GDPR complaint claims Google and IAB ad category lists leak intimate data

https://techcrunch.com/2019/01/27/google-and-iab-ad-category-lists-show-massive-leakage-of-highly-intimate-data-gdpr-complaint-claims/

by imbiased • 7 years ago

146 67 7 years ago

techcrunch.com

seren2• 7 years ago

I am curious, if you ask for a dump of your data from Google, where do you have to look to find your ad category ? As far I know, this is not directly accessible from your profile or privacy settings.

Looking at the data selection to export, I am not even sure this is included somewhere.

kerng• 7 years ago

Yes, it seems that service providers confuse the "provide a dump of my data" with just being the information a user actively uploaded and stored. The point of this is to get access to any information the service provide might have about the individual requesting the data. And have it all deleted upon request also!

te_chris• 7 years ago

I'm pretty sure GDPR is meant to force disclosure of derived data too.

SquareWheel• 7 years ago

I have ad personalization turned off, but you should be able to view and edit your interests from your settings page.

https://support.google.com/ads/answer/2662856

seren2• 7 years ago

It is mostly empty just my age and sex.

However I am sure I got an interest profile, at least being used with the Discover feed on Android.

Maarten882• 7 years ago

Maybe Google doesn't store it, and just uses these categories in the process of auctioning advertisements, sending them as context?

The problem with that being, of course, that any company participating in the bidding process can decide to store that information and build a profile that does have this information.

m4r35n357• 7 years ago

I think you mean "participating"

londons_explore2• 7 years ago

Bidders don't get as much info as googles internal models get. For example, bidders get to 'track' users by a unique id for up to 30 days, but then the id gets reset, so they can never persist any data beyond that unless they can correlate the new id with the old.

That correlation tends to take weeks worth of data to do with any accuracy, and by that time, all the opportunity to actually use the knowledge to place bids has gone.

The bidders can re-correlate if they actually make a bid, and use a creative to inspect their own cookies, and then resell that ad-spot, but typically that isn't worth it for small bidders (there's just too many devices on the internet - you'd need a huge ad budget), and large bidders are bound by privacy laws that stop them doing it (no investor wants the company the wrong side of an EU fine).

A few bidders used to do that on iOS devices, since the ads there are sufficiently valuable to make it worth it, but I haven't seen it for a few years.

w_t_payne• 7 years ago

Not just Google though, is it?

cyborgx7• 7 years ago

And your point is what exactly?

dessant2• 7 years ago

We should also be able to access our marketing categories without a Google account, since sensitive data is collected and a profile is built even if you don't have a Google account.

mehrdadn3• 7 years ago

I agree but is this a Google specific thing? So many companies gather data on people without letting them see anything... I feel like we need legislation regarding this for all of them.

zaarn• 7 years ago

GDPR already requires all that data access and control even for people that don't have a formal account and haven't agreed to your ToS. No additional legislation in the EU needed.

Mirioron4• 7 years ago

How is legislation going to fix this unless you mandate region locking of the internet? The moment a website loads some script from a Chinese site all bets are off from a legislative protection standpoint.

ndnxhs• 7 years ago

Better yet, google should not be able to store any personal data about users who are not registered

xf00• 7 years ago

I feel like this is another example of something which can only be enforced by creating a new framework that inevitably benefits the few corrupt actors and defeats its own purpose.

est31• 7 years ago

How sure are they that it's one individual person that they are tracking? If you and others use the same computer, then maybe stuff might get mixed up. If "accessing" marketing categories includes read-access then your situation is worse than before.

What about the legal risk for Google if you opted out of the tracking a month ago but now google thinks you are a different person and is tracking you?

giancarlostoro• 7 years ago

There's subtle ways to fingerprint someone, even how they move their mouse:

https://motherboard.vice.com/en_us/article/78k8pz/how-you-mo...

Sir_Substance• 7 years ago

These are indeed tricky problems to solve.

They're also googles problems to solve, not societies. We're not required to provide solutions for them.

If google can't solve them, maybe that means google's business model is illegal.

thrwawaygoogswe• 7 years ago

Throwaway of an ex search engineer here. This can’t work because how would google reliably only give you your information without a login account? They are only useful enough in aggregate to google so they can’t know it is only you with 100% certainty until you log in. AFAICT anyone telling you anything else is probably nonsense fearmongering, or maybe doesn’t understand how sophisticated attackers of google are and hasn’t thought through what happens when you have a logged out way of spoofing someone’s internet behavior to get their whole data.

This is effectively a) putting everyone’s approximate search histories on the internet, or b) outlawing google search’s buisiness model.

The consequences of trying option a and failing even once are so great, I argue if that’s your goal you should ban logged out personalization before anyone deludes themselves into thinking they can do it without leaking everyone’s info publically. I also think that’s going to harm consumers more than it actually helps them but I am obviously biased as an ex google search engineer.

dessant2• 7 years ago

We don't expect relinked data to be viewable, because that is ripe for exploitation, but we do want to access and control the data that is linked to the advertising cookies that were placed on our devices.

onetimemanytime• 7 years ago

I think Google and FB have met their match, EU! Not only penalties but crippling changes to their existing, everything goes, business model. Penalties they can afford...

Tsubasachan• 7 years ago

Advertising and marketing is a trillion dollar industry that employs millions of people across the globe and I want nothing to do with it.

Advertising atheism and I wouldn't be entirely surprised if in the future people will be prosecuted for it.

ckastner• 7 years ago

Key quotes:

Lack of transparency makes it impossible for users to exercise their rights under GDPR. There is no way to verify, correct or delete marketing categories that have been assigned to us, even though we are talking about our personal data.

and

Under GDPR, processing special category [medical information; political affiliation; religious or philosophical views; sexuality; and information revealing racial or ethnic origin] data generally requires explicit consent from users — with only very narrow exceptions, such as for protecting the vital interests of the data subjects

The last quote is particularly troublesome, as Article 9 GDPR [1] is explicit about this: processing this data is prohibited by default, and none of the exemptions seem to apply even by a stretch of imagination.

Assigning such labels may be the norm from the Ad industry's point of view, but that is simply no longer possible under the GDPR.

[1] https://gdpr-info.eu/art-9-gdpr/

a_imho• 7 years ago

Google is the elephant, but it is very rare to see compliant services/sites. The interesting question is when/if EU is going to flex its GDPR muscles.

Mirioron4• 7 years ago

Never. This is used as another tool to selectively target companies the EU doesn't like while maintaining appearances.

detaro• 7 years ago

Germany (well, German states actually) alone has handed out fines to 41 companies, and has hundreds of proceedings in flight (i.e. one German state is currently investigating 50 local companies), the vast majority against locals. The average cases just don't make headlines, especially not in english-speaking media, because who cares?

throw2016• 7 years ago

It just gets creepier and creepier and to think there are hundreds of thousands of people involved in this sordid endeavour who think nothing of and stalking, profiling and dehumanizing others for personal gain.

More evidence there is zero moral compass in SV and given enough money people are willing to do whatever away from public view and posture and pretend to care about niceties like ethics in public. And these are educated folks who are not starving and desperate.

Discussions should move from a default human base ethical position to any discussion about ethics is posturing and empty, its only by actions that any sense of ethics can be gleaned.

But people who behave unethically cannot then expect an ethical society or ethical behavior from others. These others too have a right to exchange their values for money and attempt to normalize, redefine or hand wave away their actions.

chronotis2• 7 years ago

Setting aside penalties for a moment, what is the minimum set of changes to programmatic advertising practices that would bring it into compliance with GDPR? Would removing the targeting categories that relate to intimate data be sufficient? Or is something deeper, more structural in the crosshairs?

mrweasel3• 7 years ago

I by no means and expert on the subject, but I believe that the "simplest" change would be to target based on content, rather than the individual user.

chronotis2• 7 years ago

Yes, but that's also a torpedo to the way programmatic ads are currently bought and sold. (FWIW I am in favor of such a change, but there are a lot of very large tech companies selling data management platforms whose core value prop is being able to stitch together audiences from this sort of data and precisely target them everywhere their browser cookie or device ID goes.)

kasey_junk2• 7 years ago

The ad categories mentioned in this complaint are the content categories.

C4stor• 7 years ago

Remove userid / cookie sync / whatever you name it from bid requests, and make them only context based. Also, forbid cookies from ads providers to be stored on the end user machine.

Note that this doesn't disallow websites with first party data and user consent to add user related information to the bid requests to increase their value, it just doesn't allow to correlate the information with a person after the RTB process ends. Of course it totally changes the role of data providers in the current ecosystem, but that wouldn't necessarily be a bad thing.

BlackFly• 7 years ago

Offer users a meaningful reason to actually consent to such targeting. Current "consent" forms are not meaningful in that most users are probably clicking "ok" just to get rid of the pop up and not because they actually agree.

Why would users actually provide meaningful consent to having a tracking profile? You need to actually offer something to users. The law essentially says you cannot just start profiling them without their permission.

You could offer users a subscription based ad free browsing experience. User pays 50 euro a year, you take a 10% margin, leaving 45 euro behind to provide the ad free experience. At 164 impressions per day (stretched inference from the article) you bid 0.075 cents per ad space. If an ordinary advertiser bids less then this to show you an ad, then no ad would be shown instead and the content publisher would still get paid. At any time you could cancel your subscription and demand that the profile be deleted. This is just one idea on how you could collect meaningful consent for an ad profile.

nopriorarrests• 7 years ago

I'm familiar with RTB (real-time bidding protocol) details, so I can assess this from the technical POV.

Most ironical thing here -- IAB categories applied not to user profiles but to URL's.

So, their goal is to facilitate ads targeting not to user profile, but to page content. This is the use case which is often discussed on HN as ethical and "right" way of showing ads -- you get the bid request with "Nature, travel" IAB categories and you show ad about outdoor gear. You don't need to crunch user data to make this simple decision.

However, I have to admit this complaint has it's own merit. Bid request usually contains not just page URL and IAB categories, but user cookie as well. So, by data-mining bidstream, you can theoretically find people (well, at least their unique cookies) who are looking for a cure for impotence, and this is against GDPR, for sure.

manigandham4• 7 years ago

These categories apply to the content, not the cookie (when a cookie is even available which it isnt in many places).

This is not personal, it's the contextual targeting everyone wants. These blog posts never understand adtech.

JulianWasTaken3• 7 years ago

The point is that bid requests may (do) contain both an identifier and data about that person. "Is reading a financial news article" being an attribute of the content, sure, but broadcast such that it can be associated with the person.

manigandham4• 7 years ago

That's just how context works. If you visit another site then there would be different categories involved and has nothing to do with the user.

There's also no personal identity, it's just a cookie if available, used mostly to frequency cap.

mancerayder• 7 years ago

Here’s a few more highly sensitive labels that are being attached to web users’ identities and shared with potentially thousands of bidding ad companies — in this case the labels are ones which the IAB uses: Special needs kids, endocrine and metabolic diseases, birth control, infertility, diabetes, Islam, Judaism, disabled sports, bankruptcy.

I'm jealous that at least Europeans can complain legally.

In the U.S., we believe that the free market knows best and that's freedom and such. Meanwhile, we're being profiled by these vile companies (FB, Google) and our data resold. Aside from individual rights being violated (hint, individual rights aren't just rights against government intervention), there's a huge societal threat here: what happens when this data is used to pit us against one another? Are we still free, then?

In the U.S. it will take a cataclysmic event to reach a GDPR-like desire by the population. The sad reality is that the EU has its citizens' interests generally in mind (consumer protections, GDPR), while in the U.S. Big Brother has the interests of large corporations at heart (namely by allowing them to run roughshod over our rights).

GDPR complaint claims Google and IAB ad category lists leak intimate data

Related Stories