6 ms·

I work with Ad Data a lot in my job, and there's a lot of misconceptions about what this data that journalists love to propogate: The location data in these ne

I work with Ad Data a lot in my job, and there's a lot of misconceptions about what this data that journalists love to propogate: The location data in these networks is very inaccurate. Your OS and browser actually do a pretty good job of locking down your location data unless you give explicit permission. It's in the ad network's interests to lie about the quality of their data - so a lot of the "location" data is going to be a vaguely accurate guess based on your IP address. But also, location data is really important to ads right now because, contrary to common perception, per user tracking is very, very hard. Each SDK might be tattling on you, but unless you give them a key to match you across apps, each signal from each app is unique. Which is why you are often served advertisements based on what other people on your network is searching - it's much easier to just blast everyone at that IP address than it is to find that specific user or device again in the data stream. Bidstream data in particular is very fraught. You're only getting the active data at the point the add is served, but it's not easy to aggregate in any way. You'll be counting the same person separately dozens or hundreds of times with different identifiers for each. The data you get from something like Mobilewalla is not useful for tracking individuals so much as it's useful for finding patterns. I think it's pretty telling from the few examples shared about how agencies actually use the data: >"CBP uses the information to “look for cellphone activity in unusual places,” including unpopulated portions of the US-Mexico border." >According to the Wall Street Journal, the IRS tried to use Venntel’s data to track individual suspects, but gave up when it couldn’t locate its targets in the company’s dataset. >In March 2021, SOCOM told Vice that the purpose of the contract was to “evaluate” the feasibility of using A6 services in an “overseas operating environment,” and that the government was no longer executing the contract Something is going to have to be figured out about this data - realistically the only way is a sunset on customized advertisements. However, I would personally not be worried (yet) that the government is going to be able to identify an individual and track them down using these public sources as they currently are.

ducttape12 8mo ago
Neither the government nor an ad agency needs to know where I am, no matter how "rough" the data is. It's none of their business.
- legitster 8mo ago
  At this point, your device is not giving anyone your location without explicit permission. So it really just comes down to your IP Address, which services do need.
  - golem14 8mo ago
    I think your is statement is inaccurate to the point of being intentionally misleading: Many devices, when running, and in some cases even if turned off but connected to their battery, will ping cell towers (maybe even BLE/Wifi) and get triangulated by the network infrastructure (such as cell towers) without actively broadcasting the GPS location. That's why I don't quite understand why the gubernment needs to have finer grained data (esp around the US/Mexican border). Precision location info would only be needed if you need to track people in densely populated areas.
    - jonas21 8mo ago
      That location information is not available to apps or ad networks without user consent. The government can access it from the carrier with a warrant, but that's not what we're discussing here.
      - techdmn 8mo ago
        Carriers have also sold customer location data, no search warrant required. Though we can rest assured that the FCC has slapped the carriers' wrists with the utmost seriousness.
        lesuorac 8mo ago
        And sold it to not just the government but anybody _claiming_ to be a bounty hunter (and some other professions).
      - tempaccount5050 8mo ago
        Couldn't you just maintain a list of cell tower IPs and figure it out with traceroute?
cm2012 8mo ago
1000% agreed with this
dygd 8mo ago
> Each SDK might be tattling on you, but unless you give them a key to match you across apps, each signal from each app is unique You'd be surprised what can be done when data from different source is fused together. Large-Scale Online Deanonymization with LLMs: https://news.ycombinator.com/item?id=47139716 https://news.ycombinator.com/item?id=47139716 Robust De-anonymization of Large Sparse Datasets: https://www.cs.cornell.edu/~shmat/shmat_oak08netflix.pdf https://www.cs.cornell.edu/~shmat/shmat_oak08netflix.pdf
- sroussey 8mo ago
  There are whole companies that de-anon ad data as a service. Which gives the lots of data brokers the ability to not do the last mile and feel good about themselves. It’s a joke.
- janalsncm 8mo ago
  I remember when the first article was posted. Their method requires two parallel corpuses e.g. people who write on LinkedIn (under their real name) and Reddit. Also, people who post under their real name are likely to write with their real voice: > Any deanonymization setup with ground truth introduces distributional biases. In our cross-platform datasets, the pro-files are likely easier to deanonymize than an average profile: the very fact that ground truth exists implies that the user may not have cared about anonymity in the first place. Similarly, two split-profiles of a single user are inherently alike, whereas two pseudonymous accounts of the same person (e.g., an official and a pseudonymous alt account) might expose more heterogeneous micro-data.
chaps 8mo ago
I worked in ad-tech for a year before I left the tech industry as a whole. I've also done a fair bit of investigative journalism. Let me share a thing: Factual, a company that specializes in hyperlocal geofencing, uses geofencing much smaller than the self-regulation that their industry allows in their own rules. I learned this after a coworker quit because our company was allowing ad targeting to people using these smaller geofences. The whole company had an all-hands about it where the CEO of the company told everyone that we were not going to stop using Factual nor the smaller-than-allowed geofences because we, ourselves, were not the ones to produce those geofences. We were just a man in the middle helping to build a system to track people at high resolution. Please try to reconcile with what your industry has and continues to destroy.
- gruez 8mo ago
  >Please try to reconcile with what your industry has and continues to destroy. I don't see anything contradictory between your comment and the OP. Having an amoral CEO who condones breaking geotargeting self-regulation doesn't contradict OP's claim that it's hard to tie geotargeting data in bidstreams back to a particular person.
  - chaps 8mo ago
    Sure, hard. But, um, lots of things are hard. For example, it was very hard for me to identify myself in an anonymized public dataset of vehicle trips, but I did. It was also hard to FOIA for the documents showing them writing SQL to spot my trip.. but I did. Hard doesn't mean impossible.
    - vvanpo 8mo ago
      It sounds like there is a story here, have you written about this somewhere?
      - chaps 8mo ago
        There definitely is and I've definitely pitched it to places. The Intercept had interest but told me that they wanted me to build the story out more to be less focused on Chicago. I understand where they were coming from (and the others who said the same thing) but it wasn't possible for me to continue doing freelance work, so no stories ended up being published about it at all.
gib444 8mo ago
> unless you give them a key to match you across apps Eg by running standard Android? That doesn't have eg secure app spawning, so apps can profile app initialisation data AIUI And probably 10 other things behind the scenes that GrapheneÓS plugs?
- ece 8mo ago
  Exactly, people are going to be logged into these apps with trackable identifiers. You can see it with tracker control on android, download a new app and see existing apps report things to new trackers, which seems to be happening at the sdk level.
uncletammy 8mo ago
> Each SDK might be tattling on you, but unless you give them a key to match you across apps, each signal from each app is unique Aren't there many examples of these? For example IMEI, IMSI, phone number, etc? Even without "unique" signals, isn't it fairly trivial to identify a user with a handful of "not very unique" signals? User-agent, a few recent IP addresses, browser capabilities, list of installed apps, device operating system properties, etc?

ducttape12 8mo ago

Neither the government nor an ad agency needs to know where I am, no matter how "rough" the data is. It's none of their business.

legitster 8mo ago
At this point, your device is not giving anyone your location without explicit permission. So it really just comes down to your IP Address, which services do need.
- golem14 8mo ago
  I think your is statement is inaccurate to the point of being intentionally misleading: Many devices, when running, and in some cases even if turned off but connected to their battery, will ping cell towers (maybe even BLE/Wifi) and get triangulated by the network infrastructure (such as cell towers) without actively broadcasting the GPS location. That's why I don't quite understand why the gubernment needs to have finer grained data (esp around the US/Mexican border). Precision location info would only be needed if you need to track people in densely populated areas.
  - jonas21 8mo ago
    That location information is not available to apps or ad networks without user consent. The government can access it from the carrier with a warrant, but that's not what we're discussing here.
    - techdmn 8mo ago
      Carriers have also sold customer location data, no search warrant required. Though we can rest assured that the FCC has slapped the carriers' wrists with the utmost seriousness.
      - lesuorac 8mo ago
        And sold it to not just the government but anybody _claiming_ to be a bounty hunter (and some other professions).
    - tempaccount5050 8mo ago
      Couldn't you just maintain a list of cell tower IPs and figure it out with traceroute?

cm2012 8mo ago

1000% agreed with this

dygd 8mo ago

> Each SDK might be tattling on you, but unless you give them a key to match you across apps, each signal from each app is unique You'd be surprised what can be done when data from different source is fused together. Large-Scale Online Deanonymization with LLMs: https://news.ycombinator.com/item?id=47139716 https://news.ycombinator.com/item?id=47139716 Robust De-anonymization of Large Sparse Datasets: https://www.cs.cornell.edu/~shmat/shmat_oak08netflix.pdf https://www.cs.cornell.edu/~shmat/shmat_oak08netflix.pdf

sroussey 8mo ago
There are whole companies that de-anon ad data as a service. Which gives the lots of data brokers the ability to not do the last mile and feel good about themselves. It’s a joke.
janalsncm 8mo ago
I remember when the first article was posted. Their method requires two parallel corpuses e.g. people who write on LinkedIn (under their real name) and Reddit. Also, people who post under their real name are likely to write with their real voice: > Any deanonymization setup with ground truth introduces distributional biases. In our cross-platform datasets, the pro-files are likely easier to deanonymize than an average profile: the very fact that ground truth exists implies that the user may not have cared about anonymity in the first place. Similarly, two split-profiles of a single user are inherently alike, whereas two pseudonymous accounts of the same person (e.g., an official and a pseudonymous alt account) might expose more heterogeneous micro-data.

chaps 8mo ago

I worked in ad-tech for a year before I left the tech industry as a whole. I've also done a fair bit of investigative journalism. Let me share a thing: Factual, a company that specializes in hyperlocal geofencing, uses geofencing much smaller than the self-regulation that their industry allows in their own rules. I learned this after a coworker quit because our company was allowing ad targeting to people using these smaller geofences. The whole company had an all-hands about it where the CEO of the company told everyone that we were not going to stop using Factual nor the smaller-than-allowed geofences because we, ourselves, were not the ones to produce those geofences. We were just a man in the middle helping to build a system to track people at high resolution. Please try to reconcile with what your industry has and continues to destroy.

gruez 8mo ago
>Please try to reconcile with what your industry has and continues to destroy. I don't see anything contradictory between your comment and the OP. Having an amoral CEO who condones breaking geotargeting self-regulation doesn't contradict OP's claim that it's hard to tie geotargeting data in bidstreams back to a particular person.
- chaps 8mo ago
  Sure, hard. But, um, lots of things are hard. For example, it was very hard for me to identify myself in an anonymized public dataset of vehicle trips, but I did. It was also hard to FOIA for the documents showing them writing SQL to spot my trip.. but I did. Hard doesn't mean impossible.
  - vvanpo 8mo ago
    It sounds like there is a story here, have you written about this somewhere?
    - chaps 8mo ago
      There definitely is and I've definitely pitched it to places. The Intercept had interest but told me that they wanted me to build the story out more to be less focused on Chicago. I understand where they were coming from (and the others who said the same thing) but it wasn't possible for me to continue doing freelance work, so no stories ended up being published about it at all.

gib444 8mo ago

> unless you give them a key to match you across apps Eg by running standard Android? That doesn't have eg secure app spawning, so apps can profile app initialisation data AIUI And probably 10 other things behind the scenes that GrapheneÓS plugs?

ece 8mo ago
Exactly, people are going to be logged into these apps with trackable identifiers. You can see it with tracker control on android, download a new app and see existing apps report things to new trackers, which seems to be happening at the sdk level.

uncletammy 8mo ago

> Each SDK might be tattling on you, but unless you give them a key to match you across apps, each signal from each app is unique Aren't there many examples of these? For example IMEI, IMSI, phone number, etc? Even without "unique" signals, isn't it fairly trivial to identify a user with a handful of "not very unique" signals? User-agent, a few recent IP addresses, browser capabilities, list of installed apps, device operating system properties, etc?