New evidence of how ad auction companies, including Google, profile internet users based on sensitive personal information, including diseases and disabilities, has been provided to data protection authorities as part of formal complaints about the online ad industry.
On Monday, Warsaw-based digital rights organisation the Panoptykon Foundation will join complaints filed with regulators in Ireland and the UK last September.
The complaints, including one to the Data Protection Commission, were filed by Jim Killock of the Open Rights Group, Michael Veale of University College London and Dr Johnny Ryan of web browser company Brave.
The complainants said they had filed new evidence on Monday with the data protection authorities revealing how ad auction companies, including Google, “unlawfully profile internet users’ religious beliefs, ethnicities, sexual orientation, diseases, and disabilities”.
Such sensitive information is classified as “special categories” of personal data in the General Data Protection Regulation and there is a general ban on processing it unless strict conditions are met, which include explicit consent.
Categorise
“Every time you visit a website that uses ad auctions, personal data about you is broadcast to tens or hundreds of companies. As part of this process, ad auction companies categorise what you watch or read or listen to,” they said.
“The categories can be benign, such as ‘Tesla motors’, ‘bowling’, or ‘gadgets’. But, as the new evidence filed today shows, they can also be extraordinarily sensitive.”
Official documents from the Interactive Advertising Bureau, the organisation that makes the rules for online ad auctions, reveal categories for targeting internet users include one titled "IAB7-28 Incest/Abuse Support".
This enables ad auction companies to target and profile a person as an incest or abuse victim.
‘Sensitive’
Other IAB categories relate to “sensitive and embarrassing health conditions, religious denomination and sexual orientation”.
The complainants also published Google’s category list for online ad auctions, which includes “eating disorders”, “left-wing politics” and “Scientology”. They said there were “hundreds” of such sensitive categories in the IAB’s and Google’s lists enabling the profiling of users.
They said ad auction firms broadcast intimate profiles about an average UK internet user 164 times per day, according to The New Economics Foundation’s estimate.
“These profiles are received by thousands of companies, and there is no control over what happens to them.”
Dr Ryan, chief policy and industry relations officer with Brave, said the documentation listing the categories used to target people had been “hiding in plain sight” but had never been presented as evidence before.
The complainants say tracking IDs and other personally specific information “are not actually necessary for ad targeting, but allow you to be reidentified and profiled every day”.
‘Tracking IDs’
“Ad auction companies can fix this by simply excluding personal data, including tracking IDs, from bid requests,” Dr Ryan said.
“Ad auctions could then operate safely. With minor changes, ad auctions could operate outside the scope of the GDPR, protecting marketers and publishers from significant risk.”
Michael Veale, technology policy researcher at University College London said: “Actors in this ecosystem are keen for the public to think they are dealing in anonymous, or at the very least non-sensitive data, but this simply isn’t the case.”
“Hugely detailed and invasive profiles are routinely and casually built and traded as part of today’s real-time bidding system, and this practice is treated though it’s a simple fact of life online. It isn’t: and it both needs to and can stop.”
