Online Behavioral Ads Fuel the Surveillance Industry—Here’s How
by Lena Cohen - Electronic Frontier Foundation
It’s become common knowledge that our personal data is collected, sold, and bought as we use the internet. We often chalk this up to advertising. Ads may feel creepy at times, but isn't that an acceptable tradeoff to access apps and content for free?
Maybe, if serving ads was the only way our data was used. But Lena Cohen at the Electronic Frontier Foundation explains how the "Real Time Bidding" (RTB) process behind targeted ads is exploited to collect personal information for a broader range of purposes:
- The moment you visit a website or app with ad space, it asks a company that runs ad auctions to determine which ads it will display for you. This involves sending information about you and the content you’re viewing to the ad auction company.
- The ad auction company packages all the information they can gather about you into a “bid request” and broadcasts it to thousands of potential advertisers.
- The bid request may contain personal information like your unique advertising ID, location, IP address, device details, interests, and demographic information. The information in bid requests is called “bidstream data” and can easily be linked to real people.
- Advertisers use the personal information in each bid request, along with data profiles they’ve built about you over time, to decide whether to bid on ad space.
- Advertisers, and their ad buying platforms, can store the personal data in the bid request regardless of whether or not they bid on ad space.
Anyone who participates in the auction, even if they don't bid or even plan to place an advertisement, receives all of this personal information. This leads to companies that participate in as many bidding networks as possible to cross-reference and combine data and build out extensive profiles of users:
Mobilewalla collected data on over a billion people, with an estimated 60% sourced directly from RTB auctions. The company then sold this data for a range of invasive purposes, including tracking union organizers, tracking people at Black Lives Matter protests, and compiling home addresses of healthcare employees for recruitment by competing employers. It also categorized people into custom groups for advertisers, such as “pregnant women,” “Hispanic churchgoers,” and “members of the LGBTQ+ community.”
Any data broker that participates in this system can store, consolidate, and sell this information for any purpose outside of advertising:
A global spy tool exposed the locations of billions of people to anyone willing to pay. A Catholic group bought location data about gay dating app users in an effort to out gay priests. A location data broker sold lists of people who attended political protests.
Some sell their tools to governments for mass surveillance. In the U.S., this is used as a workaround for 4th amendment protections. Agencies claim users have inherently consented to their data being sold to law enforcement by nature of using the internet. They use this to access troves of information that would otherwise require a warrant.
There are some steps you can take to better protect yourself. But the most thorough and permanent solution is to ban behavioral advertising all together.