8 ms·
It'd be useful if the author revealed how she managed to obtain her data. I am pretty sure that a request with just your real name wouldn't reveal much. I assum
by chopin 6y ago
It'd be useful if the author revealed how she managed to obtain her data. I am pretty sure that a request with just your real name wouldn't reveal much. I assume that most data is collected under some identifier which isn't matched to your real name in order to thwart this kind of request.
- wlll 6y agoI'd also like to know this. It seems like asking this organisation to delete my data would be largely beneficial, but what data do I need to provide for them to do it?
- lmkg 6y agoAccording to GDPR, the contact info for sending an access or deletion request must be provided in the Privacy Policy. Under GDPR (Europe), if you send a request, the company must honor it unless they have reason to doubt your identity, in which case they must ask for follow-up. Under CCPA (California), they are only obligated to honor "verified" requests. There's a range of what counts as verifying, from just being able to log in to your account on the low end, up to providing 3 pieces of matching data on the high end. The company is obligated to tell you what data they have. They are not obligated to go out of their way to make connections, though, so you're better served by providing as many identifiers as possible (like account numbers).
- WoefullyInept 6y agoIt's really not. What do you think they'll do with a cookie id associated to a few events?
- wlll 6y agoApparently it's thousands of events, at least according to the linked article.
- ma2rten 6y agoIf they got data from MasterCard and Experian, they must know the her real name.
- WoefullyInept 6y agoThis is explicitly false. Mastercard or Experian might know her name but this would not be shared for an audience. Its simply cookie123 is in audience456.
- fitzrocks 6y agoThis is the correct answer. It's done by cookie matching. Source: I worked on these products at Quantcast.
- ma2rten 6y agoThanks for clarifying that. I had no idea that Credit Card companies even that information about cookies. Many people (especially on HN) think that this kind of data collection is unethical. How do you feel about that and did you like working on it?
- fitzrocks 6y agoIt's a sizable revenue stream for the payment networks, credit bureaus, Tivo/Roku, and others you wouldn't even think of. When a cashier asks you for your zip code or phone number in the store, that's two ways used to tie the purchase back to your identity. I did enjoy my time at Quantcast. The dataset is used for more than targeting advertising. For example, Quantcast's offers a free analytics product that uses the same dataset. I am conflicted, and my view on data collection more broadly is more nuanced than what's in this comment. For this kind of data collection specifically: On one hand, it's how the entire publishing industry has built their revenue model. And I like news, sports, content, etc. On the other hand, it's creepy for a 3rd-party service that I've never heard of or interacted with being able to infer traits about me based on my browsing patterns, and then sell targeted advertising to yet another company I've never interacted with. I use an adblocker specifically for this reason, despite running an analytics startup.
- s_dev 6y ago>I am pretty sure that a request with just your real name wouldn't reveal much. It's enough to email from the address thats associated with the account. Generally speaking.
- dexterdog 6y agoOne more reason to make sure your email account is not compromised in any way. I have many emails associated with my 'profile'. If one of those is compromised somebody could potentially request all of my data. Requests for information should only be fulfilled with a notarized identification verification. The potential for security breaches here is massive.
- chrisweekly 6y agoYes, this. Collecting my data would bother me somewhat less if it weren't also so freely distributed.
- chopin 6y agoI don't have an account with Quantcast. That's the whole point.
- monkeydust 6y agoAlso wondering this, if there is a boiler plate template we can use I will send it straight away to Quantcast.
- throwaway8443 6y agoI actually e-mailed to the author a year ago to ask that very question. Her answer was that she provided her cookie ID to Quantcast and then asked for any data associated with that ID. She also promised me to include that information in the article to prevent confusion, but she never did. Ironically, Quantcast only knew her real identity after the request.
- hadrien01 6y agoHow do you get your cookie ID?
- WoefullyInept 6y agoThis is why I cringe when I read articles like this. To Quantcast she was just a cookie with some events that ultimately indicated she might like x and has shown interest in buying y.
- sroussey 6y agoA cookie to take to live ramp and they tell you all the other “anonymous” ids you have, including those that can identify you. Which is how ads follow across devices, for example. But can be used for any purpose.
- wasmitnetzen 6y agoThere is a form[1] linked in their privacy policy[2], which doesn't work and tells me I'm not inside the EU or California, which I am. [1]: https://www.quantcast.com/privacy/data-subject-rights/ https://www.quantcast.com/privacy/data-subject-rights/ [2]: https://www.quantcast.com/privacy/ https://www.quantcast.com/privacy/
- deleted 6y ago[deleted]
- megous 6y agoThe same for me. I'm in the middle of EU, lol. Tracking company can't (will not?) track locations to at least hit the continent correctly.
- nerevarthelame 6y agoSend an email to the address specified (privacy@quantcast.com) with your information and what you're trying to accomplish (typically either a disclosure of what personal information they have on you, or erasure of any said information). They will almost certainly satisfy your request (even if you don't truly live in California or the EU) because there are significant regulatory repercussions for not responding to legitimate requests. Or at least that's how it works at the big company I work for.
- hansvm 6y ago
- x0x0 6y agoThe data quantcast collects and stores is associated with cookies in the browser. Generally, you would have to visit their site to allow their code to query the data associated with their domain from your browser.
- crawlcrawler 6y agoWhat to me _seems_ to be much more likely though is that multiple cookies are connected to a classification ID that multiple other users may also be connected to and that to identify your PII within their system you'll need to provide your user name.
- sroussey 6y agoA third party is used for that so everyone thinks they are legit.
- ClikeX 6y agoI usually just email the company from the same email adress that is in my account. Just say that by GDPR guidelines you would like to see your data. I've only done this for deletion of data by the way.
- dylan604 6y agoIn your request, let them know that you are specifically wanting to see what data they have that needs to be updated/corrected. Let them know that the ads you are getting are currently not working, and you are only wanting to help them fix the problem.
- sroussey 6y agoIt’s a pain, but we are automating it. You can signup at https://www.privicy.com/privicypal/about https://www.privicy.com/privicypal/about
- crawlcrawler 6y agoIs this comment and that website [0] sarcasm? What exactly are you automating? The theft of my PII or the opposite? On this matter your privacy policy[1] confuse me. Sorry if I'm being a daft punk. [0] https://www.privicy.com https://www.privicy.com [1] https://www.privicy.com/legal/privacy-policy https://www.privicy.com/legal/privacy-policy
- drewmol 6y ago>The theft of my PII or the opposite? Please consider referring to it as spying over theft and PII about you, as opposed to your PII? Part of the server logs may be about you but are not yours per say.
- deleted 6y ago[deleted]
- sroussey 6y agoYeah, that’s a grey area actually. It’s why Google Analytics has the option of chopping off the last byte of IP addresses, for example. Better to assume all PII and PI even if not identifying, belongs to the user. GDPR is explicit on some of this and not on others. Shared information, or that deemed necessary, won’t be deleted on request for say Uber/Lyft. There is a financial transaction and a driver etc, they won’t delete. They could sever the link to your profile though. Facebook offers something like this, but don’t do it. You will never be able to authenticate yourself again, and they will keep building the “anonymous” profile. It’s complicated for users out there...
- drewmol 6y ago>Better to assume all PII and PI even if not identifying, belongs to the user. I agree from a liability standpoint, from a company's perspective. From a user perspective, better to assume all information that can be captured will be, it will eventually be available to all humanity and it doesn't belong to you.
- deleted 6y ago[deleted]