1. 35
  1.  

  2. 3

    This ID is then used to deliver targeted ads and track users across the web.

    This is wrong.

    Most advertisers don’t target ads on desktop using anything other than plain old HTTP cookies. There are lots of reasons for this, but they largely boil down to (a) they don’t have to, and (b) they don’t want to invade your privacy either.

    The reason an advertiser wants to collect this is so that they can pay more money for advertising, which allows publishers to make money with quality content that keeps users coming back.

    Meanwhile, a publisher who has a large number (99%) of Windows 7 machines that all have Arial Nova is probably running fraud.

    Ad fraud pushes the price of advertising down, which doesn’t hurt ad networks like Google, or even the biggest online advertisers, but it does hurt publishers. It means that a website owner either has to change their content to appeal to a wider audience (more traffic), or they need more ads.

    I wonder how many people advocate this kind of privacy-focused browsing in exchange for more fake news and lower quality content with their eyes wide open?

    1. 5

      Most advertisers don’t target ads on desktop using anything other than plain old HTTP cookies.

      I don’t doubt this but do you know where one could find statistics about this? I wonder what portion of advertisers is this true about. To what degree is this true for mobile as well? Is fingerprinting a growing trend? Also, personally I’m happy to see advertisers that use fingerprinting thwarted, even if they are a minority.

      In any case there is virtually no way for consumers to audit their data footprint apart from preventing the collection of the data in the first place. Additionally, if data is collected, but not used for targeting today, it still has the potential for being used for targeting tomorrow, or else being resold and shared by a company who does targeting. I’m not sure how it makes sense for someone concerned about their data to give faceless companies the benefit of the doubt, advertising companies in particular.

      The promise of getting better content by indirectly paying publishers with my publishing data is unconvincing to me personally. In general, I find that the degree to which a site derives its revenue from advertising is inversely proportional to its quality.

      1. 3

        I don’t doubt this but do you know where one could find statistics about this? I wonder what portion of advertisers is this true about.

        It’s almost 100%. It’s certainly 100% of any big (national) advertiser. Every ad exchange I’m aware of requires the advertiser fill out a questionnaire that says they won’t use things like E-Tag, or evercookies and flash cookies, and so on. Google use this language: Flash cookies and other locally shared object (LSO) technologies are not allowed on Ad Exchange.

        To what degree is this true for mobile as well?

        It’s almost zero. Mobile RTB uses IP address and user agent – which works because mobile apps set the user agent to include the app name. Google and Facebook will sync this data on their platforms to enable cross-device targeting, but it’s still not very sophisticated.

        Is fingerprinting a growing trend?

        Not for ad targeting. Yes for ad fraud.

        Big advertisers can measure the effectiveness of a sophisticated marketing campaign over the course of 6-12 months, and ad fraud is one of the biggest predictors of voidage, so it follows that fingerprinting is valuable insofar as it can detect ad fraud.

        Also, personally I’m happy to see advertisers that use fingerprinting thwarted, even if they are a minority.

        Even though it means more fake news and lower quality content?

        Forget whether you think it’s likely for a moment, because if you’re willing to trade that – then it’s irrelevant, but if not, then see below.

        In any case there is virtually no way for consumers to audit their data footprint apart from preventing the collection of the data in the first place.

        That’s not true. Every data provider makes it possible to get this information, sometimes in a very friendly format. For example, here’s BlueKai’s information about you.

        I think advertisers would be happy to put this information wherever you want, but it’s proven very difficult to have a productive conversation with privacy advocates. They seem more interested in short-term gains rather than discussing the long-term effects of their positions.

        The promise of getting better content by indirectly paying publishers with my publishing data is unconvincing to me personally. In general, I find that the degree to which a site derives its revenue from advertising is inversely proportional to its quality.

        Right now, ESPN can get $5-9 per thousand users per ad if they sell demographic data, or $1-2 without. These numbers are typical, and but a small site can’t command these prices directly since the sale of this traffic is logistically difficult. If we make it easier, it should be evident that smaller sites will be able to 5-10x their revenue, but the problem is: how do we make it easier for them, without making it easier for ad fraud?

        Fingerprinting can help tremendously, because it gives us a way to ask what is (technologically) normal. If we defeat it, how exactly are we supposed to valuate this traffic?

        1. 6

          Thanks for responding.

          Google use this language: Flash cookies and other locally shared object (LSO) technologies are not allowed on Ad Exchange.

          Wait, I was asking about fingerprinting. I see that Flash cookies are not allowed. But fingerprinting refers to determination of identity by aggregating multiple sources of data, with or without Flash supercookies - user agent, canvas, font (per the article), battery API, WebRTC, etc. I might be missing something but I don’t see those practices forbidden in the page you linked.

          Mobile RTB uses IP address and user agent

          AT&T, last I looked, requires you to opt-out of using your data for targeted ads. Presumably because of this they are able to tie all your internet traffic to your profile. I have no idea what happens to this data or how to audit it. Also historically ISPs have tested placing supercookies in http request headers. Based on both of these examples I am under the impression that mobile tracking is more sophisticated than just dumb aggregation by IP address, user agent, and mobile app name.

          Even though it means more fake news and lower quality content?

          I’m quite skeptical of the argument that advertising revenue drives quality content. Rather it seems like the opposite. “Fake news” and clickbait are both examples of this. It’s the plenitude of advertising dollars that drives these practices, not the opposite.

          For example, here’s BlueKai’s information about you.

          A customized hosts file and ad-blocker makes it very difficult for me to open that page :) When I was finally able to do so, it didn’t show me any data, so I visited the sports site they linked to, and came back, and it said that I am located in the country I am indeed located in :)

          But browser fingerprinting is based on collection of low-level data such as I mentioned. I didn’t see in that page any of the data points used in fingerprinting - I didn’t even see my IP address, which presumably they were using for geolocation. My comment was “there is virtually no way for consumers to audit their data footprint” and I still would say this is true.

          Additionally browser fingerprinting is a powerful technology that can be used to construct user profiles after the fact. Let’s say I collect a database of data points from user browsing sessions. Based on these data points I can run analysis and, within a certain degree of likelihood, link data points from heterogenous sessions together and identify them as coming from the same user. Even if this is beyond the technical sophistication of current ad networks, that doesn’t mitigate the risk that these sorts of queries and analyses will become commonplace in a few years time, at which point these queries and analyses could be run retroactively on historical data. Once this data is collected and stored my profile exists “virtually” even if it doesn’t exist “actually.” As a consumer visiting bluekai’s website, I’m not able to see what data they have about me - only some gross aggregation that could retroactively change with the use of more sophisticated methods.

          I think advertisers would be happy to put this information wherever you want, but it’s proven very difficult to have a productive conversation with privacy advocates.

          You make it sound as if advertisers are working in good faith. Yet requiring opt-out rather than opt-in for tracking is a dark pattern. To me this seems like glaring evidence of something other than good faith. Additionally, as far as I can tell, privacy laws are a major impetus here for much of the transparency we do see in the advertising industry.

          [T]he sale of this traffic is logistically difficult. If we make it easier, it should be evident that smaller sites will be able to 5-10x their revenue, but the problem is: how do we make it easier for them, without making it easier for ad fraud?

          Personally I’m not concerned about the revenue of large or small sites from advertising dollars. I view advertising as a parasitic industry that drives content quality down while building up opaque databases about people - a net negative. Something like, say, basic income seems like a much better solution for small, independent content creators than advertising with its numerous downsides.

          1. 3

            I might be missing something but I don’t see those practices forbidden in the page you linked.

            You’re not going to find it on that page, but linked to in industry guidance, such as youronlinechoices.com.

            Here’s another page. It specifically mentions more “fingerprinting” techniques and keywords that I think you’re scanning for.

            You might try learning more about this.

            AT&T, last I looked, requires you to opt-out of using your data for targeted ads. Presumably because of this they are able to tie all your internet traffic to your profile. I have no idea what happens to this data or how to audit it. Also historically ISPs have tested placing supercookies in http request headers. Based on both of these examples I am under the impression that mobile tracking is more sophisticated than just dumb aggregation by IP address, user agent, and mobile app name.

            You might look again. It’s not much more sophisticated than that because none of those things worked very well: Verizon and AT&T and anyone else could include whatever they want in the header, however participants in this space can’t easily exchange that information with their partners, so it isn’t as useful as they might hope.

            Here’s the documentation for BlueKai’s Mobile ID which is indeed, just user agent and IP address.

            Based on these data points I can run analysis and, within a certain degree of likelihood, link data points from heterogenous sessions together and identify them as coming from the same user.

            However you haven’t explained why you think this is bad. That’s my question.

            Knowing that a user is, within a certain degree of likelihood, interested in some topic X, allows for the sale of advertising to a marketer interested in reaching people interested in X: Now instead of estimating 50% of people are interested in this topic, and buying double the people (at half the budget) they can be more efficient, but it also means that publishers can specialise their content, and tailor it for specific (small) interests.

            Do you think that the Internet should only have content that is (a) for direct-pay (by credit card), or (b) is of interest by at least 10% of Americans? Targeting makes it possible to have sites that are interesting to as low as 0.3% of Americans, and still earn the operators a NYC-liveable wage!

            You make it sound as if advertisers are working in good faith. Yet requiring opt-out rather than opt-in for tracking is a dark pattern. To me this seems like glaring evidence of something other than good faith. Additionally, as far as I can tell, privacy laws are a major impetus here for much of the transparency we do see in the advertising industry.

            Yes, because I think most of them are. Especially the big ones. And I think this is a bit hyperbolic.

            What terrible thing are you trying to prohibit? I don’t even know what you mean by “dark pattern”.

            It isn’t what people expect? People are watching a television program that is sponsored by marketers who sell products that may be of interest to people who are interested in that television program, and I can’t imagine what other transaction people expect could be going on. Or should be.

            Personally I’m not concerned about the revenue of large or small sites from advertising dollars. I view advertising as a parasitic industry that drives content quality down while building up opaque databases about people - a net negative. Something like, say, basic income seems like a much better solution for small, independent content creators than advertising with its numerous downsides.

            I don’t think wishing for things is very productive. Do you think by blocking enough ads that Verizon Wireless will send their lobbyists into congress to push for a universal basic income? What exactly are you proposing we do?

          2. 7

            The idea that fake news arises when people take measures to protect their privacy only makes sense if you ignore the entire history of media and advertising.

        2. 8

          I wonder how many people advocate this kind of privacy-focused browsing in exchange for more fake news and lower quality content with their eyes wide open?

          Your argument here seems to be that when ad rates fall too low publishers will simply go out of business unless they publish fake news. But that would be fine with me because then I could accurately ascertain the legitimacy of a site simply by checking to see if it has ads. If it does, it’s fake news, if it doesn’t, then I might pay attention because it’s run either by a company with a real business model or a non-profit.

          I simply don’t accept the premise that advertising is necessary for good content. In fact, I think advertising actively discourages good content. So I’m happy to see it die.

          1. 1

            Your argument here seems to be that when ad rates fall too low publishers will simply go out of business unless they publish fake news. But that would be fine with me.

            Wow.

            That honestly surprises me.

            Thanks for your opinion though.

            1. 4

              Well, it might be less surprising if you hadn’t clipped my quote where you did. Basically, if a publisher can’t convince people to pay for its content (in either a for-profit or non-profit manner) then the content is probably not all that compelling or the publisher is structured in an inefficient manner. I’m 100% positive that there are exceptions, though I can’t personally think of any, and I’d have to consider those separately.

              By the way, I pay for a number of subscriptions to both physical magazines (none of which publish ads) and web sites (which also don’t publish ads). Most are non-profits. I find that I have no trouble finding interesting, thought-provoking things to read. In fact, there’s more content than I can even consume reasonably.

              1. 2

                I can’t personally think of any [exceptions], and I’d have to consider those separately.

                You have a twitter account.

                By the way, I pay for a number of subscriptions to both physical magazines (none of which publish ads) and web sites (which also don’t publish ads). Most are non-profits. I find that I have no trouble finding interesting, thought-provoking things to read. In fact, there’s more content than I can even consume reasonably.

                And of course, you have a search engine you pay-per-search, the google fonts you pay for on your website, the creative-commons advertisement at the bottom of your website, the fact you use Ubuntu which is advertising supported, and so on.

                Sponsored content is pervasive, and it’s a huge part of what (mentally) ratchets our prices and costs so low.

                Well, it might be less surprising if you hadn’t clipped my quote where you did.

                You either answered the question I asked (which ended there), or you’re answering a different question that I didn’t ask, and that I’m not really interested in talking about (how you as a reader detect a fake site).

                Do you think it matters? You don’t seem to think that targeted ads for less fake news and crap content is a fair trade, because, in your words: There is “more content than I can even consume reasonably”. Maybe you just weren’t aware that twitter or Google et al are only able to produce the content and services you consume because of advertising.

                Or maybe you don’t care – if Google give services away for ads that you can block, then they’re suckers, and you’re patting yourself on the back for being so smart, but you’re also facilitating the fake news and crap content that is bombarding human beings that aren’t so smart as you.

                Where exactly do you think this kind of conversation can go?

                1. 2

                  I’m enjoying your posts on this topic, thanks :).

                  Could you elaborate on how using google services with an adblocker is facilitating fake news and crap content?

                  1. 1

                    Could you elaborate on how using google services with an adblocker is facilitating fake news and crap content?

                    The biggest brands have advertising budgets that are relatively fixed. Their goal is to get a certain [reach] from a given medium, and the planner/buyer is going to do this with the fewest number of transactions possible. Exactly how they go about doing this varies, but because the budgets are fixed, if you block an ad, then Google simply doesn’t sell you, so the publisher misses out, but Google receives x% of that entire budget, so they are (relatively) unaffected.

                    Meanwhile, a lot of these fake news/crap content sites will purchase the traffic – “legitimately” by purchasing search, or less legitimately in the form of injection/toolbar users or even pops. That less-legitimate is particularly important, and generally has some technological sameness (like having the same fonts, or has some plugin installed on all the traffic), but you’re not going to these sites anyway, so if 20% of users have an ad blocker, that’s only 20% of real traffic, not this traffic. That means that when the advertiser spends their money, more of their money moves to these vehicles, instead of sponsoring real sites.

                    The advertiser will (eventually) check the effectiveness of their campaign, and see that this media buy didn’t get them very/any benefit, so the ROI on their spend will be poor. They will want to count the users – if some of the traffic is invalid and can be excluded, then the ROI on the real traffic might be good (or at least close to their predictions), but if they cannot exclude any traffic, for example because we have stopped tracking/analysis of this traffic, then the advertiser simply pushes the price of the audience down.

                    Does that make sense?

                  2. 2

                    Creative Commons is ad-supported? Really? Seems unlikely. Twitter I would happily do without if I was asked to pay anything more than nothing. Google Web Fonts, again, I would never pay more than nothing for anyway. Ubuntu is not ad-supported in any meaningful way, they barf out Amazon links but the feature is turned off by default these days AFAIK.

                    A lot of this is basically an economic question. I consume these things because they are free. If they cost more than zero I wouldn’t consume most of them because they are worth practically nothing to me. In the case of Twitter, I consume it because other people I find interesting consume it. But most of those people wouldn’t pay for it (because they are like me), so if Twitter charged those people would leave, and I would leave.

                    If Google offered me a way to pay not to see any ads and to not be tracked I would seriously consider it. As it is, they only offer a way to pay to see fewer ads. Additionally, so long as ad networks are regularly tricked into serving malware, I view ad-blockers as critical security software. Fix your industry and you might find people like me more sympathetic.

                    Or maybe you don’t care – if Google give services away for ads that you can block, then they’re suckers, and you’re patting yourself on the back for being so smart, but you’re also facilitating the fake news and crap content that is bombarding human beings that aren’t so smart as you.

                    Your argument about “fake news” just isn’t believable, especially when so much “fake” content is published by “legitimate” outlets. Fake news is really more a result of competition (capitalism) in the information industry than anything else. When companies compete for eyeballs (whether they’re paid eyeballs or ad impressions), and there are no rules about telling the truth, there will be a tendency to report whatever “sells”. Your argument is essentially the equivalent of those commercials that told kids that smoking pot supported terrorists.

                    1. 1

                      Additionally, so long as ad networks are regularly tricked into serving malware, I view ad-blockers as critical security software.

                      I’m not arguing that you should disable your ad blocker. I simply think you’re facilitating what will be seen as a huge mistake by confusing this issue with the tracking and privacy issues.

                      I consume these things because they are free.

                      You’re wrong. Google is able to permit redistribution of these fonts and make self-driving cars because of advertising.

                      What you’re proposing is not vaccinating your kids. It has real effects that don’t affect you immediately, but it’s going to affect everyone else in your community.

                      Creative Commons is ad-supported? Really? Seems unlikely.

                      Straw man? Really? Creative Commons receive donations and spend the money on advertising. You’re the advertisement.

                      Your argument is essentially the equivalent of those commercials that told kids that smoking pot supported terrorists.

                      Sigh. Smoking pot does support terrorists. So what? It also supports roads and skiing, health programs, and safety programs. Just because marijuana legalisation is probably a net positive doesn’t mean that there aren’t gross negatives. This is just your myopia, and while you complain about “dark patterns” you’re going into an arms race where the collateral damage is malware and representative democracy.

                      But maybe there’s another way: The bulk of the advertising spend isn’t interested in serving malware either. Learn about the market and find a way for everyone close to the money to get a balloon, while still getting what you want, and maybe you’ll actually get what you want in the long run as well.

                      1. 3

                        You’re wrong. Google is able to permit redistribution of these fonts and make self-driving cars because of advertising.

                        No, I’m not wrong. You seem to think I’m an idiot and don’t realize that someone has to pay for everything. They are free to me. If Google started charging more than I was willing to pay for fonts I’d just stop using them. That’s how economic decision making works. Google Web Fonts is worth maybe $1/year to me. Right now, the price to me is zero. I use them because my surplus there is still positive. But I’m not going to make it easy for Google to track me just because they’ve got a tricky business model. If they feel it’s not worth their while to host the fonts, fine, let them stop. Or let them charge and people will decide accordingly.

                        Also, why do we need Google to provide fonts and self-driving cars in the first place? If you’re into markets, and you seem like the type who is, you can correct me if I’m wrong, shouldn’t the market provide those things if they provide value to society (and therefore people are willing to pay)? Now you sound like a late-90s record executive complaining about MP3s. No one owes anyone a business model. If the only way you can make money is by doing something that I find creepy and potentially dangerous then I have no sympathy.

                        Straw man? Really? Creative Commons receive donations and spend the money on advertising. You’re the advertisement.

                        You brought up Creative Commons. Not me. I have no idea what you were trying to demonstrate by pointing out that I link to the CC web site from my web site. Last I checked that was basically the killer feature of the web.

                        This is just your myopia, and while you complain about “dark patterns” you’re going into an arms race where the collateral damage is malware and representative democracy.

                        There are a ton of things I believe are far, far more detrimental to representative democracy. Real existing capitalism itself, for one.

                        But maybe there’s another way: The bulk of the advertising spend isn’t interested in serving malware either. Learn about the market and find a way for everyone close to the money to get a balloon, while still getting what you want, and maybe you’ll actually get what you want in the long run as well.

                        Yep, sounds like something the ad industry should focus on. Until I feel I can trust them, however, I’m blocking everything I can reasonably block.

                        1. 1

                          No, I’m not wrong.

                          Yes. You are wrong. Full stop.

                          You seem to think I’m an idiot and don’t realize that someone has to pay for everything. They are free to me.

                          Well, I don’t think you’re an idiot for that: You clearly realise someone has to pay for it. You just don’t think it’s you. You think you’re somehow hurting google or “the advertising industry” by using an ad blocker, and you’re completely wrong about that.

                          It’s unclear if you know who it’s actually hurting and who it’s actually helping. I think you probably do by now, but you’re so angry you’re growing belligerent; Nobody called you an idiot, so calm down.

                          No one owes anyone a business model. If the only way you can make money is by doing something that I find creepy and potentially dangerous then I have no sympathy.

                          That’s true, but you’re creating more opportunity for more creeping and greater danger, rather than actually reducing the amount of creepy and dangerous things.

                          I don’t know if you’re doing this because you’re ignorant (which I hope), or you simply lack empathy for the people who are being creeped on, and actually being put at risk of that greater danger.

                          I link to the CC web site from my web site. Last I checked that was basically the killer feature of the web.

                          That’s exactly what an advertisement is: The killer feature of the web. You don’t even realize your website has advertisements on it, because when I say “CC advertises” you somehow thought that I meant that “Creative Commons is ad supported”. Or you were trolling. Again, I’m not quite sure.

                          Anyway, that’s how big this marketplace is. You can’t block advertising, you can block a certain kind of technology that makes advertising more efficient for publishers. You know that because you’re not an idiot – the question isn’t even whether that efficiency is worth the other risks;

                          The billion dollar question is whether there’s a way to get publishers what they want (the efficiency) without the risks.