The rise of first-party online tracking

    In a startling example of the Matthew effect of accumulated advantage, the incumbent advertising giants are actually being strengthened by legislation aimed to curb their influence. Because, of course.

    For years, digital businesses relied on what is known as “third party” tracking. Companies such as Facebook and Google deployed technology to trail people everywhere they went online. If someone scrolled through Instagram and then browsed an online shoe store, marketers could use that information to target footwear ads to that person and reap a sale.

    [...]

    Now tracking has shifted to what is known as “first party” tracking. With this method, people are not being trailed from app to app or site to site. But companies are still gathering information on what people are doing on their specific site or app, with users’ consent. This kind of tracking, which companies have practiced for years, is growing.

    [...]

    The rise of this tracking has implications for digital advertising, which has depended on user data to know where to aim promotions. It tilts the playing field toward large digital ecosystems such as Google, Snap, TikTok, Amazon and Pinterest, which have millions of their own users and have amassed information on them. Smaller brands have to turn to those platforms if they want to advertise to find new customers.

    Source: How You’re Still Being Tracked on the Internet | The New York Times

    Using WhatsApp is a (poor) choice that you make

    People often ask me about my stance on Facebook products. They can understand that I don't use Facebook itself, but what about Instagram? And surely I use WhatsApp? Nope.

    Given that I don't usually have a single place to point people who want to read about the problems with WhatsApp, I thought I'd create one.


    WhatsApp is a messaging app that was acquired by Facebook for the eye-watering amount of $19 billion in 2014. Interestingly, a BuzzFeed News article from 2018 cites documents confidential documents from the time leading up to the acquisition that were acquired by the UK's Department for Culture, Media, and Sport. They show the threat WhatsApp posed to Facebook at the time.

    US mobile messenger apps (iPhone) graph from August 2012 to March 2013
    A document obtained by the DCMS as part of their investigations

    As you can see from the above chart, Facebook executives were shown in 2013 that WhatsApp (8.6% reach) was growing rapidly and posed a huge threat to Facebook Messenger (13.7% reach).

    So Facebook bought WhatsApp. But what did they buy? If, as we're led to believe, WhatsApp is 'end-to-end encrypted' then Facebook don't have access to the messages of users. So what's so valuable?


    Brian Acton, one of the founders of WhatsApp (and a man who got very rich through its sale) has gone on record saying that he feels like he sold his users' privacy to Facebook.

    Facebook, Acton says, had decided to pursue two ways of making money from WhatsApp. First, by showing targeted ads in WhatsApp’s new Status feature, which Acton felt broke a social compact with its users. “Targeted advertising is what makes me unhappy,” he says. His motto at WhatsApp had been “No ads, no games, no gimmicks”—a direct contrast with a parent company that derived 98% of its revenue from advertising. Another motto had been “Take the time to get it right,” a stark contrast to “Move fast and break things.”

    Facebook also wanted to sell businesses tools to chat with WhatsApp users. Once businesses were on board, Facebook hoped to sell them analytics tools, too. The challenge was WhatsApp’s watertight end-to-end encryption, which stopped both WhatsApp and Facebook from reading messages. While Facebook didn’t plan to break the encryption, Acton says, its managers did question and “probe” ways to offer businesses analytical insights on WhatsApp users in an encrypted environment.

    Parmy Olson (Forbes)

    The other way Facebook wanted to make money was to sell tools to businesses allowing them to chat with WhatsApp users. These tools would also give "analytical insights" on how users interacted with WhatsApp.

    Facebook was allowed to acquire WhatsApp (and Instagram) despite fears around monopolistic practices. This was because they made a promise not to combine data from various platforms. But, guess what happened next?

    In 2014, Facebook bought WhatsApp for $19b, and promised users that it wouldn't harvest their data and mix it with the surveillance troves it got from Facebook and Instagram. It lied. Years later, Facebook mixes data from all of its properties, mining it for data that ultimately helps advertisers, political campaigns and fraudsters find prospects for whatever they're peddling. Today, Facebook is in the process of acquiring Giphy, and while Giphy currently doesn’t track users when they embed GIFs in messages, Facebook could start doing that anytime.

    Cory Doctorow (EFF)

    So Facebook is harvesting metadata from its various platforms, tracking people around the web (even if they don't have an account), and buying up data about offline activities.

    All of this creates a profile. So yes, because of end-ot-end encryption, Facebook might not know the exact details of your messages. But they know that you've started messaging a particular user account around midnight every night. They know that you've started interacting with a bunch of stuff around anxiety. They know how the people you message most tend to vote.


    Do I have to connect the dots here? This is a company that sells targeted adverts, the kind of adverts that can influence the outcome of elections. Of course, Facebook will never admit that its platforms are the problem, it's always the responsibility of the user to be 'vigilant'.

    Man reading a newspaper
    A WhatsApp advert aiming to 'fighting false information' (via The Guardian)

    So you might think that you're just messaging your friend or colleague on a platform that 'everyone' uses. But your decision to go with the flow has consequences. It has implications for democracy. It has implications on creating a de facto monopoly for our digital information. And it has implications around the dissemination of false information.

    The features that would later allow WhatsApp to become a conduit for conspiracy theory and political conflict were ones never integral to SMS, and have more in common with email: the creation of groups and the ability to forward messages. The ability to forward messages from one group to another – recently limited in response to Covid-19-related misinformation – makes for a potent informational weapon. Groups were initially limited in size to 100 people, but this was later increased to 256. That’s small enough to feel exclusive, but if 256 people forward a message on to another 256 people, 65,536 will have received it.

    [...]

    A communication medium that connects groups of up to 256 people, without any public visibility, operating via the phones in their pockets, is by its very nature, well-suited to supporting secrecy. Obviously not every group chat counts as a “conspiracy”. But it makes the question of how society coheres, who is associated with whom, into a matter of speculation – something that involves a trace of conspiracy theory. In that sense, WhatsApp is not just a channel for the circulation of conspiracy theories, but offers content for them as well. The medium is the message.

    William Davies (The Guardian)

    I cannot control the decisions others make, nor have I forced my opinions on my two children, who (despite my warnings) both use WhatsApp to message their friends. But, for me, the risk to myself and society of using WhatsApp is not one I'm happy with taking.

    Just don't say I didn't warn you.


    Header image by Rachit Tank

    Tracking vs advertising

    We tend to use words to denote something right up to the time that term becomes untenable. Someone has to invent a better one. Take mobile phones, for example. They’re literally named after the least-used app on there, so we’re crying out for a different way to refer to them. Perhaps a better name would be ‘trackers’.

    These days, most people use mobile devices for social networking. These are available free at the point of access, funded by what we’re currently calling ‘advertising’. However, as this author notes, it’s nothing of the sort:

    What we have today is not advertising. The amount of personally identifiable information companies have about their customers is absolutely perverse. Some of the world’s largest companies are in the business of selling your personal information for use in advertising. This might sound innocuous but the tracking efforts of these companies are so accurate that many people believe that Facebook listens to their conversations to serve them relevant ads. Even if it’s true that the microphone is not used, the sum of all other data collected is still enough to show creepily relevant advertising.

    Unfortunately, the author doesn’t seem to have come to the conclusion yet that it’s the logic of capitalism that go us here. Instead, he just points out that people’s privacy is being abused.

    [P]eople now get most of their information from social networks yet these networks dictate the order in which content is served to the user. Google makes the worlds most popular mobile operating system and it’s purpose is drive the company’s bottom line (ad blocking is forbidden). “Smart” devices are everywhere and companies are jumping over each other to put more shit in your house so they can record your movements and sell the information to advertisers. This is all a blatant abuse of privacy that is completely toxic to society.
    Agreed, and it's easy to feel a little helpless against this onslaught. While it's great to have a list of things that users can do, if those things are difficult to implement and/or hard to understand, then it's an uphill battle.

    That being said, the three suggestions he makes are use

    To combat this trend, I have taken the following steps and I think others should join the movement:
    • Aggressively block all online advertisements
    • Don’t succumb to the “curated” feeds
    • Not every device needs to be “smart”
    I feel I'm already way ahead of the author in this regard:
    • Aggressively block all online advertisements
    • Don’t succumb to the “curated” feeds
      • I quit Facebook years ago, haven't got an Instagram account, and pretty much only post links to my own spaces on Twitter and LinkedIn.
    • Not every device needs to be “smart”
      • I don't really use my Philips Hue lights, and don't have an Amazon Alexa — or even the Google Assistant on my phone).
    It's not easy to stand up to Big Tech. The amount of money they pour into things make their 'innovations' seem inevitable. They can afford to make things cheap and frictionless so you get hooked.

    As an aside, it’s interesting to note that those that previously defended Apple as somehow ‘different’ on privacy, despite being the world’s most profitable company, are starting to backtrack.

    Source: Nicholas Rempel

    Every part of your digital life is being tracked, packaged up, and sold

    I’ve just installed Lumen Privacy Monitor on my Android smartphone after reading this blog post from Mozilla:

    New research co-authored by Mozilla Fellow Rishab Nithyanand explores just this: The opaque realm of third-party trackers and what they know about us. The research is titled “Apps, Trackers, Privacy, and Regulators: A Global Study of the Mobile Tracking Ecosystem,” and is authored by researchers at Stony Brook University, Data & Society, IMDEA Networks, ICSI, Princeton University, Corelight, and the University of Massachusetts Amherst.

    [...]

    In all, the team identified 2,121 trackers — 233 of which were previously unknown to popular advertising and tracking blacklists. These trackers collected personal data like Android IDs, phone numbers, device fingerprints, and MAC addresses.

    The link to the full report is linked to in the quotation above, but the high-level findings were:

    »Most trackers are owned by just a few parent organizations. The authors report that sixteen of the 20 most pervasive trackers are owned by Alphabet. Other parent organizations include Facebook and Verizon. “There is a clear oligopoly happening in the ecosystem,” Nithyanand says.

    » Mobile games and educational apps are the two categories with the highest number of trackers. Users of news and entertainment apps are also exposed to a wide range of trackers. In a separate paper co-authored by Vallina-Rodriguez, he explores the intersection of mobile tracking and apps for youngsters: “Is Our Children’s Apps Learning?

    » Cross-device tracking is widespread. The vast majority of mobile trackers are also active on the desktop web, allowing companies to link together personal data produced in both ecosystems. “Cross-platform tracking is already happening everywhere,” Nithyanand says. “Fifteen of the top 20 organizations active in the mobile advertising space also have a presence in the web advertising space.”

    We're finally getting the stage where a large portion of the population can't really ignore the fact that they're using free services in return for pervasive and always-on surveillance.

    Source: Mozilla: Read, Write, Participate