Online Tracking More Detailed Than Thought

It's no secret that advertisers and other groups buy and sell data about people's Internet use. But a new report says the information is far more detailed and specific than realized.

The Irish Council for Civil Liberties (ICCL) says it's much easier than people realized to identify specific individuals, in some cases threatening national security. The data isn't hacked or stolen, but rather made available to people bidding for online advertising slots and trying to reach a particular auction.

The basics of how this work are well known. Legitimate online businesses track users online but don't sell individual records. Instead they'll label them as likely fitting particular groups, such as fans of a football team or new parents, based on their browsing history.

Advertisers can then target these groups, for example people who are likely golf fans, live near a specialist golf store, and appear to buy high end goods. In principle at least, tech firms try to balance the categorization so that groups are narrow enough to allow effective ad targeting, but broad enough that identifying any individual is difficult.

Blackmail Made Easier

However, the ICCL investigation found that advertisers have more categories, covering more specific characteristics, than widely assumed. That means the available information about any individual is much greater, making it easier to cross-reference with other details to identify them.

Some of the categories in ad data revealed by the ICCL were highly personal, including information about potentially embarrassing health conditions. Other categories were potentially a major security risk not just for the individuals but for companies.

These included people being categorized as a judge, elected official, national security worker, military personnel, military family, or counter-terrorism worker. If identified, some of these people could be threatened or blackmailed.

Russia Among Customers

The report also claims Google sends ad data to a Russian broker that tries to identify people who regularly visit websites politically opposed to the Russian government. (Source: iccl.ie)

Google and Microsoft both responded to the report saying they protected individuals' privacy when handling ad data. Microsoft said it complied with all laws, while Google said the way it makes data available to potential advertisers "simply [doesn't] allow bad actors to compromise people's privacy and security. (Source: ft.com)

What's Your Opinion?

Are you surprised by the reports? How easily do you think a bad actor could gather information about you and identify you? Is it possible or desirable to have tougher laws on how tech companies share and combine data about online activity?