BLOCKING THE DATA STALKERS - New Economics

brokers and other intermediaries.Today, however, the picture is radicallydifferent. In 2018 almost half (44%,worth 237 billion) of all advertisingspend will be online, rising to over 50%by 2020.11 Advertising has migratedonline in a remarkably short space oftime. But what is more remarkableis that advertisers can now targetindividuals wherever they are on theInternet; and that two digital giants –Google and Facebook – control 58% ofthe digital ad spend.12and device details. It also sends variousidentifying information about you (theuser) from previously collected data orprofile data bought in from brokers,forming a detailed profile of you.3. This profile, built from the dataoffered by the website, is then usedby advertisers to bid in an auctionfor the right to show you a particularadvert, which is run as a ‘second-priceauction’. In these auctions, the winningbid pays the price offered by therunner up (the second price), which issupposed to make the process simplerand less risky.13A new system has been created foradvertisers. No longer are they lookingto spend their money in places wherethey think their customers are. Today,advertisers can target their audiencewherever they are online, thanks toa pervasive online tracking systemcoupled with a new auction system forplacing ads.4. The winning bidder gets to place thead on the page you’re viewing.This process happens repeatedly as wesurf the web. Bid requests on UK users,containing our personal information,are being sent out at a rate of almost10 billion a day or 164 per person perday,14 and are seen by hundreds if notthousands of advertisers, who could allbe illegally collecting that data, withoutus being aware of it.It works like this:1. When you click on a webpage, thepage does not come pre-loaded withadverts that have already been placed.As you click, the website you’re visitingsends a ‘bid request’ to one of twomain ad tech channels, OpenRTB andAuthorised Buyer (the latter is run byGoogle).The impact of this change in theunderlying system for placing advertshas had major repercussions. Thesystem is probably the largest sourceof personal data potentially beingillegally collected in contraventionof the spirit, if not the letter, of theGeneral Data Protection Regulation(GDPR).15 Changing the way thatadvertisers find space has had a major2. During this bid request, the websiteprovides as much information aboutyou as possible, including the webpageyou’re visiting, your IP address (fromwhich your location can be inferred),9

impact on industries that rely onadvertising revenue for survival, suchas newspapers and magazines.1.1.1 THE SOCIETAL PROBLEMWe now live in a world where, unlesswe take active measures to prevent it,our everyday activity on the Web willcontinue to be recorded and tracked,with massive international companiescompiling it all into detailed profiles.Our digital selves then becomemarketable products with advertisersable to pay tech giants and websiteowners to place adverts in front of us.This has created a huge incentive forthese tech giants, as well as a myriad ofsmaller companies, to try and gather asmuch information about us as possible.They do this to be able to nudge andinfluence our decisions and behaviourto meet their own ends.This presents an issue of power as wellas privacy since the online advertisingmarket is extremely concentrated, withGoogle and Facebook having an 84%market share.16 Both have grown theirad revenue sharply in the last decade,with Facebook growing by over 600%in the five years from 2012 to 2016.Both companies are hugely reliant onad revenue, with Facebook collecting97% of its overall revenue from adspending, while at Google it accountsfor 88%.17The switch has therefore had adramatic impact on our mediaorganisations who used to fund asignificant portion of their operationsby selling advertising space. Thismodel, which functioned well for over100 years, has been decimated in thelast few decades, and today, manyorganisations are struggling to ensuresufficient revenue to maintain theiroutput as ad spending moves frommedia organisations to Facebook andGoogle. US presidents Donald Trump18and Barack Obama19 do not have muchin common, but both relied heavily ondigital campaigning and have shownhow the tools created for the worldof adverts have been repurposed toinfluence our democratic system.20Advertisers and their marketingconsultants are also seeing this as anarms race. They need to constantlydevelop new techniques to getour attention since we, as users,develop resistance to certain typesof advertising over time. The firstbanner ad, placed by AT&T on Wired.com, had a 44% click-through rate,while a similar ad today would getonly 0.06%.21 And so the sector hasevolved. It now uses superficial datacollection on people, allowing them topersonalise adverts. This has createdthe phenomenon of ‘ad nauseam’,where a product you have recentlybought stalks you for weeks across theInternet. The industry knows this is aproblem and believes in a future where:10

“Ads need to be bespoke [ ]created in real time and tailored tothe individual [ ] [using] advancedneural networks, deep-learning andlarge data sets to produce insightsand then rapid decisions about whatadvertisement should be served.”22“Our right to privacy forms thebedrock upon which all of our otherrights and freedoms are built. TheLords Constitutional Committee(2009) agreed that: ‘Mass surveillancehas the potential to erode privacy.As privacy is an essential prerequisite to the exercise of individualfreedom, its erosion weakens theconstitutional foundations on whichdemocracy and good governancehave traditionally been based in thiscountry.‘”25Companies are starting to combinedata they collect through the use ofcookies23 and existing digital profiledata available from data brokers withcontextual, real world data aboutweather, relevant events, and socialmedia data to understand when weare most susceptible to an advert. Theywill then be ready to place a tailoredmessage targeting our vulnerability orneed.241.1.2 TECHNICAL PROBLEMTwenty-five percent of ad spend islost to fraud,26 with experts labelling it“one of the most profitable crimes withthe least amount of risk”.27 Fifty-sixpercent of adverts will never be seenby a human.28 Ad fraud often uses atechnique known as domain spoofingwhich uses unknown websites, ownedor compromised by criminals, to placeads which they then drive traffic tousing botnets (collections of computerscontrolled by malicious code) andother tricks. Edward Snowden hasalso warned that the way that advertsare served, often allowing remotecomputers to access Flash software todisplay them, can also be a security riskand that “using an ad-blocker is not justa right but a duty”.29This is a fundamental driver of thepractice of collecting as much data onus as possible so that companies canmonetise it by showing us adverts.Whole companies and digital productsare being built solely around thisprinciple – indeed any free app thatwe have on our phone or computeris relentlessly gathering data aboutus, selling it to data brokers, in someinstances creating their own profile ofus, while delivering us personalisedadverts. The reason that we should careabout this is clearly articulated by thisstatement by the organisation Don’tSpy on Us:11

The ad tech industry is potentiallyexposing every person who uses theInternet not only to fraud but alsoto the non-consensual, and oftenunwitting, sharing of their data withthousands of companies who are allable to copy, share, and sell the dataon again. The now infamous politicalconsultancy Cambridge Analytica usedto be one of many companies that hadaccess to this stream of personal userdata. It was accused of using Facebookprofile data without permission tocreate a system to target specific votersin the USA. A recent case against tinyFrench data broker CNIL found thatit had illegally collected over 24.7million records of people and theirgeolocation and almost 43 million otherpieces of personal data through thebid process.30,31 This practice is illegalbecause those receiving bid requestsare not allowed to collect and recordthe personal data they receive; they canonly use the data to bid in real time toplace an advert. Because of the obviouschallenge of identifying if and whenadvertisers are actually recording thedata they receive, we believe that thecase against CNIL represents only thevery tip of a massive iceberg.page loading, information about you iscompiled and sent out as a bid requestfor advertisers to assess the value ofshowing you an advert. However, theserequests broadcast more data thanis justified for advertising purposes,and can include sensitive informationsuch as sexuality, ethnicity, or politicalopinions.Cases brought by Brave32 and PrivacyInternational33 to the InformationCommissioner’s Office (ICO) are nowforcing the industry to confront the wayin which data is shared in this space.1.2 GENERAL DATAPROTECTIONREGULATIONThe GDPR is an importantinternational development in theregulation of data and the protectionof people, but it does not addressthe question of power dynamics andis primarily focused on “individualcontrol over data flows”.34 The GDPR’smain route for maintaining anyaccountability over the companies thatcollect and exploit our data is limitedbecause it focuses too heavily onindividual actions, like giving consentor lodging a complaint with the ICO.The GDPR should not, therefore,be considered a panacea to all ourconcerns about data, privacy andpower.The bid request during the auctionprocess totally fails to ensure theprotection of personal data againstunauthorised access. As alreadyexplained, when you click on a link toa page, between you clicking and the12

The GDPR has a number of key flaws:If we are to dismantle the structuresthat create tech monopolies and pose athreat to society, we shouldn’t limit ourjudgements regarding data processes towhether they are GDPR compliant. Aslegal scholar Frank Pasquale highlights,accountability in the digital economyshould question whether these toolsshould be developed at all and, at thevery least, what limits should be placedon their use and commercialisation.35 It places an overwhelming burdenon the individual to take action. It requires a review of complex termsand conditions which individuals inpractice don’t have the time to readand/or can’t understand. Accountability is undermined byallowing justifications such as‘legitimate interest’ or ‘necessity’to be used by data collectioncompanies.This paper looks at two types ofintervention: A series of interventions to addressthe current limitations of, and to gobeyond the GDPR. It doesn’t protect metadata orinferred data, despite the ability ofboth to identify individuals. An intervention which bansthe sharing of personal data foradvertising and addresses one ofthe main roots of the concentrateddigital power in the hands ofGoogle and Facebook, as well asthe commodification of our digitalselves, and of the Internet itself. It doesn’t adequately control on-sellof data between firms. It leaves open the risk of fraudand misuse of data by leaving thestorage and encryption of the datain the hands of the company, not theindividual.The GDPR has given us a frameworkto challenge the unauthorised sharingof personal data. But at a morefundamental level, while it addressesprivacy issues, it does not address theissue of power in the data economygenerally, and the ad tech sectorspecifically.13

2. GOING BEYOND GDPRData protection legislation –which is actually concerned withthe protection of people ratherthan data – is premised on notions ofindividual agency and consent. Thiscannot work if users don’t understand,or don’t take the time to read theterms and conditions they are signingup to. Reports show that most peopledon’t read the long list of terms andconditions they accept when signingup to new digital services.36 Twenty-fivepercent of people are unaware that themonetisation of their personal dataforms the core digital platform businessmodel, while 45% are unaware thecompanies use that data to providepersonal ads.37every day, 24 hours a day.38 Imaginehow that would scale if we took intoaccount all the digital agreements weenter into every day. This leaves us witha dilemma to resolve: How can weeffectively rely on consent to protectpeople from data exploitation?The interventions we propose seek tocreate conditions where our data isnever collected, shared, or sold withoutus giving our consent. The solution liesin ensuring that people are protectedby default, as well as reducingthe overall amount of data beingcollected. This should result in fewercircumstances where our consent isneeded; and where consent is needed,it should be easier to understand whatwe are consenting to. We should alsoencourage innovative companies,public sector organisations, and thevoluntary sector to consider developingand implementing collective forms ofconsent.Data should be gathered and sharedon the basis of consent from thedata subject, with exceptions incertain sensitive cases like criminalproceedings or national security.However, relying on individuals to readand understand the multitude of termsand conditions that we accept withoutconsideration every day is unrealistic,unproductive, and uneconomic. Totake one example, if everyone whoinstalled Flash, a software program todeliver animations and applications,read the licence agreement, it wouldconsume 1500 person years of effort2.1 PRIVACY BY DEFAULTAn effective foundation would beto mandate the design practices ofprivacy by default and privacy bydesign. These principles would dictatethat our online interactions, as wellas our devices and software, would be14

automatically set to not collect, share,or sell on our personal data. We wouldthen have a series of options andtools that we could use to change thisdefault setting to specify which thirdparties could gather data on us securelyand for what purpose. This would helpreduce the vast quantity of data beinggathered all the time, which in itself isa risk to companies and data subjects.for change. When Facebook’sinternal company documents werepublished by the UK Parliament inlate 2018, people started dissecting thedocuments and associated terms tohelp interpret them.39 Imagine if thiswas standard for all major sites withthe results publicly available and easilydigestible. Unacceptable conditionswould quickly surface and collectiveaction could be mobilised.2.2 RETHINK CONSENTAnother way forward could be toconsider giving our consent byproxy through trusted individuals orgroups, perhaps for a small fee. Hereindividuals with specific knowledgeor skills would review site’s terms andbe empowered to give consent on ourbehalf. Different groups would emergewith different appetites for sharing dataas well as other criteria.Even with both design practices beingrequired by legislation, companieswould still be asking us to consentto allow our data to be collected. Wetherefore need to re-think consent.At a minimum, if we want to stickwith our individualistic model, thenwhen consenting to data collection andsharing, the terms and conditions ofany website or service provider shouldmake it clear, in an easily digestiblegraphic or table, exactly what datais being collected about us, whetherit is personally identifiable and whoit may be shared with or sold to. Tofacilitate understanding, the means ofdisplaying the information should bestandardised and consistent, showingexactly what data is being collected andwhether it is being sold or shared withother companies.2.3 RESTRICT THE USE OFLOOPHOLESThe protection of people should beprioritised over corporations’ businessmodels by restricting the use ofloopholes. Legislatures have tendedto resolve the difficulties of requiringconsent for all data collection andprocessing by granting the dataindustry sweeping justifications it canuse to override consent requirements.This has resulted in a situationwhere many tech companies exemptthemselves from requiring datasubject consent through the ‘legitimateinterests’ justification contained withinThe possibilities here are for us tocrowdsource reviews of termsand conditions to help highlightproblematic conditions and open upthe potential of collective bargaining15

the GDPR. ‘Legitimate interests’ is themost flexible lawful basis for processingdata and can be the company’s owninterests or the interests of thirdparties. These interests can includecommercial interests, individualinterests, or broader societal benefits.Facebook invokes “necessity forperforming a contract” as a legal basisfor targeting ads to its users,40,41 whileGoogle still collects your locationeven after you ask it not to, seeminglyin contravention of the GDPR.42Legislatures should prioritise theinterests of people over corporationswhen tackling the data economy, withdata sharing subject to collection andanalysis on the condition that consenthas been freely given; is specific,informed, and unambiguous; and iseasily rescindable. Companies, likeFacebook, should not be able to rely onthese blanket justifications to processdata.consent but as a ‘legitimate interest’ ofthe business. We would bring an end tothis by restricting the sale of third partyaccess to our data to cases where wehave given our explicit consent to grantthat specific third party access. This isan area that the ICO is investigating,saying that it is particularly concernedwith the “purchasing of marketinglists and lifestyle information fromdata brokers43 without sufficient duediligence, a lack of fair processing,and use of third party data analyticscompanies with insufficient checksaround consent.”44 The ICO hasalready taken action against some ofthe smaller UK-based data brokers.45,46Other action to address this riskincludes Privacy International’s filingwith French, Irish, and UK dataprotection authorities against sevendata brokers, ad tech companies, andcredit referencing agencies.472.4 BAN THE SHARINGAND SELLING OF DATABETWEEN COMPANIESWe recommend that data sharing andselling between companies withoutthe consent of the data subject bebanned, whether in the same companyfamily (like Google and YouTube)or totally separate. This practice caninvolve sharing large data sets whichcompanies use to create profiles aboutus and is often done on the basis not of16

3. BANNING THE SHARINGOF PERSONAL DATA FORADVERTISINGTthe features of the website. Websiteowners may want to include additionalinformation in the bid request, such askeywords outlining what they cover,and potentially even some aggregateddemographic information about theirwebsite. This should allow advertisersto understand what kind of personthey may be placing an ad in front of.It would mirror much more closelythe way that adverts are (still) placedin print publications, based on theadvert’s target audience matching thetarget audience of the publication orservice.he current auction process is notfit for purpose because it totallyfails to ensure the protection ofpersonal data against unauthorisedaccess

particular magazine, or, more recently, a television slot. Advertisers had to go to where they thought their target market was, or, as with billboards and other public adverts, to show their products to a huge number of people in the hope that some of them would be their targ