I left the ad industry because of data tracking • Hacker News Board

Re: I left the ad industry because of data tracking

#21

Post by icebraining » Fri, Jun 07, 2019, 10:47 AM UTC

luckylion wrote: post #15

icebraining wrote: post #9

Earlier quoted context omitted.

Unless the site is only available to German users, you should be able to file a complain with any of EU member state regulators, and not all are so timid as that. NOYB, the non-profit org founded by Max Schrems, has already been filing complaints with the French, Austrian, Belgian and German authorities: https://noyb.eu/

> Unless the site is only available to German users, you should be able to file a complain with any of EU member state regulators, and not all are so timid as that. You can, but they will forward that to the applicable authority, which will be the local German one for German sites.

On what do you base this? Facebook is registered in Ireland, yet multiple EU authorities have fined them.

Re: I left the ad industry because of data tracking

#22

Post by everdrive » Fri, Jun 07, 2019, 10:50 AM UTC

otabdeveloper3 wrote: post #20

user17843 wrote: post #12

I have yet to see a real whistleblower report by someone deep into the ad industry revealing whats really going on there. There are almost no details about what's really happening on a technical level (beyond the little things we already know), and whether large data sets are abused in the sense that they get routinely de-anonymised.

There's nothing to whistleblow. Advertising is applied sociology. As such, advertisers want to aggregate large data sets into large segments that are easy to manipulate statistically. (Where the central limit theorem starts working.) There is no demand for personal data or de-anonymization because that stuff doesn't sell. The personal data collection is done by Google, Facebook at al not for advertising purposes. The…

I think in some circles the meaning of the term "whistle-blowing" has drifted enough that people use it interchangeably with "reveal."

Given your 15 years of experience, what resources do you recommend to HN so that we can learn more? Can you give us a "life of an advertising bit," eg: A person visits a website on their phone, that information is accompanied by x data on their phone, goes to the initial ad server, this information is compiled against data from sources a,b,c, etc ...

Re: I left the ad industry because of data tracking

#23

Post by user17843 » Fri, Jun 07, 2019, 10:51 AM UTC

otabdeveloper3 wrote: post #20

user17843 wrote: post #12

I have yet to see a real whistleblower report by someone deep into the ad industry revealing whats really going on there. There are almost no details about what's really happening on a technical level (beyond the little things we already know), and whether large data sets are abused in the sense that they get routinely de-anonymised.

There's nothing to whistleblow. Advertising is applied sociology. As such, advertisers want to aggregate large data sets into large segments that are easy to manipulate statistically. (Where the central limit theorem starts working.) There is no demand for personal data or de-anonymization because that stuff doesn't sell. The personal data collection is done by Google, Facebook at al not for advertising purposes. The…

My question to someone from the ad-industry would be if there are known "intersections" between these anonymised data sets ad-tech is using to sell as much as possible, and companies who buy these data-sets to connect them to real identities.

Especially because the web is full of Privacy notices people agree to, and I guess in some of those people actually agree to have their anonymous browsing data connected to their real identities.

Re: I left the ad industry because of data tracking

#24

Post by ramraj07 » Fri, Jun 07, 2019, 10:55 AM UTC

user17843 wrote: post #12

I have yet to see a real whistleblower report by someone deep into the ad industry revealing whats really going on there. There are almost no details about what's really happening on a technical level (beyond the little things we already know), and whether large data sets are abused in the sense that they get routinely de-anonymised.

This comes from discussions and lectures from people working on engineering in some ad aggregstors - at least one said that in the end, they have a table with 300 million IDs for each person in the country and they key all the data they can link to that person with this id. In principle this data is annonymized. But does that make a difference? At least in health care people worry about hipaa and do audits to minimize reidentification risk but I'm not sure if adtech companies do anything like that. So yes, a good data scientist can find any person they want from the data but even otherwise I think these companies can work on a fairly meaningless definition of annonymization to get away with all this crap.

Re: I left the ad industry because of data tracking

#25

Post by Aromasin » Fri, Jun 07, 2019, 10:56 AM UTC

zed88 wrote: post #13

user17843 wrote: post #10

Earlier quoted context omitted.

> it even automatically saved the identified user's profile pic from facebook into their database. Please share more information. Did that require the user to be logged into FB?

Here is a hint https://docs.fullcontact.com/#enrich-api

As an engineer, I'm amazed. As a person who doesn't want the person on the other end of every website I visit to know who exactly I am, I feel violated. At this point though, all I feel I can do as a hapless consumer is to desensitize myself to said violation.

I use a VPN, Pi-Hole, Ghostery and Firefox. All of these a relatively recent additions though, so if a website can get my email and that links to an already existing database of all my collected data up to that point, I'm buggered anyway.

Re: I left the ad industry because of data tracking

#26

Post by pdkl95 » Fri, Jun 07, 2019, 11:05 AM UTC

zed88 wrote: post #13

user17843 wrote: post #10

Earlier quoted context omitted.

> it even automatically saved the identified user's profile pic from facebook into their database. Please share more information. Did that require the user to be logged into FB?

Here is a hint https://docs.fullcontact.com/#enrich-api

From this reprehensible API, "enriching" a simple candidate key (e.g. email addr) (slightly edited for brevity):

https://docs.fullcontact.com/#data-add-ons

    { "gender": "Male",
      "name": {
        "given": "Johnathan",
        "family": "Doe",
        "middle": "David",
        "prefix": "Mr",
        "suffix": "Jr",
        "nickname": "John"
      },
      "age": {
        "birthday": {
          "year": 1980,
          "month": 1,
          "day": 10
        },
        "range": "35-44",
        "value": 37
      },
      "locations": [
        { "label": "deduced",
          "formatted": "Denver, Colorado, United States"
        }
      ],
      "education": [
        { "name": "State University",
          "degree": "Masters Degree of Automation",
          "end": { "year": 1998 }
        }
      ],
      "employment": [
        { "name": "ACME, Inc",
          "domain": "http://www.example.com",
          "current": false,
          "title": "Widget Maker",
          "start": { "year": 2010, "month": 6, "day": 1 },
          "end": { "year": 2015, "month": 10, "day": 15 }
        }
      ],
      "interests": [
        { "name": "Quilting",
          "affinity": "HIGH",
          "category": "hobbies"
        }
      ]
    }

edit: Note the arrays, which presumably can return multiple records.

Re: I left the ad industry because of data tracking

#27

Post by luckylion » Fri, Jun 07, 2019, 11:09 AM UTC

icebraining wrote: post #21

luckylion wrote: post #15

Earlier quoted context omitted.

> Unless the site is only available to German users, you should be able to file a complain with any of EU member state regulators, and not all are so timid as that. You can, but they will forward that to the applicable authority, which will be the local German one for German sites.

On what do you base this? Facebook is registered in Ireland, yet multiple EU authorities have fined them.

On filing complaints and being informed that they were forwarded to the local authority that has jurisdiction.

https://gdpr.eu/article-55-supervisory-authority-competence/ also states Each supervisory authority shall be competent for the performance of the tasks assigned to and the exercise of the powers conferred on it in accordance with this Regulation on the territory of its own Member State, and article 56 adds to that.

Re: I left the ad industry because of data tracking

#28

Post by geocar » Fri, Jun 07, 2019, 11:14 AM UTC

user17843 wrote: post #12

I have yet to see a real whistleblower report by someone deep into the ad industry revealing whats really going on there. There are almost no details about what's really happening on a technical level (beyond the little things we already know), and whether large data sets are abused in the sense that they get routinely de-anonymised.

What the author is referring to is usually branded, so it's difficult for people on the sales side to give details without revealing who it is unless you're in the weeds (technically), and I'm sure you can appreciate why they might not want to, so here's the gist:

- Companies collect a number of "records" keyed to an email address. How they do this varies from running microsites/forms that collect data directly from people, to scraping linkedIn and resumes.

- Data vendors will share this data with each other by hashing the email address. Almost always with md5, and rarely salted.

This means you can enrich data both anonymously (by relying on the fact the email address is unsalted) or in an identifying way (because one of the parties has the real email address). In both cases, it's just a LEFT JOIN.

Re: I left the ad industry because of data tracking

#29

Post by cik2e » Fri, Jun 07, 2019, 11:14 AM UTC

otabdeveloper3 wrote: post #20

user17843 wrote: post #12

I have yet to see a real whistleblower report by someone deep into the ad industry revealing whats really going on there. There are almost no details about what's really happening on a technical level (beyond the little things we already know), and whether large data sets are abused in the sense that they get routinely de-anonymised.

There's nothing to whistleblow. Advertising is applied sociology. As such, advertisers want to aggregate large data sets into large segments that are easy to manipulate statistically. (Where the central limit theorem starts working.) There is no demand for personal data or de-anonymization because that stuff doesn't sell. The personal data collection is done by Google, Facebook at al not for advertising purposes. The…

> There is no demand for personal data or de-anonymization because that stuff doesn't sell.

Say what?? I’ve also worked in the ad industry and deanonymized personal data is shared and sold routinely. You speak of statistics and large segments but every advertiser I’ve interacted with is either doing individual-level targeting or striving towards it.

Re: I left the ad industry because of data tracking

#30

Post by geocar » Fri, Jun 07, 2019, 11:16 AM UTC

user17843 wrote: post #11

zeristor wrote: post #7

The Pwned website shows you which websites your account details have been leaked for. Is there one to show you what the ad industry has on you, and perhaps how it can by it? If people had insight to this for how much longer would this be a problem? I imagine there’s a website that does this which was launched five years ago.

the thing is, in theory all of this data is pseudonymous, or even anonymous, as the industry creates all of these profiles and does not attach real names to it.

This is not true.

Many many companies in this industry attach real names and email addresses to this data, and even the ones that aim for pseudonymity do it typically in a very weak way (such as an unsalted md5 hash).