Hacker News Reader

Comment by CubsFan1060 | Hacker News Reader

Ugh. The more I think about this the more complicated it becomes.

I think most people would be pretty ok saying "I'm a part of a classic car community on Facebook, so I get ads on Facebook for classic car things".

I think people would be less ok with "I played a game on my phone while standing in an auto shop. Now I'm getting car ads on my news site because game accessed my location, shared with facebook, who then shared with news site"

I don't know how to make these different use cases clear without having pages and pages of explanation that nobody will read.

View on HN

I don't mind that my ads are targeted based on my location, content of my messages, etc.

... What I mind is that nobody can assure who the buyers of my data are, or what they're really using it for. Facebook says "small businesses", but there are no guarantees it's not your government, a foreign government, your employer, your insurance company, a scammer, etc.

But Facebook never sells the data itself, it only sells targeting capabilities. The government can only say "display this ad to people who fit these categories", but they can never see those identities.

Are you sure about that? https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Ana...

The targeting capabilities are never fully revealed, even if you check the "why was I displayed this ad".

It's always something generic like "reaching people who are over 15 and located in $country".

...then why the fuck is the ad about the exact same thing I was browsing 20 seconds ago on my work laptop or chatted about with my friend on Messenger? I've even got ads on FB properties about products I chatted on IRC with someone I've got no connections on FB with, but most likely our graphs have merged somehow.

This is easy to test, turn off all blockers and go browse for some product you normally don't look for. A bread maker or a washer-dryer combo. Then count the seconds you start getting ads for that exact type of product on FB/IG.

See "Web Custom Audiences"[0] and "Lookalike Audiences"[1]:

Company X sends event logs to FB whenever anyone visits their website. They don't know who you are, but they pass metadata that helps FB determine who you.

Company X can then specify that their ads should be shown to anyone who visited their site in the last, say, 30 days. This is helpful for businesses who want to follow up with the digital equivalent of window shoppers.

Alternatively, Company X could create a "Lookalike Audience", and have FB show their ads to people who have similar characteristics to their existing site visitors/purchasers, but are different users entirely. This is useful for businesses who want to efficiently find new customers.

Most ads people see fall into one of these buckets.

[0] https://www.facebook.com/business/help/610516375684216?id=24... [1] https://www.facebook.com/business/help/164749007013531?id=40...

Even if this was true, the targeting can get so fine grained that you can basically narrow your ads down to individuals, and your ad can be whatever payload you want.

“Deliver this specific JavaScript to all white men in Vermont who own a 2015 iMac 21” who predominantly browse in Private Mode, drive a Mazda 3, and have visited Real Doll twice in the last month.”

That is basically one person. Now you know their location because the JavaScript loaded a unique file from service you have access to.

If the US passed laws that changed personal information ownership to be instead: "Personal information is permanently owned. Individuals cannot sell their personal information, only give licenses for use to individual organizations and licenses can be retracted at any time."

I think that would be a good way to set things up.

>I don't know how to make these different use cases clear without having pages and pages of explanation that nobody will read.

Expose the logic. Put a "?" Icon button on the add that lists every data point used in the decision making process, who collected the data, when, and how.

E.g:

1.1.2020 @ Starbucks on main st in 90210 you bought a medium coffee, a gift card, and a cookie.

1.3.2020 @ Barnes and noble you bought a book and m&MS.

So when the customer wonders why they're being shown advertisements for cat litter they'll be able to see how the ml algorithm thought they'd be interested.

If the logic can't be explained in real time to the advertised too then it surely can't be justified to the actual companies buying said advertisement.

But that's not how sophisticated machine learning algorithms work. Without knowing specifics, it gets us in the right ballpark to imagine they ingest all that kind of information and build an opaque representation of the user/customer, which allows various similarities to be computed between users and ads, regarding how likely they are to be receptive or how likely they will click. There's no short list of events you did. It can even contain stuff like how quickly you move your mouse cursor, whether you use the scroll wheel or the scroll bar, or who knows what else.

The ML algorithms are the ultimate "source: dude trust me"

If all those metrics are being used to sell advertisements against me then I have every right to know each metric, all the details behind every single piece of data collected, from where when and whom, as well as the right to know to know how every data point and metric and is used to sell every specific advertisement to me. That means everything I just enumerated and more must be retained every time a query is run against my data or auction is ran to advertise to me.

What's that about a short list? Sorry, I may not have been clear, if you're using 1 data point or 1x10e999 I have the right to know every single one. I have the right to know the inferences drawn about me and how advertisers can target me. If companies aren't retiring data they are reckless and auditable records for every customer should help to rectify that imbalance. Likewise, if a model cannot be explained, proven mathematically, and reproduced then it's bad computer science. I'm sorry if this seems offensive but I'm sick of the whole move fast and break things when innocent people keep getting hurt or companies fleeced of their advertising dollars.

Either this stuff can be explained in reverse (so consumers know what privacy they've sacrificed, and advertisers know they're not being fleeced) or it can't and there's sketchy or bad computer science at work.

Even if that were possible it wouldn’t really explain why you got this ad vs some other one, so the explanation would fall flat. That is just “how” you got it not “why” you got it.

You're missing my point.

Many ads are sold in real time auctions. Every metric exposed or used in that process should be accounted for and auditable by the advertised too. Let the user, or journalists, or researchers figure out the why from the corpus.

I agree with you about the 2 scenarios.

My concern, though, isn't about potentially pages and pages of explanations. It's more about the fact that I spend time opting out of that kind of stuff and some how still get the ad just because I was standing in an auto shop.

I've got a pi-hole on my home network, I've opted out of personalized ads on every site that gives me the option. I try to make it clear, "leave me alone."

But still I get ads that tell me I'm not being left alone.

The problem is these tools we're given to opt out, and we learn that they don't work; and a feeling that everyone in the world except marketers have to seek explicit consent.

Reply on news.ycombinator.com