5 ms·

Who's selling the data is the far more serious issue here. Behind this is a remarkably well-structured syndicate. The supply chain looks something like this: co

Who's selling the data is the far more serious issue here. Behind this is a remarkably well-structured syndicate. The supply chain looks something like this: consumer apps embed ad SDKs → those SDKs feed location signals into RTB ad exchanges → surveillance-oriented firms sit in the RTB pipeline and harvest bid request data even without winning auctions → that data flows to aggregators who don't have any direct relationship with consumers → and from there it's sold to government agencies, among others. The genius of this structure is that accountability dissolves at every layer. Each intermediary can claim they're just passing along "commercially available data." Nobody verifies whether consumers actually consented to their location data being collected and resold. The consent verification is always someone else's job. The real problem is that this data is buyable at all, by anyone, through an opaque multi-layered supply chain specifically designed so that no single entity bears responsibility for the end result.

SoftTalker 7mo ago
There probably was a consent, buried on page 12 in the terms of use of the app they installed at the front of your chain.
- ranger_danger 7mo ago
  I think that practice should be illegal... they know nobody reads those. Even the "reasonable person" standard for court would probably conclude that most people would never read it.
wittyusername 7mo ago
I find myself uninstalling every app unless I really need it and use it. It's amazing how many apps just sit around in your life over time. get them off your phone
- WarOnPrivacy 7mo ago
  I do this. I also block the ad ecosystems on the device (root, adaway).
- cdrnsf 7mo ago
  I do this as well — I also have DNS level blocking via a NextDNS profile and prefer PWAs if possible.
- aceazzameen 7mo ago
  Same here. I use Firefox for everything, and uninstall all the junk via adb. Also low power mode not only for battery efficiency, but to prevent most background services from running.
- dylan604 7mo ago
  The greatest part of reading HN is finding out that my distrust of apps and their developers is not weird. It does make me question my abilities as a dev for refusing to partake in these reindeer games. Clearly, I am not the right type of person to do well in big tech.
  - autoexec 7mo ago
    The problem is that it is weird. It's the smart/right thing to do, but countless people mindlessly install whatever they're told to install or whatever looks fun. We hand mobile devices over to children who have no idea why they shouldn't, but honestly many adults are just as ignorant and trusting. Most people I've spoken with are either thinking "Apple/Google/Government would never allow apps to do something like that!" or they think "Everyone is already doing it so why bother trying to fight it. I'd only be inconveniencing myself for nothing"
- hnburnsy 7mo ago
  > I find myself uninstalling every app unless I really need it and use it. It's amazing how many apps just sit around in your life over time. get them off your phone That's the thing they don't just sit around, they all have run at start up and for Android I blame Google for not giving users the ability to block run at start up.
- fn-mote 7mo ago
  I’m not opening it… can it do anything on iOS?
- anonzzzies 7mo ago
  I am mostly back to my phone being with ironfox and using it for everything instead of apps. My bank works fine with it still and so far no issues with other things I need.
nullcathedral 7mo ago
I wouldn't be surprised if we saw a headline in a few years when we find out other actors (e.g. China, Russia) have been buying this data en-masse too.
- wmf 7mo ago
  The CIA buys this data to track Putin's chef so of course China and Russia are doing the same to us.
  - WarOnPrivacy 7mo ago
    I'd much rather be tracked by China than by anything at all with a USA presence. As if I had a choice. As if politicians of any party care now, in a meaningful way. As if news orgs were ever interested in security experts who sounded the klaxons (for years and years and years).
  - ranger_danger 7mo ago
    Do you have a source for this claim?
    - wmf 7mo ago
      https://www.wired.com/story/how-pentagon-learned-targeted-ads-to-find-targets-and-vladimir-putin/ https://www.wired.com/story/how-pentagon-learned-targeted-ad...
lmeyerov 7mo ago
Apple and Google are facilitating the data sales Specifically, these big companies revenue share with app companies who in turn increase monetization via selling your private information, esp via free apps. In exchange for Apple etc super high app store rake percentage fees, they claim to run security vetting programs and ToS that vet who they do business with and tell users & courts that things are safe, even when they know they're not. It's not rocket science for phone OS's to figure out who these companies are and, as iOS / android os users already get tracked by apple/google/etc, triangulate to which apps are participating
- adrr 7mo ago
  If I have a free app that hits location services on the device and I sell this data, how does Apple and Google make money from me?
  - lmeyerov 7mo ago
    [dead]
- quantified 7mo ago
  And Facebook/Meta. Their trackers are everywhere.
  - autoexec 7mo ago
    cloudflare is more everywhere than facebook
    - hedora 7mo ago
      Yeah, but unlike facebook, they weren't just caught making videos of people having sex then paying people to watch the videos. Also, unlike facebook, they also weren't just caught running a dark money lobbyist network with the goal of forcing more collection of minors' private information.
      - 7mo ago
lateforwork 7mo ago
[dead]
AndrewKemendo 7mo ago
And it’s working precisely as designed For example you can have a truthful statement: “all of the apps that you have are constantly spying on you” And the rejoinder is “ any given app is not specifically selling my data to specifically the FBI and so therefore it is not spying” To which the response would be: “that is correct however the aggregate data is bundled and sold off to specifically the FBI or intelligence agencies and so there cannot be a logical differentiation between apps.” By that point the person has downloaded another rewards app and added their drivers license to it.
hobs 7mo ago
We can hold both accountable actually, its a workaround of our fourth amendment rights and also it should be illegal to do this for the companies involved.
- autoexec 7mo ago
  Explicitly outlawing the practice is good, but since they've already been participating in the violation of our rights and knowingly profiting from it there should be consequences. I'd be perfectly fine with going after companies that sell data to the government, but I don't think it would be fair to go after companies who were forced to hand data over unwillingly, even if they didn't inform the public it was going on out of fear of reproductions.
redmattred 7mo ago
Not sure about now, but geolocation data used to be available for purchase from: https://en.wikipedia.org/wiki/Skyhook_Wireless https://en.wikipedia.org/wiki/Skyhook_Wireless
cameldrv 7mo ago
The RTB thing has been around for over a decade at this point. What I’m not sure about is what’s being sold by car companies. I know they sell the data to insurance companies. I’m curious if the government can manage to get it as well commercially.
- sillystuff 7mo ago
  > What I’m not sure about is what’s being sold by car companies... if the government can manage to get it as well commercially. General Motors sold driving data to data brokers including LexisNexus. Anyone, private or government can buy data from LexisNexus.
samrus 7mo ago
I think the pipeline needs to be plugged at both ends. We shouldnt allow this data to be sold without express consent. And we shouldnt allow the government to purchase this sort of data regardless of consent, protected under the 4th amendment. unless, iguess, express consent is given to be used by the government for investigative purposes, which no one would give since they dont have to under the 5th amendment
- deleted 7mo ago
  [deleted]
- robotnikman 7mo ago
  I think the user should be paid for the data that is being gathered up. If we want a source of UBI for the future where AI is replacing every job, well here is a potential source to fund it.
  - autoexec 7mo ago
    dynamic/discriminatory pricing driven by AI leveraging all this data would just ensure that any money people got from UBI was funneled into the pockets of corporations anyway.
- analog31 7mo ago
  I think sale and purchase are too hard to police. Possession of data should be illegal, with a level of statutory damages that invites litigation.
- dylan604 7mo ago
  > And we shouldnt allow the government to purchase this sort of data regardless of consent Fine, we'll force companies to allow a small little box to be added to their data center. Don't worry about what it does, but you cannot disconnect network/power to it once it is installed. Once it is operational, you'll no longer need to think about it ever again, and we recommend that you don't. You should also not talk about this box to users/customers/clients. In fact, you'd be better off if you didn't talk to your employees about it either.
jacquesm 7mo ago
That's a very accurate summary. That stupid game you installed a year ago, that's what gets you. If you have a smartphone keep a very sharp eye on your location services, and whether they're in the state you expect them to be in. Also a great way to save your battery.
pocksuppet 7mo ago
All of it is legal, and incentivised. Is it any surprise?
- lmeyerov 7mo ago
  *legal in the US
- autoexec 7mo ago
  US companies don't even care if something is illegal as long as they know the slap on the wrist they get will be a small fraction of they money they made with crime. Most of the time the US government just wants a cut of the action. Google alone has spent billions in fines.
autoexec 7mo ago
> Who's selling the data is the far more serious issue here. Everyone who has it is selling that info, and nearly everyone who collects it is selling it. Until there are laws that actually protect us, we should stop giving companies our location data every chance we get and push for laws that prevent it from being unnecessarily collected in the first place.
- roysting 7mo ago
  "FBI is buying location data to track US citizens" ... "Until there are laws that actually protect us" I don't see how we overcome that massive hurdle. It's not like those who ostensibly make the laws don't know and approve, and probably intentionally implemented that. We now have full scale mass tracking and surveillance of the kind no one pre-9/11 would believe would have been allowed to exist in the form of the Flock cameras (of course it was an enemy Brit implementing surveillance in the USA) making anonymity quite literally as challenging as Winston Smith trying to move around without being detected to meet his love interest. How are we going to get the de facto tyrants in the government to pass laws that materially disempower them by being unable to mass surveil everyone at any given time if they don't like what you are saying or thinking? The problem with all the naysayers for all those decades is that once you have given up control over your own life and you have given away your rights protected by the Constitution, your enemies in the government are unlikely to simply give them back because you ask nicely. In fact, they will most likely aggressively move against anyone that even suggests that you nicely ask for your rights back.
  - autoexec 7mo ago
    > It's not like those who ostensibly make the laws don't know and approve, and probably intentionally implemented that. In theory we should have to power to vote out those lawmakers and elect new ones who will pass the laws we want enacted and uphold the constitution. If we no longer have that power the founding fathers were pretty open about what was expected from us, but it isn't pretty.
AngryData 7mo ago
I don't think either issue is above one or another. Its problematic to build such databases, and it is problematic that the government is buying these services despite being forbidden from doing it themselves. Being able to buy it is a huge loophole and they all know it is a loophole and is breaking the spirit of the law. Its like saying murder is illegal but hiring a hitman perfectly legal. Its bullshit and everyone involved in these decisions should be in jail. There is no way anybody working for the FBI can claim ignorance to the constitution.

SoftTalker 7mo ago

There probably was a consent, buried on page 12 in the terms of use of the app they installed at the front of your chain.

ranger_danger 7mo ago
I think that practice should be illegal... they know nobody reads those. Even the "reasonable person" standard for court would probably conclude that most people would never read it.

wittyusername 7mo ago

I find myself uninstalling every app unless I really need it and use it. It's amazing how many apps just sit around in your life over time. get them off your phone

WarOnPrivacy 7mo ago
I do this. I also block the ad ecosystems on the device (root, adaway).
cdrnsf 7mo ago
I do this as well — I also have DNS level blocking via a NextDNS profile and prefer PWAs if possible.
aceazzameen 7mo ago
Same here. I use Firefox for everything, and uninstall all the junk via adb. Also low power mode not only for battery efficiency, but to prevent most background services from running.
dylan604 7mo ago
The greatest part of reading HN is finding out that my distrust of apps and their developers is not weird. It does make me question my abilities as a dev for refusing to partake in these reindeer games. Clearly, I am not the right type of person to do well in big tech.
- autoexec 7mo ago
  The problem is that it is weird. It's the smart/right thing to do, but countless people mindlessly install whatever they're told to install or whatever looks fun. We hand mobile devices over to children who have no idea why they shouldn't, but honestly many adults are just as ignorant and trusting. Most people I've spoken with are either thinking "Apple/Google/Government would never allow apps to do something like that!" or they think "Everyone is already doing it so why bother trying to fight it. I'd only be inconveniencing myself for nothing"
hnburnsy 7mo ago
> I find myself uninstalling every app unless I really need it and use it. It's amazing how many apps just sit around in your life over time. get them off your phone That's the thing they don't just sit around, they all have run at start up and for Android I blame Google for not giving users the ability to block run at start up.
fn-mote 7mo ago
I’m not opening it… can it do anything on iOS?
anonzzzies 7mo ago
I am mostly back to my phone being with ironfox and using it for everything instead of apps. My bank works fine with it still and so far no issues with other things I need.

nullcathedral 7mo ago

I wouldn't be surprised if we saw a headline in a few years when we find out other actors (e.g. China, Russia) have been buying this data en-masse too.

wmf 7mo ago
The CIA buys this data to track Putin's chef so of course China and Russia are doing the same to us.
- WarOnPrivacy 7mo ago
  I'd much rather be tracked by China than by anything at all with a USA presence. As if I had a choice. As if politicians of any party care now, in a meaningful way. As if news orgs were ever interested in security experts who sounded the klaxons (for years and years and years).
- ranger_danger 7mo ago
  Do you have a source for this claim?
  - wmf 7mo ago
    https://www.wired.com/story/how-pentagon-learned-targeted-ads-to-find-targets-and-vladimir-putin/ https://www.wired.com/story/how-pentagon-learned-targeted-ad...

lmeyerov 7mo ago

Apple and Google are facilitating the data sales Specifically, these big companies revenue share with app companies who in turn increase monetization via selling your private information, esp via free apps. In exchange for Apple etc super high app store rake percentage fees, they claim to run security vetting programs and ToS that vet who they do business with and tell users & courts that things are safe, even when they know they're not. It's not rocket science for phone OS's to figure out who these companies are and, as iOS / android os users already get tracked by apple/google/etc, triangulate to which apps are participating

adrr 7mo ago
If I have a free app that hits location services on the device and I sell this data, how does Apple and Google make money from me?
- lmeyerov 7mo ago
  [dead]
quantified 7mo ago
And Facebook/Meta. Their trackers are everywhere.
- autoexec 7mo ago
  cloudflare is more everywhere than facebook
  - hedora 7mo ago
    Yeah, but unlike facebook, they weren't just caught making videos of people having sex then paying people to watch the videos. Also, unlike facebook, they also weren't just caught running a dark money lobbyist network with the goal of forcing more collection of minors' private information.
    - 7mo ago

lateforwork 7mo ago

[dead]

AndrewKemendo 7mo ago

And it’s working precisely as designed For example you can have a truthful statement: “all of the apps that you have are constantly spying on you” And the rejoinder is “ any given app is not specifically selling my data to specifically the FBI and so therefore it is not spying” To which the response would be: “that is correct however the aggregate data is bundled and sold off to specifically the FBI or intelligence agencies and so there cannot be a logical differentiation between apps.” By that point the person has downloaded another rewards app and added their drivers license to it.

hobs 7mo ago

We can hold both accountable actually, its a workaround of our fourth amendment rights and also it should be illegal to do this for the companies involved.

autoexec 7mo ago
Explicitly outlawing the practice is good, but since they've already been participating in the violation of our rights and knowingly profiting from it there should be consequences. I'd be perfectly fine with going after companies that sell data to the government, but I don't think it would be fair to go after companies who were forced to hand data over unwillingly, even if they didn't inform the public it was going on out of fear of reproductions.

redmattred 7mo ago

Not sure about now, but geolocation data used to be available for purchase from: https://en.wikipedia.org/wiki/Skyhook_Wireless https://en.wikipedia.org/wiki/Skyhook_Wireless

cameldrv 7mo ago

The RTB thing has been around for over a decade at this point. What I’m not sure about is what’s being sold by car companies. I know they sell the data to insurance companies. I’m curious if the government can manage to get it as well commercially.

sillystuff 7mo ago
> What I’m not sure about is what’s being sold by car companies... if the government can manage to get it as well commercially. General Motors sold driving data to data brokers including LexisNexus. Anyone, private or government can buy data from LexisNexus.

samrus 7mo ago

I think the pipeline needs to be plugged at both ends. We shouldnt allow this data to be sold without express consent. And we shouldnt allow the government to purchase this sort of data regardless of consent, protected under the 4th amendment. unless, iguess, express consent is given to be used by the government for investigative purposes, which no one would give since they dont have to under the 5th amendment

deleted 7mo ago
[deleted]
robotnikman 7mo ago
I think the user should be paid for the data that is being gathered up. If we want a source of UBI for the future where AI is replacing every job, well here is a potential source to fund it.
- autoexec 7mo ago
  dynamic/discriminatory pricing driven by AI leveraging all this data would just ensure that any money people got from UBI was funneled into the pockets of corporations anyway.
analog31 7mo ago
I think sale and purchase are too hard to police. Possession of data should be illegal, with a level of statutory damages that invites litigation.
dylan604 7mo ago
> And we shouldnt allow the government to purchase this sort of data regardless of consent Fine, we'll force companies to allow a small little box to be added to their data center. Don't worry about what it does, but you cannot disconnect network/power to it once it is installed. Once it is operational, you'll no longer need to think about it ever again, and we recommend that you don't. You should also not talk about this box to users/customers/clients. In fact, you'd be better off if you didn't talk to your employees about it either.

jacquesm 7mo ago

That's a very accurate summary. That stupid game you installed a year ago, that's what gets you. If you have a smartphone keep a very sharp eye on your location services, and whether they're in the state you expect them to be in. Also a great way to save your battery.

pocksuppet 7mo ago

All of it is legal, and incentivised. Is it any surprise?

lmeyerov 7mo ago
*legal in the US
autoexec 7mo ago
US companies don't even care if something is illegal as long as they know the slap on the wrist they get will be a small fraction of they money they made with crime. Most of the time the US government just wants a cut of the action. Google alone has spent billions in fines.

autoexec 7mo ago

> Who's selling the data is the far more serious issue here. Everyone who has it is selling that info, and nearly everyone who collects it is selling it. Until there are laws that actually protect us, we should stop giving companies our location data every chance we get and push for laws that prevent it from being unnecessarily collected in the first place.

roysting 7mo ago
"FBI is buying location data to track US citizens" ... "Until there are laws that actually protect us" I don't see how we overcome that massive hurdle. It's not like those who ostensibly make the laws don't know and approve, and probably intentionally implemented that. We now have full scale mass tracking and surveillance of the kind no one pre-9/11 would believe would have been allowed to exist in the form of the Flock cameras (of course it was an enemy Brit implementing surveillance in the USA) making anonymity quite literally as challenging as Winston Smith trying to move around without being detected to meet his love interest. How are we going to get the de facto tyrants in the government to pass laws that materially disempower them by being unable to mass surveil everyone at any given time if they don't like what you are saying or thinking? The problem with all the naysayers for all those decades is that once you have given up control over your own life and you have given away your rights protected by the Constitution, your enemies in the government are unlikely to simply give them back because you ask nicely. In fact, they will most likely aggressively move against anyone that even suggests that you nicely ask for your rights back.
- autoexec 7mo ago
  > It's not like those who ostensibly make the laws don't know and approve, and probably intentionally implemented that. In theory we should have to power to vote out those lawmakers and elect new ones who will pass the laws we want enacted and uphold the constitution. If we no longer have that power the founding fathers were pretty open about what was expected from us, but it isn't pretty.

AngryData 7mo ago

I don't think either issue is above one or another. Its problematic to build such databases, and it is problematic that the government is buying these services despite being forbidden from doing it themselves. Being able to buy it is a huge loophole and they all know it is a loophole and is breaking the spirit of the law. Its like saying murder is illegal but hiring a hitman perfectly legal. Its bullshit and everyone involved in these decisions should be in jail. There is no way anybody working for the FBI can claim ignorance to the constitution.