to legality since I'm not a lawyer, and I never claimed it was illegal for that reason. If this feature was disclosed to users with an opt-out, it'd be significantly less suspicious. Instead you've got a secret hard-coded mechanism for tracking users that is impossible to disable. Maybe the reason people are suspicious is because it's a little hard to trust "we don't use this for tracking! trust us!" from a company that makes their money from advertising and tracking (including shadow profiles). Additionally, Google could be compelled to use this data to track users and lie about it publicly through the use of National Security Letters or other nation state mechanisms.
- 0xy 6y ago
  >Literally the first website I picked, CNN.com, has doubleclick sources, but not GTM or GA (at least as far as I can tell). I can see they're preloading GTM scripts, which means those requests are absolutely made. I can't tell if the script is executed, but that doesn't even matter since it's requested. Just open up your network console and filter by "Google". There are numerous requests to Google services, including Google.com and GoogleTagServices.com. >I will once again ask for a scheme by which the header is both useful for tracking or advertising, and isn't used for tracking individual users. Tracking groups of users. >So was this an 8+ year scheme? Even worse. Google had 8 years to adequately disclose to users the DoubleClick tracking or allow them to disable it. To this day, disabling is not possible (not even via config). >Ah, I see, so in the case of multiple logged-out but non-incognito chrome users in the same household, x-client-data could be used to better target ads to specific devices in the household, instead of the household as a whole. That's the "gold" here? Yes, this is why ad networks tend to run fingerprinting scripts. Tracking specific devices is huge. That's partially why the ad industry took a huge hit when Safari cracked down on third-party tracking.

by 0xy 6y ago

joshuamorton 6y ago

> Okay I presume you've never worked in the ad or tracking industry Yes and no. I work on tooling very similar to the actual, intended, use of the x-client-data header (aggregate performance analysis). > because the data being sent to DoubleClick without notification is gold for tracking purposes What does it provide that other data that is accessible does not? > IP Addresses cannot be used to differentiate devices. Ah, I see, so in the case of multiple logged-out but non-incognito chrome users in the same household, x-client-data could be used to better target ads to specific devices in the household, instead of the household as a whole. That's the "gold" here? > - This "feature" was added sneakily. No notification, there's no user disclosure. Nothing. That just screams suspicious, given the value of the data being sent. Sure, sort of, in 2012[0]. Doubleclick was added a bit later, in 2014[1]. The reasoning, at the time, is provided in the linked bug[2]. Sure looks nefarious. So was this an 8+ year scheme? Now, there are (at least) two possible ways to look at this, either it's an almost decade long scheme, or alternatively no one on chrome had any intent of ever tracking individual users, and it wasn't even considered. The bug also provides some more insight, doubleclick and GA serve different types of data, and that might matter for measuring things about QUIC. > DoubleClick is in the whitelist for no reason other than ad tracking purposes. The amount of websites who make calls to DoubleClick and not GTM or GA must be vanishingly small. Literally the first website I picked, CNN.com, has doubleclick sources, but not GTM or GA (at least as far as I can tell). > and does not rule out use for tracking or advertising purposes I will once again ask for a scheme by which the header is both useful for tracking or advertising, and isn't used for tracking individual users. It seems like you're claiming that Google is attempting to split hairs and say that tracking individual devices is different from tracking individual users. I've explained before why something like x-client-data can actually be a useful privacy-preserving tool elsewhere[3] (since it allows you to join across a quasi-identifier instead of a PII-identifier). [0]: https://chromium.googlesource.com/chromium/src.git/+/f89fdab13152123f737dc84f5910362fa6569f7f%5E%21/chrome/browser/renderer_host/chrome_resource_dispatcher_host_delegate.cc https://chromium.googlesource.com/chromium/src.git/+/f89fdab... [1]: https://chromium.googlesource.com/chromium/src.git/+/64d617ec7c502ea5ce5ec8f6f97580000541a854 https://chromium.googlesource.com/chromium/src.git/+/64d617e... [2]: https://bugs.chromium.org/p/chromium/issues/detail?id=379341 https://bugs.chromium.org/p/chromium/issues/detail?id=379341 [3]: https://news.ycombinator.com/item?id=22244282 https://news.ycombinator.com/item?id=22244282

d3nj4l 6y ago
Well, you still aren't addressing why it can't be disabled.
- joshuamorton 6y ago
  You're correct, I think that's a fair criticism. But "hey your should add an opt-out" is a far cry from "you're secretly and illegally using this to track people in a way you've explicitly denied", which is where the conversation started.
  - 0xy 6y ago
    I mean, it is secret. Hardly anyone on HN knows about this let alone the average Chrome user. Google made the deliberate decision to not disclose this tracking, right? That's the definition of secret. I won't speak to legality since I'm not a lawyer, and I never claimed it was illegal for that reason. If this feature was disclosed to users with an opt-out, it'd be significantly less suspicious. Instead you've got a secret hard-coded mechanism for tracking users that is impossible to disable. Maybe the reason people are suspicious is because it's a little hard to trust "we don't use this for tracking! trust us!" from a company that makes their money from advertising and tracking (including shadow profiles). Additionally, Google could be compelled to use this data to track users and lie about it publicly through the use of National Security Letters or other nation state mechanisms.
0xy 6y ago
>Literally the first website I picked, CNN.com, has doubleclick sources, but not GTM or GA (at least as far as I can tell). I can see they're preloading GTM scripts, which means those requests are absolutely made. I can't tell if the script is executed, but that doesn't even matter since it's requested. Just open up your network console and filter by "Google". There are numerous requests to Google services, including Google.com and GoogleTagServices.com. >I will once again ask for a scheme by which the header is both useful for tracking or advertising, and isn't used for tracking individual users. Tracking groups of users. >So was this an 8+ year scheme? Even worse. Google had 8 years to adequately disclose to users the DoubleClick tracking or allow them to disable it. To this day, disabling is not possible (not even via config). >Ah, I see, so in the case of multiple logged-out but non-incognito chrome users in the same household, x-client-data could be used to better target ads to specific devices in the household, instead of the household as a whole. That's the "gold" here? Yes, this is why ad networks tend to run fingerprinting scripts. Tracking specific devices is huge. That's partially why the ad industry took a huge hit when Safari cracked down on third-party tracking.