Hi all! I’m an IT person working with someone who’s 30+ years old and for various reasons is only now starting to use technology like phones and laptops.
They’re naturally quite an anxious person, and due to their tech-illiteracy are prone to misunderstanding things in the digital world, which brings me to why I’m posting!
They’ve latched onto digital/online privacy, growing very anxious that anyone, anywhere, anytime can see what they’re doing and have done online and has access to an MI5/FBI esc dossier on their activities.
My goal is to try and quell these concerns by informing them more about what data companies like Google and Facebook collect, how it’s used, and who has access to it. To that end, it would be of great help if anyone has a moment to fact-check what I’ve found out so far and comment on a few questions!
I’ve focused most of my research around Google because there is lot written about them and their processes, and Google is a name the person I’m working with will recognise.
What information are Google and similar companies collecting?
Pretty much everything you can think of, this list by security.org seems to be the best breakdown I’ve seen on it so far.
Then, from what I’ve read this data is normally split into two categories:
-
Information you create/content you generate. This would be emails you send through Gmail, posts you make on Instagram or images you upload to Google Images.
-
Data that’s collected about you; your IP address, the times at which you’re using services, a log of topics you’ve shown interest in etc.
What happens to all this data?
The line seems blurry, but information from section 1 that you would expect to be private -such as the content of your emails - typically is, however, this would vary depending on the company and how devious their Privacy policy is. Information from section 2 is much more obviously used for marketing, which is understandable.
Then, Information that can be used for marketing is collated into a profile along with a few identifiers.
How is this data accessed?
There are three main ways to access it:
-
The profiles are then aggregated into larger demographics and advertisers can advertise to those demographics – which sounds reasonable, assuming the individual profiles remain in-house at Google/other companies.
-
Real-time bidding, which is more invasive because the data is much more specific to particular users and shared with many more parties as part of the process.
-
Google’s “Customer Match” service which allows you to upload existing information you know about a user if Google has a match for the data you’ve supplied.
My question here is:
How much information is revealed during the bidding process; Is it just some IDs, Year of birth, Gender, a string of keywords for interests, and their location, or, looking at the OpenRTB documentation is there some more concerning data exchanged as part of the “data” and “ext” attributes?
Who has access to this data
Err, well… this is where I’m starting to struggle.
Anyone involved in the RTB process would have access to individual, but anonymised (ish) data.
Anyone can pay Google to advertise to a demographic that contains you, but that’s not too bad either.
Anyone could use Customer Match to advertise to you, but I assume Google wouldn’t hand over much if any data as part of this process?
The data would end up with a data broker, and could ultimately be bought and accessed by anyone who creates an account. That leads me to my next question, Which forms of data (individual profiles, Anonymised profiles, profiles aggregated into demographics) can be bought from brokers? And what would this data contain?
And, the million-pound question: how realistic is it that someone who knows you could find and purchase your data? Finding people from their data is proven to be possible, but that’s very different from finding the data for a person.
Any thoughts, insight or advice would be much appreciated!