The Hidden-Pregnancy Experiment: Could I Hide My Pregnancy from My Phone?
newyorker.com
newyorker.com
The most powerful signals now are not demographics and search history, but location, transactions and automatic content recognition (ACR).
Transactions is pretty straightforward, your bank and/or payment networks sell your data to brokers at a merchant level. Many retailers sell your data at a SKU level.
Location is less visible. There are various levels of granularity of location tracking and reporting built into many SDKs that are included in just about any mobile app you download, and that data is sold.
Automated content recognition (ACR) is the craziest. The actual contents of your screen- the Instagram post, the TV show you are watching, etc (and its underlying transcript) are analyzed by the app or the TV, and sold often in real time to data brokers with such efficiency that you can be viewing the photo of the new Land Rover your friend just bought and posted, to your very next swipe being an ad for a Land Rover
I happen to live in one of country with the highest GDP per capita (higher than the US) and I also spend lots of time in another country, in France, on a very famous place on the french riviera. That'd be the location part.
Then I love fast expensive sports cars. I just can't help it. Own two or three.
So what kind of ads do I get all the time? Ads for very very very rich people. Ads that want to sell me private jets flights or... Directly private jets. Yup: I'm not kidding, I keep getting ads where this insert many millions here private jets are for sale. Porsche cars: all the time.
Needless to say: I don't have anywhere what it'd take to fly private, let alone buy a private jet (even used).
But I find it funny: somehow the ad industry is thinking I'm completely ballin'.
Now of course I make sure to not only click on the ads but also pretend I'm deeply interested: for example I'll make sure to Google "Is a used Embraer better than a used Gulfstream?" : )
That automation has reached this degree of sophistication is why I claimed in my post that internet privacy is dead for the vast majority of people.
One cannot own a smartphone and maintain even a modicum of privacy unless one takes drastic measures such as those mentioned in my post. And the vast majority will never go that far and Big Tech is fully cognizant of the fact (acquiescence is so much easier than struggling to achieve one's privacy, it underpins Big Tech's huge success).
They might match your phone up with someone elses laptop and you'll see ads for stuff they searched.
They might get your location wrong by 1000 miles and suddenly all the ads are in French.
You might have clicked no to a cookie banner so now you get to see ads for ED medication despite definitely not having a use for it...
Advertising is all a numbers game, and they just aim to be mostly right most of the time.
Oh,the hubris on this one...
Can you say with 100% confidence that everyone you know and interact with has as good as a digital hygiene as you?
Can you say with 100% confidence that no company is acquiring data about you through shady brokerages?
Can you say with 100% confidence that no company had a data leakage (accidental or not) and went on without reporting it?
Not actionable, how? GDPR hasn't stopped companies from collecting the data, it just added a bunch of roadblocks which are being overcome via dark patterns that make the majority of people consent to data sharing.
Based on rare encounters with data processors outside of EU. They sell their products to me based on the knowledge that is at least 10 years old (and they use some old contacts for it).
> I just gave an example
Irrelevant. I‘m talking only about my experience, because I‘m actively exercising my rights under GDPR and similar privacy laws.
> GDPR hasn't stopped companies from collecting the data
GDPR made it illegal to collect it without unambiguous consent. If you want privacy, you can get it. As I can see from the inside sources, every big business in EU cares about compliance. Startups usually take a risk-based approach, but they don’t dare to sell the data and mostly compromise on security until they get bigger. Overall, here it is much safer and saner environment, if you don’t consent to marketing stuff. All you need is to read the label on the checkbox when you sign up.
Your first comment was arguing "tracking doesn't exist in the EU, because we have regulations for it". Now this here is a much weaker version of the argument, because it means "data tracking can be avoided if you are always vigilant and practice good Internet hygiene".
You might believe that you are protected, but what I am saying is that even those aware of tracking might end up getting a lot of their data collected via those that are not.
It was not. It is false generalization of my words.
>those aware of tracking might end up getting a lot of their data collected via those that are not
We all leave pretty big footprint both online and offline, very often through a consented and legitimate process. It is a simple matter of data hygiene to make most of that footprint just useless pile of bits if you control the narrative and spread of information is constrained. Who cares if one of my phone numbers landed in a public database because I registered a company many years ago? I wrote a lot on this forum — do you think you can build a precise portrait of me with this, that or some other data? Do you really believe one can use it against me in a way I would not expect? A while ago I was working on a data mining project for some Western government, an information warfare they used to shape public opinion globally. I know quite well what data can be extracted, especially with modern technology. Without privacy laws there exists asymmetry between data industry and individuals, but the balance is shifting to the point, where you can actually manage what others know about you.
Accidentally misfiring an ad has no consequences if it doesn't happen in place of a better targeted ad and you don't reliably abandon the platform as a result.
Company I worked for a decade back used to show charity ads when there was no relevant ad campaign.
I remember a podcast about this. Maybe Reply All. But I cannot find it anymore.
But this way makes a better story.
See:
https://www.forbes.com/sites/kashmirhill/2012/02/16/how-targ...
https://www.nytimes.com/2012/02/19/magazine/shopping-habits....
and
https://www.kdnuggets.com/2014/05/target-predict-teen-pregna...
https://www.nytimes.com/2012/02/19/magazine/shopping-habits....
Lots of ED ads, lots of "How to retire" ads, those weird ads with retouched old men with six-pack abs, the stupid intermittent fasting ads, etc.
I do get the occasional run of Spanish-language ads. Not sure why.
What does Jia think "CCTV" is, exactly?
> My modest experiment went surprisingly smoothly. Because I’d had my first child not long before, this time I didn’t need to buy anything, and I didn’t want to learn anything. I smooth-brained my way to three months, four months, five; no diaper ads. I called up a lawyer and data-privacy specialist named Dominique Shelton Leipzig to get her perspective. Globally, she told me, we generate 2.5 quintillion bytes—that’s eighteen zeroes—of data per day. “The short answer is, you probably haven’t hidden what you think you have,” she said. I told her about the rules I’d set for myself, that I didn’t have many apps and had bought nothing but prenatal vitamins, and that Instagram did not appear to have identified me as pregnant. She paused. “I’m amazed,” she told me. “If you didn’t see any ads, I think you might have succeeded.” I congratulated myself by instantly dropping the experiment and buying maternity pants; ads for baby carriers popped up on my Instagram within minutes.
For Google et al the tiny minority of us who've achieved some degree of privacy aren't worth worrying about, and we as a group aren't going to grow any larger for reasons that achieving a reasonable degree of privacy is a far too onerous a job for the majority of people, moreover most would consider their phones broken after such privacy modding.
For instance, the phone I'm typing on now hasn't yet been rooted but that largely doesn't matter, it's reasonably private (but not completely so) with the following tweaks: first, it has no Google account (probably the most important tweak of all), all apps except for a few F-droid ones have internet access disabled (their calls to the internet are diverted to a VPN nul location by a firewall), all Google apps are disabled including Google Play Services and especially Chrome, no non-F-droid app has access to background data, and as a precaution the disabled Google apps have all permissions denied/turned off, in effect they have access to nothing, neither the internet nor hardware. These tweaks send both the Play Services and the apps that rely on it into spasms and they keep bleeting notifications to turn Play Services back on or the apps won't work, this bleeting is most annoying but it too is easily remedied by disabling notifications from the offending apos. Finally, my F-droid browsers have JavaScript disabled (there's more but that'll do for now).
Wirh these tweaks the phone still works fine for me, calls and messaging all work OK, so too do GPS, WiFi, the internet along all phone sensors and my non-Gmail (POP) email account.
That's about the minimum one needs to do to achieve even a modicum of privacy on one's phone. That said, a phone so tweaked is essentially useless to the vast majority who expect Google, Facebook and similar apps to work (if you want privacy you just can't use them). That the vast majority cannot do without these Big Tech apps is why I believe privacy is essentially dead.
Incidentally, some may be interested to know that many (but not all) apps that complain about not working if Play Services are turned off actually do still work. What Google and developers don't tell you is that these apps use the Play Services to report your activities to Google and the world, it's a key reason why I nuke Play Services.
IMHO unrooted android is starting to become actually viable, for example there are apps (like AdGuard) that use a VPN to MitM all your connections and filter out ads even if they attempt to hide inside HTTPS connections.
And with the `pm disable-user` trick you can disable apps that you can't normally uninstall (or disable). Which is great for OEM- or carrier-installed bloatware.
Another interesting factoid mentioned:
> identifying a single pregnant woman is as valuable to data brokers as knowing the age, gender, and location of more than two hundred non-pregnant people, because of how much stuff new parents tend to buy
Iirc:
College graduation/ first real job, Wedding, first home purchase, first kid on the way, retirement filed-for, and ??? I'm forgetting something. Maybe out-of-town move?
Related and overlapping: I suggest searching for the late 90s article on Target basically telling a teen that she was pregnant via direct mailers before she even knew. Dad over reacts then has to eat his accusation when they (Target) were right.
Based on non-typical purchase of un-scented lotion and 2-3 other undisclosed items.
I'm sure it's only gotten worse since then.
Idk how old you are, but part of the point is the 'before times' ended much earlier than most are aware.
The biggest lesson of the Target story (for the marketers) was don't let consumers know that the marketer knows so much about them.
Had they just sent diaper coupons mixed with generic ads, they might have been more successful. 'Congratulations You're Pregnant!' is what didn't work.