I still don't think companies serve you ads based on your microphone
simonwillison.net
simonwillison.net
However...
A friend tested the theory a few years ago. He doesn't own a swimming pool, doesn't want to, and has never expressed any desire to. He put his and his wife's phone on the table and said to the wife (loudly), "Why don't we look into pool fencing?". She agreed with him. Shortly after, on both of their phones, on a particular social network, they were inundated with ads for....pool fencing.
But, recently I started thinking about the average user, who will install anything and approve any permissions requested without reading it. And imperfect App Store reviews approving a Trojan horse accidentally.
Am I positive someone hasn’t inadvertently allowed mic access to a malicious party? I wonder if that person’s phone may, in fact, be listening to them.
For the next week or so, I got many ads on my phone about underwater packages for Hawaii, along with ads for various snorkeling and swimming gear. Now I had never researched any of that on my phone, however obviously my brother has. And the ad trackers saw that both my phone and his had communicated out over the same IP address (my parents wifi) on other random internet connections, so that is probably why they were then targeting my tracker cookie with ads that would be related to his tracker cookie. (This is all technically "easy" for the trackers to do, and seems logical that they would, because "why not").
On an unrelated note, I was making a peanut butter sandwich, started browsing some sites, and started getting ads for Skippy peanut butter. My phone must have smelled the peanut butter in the air.
It was impressively creepy and a good way of surprising her with something she hadn't said anything about but was considering buying.
Experiment design is important! I completely believe that this happened to your friends and I also don't think it means what you/they think it does
(That is: you need to completely isolate yourself; music practice room on a college campus where nobody is wearing a watch or phone and repeat the experiment. If it turns out that you still see ads for that thing, then the experiment didn't prove anything)
That's kind of the smoking gun when you can create a disjoint set of topics and a disjoint set of mediums of communication delivery and see what shows up in the ad space from those discussion topics strictly expressed verbally.
If you feel like repeating this experiment, try generating the phrase randomly rather than choosing one, to eliminate unconscious bias.
Occam's Razor and the answer to the question, "What kinds of companies are at work in the environment?" push that probability in a specific way, because the motives and means are definitely there. Do you think they are the kinds of companies that would waste such an opportunity?
Their Chief Councel's recommendation depends on how slimy they are, right?
What would happen if they got caught? Slap on the wrist would be all, if that, no?
This is absurd. The chances of rolling snake eyes twice in a row is 0.07%. However, that doesn't mean if I do get snake eyes back to back, I should think it's caused by "Technilogical causes" (aliens? CIA remotely controlling the dice?). At best, it's an incomplete argument. The power of the birthday paradox, along with the factors I explained in my previous comment means such occurrences are virtually guaranteed to occur if you're on the look out for them. This can't be dismissed with an off-hand with "Technilogical causes are much more likely than accidental causes for such effects to appear, in today's world".
>Occam's Razor and the answer to the question, "What kinds of companies are at work in the environment?" push that probability in a specific way, because the motives and means are definitely there. Do you think they are the kinds of companies that would waste such an opportunity?
Apple got sued for accidentally recording siri queries, and that cost them class action lawsuit, along with the requisite discovery. Some company intentionally doing this, all the while actively engaging in a conspiracy is far harder, and much easier to fall apart due.
No, more like Siri, bruh. To sell some too-expensive slippers. You used the word "absurd", didn't ya?
> accidentally recording siri queries
Sure. Apple does things by accident. Gotcha.
Motive, means, opportunity. Which is missing?
The dice analogy is clearly a separate scenario than your guci slippers story, I'm not sure why you're trying to bring siri into that analogy. The point is that you can't just invoke "Technilogical causes are much more likely than accidental causes for such effects to appear, in today's world" without justification. If there's spooky stuff happening at a rate far higher than to be expected by pure chance, and there was proper documentation of this, I might be amenable to the above argument, but you haven't done that. In previous comments I listed multiple reasons issues with relying on random anecdotes, but you failed to rebut them.
>Sure. Apple does things by accident. Gotcha.
Is it really so unbelievable that automatic speech recognition would have false positives? There's plenty of things to criticize about Apple's behavior in that case (eg. not taking steps to ensure audio from accidental triggers are deleted), but the implication that they're intentionally doing it is totally unsupported.
>Motive, means, opportunity. Which is missing?
Proof that a crime has actually been committed. With that logic we should be arresting people for murder every time their ex/spouse goes missing, even if there's no evidence that foul play occurred. If it's been actually proven (ie. more rigorous evidence than random anecdotes) that people are getting targeted advertisements based on their conversations, maybe we can start assigning blame, but we haven't even established that's happening yet.
Bye.
We did watch three Tom Papa stand-up shows on NYE, though. They were glorious; we were crying laughing. "Outrageous!" I love that guy, so brilliant, silly, and hilarious!
Isn't the technical hurdle just changing the "Alexa" or "Siri" wake word into a keyword for an ad campaign?
It seems like users can have iphone listen to audio keywords, but I don't use Apple so I don't know the details. https://support.apple.com/guide/iphone/use-vocal-shortcuts-i...
Obviously an experimental advertising system would require a special deal with the phone manufacturer and would be covered by Apple's very broad license to advertise based on your data.
That doesn't mean they're doing it, of course. I'm just not aware of technical or legal barriers.
...unless there were actually several thousand people who performed this experiment, got a negative result, and therefore don't remember it or post anything about it.
So how does the phone + ad networks decide which words to prioritize to trigger which ads when?
So for this anecdote to be true, not only would the phone have to be listening, but the targeting algorithm would need to decide to actively exclude all the other audible triggers from that time period, and fill your limited ad impression inventory with the one phrase you were intentionally testing.
How would it do that? Especially if this is indeed an outlier one-off topic of conversation that you cover in a single sentence. There would not be contextual clues (like repetition over time) that might indicate you are actually “in market” for a pool fence.
To me this is the problem with these anecdotal tests. You understood that that was an important phrase in the context of ad targeting. But how did the automated ad system know it should serve you ads on that topic, and not one of the many other advertisable topics you talk about over the course of several days? Or that your phone hears over several days?
Not saying I agree that 'phones are listening to show us ads', but technically we have the capability for that to happen (sampling audio every X intervals and matching against a local database of keywords)
I think it is very easy to sneak a few (thousand) extra fingerprints in this database and do all kinds of tracking with it. All while the green microphone icon is disabled.
Why would “pool fencing” take up one of those valuable keyword slots on everyone’s phone?
And you’re going to see way less than 11k ads per day. Why would the ad server prioritize serving an ad for pool fencing (a phrase said once) over all the far more common topics a person talks about in a typical day, like movies, TV shows, food and drink, clothes, cars, consumer electronics, music, etc?
So showing that person an ad for pool fencing is a complete waste; they're never going to click it. If that's what an alleged audio targeting system does, it would make the ad network less profitable than just using the data they already have. So why would anyone build it that way?
I'm not saying it is or isn't happening but it wouldn't be hard.
The same way they analyze your email and web searches. Basically, statistics.
>To me this is the problem with these anecdotal tests. You understood that that was an important phrase in the context of ad targeting. But how did the automated ad system know it should serve you ads on that topic, and not one of the many other advertisable topics you talk about over the course of several days? Or that your phone hears over several days?
Buddy, so many people have witnessed this happening for at least 10 years and even done experiments at this point that it's common knowledge. I know for a fact that one of my friends now has a phone that is especially receptive to hearing me say things around it, because our conversation topics ALWAYS come up in my searches, ads, and feeds shortly after. Think about that. Someone else's phone sends data to a cloud that I never gave permission to. It then puts that together with data from MY phone about where I was (perhaps even the devices chirping at each other!). The aggregation happens within a week then I see relevant ads. I've seen this happen dozens of times. It's no coincidence.
As far as the article, I'm not even going to read it. It's got to be stupid. We know from leaks, reverse-engineering, and personal experience that this spying is going on. I question the source of this article, but I suppose we should never underestimate the lengths someone will go to in order to feel that they are smarter than the rest of us with our eyes open.
No we don't. There isn't any of that. This is flat earthing for technophiles.
https://www.404media.co/heres-the-pitch-deck-for-active-list...
And nevermind the conspiratorial thinking required to believe whole teams of engineers are developing and maintaining this capability across several giant companies, but nobody ever puts it on a resume. Apparently the thousands of people working on this are all personally committed to complete secrecy, forever. Uh-uh.
Bro it doesn't matter how much evidence you provide people with that this IS happening. They usually won't accept it. If they do accept it, half the time they shrug it off with "I've got nothing to hide anyway" kind of cope.
I seriously think I'm arguing with employees of these companies on HN because all you people do is deny everything and smear people who talk about this stuff. I hate to break it to you, but conspiracies are real. Noticing that people are conspiring to do things that nobody likes is not unreasonable in any way.
Take a look at this for example: https://www.theverge.com/23293687/amazon-irobot-acquisition-...
Even simple ad systems are a huge privacy threat. Add to that audio, location, and even AI screen reading surveillance, and you're screwed.
>thousands of people working on this all personally committed to complete secrecy
Basically describes a LOT of government spying programs or horrific abuses that have happened, for instance.
Secrets can absolutely be held, and I wouldn't be surprised by even thousands of NDA'd engineers (who already have been doing this sort of thing for a loooong time) opting not to leak anything in a way that would be credible.
I'll reiterate that I'm skeptical of the overall conspiracy claims even though I usually believe in mass spying claims or institutions/corps/etc. being awful. I just think your argument there is pretty flawed, at least that aspect of it.
In fact, on why I'm skeptical: I just can't shake this profound sense that it's like the "Frequency Illusion" phenomenon that I've demonstrated to people while driving or walking outside.
Or more likely a mix of it with people also getting prompted with what they "want" in the first place by all the advertising and targeted media and their various search history data.
I would be VERY interested to hear details of those leaks and that reverse-engineering. I've only ever heard the personal anecdotes.
(If you'd read my article you would have seen this bit at the top: "Convincing people of this is basically impossible. It doesn’t matter how good your argument is, if someone has ever seen an ad that relates to their previous voice conversation they are likely convinced and there’s nothing you can do to talk them out of it.")
If companies are willing to track your every click and mouse movement, every footstep and slight movement you make with your phone even while you are asleep, build and bundle keyboard apps to capture what you type, monitor you with AI, etc., are you seriously surprised that they would not also listen to you? None of that stuff I just described is fiction. It's established tech that has been documented over time. The only reason it's not 100% illegal is because the EULA probably covers it.
I swear people who think they aren't listening when they can seem like people who would be shocked to learn that an armed carjacker might demand your wallet in addition to your car. Unreal...
Oh yeah one more tip. Try to use the data export feature from Google or Facebook. You might just be surprised what you find. I've heard of people finding recordings of private conversations picked up by Google devices. I personally found hundreds of Facebook messages and posts that I deleted with a tool, and aren't visible to anyone (OK maybe the messages make sense but not the posts).
That's what my article is about: it's about how I'm certain people will use this settled-out-of-court lawsuit as "evidence" that Apple are spying and targeting ads, but it's very clear that's not what was happening here.
Another one I forgot to mention: Google explicitly tracks your location history unless you turn it off, and you'd be foolish to think that they won't (or couldn't) save the data anyway. People have done experiments showing dramatic improvements in battery life using AOSP without Google telemetry and spyware.
The microphone thing is false. You can try the takeout feature (or equivalent) across multiple providers to confirm that.
I seriously don't trust anything on a very deep level. Like I said, I've seen too much evidence that these companies are run by snakes that can only be trusted in certain ways. You might not agree, and I'm not prepared to argue all that tonight (I keep hitting the comment rate limit anyway). Just try to remain skeptical both ways if you don't believe we're being spied on, ok?
Really smart people have been working on these things at Google for decades and that’s barely scratching the surface of this nuanced discussion. CPU/GPU has only gotten faster and smaller with more RAM available and better power management across the board for mobile devices.
Anything is possible if there is money to be made and it’s not explicitly illegal or better they can pay the fines after making their 100x ROI.
Most people don’t speak, and aren’t around people talking to them, for more than a few minutes to hours in a day.
You just need to awake every few secs or mins to see if someone is speaking and go back to sleep if they’re not.
They could even pickup or recognize the second voiceprint ID and know it’s your best friend and wake up the audio recognition from ultra power saving mode or whatever. Literally anything is possible to make this is work.
If big tech isn’t doing this then it sounds like a huge startup idea worth $$$. I hope someone on here in the spirit of HN runs with it and blows the top off this topic once and for all if it’s monetizeable or expose the FAANG patent sharks that come out to play and silence them for infringing on their shady microphone tech.
If this targeting technique works and is feasible and legal and in demand by advertisers, why isn't there a competitive group of startups all trying to do it better than each other and sell the results?
Now the conspiracy theory has grown to include "dozens of companies compete at this, all of them secretively operating in a marketplace that is entirely invisible to the outside world."
AI.
That is entire premise of 'Nexis' from Yuval Harari.
Individualized bot driven surveillance .
https://www.theregister.com/2024/09/16/oracle_ai_mass_survei...
""Ellison declares Oracle all-in on AI mass surveillance, says it'll keep everyone in line
Cops to citizens will be 'on their best behavior because we're constantly recording and reporting'""
That was one of the points in the book. in 2017 or before, a surveillance state was limited by the number of people it takes to do the actual surveillance . Now AI increases the efficiency.
There is a couple months where he is on every podcast. Then he is gone again.
You know who else does this, every other author on the planet. When a book is coming out, then suddenly the authors are on every podcast or show, talk, debate, anything they can manage to get on. Its a blitz.
You know what else happens on a book tour, they tend to give a highlight of the book. They don't sit there reading off references and citations. They give a streamlined high level idea of what the book is about, but not all of it, because they want people to go buy it.
2) If the app detects a consumption-related trigger word, the related conversation is flagged for transmission to the server.
3) Flagged audio block is converted to text. Consumption related verbs ("buy", "purchase", etc) are identified. The syntax of the sentence clearly indicates which noun is the target of a given consumption-related verb ("new car", "pool fencing")
4) Serve related ads
Lots of people run network traffic sniffers to see what apps are doing. Lots of people decompile apps. Lots of people at companies leak details of bad things they are doing.
Why has nobody been able to demonstrate this beyond anecdotes about talking about swimming pools and then getting adverts for swimming pool stuff?
edit: Having re-read my comment, I can see how it could easily be read to say "It's happening and this is how it works", whereas I intended to convey something like "It could easily be done and here's how." I have a bad habit of implying my point rather than stating it outright. I'm working on it!
If it were happening, it would kill our battery really quickly, and be easily measurable and obvious in a router trace, so I find it very unlikely.
Unless we're talking about an electret capsule with a physical LED wired into the supplying power rail that is switched off when the mic is not in use, you have to trust software.
And good luck with that after the patriot act. I am not implying the NSA has a microphone backdoor, but if they had and someone abused it, how would you know about it?
Listening in for keywords and only send text/audio when keywords are spoken isn't only good for ads, that would be dream of any intelligence agency. And since Snowden have been a few years.
"Citizen four" by Edward Snowden.
Those chips do not log or transmit the audio they have access to.
In this situation, I was alerted to this because the assistant started responding. However, I've also been in situations where I tried deliberately to talk to the assistant and it failed silently. In those situations, the UI spawns the Assistant interaction dialog, listens to what I say and then just silently closes. Sometimes this happens if there's too much background noise, for instance, and it then just re-evaluates that it wasn't a valid query at all and exits. Sometimes some background process may be frozen. Who knows if this happens before or after sending the data to the server. Sometimes the dialog lingers, waiting for the next input, and sometimes it just shuts off, leaving me (annoyingly) to have to reopen the dialog.
Putting that together, I have no idea how many times the Google Assistant has activated in my pocket, gone live, recorded stuff, sent it to Google's servers, realized it wasn't a valid query, and shut off without alerting me. I've certainly seen the Assistant dialog randomly open when looking at my phone plenty of times, which is usually a good indicator that such a thing has happened. If it silently fails in such a way that the UI doesn't respawn, then I would have no idea at all.
The net effect is that Google gets a random sample from billions of random conversations from millions of people every time this thing unintentionally goes off. They have a clear explanation as to why they got it and why ads are being served in response afterward. They can even make the case that the system is functioning as intended - after all, it'd be unreasonable to expect no false positives, or program bugs, or whatever, right? They can even say it's the user's fault and that they need to tune the voice model better.
Regardless, none of this changes the net result, which is they get a random sample of your conversation from time to time and are allowed to do whatever with it that they would have done if you sent it on purpose.
Have you tried resisting an export from Google Takeout to see if there are answers in that data?
It's much better and safer to assume they are than they're not, especially because I've seen many many results which indicate they are.
That said, there's a much easier way to test this. Take two identical voice recognition smart devices (think Amazon Echos), register them each with a new never used Amazon account. Modify one of the devices to have a switch on its mic input which you leave off, and one which you leave on. See if the one with the mic on starts showing ads for things you've never searched for on that Amazon account. If the other one doesn't then there's your answer.
That sounds interesting enough that I might just give it a try.
It doesn't have to be your phone. Could be your TV or any other device.
Most importantly there's just patterns of behavior. Companies are absolutely desperate for every scrap of data they can get on you. Why would they not capture audio from your mic?
Did you know that you can set up a proxy from your phone and capture all traffic from it? It would be so trivial to find the traffic from your phone. There are ways to MITM and inspect the traffic, too.
There are also many people doing static reverse engineering of phone apps looking for security vulnerabilities. To believe this urban legend, you’d also have to believe that none of them have ever encountered this hidden voice analysis code.
If we ignore that, you know there are OS-level security controls on apps, right? iOS and Android don’t make it easy for apps to use the microphone constantly and run in the background to process it.
Finally, if we ignore all of that, how can anyone believe that these companies are recording conversations but none of their employees have ever chosen to blow the whistle? We’ve seen numerous FAANG “whistleblowers” come through with everything down to trivial or baseless complaints, but nobody has blown the whistle on these supposed widespread spying programs?
The whole urban legend is preposterous to anyone who has any experience with apps or phone security, let alone common traffic analysis or reverse engineering tools. I don’t understand why the myth is so persistent among even some technical people.
As for whistleblowing... Is there really that much to whistleblow about it? We already know that ad-based companies like Google are collecting our data every chance they get, because they make billions of dollars from it. They're scraping our emails, studying our GPS location, paying attention to who we are in proximity with, etc. The level of surveillance is incredible and people don't really care. It wouldn't be headline news to find out that they are taking advantage of yet another side channel.
The phone knows about your proxy. There are phones - actual brands - that were caught on sending secret telemetry to their manufacturer, but only when not listened - definitely only on mobile data, no wifi, and I assume with cert pinning.
I know a person who was researching this and they needed a Faraday cage and a BTS to conduct experiments. So it's not exactly trivial.
The difference is that these were small Chinese brands that were not even that popular in my country - and still someone researched this. Imagine how much research Android and Iphone get, and there's not a single proof of and wrongdoing. Now that is unlikely.
I was walking to work and my backpack zipper broke getting off the elevator. When I got to my cube I set my phone on the desk and said to my coworker, "damn, my backpack zipper just broke!" 45 minutes later I was in a meeting and checked my phone and backpack zipper ads appear. I had never googled backpack zippers before, never seen backpack zipper ads. Literally the only proceeding thing before getting these was was telling my coworker that mine had just broken.
Either they have the most technically impressive spying system that can't do anything right or it's just not happening and people are making connections where there isn't really any.
Having knowledge of the technical limitations and challenges myself, I used to be on board for this argument, but now less so.
All of the technical arguments against the listening seem to ignore the "Ok, <DEVICE>" or "Hello, <DEVICE>" initiating phrases for the voluntary surveillance devices people put in their rooms, and offer only a worst case defense ~"how could they process everything everyone is saying?!"
Why is it such a stretch to imagine these devices grab Direct Objects and Subjects and store those singular items for ad keywording?
We have cookies and know how they work, why is it difficult to extrapolate?
simonw is a breathless proselytizer of LLMs and likely is suffering from "a man's salary depending on misunderstanding" and all that.
It bears repeating, "these corpos are raising billions and hiring former alphabet heads to their boards for reasons other than just making you a better programming assistant."
How about because Apple say they don't do that, and can and do get sued if they say things like that which are not true?
(Sadly I make basically no money at all from my "breathless proselytizing" of LLMs. I hope to fix that this year, someone should pay me for this stuff!
You know I've written more negative things about LLMs than almost anyone else, right? 121 posts tagged AI ethics right here: https://simonwillison.net/tags/ai+ethics/ )
Who knows.
I'm just saying, the technical, ethical, and legal implications of creating an ad network that surreptitiously slurps up audio 24 hours a day in violation of the claimed terms of service without anybody leaking anything about it is a conspiracy that seems less likely than people just being more predictable than they would like to believe.
You might think the pool fencing example might be an extreme coincidence, but far weirder things happen every day. And what made your friend consider pool fencing as an example if they don't like pools? Maybe something they saw recently gave them the idea? Hmm...
We were watching it in Italian, our main language, and I wanted to know more about it, as I typed "g", the first result was "gatto siberiano", exactly the cat I was looking for. Way too specific.
Another time as my girlfriend said she was interested how much a specific model of a watch a friend of him costed, the very same happened, as I typed the first few letters the very watch brand and model appeared.
Since then, I just don't care about how much technical description I can read, nothing's gonna convince me of it being a coincidence.
Then theres the time a friend told me about a very specific brand of Ramen, I opened up Facebook, and there it was, very first ad.
They don’t need to be listening to us, and wouldn’t know how to even begin hiding it if they were. Something like that would require tons of compute and thousands of conspirators risking massive backlash, all to prop up a relatively tiny part of their business.
> Convincing people of this is basically impossible
Absolutely correct IME, btw. This is one of those things a smart engineer learns not to argue online, or at the Christmas dinner table for that matter. People tend to stand their ground on this one and move quickly to accusations of bias and naïveté…
> A marketing firm called Cox Media Group has recently revealed that it is listening to user conversations via their smartphones through its so-called "Active Listening" Software. With this, the company will push advertisements that users will see on certain platforms based on the heard conversations as unveiled by a report.
https://www.techtimes.com/articles/307372/20240904/cox-media...
Is techtimes.com junk?
Basically this is just a random small-ish company trying to get new clients with a flashy feature. Ultimately they have to use the same data as everyone else, which I’m 99.99% sure doesn’t involve any intentional (much less “active”) recording by Google, Apple, or Meta. Maybe they have their own hardware partners that have networked microphones, maybe they’re really using incidental recordings from their “407 data partners”, or maybe it’s an empty promise - I sadly can’t read the original(ish) article https://www.404media.co/heres-the-pitch-deck-for-active-list...
It’s perhaps noteworthy that the intermediary source is the NYPost, which is most certainly junk! This story isn’t fake news, but it also isn’t presented in a honest way, IMHO
There was a class action lawsuit back in 2019 alleging that Apple accidentally recording people's conversations with siri counted as wiretapping. If no enterprising lawyers has tried this lawsuit with cox, and no news articles has come out criticizing their broad ToS, it's probably safe to assume cox isn't doing it.
If marketing or sales can twist a feature such that it's not presented perfectly honestly, but makes them look incredible and all but guarantees a sale? I think they'll twist meanings for that bonus. Certainly not every member of sales and marketing, but often enough that the pitch deck of a sales team shouldn't have nearly this much sway, IMO.
If you review the actual presentation (https://www.documentcloud.org/documents/25051283-cmg-pitch-d...), none of the claims in it are that remarkable. The whole kerfuffle seems to have come from a combination of the presentation actually being incredibly vague (probably intentionally to allow them to overstate the capability---this is a presentation for sales pitches) and some confirmation bias on the part of 404 Media, reading into it what they were looking for. But there's also a healthy amount of "news laundering," a lot of the articles cribbing off of 404 (like this techtimes one) actually make stronger claims than the original 404 piece does. It has a fair amount of weaseling that it's not clear how the slide deck should be interpreted, whether it's a real or speculative capability, etc.
If you've ever worked in enterprise software sales, you would be extremely wary of interpreting the slide deck the way a lot of these articles do. It reads like a lot of bluster.
Yup. Or if you've ever built enterprise software - after a sales engineer sold a featuee that doesn't exist l. Ugh
The company I work for has had to cancel contracts and claw back money a few different times from vendors that have promised features that were mandatory in our industry that weren't actually available in the software. One I recall was a pricey leave of absence tracking platform that didn't actually consider hipaa compliance to be important.
It's a small media company whose primary business is operating a handful of local newspapers and TV stations. They have no privileged access to mobile operating systems. If they really had implemented this scheme in actual apps (rather than just write it into a pitch deck), those apps would need to be asking for microphone permissions.
Note how there never was any follow-up showing that this really was happening. The story was only ever about that pitch deck. Compare that to e.g. the currently ongoing story about the dodgy things done by the Honey browser extension.
https://arstechnica.com/gadgets/2023/12/no-a-marketing-firm-...
(I wouldn't exactly rate techtimes.com up there with NYT/Washington Post/etc.)
And people also are terrible at math. Modern ML (regression & neural nets) are ridiculously good at predicting stuff you might be interested in, particularly when rich data sources like browsing and e-commerce histories are available; the decision to show the ad to you at some point almost certainly was made long before any audio-to-marketing pipeline could act on it.
My proof? Yesterday I was driving home and I saw an old Toyota Previa minivan and thought to myself "Oh, a Previa, you don't see those very often these days." When I got home, I started scrolling through my Google News and it showed me an advert for the new Previa.
I agree with Simon: you basically aren't going to convince someone that their phone doesn't listen to you and serve you adverts based on it, because they've run into instances where it seems like it.
That's not me taking a stance on whether it's true, though. There would be a lot of fame in it for a whistleblower, but on the other hand if Google or Meta figured out a way to do it with a low chance of it being proven, why wouldn't they?
This is trivializing people in my opinion. The non-trivializing interpretation would be that for whatever reason people are skeptical that a black box that they don't understand very well, don't know how to audit, and don't know how to exert low level control over is doing things that they don't want it to do.
When framed that way it is immediately clear that this is an incredibly reasonable stance to take. The default assumption should always be that a third party who has a vested interest is pursuing it.
As an example. It is paranoia to assume that a 1970s era vehicle with almost no electronics in it is reporting on me to the manufacturer. It is willful ignorance bordering on delusion to assume that a vehicle manufactured in 2020 is not.
“Be part of the richest portion of the middle class and never have to worry about money again orrrrr mysteriously die 6 months from now leaving no identifiable impact”
The Previa ads were always there but that was the first time you noticed it because it was on your mind.
(To be clear, I'm not being facetious -- this is a viable possibility)
(A) Explains why you noticed the Privia. (B) Explains why you searched for something that might have triggered a Privia ad.
To a layman this might be indistinguishable from magic. So in some way maybe the phone really can read your mind :)
For more consumption.
The trouble is, what does "suddenly" and "a bunch of" mean? This doesn't sound very specific, let alone scientifically rigorous. How many ladder ads were you getting previously, and how would you know? Exactly when did the rate of such ads increase? Unless you have these details, it's highly possible you're estimating them inaccurately.
People will of course choose privacy over no privacy with all else being equal, but privacy is the first thing sacrificed when push comes to shove. If the average person is given the choice of having everything said within earshot of their phone being recorded and sent to Facebook or giving up Instagram, they'll happily choose Instagram and forsake their privacy.
If privacy advocates want to start turning the tide in this battle, the first step needs to be convincing the average person why privacy is important on a personal and tangible level. No arguments about future totalitarian regimes or hypothetical ideals. Abstract concepts like that rarely motivate people who have so many more practical political concerns. It needs to be something that is more important to people than having access to Instagram. And I have absolutely no idea how that could be accomplished which makes me concerned that we're already too late.
If people really do believe that their phones are spying on them all the time to show them ads that means that people are basically surrendering to an imagined surveillance state. They shut up and accept it, because they'd rather keep Facebook/Instagram installed than fight back.
I find that really depressing. I want people to have more agency than that.
We need people to understand the imagined v.s. the actual privacy threats, so they can push for better standards. If they believe in and submit to the conspiracy theories good luck getting anyone to campaign for actual meaningful improvements to the problems that are real.
I do think that this is a very "lightly held" belief. It's something people kind-of believe, they'll tell this to each other, but it doesn't affect any behavior - not because it's not important IMO, but because people mostly don't really, deep down, believe it.
And I do wonder if convincing people this isn't happening will have the opposite effect than we intend. Instead of being more aware of what actual privacy violations are, it'll just make people write off the whole idea of companies invading their privacy. Idk.
People have only vibes, they think that if they paid with cash it would proobably be more private than a credit card, but what data is being sold and to whom for what uses? Is that even the case or are there regulations? If I constantly make cash withdrawals at the bank am I actually inviting extra scrutiny by looking like a money launderer? If I install this browser add-on maybe it sells all my data. But I'm also using chrome literally made by the ad company, and that youtuber told me if I don't use a VPN I'm constantly being tracked anyways...
If you just have a giant morass of confusing information about every digital decision, and a lot of annoying first steps you would take are likely to be no-ops, you just don't engage. People are defeated by ambiguity and lack of attention span, same reason lobbying works and people were constantly being poisoned by food & drug additives before the modern era.
Yeah but I don't care, I have nothing to hide, let them have my data.
It's a slap in the face of me, trying to meticulously remove all internet access of programs and devices that don't need it, and moving from all free and not-privacy-friendly services to mostly paid and private-friendly ones - probably "losing" a big chunk of my lifetime doing this. I feel paranoid sometimes, when I hear this argument.
It sucks, yet I drive a Free Tank, and now help people online take care of theirs. The other day I was talking with one from the future generation about what type of computer they would want and they said "A Fedora gaming desktop". And that made it all alright :)
When in the history of online ads have advertisers not used available data?
I completely disconnected my TV from the internet, but it still prompts me to connect it to Wi-Fi, to agree to policies, etc. This page is full of horribles: https://www.consumerreports.org/electronics/privacy/how-to-t...
And that's the one that's actually happening. Listening to your conversations isn't technically possible and is easy to disprove.
I think this is totally mistaken. An ad seller which also wants to respect privacy keeps this data in-house and does the ad targeting themselves. The advertiser never needs to see personal information for this kind of market to give people ads related to overheard conversations.
Still, you’re right that Google could be keeping it all for themselves and feeding it to their black box targeting services. I really strongly doubt that’s happening with incidental assistant snippets much less intentionally-eavesdropped recordings, but it is more plausible than this makes it seem.
I don't have any evidence either way that that happens, but it seems like a more practical way to accomplish it.
And as we know from the lawsuit, it seems that there's been a lot of data gathered accidentally too.
In the story, there was an implication that these audio snippets had been used for targeted ads. This is very clearly not true.
A separate issue is whether Apple take audio from opt-in full hey Siri sessions and sell that advertisers for targeting.
I very much doubt they do that, but even if they did that shouldn't be part of the "your phone is secretly spying on you through your microphone" conspiracy theory because of course your phone is listening to you if you just said "hey Siri" and started talking to it.
The problem is that the infrastructure to harvest all of this data clearly exists, and the only reason we shouldn't believe that it's being mishandled is whatever degree of faith we have in these companies to behave ethically, comply with legal requirements (or face a slap on the wrist), and most importantly, have developers that don't inadvertently make any mistakes. I really don't have faith in the latter point in particular.
The point is that maybe this data improperly ends up being used to serve ads, or maybe it doesn't, but in light of all the above, entertaining the idea is in no way akin to thinking that the moon is made of cheese.
EDIT: clarified "recording" to "listening".
Think about how many people would need to be in in the secret and actively lying about it: employees of phone hardware companies, and ad tech engineers, and execs at these companies, and their legal teams, and every contractor they used to help build this secret system.
All of whom passionately deny that this is happening.
If that's not a conspiracy I don't know what is.
Just because something is labeled a conspiracy theory doesn't mean it's not true (this one isn't true though). You're welcome to continue believing in it, but saying "it's not a conspiracy theory" doesn't work for me.
1. The occasional false positive response to a wake word that wasn't really a wake word, causing search queries to be run that you didn't intend.
2. This data being accidentally mishandled behind the scenes in Apple's servers in some way, such as developer error leading to the data accidentally landing in the wrong folder, being labeled with an incorrect flag in some database somewhere, or otherwise being given the wrong level of sensitivity.
3. This data being deliberately "correctly-handled" behind the scenes in Apple's servers in some way that users wouldn't like, but technically agreed to when they first used the phone.
4. This data being used for valid "QA" purposes that, for all intents and purposes, include situations that user would probably not be comfortable with, but also technically agreed to.
5. An unforeseen security vulnerability affecting any part of this process.
6. Malware on the phone interfering with any of the above.
7. Not-quite-malware that you agreed to install, doing things you're not quite happy with but technically agreed to, which is somehow in the loop of any part of this process.
Again, we can debate all day which of these are true - hopefully none of them are true. But we're talking about software development here, where these sorts of things happen on a daily basis. None of this is "they faked the moon landing" kind of stuff, and all lead to the same result from the standpoint of user experience.
I still doubt it's actually happening, but I'm not ready to 100% rule out that sequence of events.
Nobody ever describes that behaviour, though. They don't say "a) we had a conversation, b) our smart speaker suddenly interrupted and gave us some search results, c) I started seeing ads based on the conversation" - b) is never mentioned.
I don't actually believe this, mind you, but theorizing on how you'd pull something like this off, the answer is compartmentalization.
All it would take on iOS is an innocent looking bug buried somewhere deep in any number of subsystems that make it so that the red dot for recording doesn't go on as often as it should. just a totally accidental buffer overflow that makes it fall to set the recording active flag when called a certain way. The XZ thing was down to a single character, and that's one of the most watched projects in the world. A latent iOS bug that no one's looking for
Again, not saying I believe this is even happening in the first place, just that it's not technically impossible, just highly improbable.
If your organization structure allows a tiny number of people to modify your deployed products in that way, the same tricks could be used by agents of foreign powers to inject government spyware.
That's a threat that companies the size of Apple need to be very cognizant of. If I was designing build processes at a company like that I'd be much more concerned about avoiding ways for a tiny group to mess with the build, as opposed to designing in processes like that just so I could do something creepy with the ad targeting.
It very clearly isn't!
Unless you mean "listening for hey Siri wake words", in which case yeah, it's doing that, but that's not the same thing as "recording".
Like if an arduino can reliably carry 1 wakeword, an iphone could carry what? 64 at minimum?
Instead of waking up recording the conversation and sending it to the stasi, it could just toggle a bool in your secret advertising profile, then sync that up at random intervals.
They dont need context, they just need "Biscuit" "Nappies" "Birthday".
Not to say it isn't all made up. It probably is. I just dont think its technically difficult to achieve. It is probably all psychology. But sitting there with a packet capture going as you talk about dogfood isnt necessarily a great test to confirm the negative.
And the chance that Pool OR Fencing is one is pretty high.
I watched a Nigerian film on the seat back display on the plane the other day. I looked it up on my laptop when I got home because I didn't finish it.
The next day in my Instagram explore page I had a Nigerian meme...
Yes, I get it -- could be frequency illusion or some IP address/cookie shenanigans. Still feels weird.
Put another way, if you googled a Swedish film then saw Swedish memes you would think that was targeted. Then upon viewing the Nigerian memes you would have attributed it to a random video rather than anything targeted.
That is the real mechanism for triggering the ads and memes, not that “your phone is listening to you.”
At least feel creepy about the real cause and not some imagined monster under the bed.
Or heck, open up a phone and stick a probe on the mic lead. See when it is getting power or not.
https://www.404media.co/heres-the-pitch-deck-for-active-list...
It's relatively comforting to think they'd be so brazen as to care about your every word, as opposed to the fact that they own so much information about you that they can predict your actions and thoughts better than you can.
Siri uses a pseudonymous identifier when communicating with Apple's services. The identifier is not linked to your Apple ID. Therefore Siri does not have access to your iCloud data. When you ask Siri to "call mom", it constructs a search query which is then executed on-device against your contacts database.
More of these requests are served entirely on-device. Just ask: how is that consistent with the idea that they are doing ad targeting based on Siri requests?
You can request a data export for your Apple account and see that there's no Siri data included in it. If they are caught lying, EU regulators will have a field day.
Apple describes their ad targeting here. They list the—frankly boring—signals they use for ad personalization, which does not include anything you say to Siri or have in your personal iCloud data. https://www.apple.com/legal/privacy/data/en/apple-advertisin...
No one is apologizing for Apple's nontransparent collection of Siri audio for QA purposes, which is what they settled over and made opt-in.
However I am still waiting for a comprehensive explanation for how it is actually happening.
There there are many ways to correlate people and their interests, but I wonder how deep it goes. Basic geolocation and public interaction metadata: Sure. But I’ve also heard people believe that it ought to be possible to spot closeness via Wifi and Bluetooth.
This is such a culturally relevant topic that there must be some serious knowledge about it somewhere.
As for my own tests, I’ve made it a point to mention that I’m considering spending money on a well advertised-for product that I haven’t yet searched for online every time this topic comes up. No ads so far. In the next phase I’ll progressively tell more people to start looking it up.
I can’t tell if my friends are convinced or if they’re too polite (or disinterested) to argue.
But it wasn't real. Even back then people would publish "sources" saying it was being done, but I'm telling you that if it worked well people would be doing it and we were in the middle of it all and couldn't find anyone who was.
There were smart-devices that acted as beacons to report people to ICE and stuff like that and they used personal data to tie it together. So there was crazy stuff out there (none tied to the respectable ad tech industry HN knows as the "privacy-violators" and so on). But this specific thing wasn't there.
E.g. person A talks about bouldering with person B. Person A then continues with their day while person B googles bouldering terms.
A and B then receive both bouldering ads. Person By because of the googling and person A because of proximity to person B.
Person A then assumes the phone spies what they say, but it doesn't. Location is enough.
Answer - you wouldn't.
This is the problem with experts and politicians. You can make money on either position, but once you have started stating your opinion, it's unlikely you'll do active research to disprove your opinion, as many have already concluded [1].
I'm happy that Simon only sees this as a hobby.
Apple will pay $95M to settle Siri privacy lawsuit
https://arstechnica.com/gadgets/2023/12/no-a-marketing-firm-...
Discovery in a lawsuit.
Credible insider leaks confirming this happens and how.
Has anyone done a public low-level analysis of these systems with questions like, where the data goes, the quality of the stream, how the data is then used/abused, etc?
TVs and cars have microphones now and are privacy nightmares. Car companies have patents [3] for in-car keyword based ad targeting. Without legalisation, it's really only a matter of time.
[1] https://www.fastcompany.com/90999277/cox-cmg-active-listenin...
https://www.404media.co/heres-the-pitch-deck-for-active-list...
[2] https://www.documentcloud.org/documents/24224884-how-voice-d...
[3] https://www.pcmag.com/news/ford-patents-in-car-advertising-s...
That said, I full agree that unless we legislate it, it will happen eventually.
I'm confident it was a sales team putting together a dishonest pitch deck that deliberately took advantage of this widespread conspiracy theory.
What companies claim they can do when they try to sell their shit product at a ridiculous price is a very different thing from what they can do.
Amazon Shopping was also supposedly a leap forward for shopping. Turns out it was just a guy watching a camera (we were told it was all automatic with state of the art object recognition tech).
Cellerite is another incredible example of this that places like reddit and HN love to suck off. They are the be all and end all until you read their actual technical papers (which companies and police forces that purchase from them do NOT do) and their very strict limitations (which they don't hide in their manuals, they just don't include any of that in their lovely powerpoints).
Go to a public library without any electronic devices and pick up a print copy of a magazine with some ranked list of products or brands. Select a handful that you don't think would be targeted towards you. For example, beauty products, childcare products, cruises marketed towards seniors, etc.
Over the course of a few weeks, use Siri to send text messages mentioning these brands, add them to your Reminders list, etc. Just don't allow it to redirect you to any apps or web searches, since that would invalidate the experiment.
Browse Apple News daily, which uses Apple's internal ad service. If you see any ads related to at least 2 of your canary brands, you have plausible evidence that your Siri interactions have been used for ad targeting.
Many years ago, Google was sued for wiretapping and lost. See Joffe v Google
More recently Apple was sued for eavesdropping without consent. They just settled for $95 million. See Lopez v Apple
I sh_t you not. She was a bit gobsmacked. I was neither surprised nor disturbed.
That's real anecdata, my friends. It could have been coincidence, and while we have nothing to hide, it's not an optimal situation, whatever the cause.
Besides, we ain't buying no Gucci slippers, no way, no how.
>Gucci
Gucci is classified as an "aspirational luxury" brand. In other words, luxury for poor people. It makes total sense that it would be pushed to people in public housing. If you get recommendations for European brands you've never heard of selling $5000 t-shirts, then I'd be worried.
I guess we should all just blindly trust Apple. Thanks, friend.
>I guess we should all just blindly trust Apple. Thanks, friend.
Never claimed any of those things. Quit putting words in my mouth.
I don’t think its a coincidence. Something is listening. Its kind of messed up that I am a normally rational, skeptical minded person, fairly knowledgable about information security and in 2024 I can’t even draw any clear lines between a nutty conspiracy theory and reality.
I’m sorry but I don’t find this article basically just saying “yeah but what are the chances Apple would do that?” persuasive at all.
I had an experience a few years ago where I had talked about a fairly niche product (I can't recall exactly what it was) and the next day I started seeing ads for that product all over the place. I commented about it to two of my coworkers that day, how I had been skeptical about the conspiracy that our phones were listening to us for marketing purposes but that this felt eerie. What shocked me was their response: They had seen the same ad all over the place. Since then I've had a hard time deciding what to be more concerned about: That my phone might be listening, or that I might have been subtly influenced into thinking about this thing; that my whole experience was actually a result of being susceptible to marketing directed at my demographic
Are you sure it's not because of an opsec fail? eg. you used your nickname when registering for some service, and that made it into some sort of mailing list? What you're seemingly implying (ie. that there's some sort of secret listening system that can figure out your nickname, tie it back to your address, and then send spam to that) makes little sense. Your name + address is already readily available. It's in the public records. You freely hand it over to random websites (eg. for online shopping). There's zero benefits in anyone making such a system to figure out people's names using surreptitious listening.
I am not sure about there being no benefit either. We moved here very recently and scraping local property records would take time and not be easily automated. So what if some data aggregator still had a blank under the name field for our address and needed to fill it in so they could address letters since we more or less automatically throw away “current resident” letters. I just don’t know, yes its far fetched but I don’t see any other explanations as much more parsimonious.
I have definitely experienced it myself, and have no doubts that it happens.
What I find amazing is that people don't use ad blockers! I wouldn't be able to tell you if they are harvesting my voice data, because I haven't seen an ad in years! It is trivial to block ads, why do so many people choose to see them?
What you actually talk about with people (excluding maybe the proffesional stuff) is mundane stuff you see on your screens, newspapers, billboards, etc.
I also believe people very rarely only speak about a thing -- without there being any digital footprint at all of them engaging with it.
I have literally seen this play out with family and traced it back to make a point.
Harder to convince folks that _nothing_ does this, but takes an edge off their more paranoid tendencies.
Transcribing all spoken text and sending it home, sure, not feasible.
What if we have 256 keywords, or 65536 keywords, maybe preconfigured for particular products or product classes. Some basic linear predictive coding mechanism ( you know, what powered those '80s chips Stephen Hawking style, speak and spell, etc) - very very low computational overhead. When the word is triggered, queue a message back home at the next reasonable opportunity - user id, timestamp, word. It will only take a couple bytes. It can be slipped in anywhere and obfuscated by any means by nature of being so small, data-wise, even as a watermark of some sort. By using a timestamp and waiting until the next opportunity, maybe minutes, hours, or days away, no time correlation detection is possible either.
People say big tech is ethical, fine. Maybe some ad company is sponsoring some free app or game for the phone, and slipping this in there. Now the developer can pay their rent and food costs. Maybe the ad company is then selling that data back to big tech who washes their hands of any wrongdoing. Maybe it's all legal because the fine print of the EULA allows for this.
Seems to me though this can be figured out empirically, just have a voice play something like "need to buy adult diapers" or "new tires" etc next to a device, enumerate every device, look for ads on whatever very specific topic, minding along the way to tell nobody and never enter it in any internet-connected keyboard.
So, we already know that it is
A. completely feasible for a smartphone to do this.
B. At least a subset of smartphones have always-on microphones.
Maybe not a remote control... But why would you put it in a remote anyways when everyone has a phone?
But that may just be the conspiracy theorist in me.
If any of your friends searched for something online, and you're connected to them in a social network, they might show you the same ad by proximity.
people better demand equal access or start slitting throats right now.
1) "Doing this wouldn't be technically feasible or would require a technical effort wildly out of proportion"
2) "There are lots of psychological biases that lead people to believe something like this happened even if it didn't actually happen"
3) "Apple is such a nice and honest company, they would never do such a thing..."
As for 1), there is enough technical discussion in this thread to disprove that point. But just as a reminder: Google build an always-on song recognition service into android, free of charge, without any obvious monetization, just because they can. OpenAI released Whisper last year as open source, a highly precise audio transcription model. By now lots of variants for on-device use exist.
All that tech doesn't just exist, it's not even seen as a moat. It's already being commodified.
As for 2), yes of course cognitive biases are always a thing. The problem is that you cannot use them to disprove something. They constitute an absence of evidence, not evidence of absence.
As for 3), yeah no comment here. Except maybe, remember Snowden. "No one would do such a thing" has already been spectacularly wrong in the past.
Between 2017 and today, there were massive changes, both in technological development but also in mindset: Surveillance capitalism became much more normalized and generally accepted as a standard part of business.
So if you argue that it was a baseless conspiracy theory back then, therefore it automatically must still be a baseless conspiracy theory today, that argument is flawed.
The reason I keep on bringing up 2017 is that it helps demonstrate the psychological angle here. People are absolutely convinced this is happening today. Many of those people were equally convinced back when this was clearly impossible, convinced based on the exact same reasoning (their own personal anecdotal experiences).
So the 2017 thing helps illustrate the lack of credibility of those personal anecdotes, independently of the issue of how possible this might be today compared with the past.
A kayak seems like a practical purchase if you live on an island.
That's what people mean when they say there is a lot of data points that can explain things very easily without having to resort to a convoluted explanation.
Edit: yep
That would explain the intensity, but I’d still be surprised to see any patterns not found by ML/statistics.
It seems to me that somebody in your life has gotten into Kayaks. Take it as a challenge to find out who it is.
The Age of Surveillance Capitalism (2018) - Zuboff, Shoshana
Given that this is form 2018, the rise of voice assistants since then, all the market forces at play and the reward highly outweighing regulatory penalty payments there is little that's supporting that users are not being recorded. The TOS phrasses like 'service improvement', 'may share with third parties', and 'user experience' are common place and are not particularly concise. Simply dismissing anekdotes and honing in on Apple Inc., the only company which does not want/need to sell data, is not convincing.
I think people tend to shoot the messenger, when it comes to privacy discussions. Getting told one is being spyed on by a divice, which is so intimt and close to one slef is embarassing. Of course things are more like a spectrum and differ from case to case.
But thinking from the first principles, do you really think that all this phonetic keyword spotting[1] IP developed for defense tech in the late 90s and early 2000s was abandoned once recording entire phone conversations and doing full speech to text on them became technologically possible?
I still remember lots of startups who did this stuff openly a decade ago, before Cambridge Analytica scandal[2]. After that it became impossible to get funding or get acquired, so the few that stayed in this field became very secretive.
—-
[1] https://en.m.wikipedia.org/wiki/Keyword_spotting
[2] https://en.m.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_A...
On iPhone, activating the microphone causes an icon to appear, which the app can’t hide. I think if the app is in the background, it turns the whole status bar bright red.
Secondly, there is power use attribution and it would be very obvious if an app were keeping the device awake and the microphone on based on battery drain and runtime accounting.
So you are asking us to accept on faith a shadowy ad SDK that is both widely used but also cannot be named, one that somehow subverts multiple layers of the system security architecture? Ok. We believe you.
But read through this doc:
if everyday people knew just how much data companies have on them and their habits, they'd be absolutely horrified. There's so much personal attribution data that most companies that know how to market properly are going to get you at some point. You may think you're careful with what you share and what is being recorded, but if you are friends or relatives of someone who does, or if you live in the same street as someone who does, they data on you.
I used to work for these kind of companies, and have a lot of friends and family who currently do, and the stuff they track and the patterns they have never fail to surprise me and make me laugh.
Sure, if they could, they would absolutely listen in to you, that would make their jobs a hell of a lot easier, but they don't. But the data they have on you so goddamn accurate, it's easy to assume they must be.
We already know about TV piracy detection leading to bars showing soccer without a license being fined.
I don't like seeing people fall for obvious conspiracy theories, and I have used my own deductive reasoning to decide that this is an untrue conspiracy theory.