EUROPEAN DIGITAL RIGHTS Targeted Online

14Targeted Online: An industry broken by design and by defaultRoot parent% appsSubsidiary% appsCountry22.75Microsoft22.11US7.72USAmazon MarketingServices1.73USBing0.12USAlexa SOpera3.20Adcolony3.12USAdmarvel0.09USLesser-known ad tech companies alsoIt also allows businesses that havetrack users on millions of apps andincluded Facebook, Google or Amazonwebsites, but generally speaking, thetrackers on their apps and websitesmost common trackers belong to theto target people who have previouslymajor tech companies.visited their site or app on the platform(depending on the user’s privacyHaving so much access to user datasettings).gives large tech companies manyadvantages. It allows them to targetTypically, advertisers can also uploadpeople at a level of granularity thattheir own data to target people on afew competitors can match.platform like Facebook.

EDRi/European Digital RightsThis can include data that has beenLarge publishers usually have theirpurchased from data brokers orown troves of data, even thoughcollected through subscriptions,they do not match those of largelocality cards or mailing lists.tech platforms. Smaller blogs andwebsites typically rely on advertisingFinally, tech platforms allownetworks, for instance Google ads, toadvertisers to automatically findautomatically display ads.audiences that match the peoplethey already know. Once an ad runsDepending on the invasiveness of theon a platform, often the targeting isadvertising techniques allowed oncontinuously optimised, so that it istheir sites, this means that smallershown to the people who are mostsites are allowing third parties (fromlikely to engage with it.larger tech companies, to smaller,lesser-known ad tech companies) toAnother group of important playerstrack users on their sites and apps.in the online advertising industry arepublishers and content creators whoAs you can see, the online advertisingoften rely on advertising to monetiseindustry is complex and made up oftheir content. Some of them usea large number of companies, manyplatforms like YouTube and TikTokof which are not household names.for this.All of this results in a system that isincredibly opaque.Most publishers and content creatorsalso depend heavily on social mediaAs a result, merely using an app orplatforms to get views and reachvisiting a websites can mean thataudiences outside of their own appsuser data is shared with hundreds ofand homepages. Publishers like newscompanies.sites and smaller blogs display ads tosupport their business – positioningads can be done at various levels ofgranularity.15

16Targeted Online: An industry broken by design and by default1.1 An offer you cannot refuse – consent and cookiesin online targeted advertisingWhether you are visiting a website,services without accepting theirusing an app on your phone or signingprivacy policies that include intensiveinto a social media account, privacytracking. Some websites placeand data protection laws in thetracking cookies even after usersEuropean Union mandate that users’clearly object.8consent is needed to process personaldata and install tracking technologiesMost cookie banners do not mentionlike cookies on devices. But throughthe specific purpose of grabbing andnudges and dark patterns,6 “consent”using users’ personal information oris often falsely extracted from userswho can access it.who do not have a real option toreject the “deal” that publishers andLikewise, privacy policies areplatforms offer.dauntingly long and written in legalese,yet do not go into the detail needed toMost cookie banners, for instance, doactually understand the purposes fornot clearly offer users the option towhich user data is being used.refuse, or will nudge users towardsconsenting (it often takes moreThe consent a user “gives” whenthan three clicks to refuse cookiesagreeing to the privacy policies orwhen only one is enough to acceptterms and conditions of apps andthem).7 Similarly, it is not possibleonline platforms is often equallyto use Google and Facebook’sproblematic.

EDRi/European Digital Rights“Some websitesplace trackingcookies evenafter usersclearly object.”Chapter 01 - Power dynamics & imbalancesin the digital adversiting industry17

18Targeted Online: An industry broken by design and by defaultThis is either because users do notfully understand how data is usedand collected, or because they do nothave the option of using the serviceswithout giving consent. This is notvalid under current European dataprotection laws.9The incorrect implementation of dataprotection and privacy legislation hasled to a plague of pop-ups on websites6that “ask” visitors to “accept” cookies,interface design meant to manipulate users withbecause otherwise they are preventedDark patterns are techniques and features ofthe aim of nudging users towards privacy intrusiveoptions. See the report on dark patterns by thefrom using the site’s services. EDRiNorwegian Consumer Council:has long advocated against xistence of these “cookie walls”.7Christine Utz, Martin Degeling, Sascha Fahl,Florian Schaub, and Thorsten Holz, ‘(Un)informedThe official group of data regulators inEurope, the European Data ProtectionBoard (EDPB), also confirmed that this“does not constitute valid consent”.11Consent: Studying GDPR Consent Notices in theField’ (ACM SIGSAC Conference on Computer andCommunications Security, 2019).https://arxiv.org/pdf/1909.02638.pdf8NYOB, ‘Say “NO” to cookies – yet see your privacycrumble?’ (NOYB, 10 December 2019).Consent is one of the key legal basesthat allow data processors to yourprivacy-crumblecollect and process personal data,9and it is the main legal basis for theonline tracking here: https://edri.org/files/eprivacy/processing of “sensitive data” suchSee our one-pager on consent in the context ofe-privacy-onepager consent.pdfas actual or inferred data about race,10political opinion, religious lhealth, sex life, sexual orientation,11and genetic and biometric data.Guidelines 05/2020 on consent under RegulationEDRi, ‘Tear Down the Tracking Wall’ (2017)European Data Protection Board (EDPB),2016/679 (2020), p.12. file1/edpb guidelines 202005 consent en.pdf

EDRi/19European Digital RightsYet, the opacity and complexity ofThe business practices of dominantthe online advertising system makesonline platforms and the ad techit difficult for users to enjoy theirindustry are complex and opaque byfundamental right to data protectiondesign, because the industry benefitsand privacy. Users cannot identify allfrom the fact that most peoplethe companies that will receive anddon’t fully understand and cannotprocess personal data, which makesmeaningfully control how their data isinformed consent impossible.used and collected.However, individuals are shownThe lack of strong enforcement of“options” to accept or deny (in someexisting laws and a lack of interestcases granularly, in some cases not)in (if not deliberate blocking of)tracking of their behaviour whichadditional regulatory initiativeslends a feeling of powerlessness andcreates the ideal conditions for“consent fatigue” (or rather “cookieharmful and illegal activities.banner fatigue”).12The industry is seldom held toaccount. This affects both individuals12and society as a whole.(Un)informed Consent: Studying GDPRConsent Notices in the Field. https://arxiv.org/pdf/1909.02638.pdfExample of a cookie banner that gives no real choiceAccept cookies from Instagram on this browser?We use cookies to help personalize content, serve relavant ads andprovide a safer experience. Learn more about cookie uses and controls inour Cookie Policy. You can review your controls at any time.AcceptLearn More.

20Targeted Online: An industry broken by design and by default02When the webwatches you back:how most onlineadvertising worksBefore diving further into the different roles andfunctions of each actor involved, let us explore whatyou do and don’t see on your screen when you visit awebsite, and what techniques are used to collect andprocess data about you to deliver targeted ads.

EDRi/European Digital Rights2.1 TrackingTo target users and predict behaviour with detail, ad tech companies and techplatforms want to know as much about each individual user as possible.What are tracking tools and howThis can mean knowing the screendo they work?size of a particular user’s device andWe have already discussed above howthe software installed on it (which canwebsites and apps contain trackersin some cases be enough to identifythat collect data about users.individuals).These tracking tools (which includeIt can also mean a user’s physicalcookies, beacons and browserlocation, the apps installed on theirfingerprinting among others) aredevice, browser settings, IP addresses,used to collect and, more importantly,their topics of interest (politics,combine data about people fromhobbies, sexual preferences, cultureacross the web, different apps andetc), how much time they spend oneven different devices. These arethe website or platforms, the way theythen used to make guesses aboutmove their mouse, who they hang outindividuals’ interests and preferences.with offline, the state of their mentalTrackers constantly observe usershealth and much more.13and their behaviour online.21

22Targeted Online: An industry broken by design and by defaultWhat is more, websites andOther techniques, like beacons, canapp developers integrate thosetrack everything a user does on atechnologies from “third parties” inweb page including what they type ortheir website or mobile applicationswhere their mouse moves. 15source code, often for convenienceand to increase commercial profit.Since online tracking has becomeubiquitous, data about a large portionThird party tracking is particularlyof users’ online experience (searches,problematic, because people aren’tlikes, lists, subscriptions, time spentaware of it and have little control overon each piece of content, etc.) ishow their interactions with an app orused to profile them for advertisinga website are shared with those thirdpurposes. This is then used to directparties. In particular, third partiesmore of the same content that theywhose code is embedded in a largemay be interested in, according to thenumber of different apps and websitesdata users have handed over and datareceive data about users that can bethat has been inferred. This createslinked and combined into an incrediblya feedback loop of micro-targeteddetailed profile.content and ads.This results in companies havingSo what? Next, we’ll look at why thisaccess to a large share of individualis harmful.14users’ browsing history.While users can delete some of thesetrackers, such as cookies, from theirbrowser, other tracking tools havebeen developed that are less easily13controlled. Fingerprinting, for example,impacts fundamental rights at:uses information about a user’s owser, or IP address to uniquely14identify and recognise their devicecompany for all of my data and here’s what I found’without the need to place a cookie.Find more information about how trackingPrivacy International, ‘I asked an online tracking(7 November 2018): -what-i-found

EDRi/European Digital Rights2.2 ProfilingWe know that content on a website can change, according to who is visiting.Social media feeds and recommendations look radically different, not just basedon who individuals follow. The same is true for the ads that we see.What makes a user unique forUnique identifiers16 such as deviceadvertisers?or browser fingerprints17 or a mobileThe data and information gatheredphone’s unique Advertising ID makethrough tracking can end up inprofiling possible and further turn adetailed user profiles. For example,user’s profile into a unique personwhen a user is using their phone toidentifier. The techniques used to dovisit a website online, that websitethat are far from perfect, for instanceautomatically places cookies andwhen several people share the sameembeds beacons and/or otherdevice, but they are good enough totracking software.provide deep insights into people’smost intimate personal lives.Trackers don’t necessarily knowan individual’s legal name, but theyInferred data: guessing stuff aboutare able to uniquely identify a user’susers and enriching datadevice or browser, and merge dataThe more data companies collectthat has been collected on differentabout individual users, the morebrowsers and on different devicesadditional insights they can infer andinto a single profile.derive from that information.23

24Targeted Online: An industry broken by design and by defaultInferred data means ad techcompanies can know things aboutpeople that those people neveractually shared with anybody.That can range from gender, age orgeneral interests to highly intimateinformation such as predicted sexualorientation, psychometric profile,IQ level, family situation, addictions,18illnesses or the menstrual cycle.Often apps will have access to evenmore sensitive information such as15Epic.org, ‘Online Tracking and BehaviouralProfiling’: 6For more details on the different types oftrackers see: Bennett Cyphers, ‘Behind the OneWay Mirror: A Deep Dive Into the Technology oflocation data, personal calendars,Corporate Surveillance’ (2 December 2019):the camera, personal contact listshttps://www.eff.org/wp/behind-the-one-way-and more.mirror17A study at the Universities ofCambridge and Stanford found that,by analysing clicks on Facebook “like”buttons, it was possible to guess anFor more information on browser fingerprinting,see: inting18Privacy International, ‘No Body’s Business ButMine: How Menstruation Apps Are Sharing YourData’ (2019): https://privacyinternational.org/individual’s personality better thanlong-read/3196/no-bodys-business-mine-how-a work colleague (based on just 10menstruations-apps-are-sharing-your-dataclicks), better than a parent or sibling19(based on 150 clicks) and betterYou’ve given the security services a key to yourthan a spouse (based on 300 clicks).soul’ (The Guardian, 13 January 2015): https://www.Researchers indicated that Facebookhas records of 100 billion “likes”.19Andrew Brown, ‘Ever liked a film on file-facebook-research20The Facebook-Cambridge Analytica scandalconcerned the obtaining of the personal data ofmillions of Facebook users without their consentby British consulting firm Cambridge Analytica,predominantly to be used for influencing theoutcome of political elections.

EDRi/European Digital Rights“By analysing clickson Facebook “like”buttons, it was possibleto guess an individual’spersonality betterthan a work colleague,better than a parent orsibling and better thana spouse.”Chapter 02 - When the web watchesyou back: how most of online advertising works25

26Targeted Online: An industry broken by design and by default2.3 TargetingThere are a variety of ways in which online ads can be targeted.Broadly speaking, these fall into four categories.Targeting based on categoriesas the ways in which users haveprovided by online platformsinteracted with content.The easiest way to target ads isto buy advertising space on socialDepending on the privacy settingsmedia platforms or through their adchosen by users, ads on platformsnetworks. These allow advertisers tocan also be targeted based on datatarget ads based on relatively broadthat has been collected outside thecategories, demographic information,platform, meaning ads on social mediasuch as age, location, and interests.platforms can be targeted based onthe websites a user has visited and theThese options suggest that targetingapps installed on their phone.is relatively broad, but in reality, thesecategories are based on all the dataUntil the Facebook-Cambridgethat tech platforms have aggregated.Analytica scandal20 caused someplatforms to change their practices,This includes users’ declared interests,advertisers could also target peoplethe content they have shared, ason platforms based on data providedwell as who they are connected with,by data brokers and credit referencingbut also a platform’s own data, suchagencies.

EDRi/European Digital RightsTargeting based on custom dataadvertisers to automatically findAdvertisers can also target usersaudiences that “look” similar tobased on the data they have collectedusers they have already identifieddirectly, for instance throughand targeted.trackers on their websites, apps,or online shops, or through emailReal time bidding (RTB)lists, shop data, location data andRTB is an automated auction processphone numbers they have eitherthat enables advertisers to target verycollected themselves or purchasedspecific groups of people on differentelsewhere. That includes personalwebsites, videos and apps withoutinformation collected through so-having to negotiate prices directly.called loyalty cards, email newslettersfor customers, and other types ofImagine auctions, stock exchange,promotional activity.traders, big screens, noise, graphs,percentages. RTB systems similarlyAutomated targetingfacilitate the auction of advertisingMost targeted ads are continuouslyspace to the highest biddingoptimised for engagement, meaningadvertiser. This technique is oftenthat no matter how an advertiser hasused on websites and by publishers.chosen to target an ad, the ad deliveryPlatforms like Facebook also use adsystem constantly tests which kindsauctions to determine the best adof users are most likely to click onto show to a person at a given pointan ad.in time.Whenever a user clicks on an ad,How does it work? A website rents itssimilar users are more likely to beadvertising space to one (or many) adshown the same ad.exchanges. The moment a user visitsthe website, during the millisecondsAdvertisers can also leave thein which it loads, the ad exchangetargeting of ads entirely to thesecreates a “bid request” that in

apps and websites, within videos and social media stories, but they also display ads on other apps and websites, and track users on these apps and websites. Major tech companies already have access to troves of user data, simply because of the amount of information they can directly collect from their users. This is either derived from their