Facebook is revealing a wider range of websites and apps that gather data for Facebook, previously without being identified or seeking consent. Facebook will offer a new privacy control covering these newly revealed snoopers.
A feature in settings called Off-Facebook Activity will show all the apps and websites that send information about you to Facebook, which is then used to target ads more effectively.You will also be able to clear your history and prevent your
future off-app behaviour being tapped.
For now, it is rolling out very slowly, with only Ireland, South Korea and Spain getting access. But the goal is to eventually offer it globally.
Facebook collects data from beyond its platform either because you have opted to use the social media site to log in to an app or, more likely, because a website uses something called Facebook Pixel to track your activities.
If you select options to turn off tracking Facebook will still collect the data, but it will be anonymised.
Back in April of this year the data protection police of the ICO set about drawing up rules for nearly all commercial websites in how they should deal with children and their personal data.
Rather perversely the ICO decided that age verification should underpin a massively complex regime to require different data processing for several age ranges. And of course the children's data would be 'protected' by requiring nearly all
websites to demand everybody's identity defining personal data in order to slot people into the ICO's age ranges.
The ICO consulted on their proposals and it seems that the internet industry forcefully pointed out that it was not a good idea for nearly all websites to have to demand age verification from all website visitors.
The ICO has yet to publish the results of the consultation or its response to the criticism but the ICO have been playing down this ridiculously widespread age verification. This week the Information Commissioner Elizabeth Denham further hinted
at this in a blog. She wrote:
Our consultation on the
proposed code began in April, and prompted more than 450 written responses, as well more than 40 meetings with key stakeholders. We were pleased with the breadth of views we heard. Parents, schools and children's campaign groups helped us
better understand the problems young people can face online, whether using social media services or popular games, while developers, tech companies and online service providers gave us a crucial insight into the challenges industry faces to make
this a reality.
...
This consultation has helped us ensure our final code will be effective, proportionate and achievable.
It has also flagged the need for us to be clearer on some standards.
We do not want to see an age-gated internet, where visiting any digital service requires people to prove how old they are. Our aim has never been to keep children from online services, but to protect them within it. We want providers to set
their privacy settings to high as a default, and to have strategies in place for how children's data is handled.
We do not want to prevent young people from engaging with the world around them, and we've been quick to respond to concerns that our code would affect news websites. This isn't the case. As we told a DCMS Select Committee in July, we do not
want to create any barriers to children accessing news content. The news media plays a fundamental role in children's lives and the final version of the code will make that very clear.
That final version of the code will be delivered to the Secretary of State ahead of the statutory deadline of 23 November 2019.
We recognise the need to allow companies time to implement the standards and ensure they are complying with the law. The law allows for a transition period of up to a year and we'll be considering the most appropriate approach to this, before
making a final decision in the autumn. In addition to the code itself, my office is also preparing a significant package to ensure that organisations are supported through any transition period, including help and advice for designers and
engineers.
A few days ago Donald Trump responded to more mass shooters by calling on social networks to build tools for identifying potential mass murderers before they act. And across the government, there appears to be growing consensus that social
networks should become partners in surveillance with the government.
So quite a timely moment for the Wall Street Journal to publish an article about FBI plans for mass snooping on social media:
The FBI is soliciting proposals from outside vendors for a contract to pull vast quantities of public data from Facebook, Twitter and other social media to proactively identify and reactively monitor threats to the United States and its
interests.
The request was posted last month, weeks before a series of mass murders shook the country and led President Trump to call for social-media platforms to do more to detect potential shooters before they act.
The deadline for bids is Aug. 27.
As described in the solicitation, it appears that the service would violate Facebook's ban against the use of its data for surveillance purposes, according to the company's user agreements and people familiar with how it seeks to enforce them.
The Verge comments on a privacy paradox:
But so far, as the Journal story illustrates, the government's approach has been incoherent. On one hand, it fines Facebook $5 billion for violating users' privacy; on the other, it outlines a plan to potentially store all Americans' public
posts in a database for monitoring purposes.
But of course it is not a paradox, many if not most people believe that they're entitled to privacy whilst all the 'bad' people in the world aren't.
Commercial interests are also very keen on profiling people from their social media postings. There's probably a long list of advertisers who would love a list of rich people who go to casinos and stay at expensive hotels.
Well As Business Insider has noted, one company Hyp3r has been scraping all public postings on Instagram to provide exactly that information:
A combination of configuration errors and lax oversight by Instagram allowed one of the social network's vetted advertising partners to misappropriate vast amounts of public user data and create detailed records of users' physical whereabouts,
personal bios, and photos that were intended to vanish after 24 hours.
The profiles, which were scraped and stitched together by the San Francisco-based marketing firm Hyp3r, were a clear violation of Instagram's rules. But it all occurred under Instagram's nose for the past year by a firm that Instagram had
blessed as one of its preferred Facebook Marketing Partners.
Hyp3r is a marketing company that tracks social-media posts tagged with real-world locations. It then lets its customers directly interact with those posts via its tools and uses that data to target the social-media users with relevant
advertisements. Someone who visits a hotel and posts a selfie there might later be targeted with pitches from one of the hotel's competitors, for example.
The total volume of Instagram data Hyp3r has obtained is not clear, though the firm has publicly said it has a unique dataset of hundreds of millions of the highest value consumers in the world, and sources said more than of 90% of its data came
from Instagram. It ingests in excess of 1 million Instagram posts a month, sources said.
Privacy International is an international NGO, based in London, which works with partners around the world to challenge state and corporate surveillance and data exploitation. As part of our work, we have a dedicated programme " Defending
Democracy and Dissent " where we advocate for limits on data exploitation throughout the electoral cycle .
We have been closely following the important work of the Committee. Prompted by the additional evidence provided to the Committee by Brittany Kaiser , published on 30 July 2019, we would like to draw your attention to aspects of her submission
that stood out to us and related points:
The ways in which Cambridge Analytica has used segments and inferences is strikingly similar to the techniques we have observed in the data broker industry.
In November 2018, Privacy International complained about seven data brokers (Acxiom, Oracle), ad-tech companies (Criteo, Quantcast, Tapad), and credit referencing agencies (Equifax, Experian) to data protection authorities in France, Ireland,
and the UK. As evidenced in the documentary "The Great Hack", Acxiom is one of the companies, as well as Facebook, that Cambridge Analytica used as a data source. Many of these companies are also involved in or linked to the use of
data for political purposes.
Our complaints show that these companies fail to comply with data protection law and in some cases seem to work under the assumption that derived, inferred and predicted data and behavioural or demographic segments do not count as personal
data, even if they are linked to unique identifiers or linked to or used to target individuals.
We noted with concern that the final report of the Committee on Disinformation and'fake news' stated that "'inferred data' is not protected" under GDPR. While we very much agree with your recommendation to extend privacy laws to close
existing gaps in this regard, we respectfully disagree with your conclusion that 'inferred data' is currently not protected. 'Inferred data' does not always fall under the definition of personal data,yet inferences that may be linked to
identifiable individuals do constitute personal data.
A new aspect of GDPR is an explicit definition of profiling in Article 4(4): "any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in
particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements".
Data brokers, ad tech companies, and credit referencing agencies amass vast amounts of data from different sources (offline and online) in order to profile individuals, derive, and infer more data about them and place individuals into
categories and segments. The law is clear that there must be transparency and limits, including relating to requirements such as legal basis, fairness and purpose limitation. However, our investigation shows that many companies fail to comply
with data protectionrequirements with far reaching consequences for people's rights.
The pervasive nature of data brokers is demonstrated by an example related to anotherof the Committee's inquires, where you have looked at the way reality TV shows have used targeted advertising on Facebook. In this regard it is important to
consider how advertising on television is becoming increasingly targeted, and the role that data brokers play as data sources .
We urge the Committee to look into the profiling practices used by commercial data brokers (including those that also operate as Credit Reference Agencies) and the role this industry plays in the use of personal data for political purposes and
beyond .
We look forward to hearing from you in relation to this request. Should you require any further information or have any questions please do let us know.
In response to today's judgment in the People's vs the Snooper's Charter case Megan Goulding, Liberty lawyer, said:
This disappointing judgment allows the government to continue to spy on every one of us, violating our rights to privacy and free expression. We will challenge this judgment in the courts, and keep fighting for a targeted surveillance regime that
respects our rights.
These bulk surveillance powers allow the state to hoover up the messages, calls and web history of hordes of ordinary people who are not suspected of any wrong-doing.
The Court recognised the seriousness of MI5's unlawful handling of our data, which only emerged as a result of this litigation. The security services have shown that they cannot be trusted to keep our data safe and respect our rights.
Elena Maris of Microsoft Research, Timothy Libert Carnegie Mellon University, and Jennifer Henrichsen University of Pennsylvania have penned a study examining tracking technologies from the likes of Google and Facebook that are incorporated into
re world's porn websites. They write:
This paper explores tracking and privacy risks on pornography websites. Our analysis of 22,484 pornography websites indicated that 93% leak user data to a third party. Tracking on these sites is highly concentrated by a handful of major
companies, which we identify [Google and Facebook].
Our content analysis of the sample's domains indicated 44.97% of them expose or suggest a specific gender/sexual identity or interest likely to be linked to the user. We identify three core implications of the quantitative results:
1) the unique/elevated risks of porn data leakage versus other types of data,
2) the particular risks/impact for vulnerable populations, and
3) the complications of providing consent for porn site users and the need for affirmative consent in these online sexual interactions
The authors describe the problem:
One evening, Jack decides to view porn on his laptop. He enables incognito mode in his browser, assuming his actions are now private. He pulls up a site and scrolls past a small link to a privacy policy. Assuming a site with a privacy policy
will protect his personal information, Jack clicks on a video. What Jack does not know is that incognito mode only ensures his browsing history is not stored on his computer. The sites he visits, as well as any third-party trackers, may observe
and record his online actions. These third-parties may even infer Jack's sexual interests from the URLs of the sites he accesses. They might also use what they have decided about these interests for marketing or building a consumer profile. They
may even sell the data. Jack has no idea these third-party data transfers are occurring as he browses videos.
The Authors are a bit PC and seem obsessed about trying to relate cookie consent with sexual consent but finally cnclude:
Through our results and connections to past porn site privacy and security breaches and controversies, we demonstrate that the singularity of porn data and the characteristics of typical porn websites' lax security measures mean this leakiness
poses a unique and elevated threat. We have argued everyone is at risk when such data is accessible without users' consent, and thus can potentially be leveraged against them by malicious agents acting on moralistic claims of normative gender or
sexuality. These risks are heightened for vulnerable populations whose porn usage might be classified as non-normative or contrary to their public life.
The authors seemed to think the porn sites are somehow ethical and should be doing the 'right' thing. But in reality they are just trying to make money like everyone else and as they say, if the product is free the your data is the
payment. But as the report points out, that price may be a prove a little higher than expected.
AVN notes that Google responded to the claims in a rather obtuse way. Google on Thursday attempted to deny the study's findings, as quoted by The Daily Mail newspaper.
We don't allow Google Ads on websites with adult content and we prohibit personalized advertising and advertising profiles based on a user's sexual interests or related activities online, the company said. Additionally, tags for our ad services
are never allowed to transmit personally identifiable information.
The study, however, did not allege that Google had placed actual advertisements from its GoogleAds network on porn sites, and in its elliptical statement, Google did not specifically deny that its tracking code is embedded on thousands of adult
sites.
Chrome's Incognito Mode is based on the principle that you should have the choice to browse the web privately. At the end of July, Chrome will remedy a loophole that has allowed sites to detect people who are browsing in Incognito Mode.
People choose to browse the web privately for many reasons. Some wish to protect their privacy on shared or borrowed devices, or to exclude certain activities from their browsing histories. In situations such as political oppression or domestic
abuse, people may have important safety reasons for concealing their web activity and their use of private browsing features.
We want you to be able to access the web privately, with the assurance that your choice to do so is private as well.
Google also noted a useful bit of info on evading article count restrictions imposed by some publishers with metered access policies
Today, some sites use an unintended loophole to detect when people are browsing in Incognito Mode. Chrome's FileSystem API is disabled in Incognito Mode to avoid leaving traces of activity on someone's device. Sites can check for the
availability of the FileSystem API and, if they receive an error message, determine that a private session is occurring and give the user a different [more restricted] experience.
With the release of Chrome 76 scheduled for July 30, the behavior of the FileSystem API will be modified to remedy this method of Incognito Mode detection.
The change will affect sites that use the FileSystem API to intercept Incognito Mode sessions and require people to log in or switch to normal browsing mode, on the assumption that these individuals are attempting to circumvent metered paywalls.
Unlike hard paywalls or registration walls, which require people to log in to view any content, meters offer a number of free articles before you must log in. This model is inherently porous, as it relies on a site's ability to track the number
of free articles someone has viewed, typically using cookies. Private browsing modes are one of several tactics people use to manage their cookies and thereby reset the meter count.
Of course it is probably a bit easier to find an addon that lets you block or delete the cookies for specific websites or else to try just turning javascript off.
And as promised, Google Chrome has been updated to make incognito mode a little more incognito.
Chrome 76 which was released today has but a stop to the common ways in which websites can work out that users are surfing the web incognito and then ban them from accessing content.
If Facebook can 'filter' or 'backup' your 'encrypted' communications then this proves that encryption is compromised, as does continued operation in any country that demands backdoors
'The status quo is exceptionally dangerous, it is unacceptable and only getting worse. It's time for the United States to stop debating whether to address it and start talking about how to address it'
Facebook is revealing a wider range of websites and apps that gather data for Facebook, previously without being identified or seeking consent. Facebook will offer a new privacy control covering these newly revealed snoopers.
A few days ago Donald Trump responded to more mass shooters by calling on social networks to build tools for identifying potential mass murderers before they act. And across the government, there appears to be growing consensus that social
networks should become partners in surveillance with the government.
Commercial interests are also very keen on profiling people from their social media postings. There's probably a long list of advertisers who would love a list of rich people who go to casinos and stay at expensive hotels.
Liberty writes:
Elena Maris of Microsoft Research, Timothy Libert Carnegie Mellon University, and Jennifer Henrichsen University of Pennsylvania have penned a study examining tracking technologies from the likes of Google and Facebook that are incorporated into
re world's porn websites. They write:
AVN notes that Google responded to the claims in a rather obtuse way. Google on Thursday attempted to deny the study's findings, as quoted by The Daily Mail newspaper.
And as promised, Google Chrome has been updated to make incognito mode a little more incognito.
