Hacker News Reader

Comment by baconner | Hacker News Reader

Get ready for ads to start addressing you directly by name and doing other like things to get your attention. Google isn't usually _too_ overt about these sort of things but the less savory ad networks could get really unpleasant.

"Hey there George Thompson, click to see one weird trick to hide your arrest records from your wife Mary"

View on HN

  You are prohibited from creating ad content which implies knowledge
  of personally identifiable information or sensitive information
  about your customers ...

  Sensitive information about your customers can’t be used in Customer
  Match campaigns or ads. Additionally, you can't use data from
  your Customer Match campaigns to identify sensitive information
  about your customers.

Sensitive information includes:

  Interest or participation in adult activities (including alcohol,
  gambling, adult dating, pornography, etc.)

  Sexual behavior or orientation, such as sexual orientation
  inferred from a user's visit to a particular website

  Racial or ethnic information, such as from sites or apps that
  collect affirmative racial or ethnic identification from visitors

  Political affiliation (other than the public registration information
  of United States voters), such as from sites or apps that solicit
  or store people's affirmative political stances

More here: https://support.google.com/adwordspolicy/answer/6299717

_you_ are prohibited, but Google is not. I'd suspect they will mix in more and more of this context (from Nest, from emails you provide, from your driving habits on Google Maps) to make ads "more personal" as time goes on.

Presumably Google could already be doing this in their own ads before this announcement. I don't know if this announcement implies any nefarious motives in this space (not to say they aren't planning this, but just seems unrelated).

There is actually a creep-out effect with taking this too far I think that drives people away from ads that are too stalkery. Consider the case of target who toned down the exactness of some of their targeted mailer ads to women likely to be pregnant after accidentilly kicking off the outing of a pregnant teen to her family.

Perhaps we should be more creeped out by the more subtle personalized ads than the clumsy attempt I suggested.

The creep-out effect depends heavily on whether you're a company with a reputation to protect (like Target)

As for the more subtle way of using this personalization will be to stick more ads in the faces of people that once signed up for a service but don't use it as much these days and don't open the reminder/newsletter emails that end up in their "social" or "promotions" tabs. I found this sort of badgering with traditional ad retargeting creepy enough to drive me to install an ad-blocker, but it undeniably works and is heavily used by companies that care about their reputation.

I just wonder how quickly Google will be able to nix those ads when people do this anyway and how creeped out people will get.

advertisers will do what they do. pay some money on that to tag users with 3rd party cookies (which was 50% of the reason Google sponsored Mozilla. guess if it's enabled by default on chrome...) and then show that personal information on dynamic display (images, flash) ads. probably even on other networks since Google's suck for display.

The fact that they can do it and are banned by an EULA is just as creepy (if not more) than them actually doing it.

So some more digging and it seems there will be a minimum of 1000 users per group [1], so we aren't quite yet at the point of targeting individuals.

[1] https://support.google.com/adwords/answer/6276125

Yeah that's not too awful. Google's too smart I think to do something as overt as my example.

And it says "Active visitors", makes me think it might not work with 1 real address and 999 fake ones

I fully expect the folks who make Facebook like and YouTube video view farms to start farming email addresses you can use for this.

Well, google doesn't know if people are active on non-google sites. And they couldn't tell advertisers or people would be able to upload 999 fake emails and 1 real one and tell if they're an active google user.

- google doesn't know if people are active on non-google sites -

I don't have numbers, but I know that the overwhelming majority of sites I see in a given day, week, or month use google analytics. A helpful 'free' tool that gives site owners excellent stats, and gives google insights into almost all of the off-google browsing that happens...

I wouldn't hold your breath. Marketers can already do this to an extent on Facebook. FB allow targeting in minimum groups of ten emails at a time. For large companies it's easy enough to batch data groups of 10 for things like happy b'day or 'Hello George' type messages. Or to take it to the 1-1 level there was an amusing case of someone trolling their flatmate by uploading 10 email addresses, nine of which were girls and selecting the sub-targeting option of 'male only'. He then ran super personal ads to freak out his flatmate. FB may have fixed this 1-1 option now given the publicity.

Personally I don't do these type of comms in my marketing as people find it creepy. Nor have I seen other utilising this like that. I have used FB for targeting with generic ads so people don't realise they are being targeted at that level. It was quite effective. End of the day professional marketers are trying to get relevant ads in-front of relevant users and not waste budget with unneeded impressions/clicks.

All that said, I do see the potential for abuse on this. I kinda feel regulators need to step in and place clear guidelines for people protection, perhaps rules around PII (personally identifiable information) sharing between organisation which is getting very common these days to enrich each others data. Also in the same way many professionals are accredited, I wonder if people working across larger PII data sets should require accreditation. Something that ensures they know the rules, and if they are abused they can be removed from the industry.

As another posted commented, there will be a minimum list size to prevent this sort of thing. For example, Twitter already allows targeting to specific individuals, but the list minimum is 500 (if I'm not mistaken).

But couldn't I put:

youremail@gmail.com

fakeemail-1@gmail.com

....

fakeemail-499@gmail.com

I should've been more specific. Twitter requires a list of 500 _recognized_ emails.

What's stopping me from setting up 500 recognized emails?

For this Google offering they're likely to use the same tech that powers their new CAPTCHA-less reCaptcha.

Which is trivially broken by having real people simulate a bunch of real Gmail accounts. Services like this already exist for Facebook likes, YouTube views, etc.

Which is (a) cheaply broken by hiring a few hundred bored students, and (b) is also even possible to be broken analytically. It is actually easier to break than the highest level of the previous captcha, as now you just need a Google account with semi-normal activity and a JS runtime that pretends to be a normal browser. The semi-normal activity is simple to be possible by running it as a bot and feeding it with search queries for 8h a day, running a query every few minutes. Which, in turn, gets the account marked as active.

    def scumbag_targeted_campaign_builder(accounts):
        for name, users in groupby(accounts, key=lambda x: x['first_name']):
            users = list(users)
            while len(users) <= 500:
                users.append(generate_fake_email())
            yield render_template(name), users

Some variation of this is pretty easy, and likely will become common.

I wonder how easy it is. Google says they require 1000 "Active visitors." So you need to not only create 1000 fake accounts to target a single real individual, but run 1000 undetected clickfraud bots (and then pay out on your own clickfraud). Not sure of the current state of the clickfraud arms race, but maybe there are cheaper and easier ways of snooping?

I don't imagine targeting any random user is particularly efficient, but when you are dealing with multi million user databases, finding close to a thousand people who share a first or last name probably isn't hard. They don't even have to address it to a person, simply provide some details (details vary based on database). Think "How was you recent trip to Hawaii? Click here for winter deals!"

Far more sinister would be "Your wife Mary has an arrest record, click to see it!" (but of course, she doesn't - they just want the click, and get to imply validity by means of knowing other personal details).

As you said, I doubt Google would try/permit this, but this will certainly come through.

Wouldn't that be classed as defamation?

"Does your wife Mary have an arrest violation? Visit now to find out!"

URL: http://www.arrestd.com/mary-smith

H1: Is your wife Mary secretly a criminal?

Body: Who knows what secrets are being hidden from you -- right under your nose! Do you know Mary as well as you think you do? For only $2.99/month we will alert you to any criminal actions and public records that we find on your wife. Get started today! Easy payments with Paypal

Related Stories: Is your ex-wife Harriet on Ashley Madison? Is your brother Blake in debt? Are your parents Anita and John under foreclosure?

Some ads already have that much info about you if you're being advertised to because of retargeting/remarketing. Eg when you bail from a site with something in your shopping cart and that item follows you around the internet.

That said, this is a great reason not to browse the internet with logged in google email. That was always the flaw in the firefox 3rd party cookie blocking debacle: it would have been an enormous gift to fb, google, and twitter.

I am curious, why do they always say the word "weird" in these ads? It's too tacky for most people to think they are "dispassionately" describing the product. One weird trick. It's almost a shibboleth now of hucksters.

Most people on HN have probably grown sick of those stock phrases, but if they're still using them in ads, there's probably "plenty of other fish in the sea" willing to take the bait... if you've ever observed "normal" computer users browsing for any length of time, you'll see what I mean.

Which is kind of half pointless. I see ad's all day long that are half relevant to me. I rarely click on them. Just because they start screaming my name doesn't make me more likely to click.

The most effective advertisements aren't ads. Most of the time I use a product or service it's because I saw someone on here or someone I know talking about it.

> Just because they start screaming my name doesn't make me more likely to click.

I suspect you are a relatively rare border case, then.

This came up a few days ago on HN. There is brand awareness as well as direct sales. So if you see a Heroku advert, then see an article on HN a few days later about it, when looking for quick app deployment you may start at heroku instead of engineyard.

Also, everyone underestimates how much advertising works. People often downplay advertising and beleive it affects others much more than themselves. While for low hanging fruit like MacKeeper, a shit-tier virus-spam-app that constantly is displayed via popups, targeted ads based on your preferences are subtle and difficult to weigh.

Reply on news.ycombinator.com