This week we dive into the murky world of data brokers, courtesy of a new report by Reset Tech Australia.
The report provides a fascinating window into how data brokers operate – particularly the granular categories and segments that online users are categorised into. This data is sold to advertisers and, in some cases, even law enforcement bodies and other authorities.
We share our reactions about the report and discuss how the availability of data about sensitive topics such as gambling, alcohol consumption, financial stress can make us more vulnerable to exploitation.
Listen now
Transcript
This is an automatically generated transcript. We make our best efforts to check that it is an accurate reflection of the episode, but it may contain some errors and unedited content.
Arj
Welcome to this week in Digital Trust, elevenM’s regular conversation about all things tech policy, privacy, AI and cybersecurity. I’m Arj joining you today from Awabakal country.
Jordan
And I’m Jordan joining you from Wurundjeri country in Melbourne. And Arj, we’re talking about what we can know about each other. How can we get to know each other better? What’s the best way, do you reckon?
Arj
Well, I’m coming to Melbourne to visit you.
Jordan
That’s true. That is exciting.
Arj
The old fashioned way would be to get, you know, in person with someone and spend time with them. But I don’t think that’s what you’re talking about.
Jordan
The modern way is to take out our wallet and buy the information and oh, the things I could find out about you just by pulling out the credit card.
Arj
Yes, data brokers, indeed, invasiveness as a service, really
Jordan
like surveillance as a service.
Arj
Yeah, we pay wallet and find out what you need to. Yeah, that’s what we’re talking about today. Triggered by a new report by Reset Tech Australia, but it’s a topic that’s often popped up and there’s lots of crazy stories and examples floating around. What’s yours? Like what kind of, when you hear data brokers, there must be something that pops up for you.
Jordan
Yeah. I racked my brains on this. I don’t have any that like are super personal. My partner likes to like enter into competitions and sign up for things. And so I’m sure I have, or we both have a very extensive kind of marketing footprint from all of those things that I often get. Questionable emails that turned out to be because she signed up to wins a TV or something. But no, I don’t have any good stories.
My favorite stories are ones that were in the news or that didn’t happen to me. There’s this like almost cliched story that kind of privacy people and data people as well. I was heartened to hear tell, which was from the early days of this kind of data analytics world where Target in the US, their data analytics people spent a lot of effort kind of trying to work out when people are pregnant because you make all these purchasing changes, you start buying nappies, you stop buying certain other stuff, maybe booze.
And so that’s a really useful thing to know. And there’s this great story that’s been incredibly well covered and reported of target kind of figuring out that a teenage girl is pregnant before her father knew or before anyone in the family and sending like pregnancy related marketing to that family and precipitating some, some difficult discussions. So, you know, that’s the cliche one that, that I always get to. I think that’s the thing about the data, the data breaking industry is that
Arj
As much as we know about it, as much as it applies personally, it feels really hidden because I think it is so good. Like, like I, I’m sure there is a massive footprint of me being collected, traded and sold, but I don’t have a personal story where I can go, aha, that was, you know, because of data broking that, that, that happened to me and, and if anything, I think we’ll get to this. I think because it is so good, it can be used to sort of target you with things that you’re like particularly most sort of vulnerable moment, or where you’re kind of most inclined to want to purchase something to the point where you probably think you came up with the idea and you know, in the moment or something.
And so I think that’s, I don’t have a personal story. My kind of, you know, new story or other kind of external recollection that always comes up with data breaking news. Well, there’s two, one is I think location data. Like it’s always To me, location data in the context of data-broking is always just sort of a bit more mind-blowing because it’s just, you know, knowing where people have been and kind of where their devices have been really is, it just isn’t another order of kind of risks. Our stories, like in Motherboard in 2020 of data brokers kind of collecting location data from a Muslim prayer app. So people would just use it to track their prayer times and then selling that onto US military intelligence. Um,
but the other one just to mention is just the markup, which we’ve quoted a several times on the pod did like a big piece around data brokers some years ago. And just remember getting a sense of how big the size of many of these data breaking companies were, and they had a story that said like six of the companies that they looked at claimed that they had more than a billion devices in their data. So just like that’s six different companies with that level of richness. So just the scale of it is always kind of a bit mind blowing. It’s like really is that engine, that economic engine behind so much of what we do online.
Jordan
And this, the scale and the intrusiveness and the detail of the data, I think, and particularly that location data is really startling when you get into it. There’s this really kind of bizarre situation that’s emerged in the U S and it’s probably a bit the same elsewhere where These data-breaking companies have better location data, better tracking data about the general population than law enforcement agencies do, or than the FBI does. The law enforcement agency would ordinarily need to go and get a warrant to go and track a person, but they don’t need to do that anymore because they can just buy that person’s location history from some data broker and use that instead.
And like, so you’re at this point where the commercially available stuff is like more detailed and more comprehensive than the stuff that a law enforcement agency would need to get a warrant for.
Back to this point that like, it’s really hard to engage with and understand and see the personal impact or connection. This report that we’re talking about today, I think is a really great contribution to making that some, just some of that detail more real, you know, like we all know that data brokers an issue where, you know, there’s all this news and media reporting that we’ve just talked about, but this, this report from reset tech Australia, they’ve taken one data set, which was kind of, I think accidentally, but like was published by Microsoft is called the Zander data set, Microsoft procured a data broking company like in 2020 or something and kind of accidentally published the catalog of the data sets or the attributes that are in that marketing data set.
And there’s like, you know, many thousands of them. And so what Reset’s done is they’ve gone through that set of data and just picked out some of the and told some stories and, you know, picked apart some of the like attributes or characteristics or audience segments, I suppose they’re called in marketing language that this data sets out that can be bought about people and they’re a bit creepy.
Arj
Yeah. It’s, um, I was saying to you before, like a lot of the other things I was talking about, like say the markup investigation sort of paint a picture and tell you about the data breaking industry and the way it works, but it’s one thing to see the actual data sets and what they look like and how they’re structured and how granular they get.
And that’s what this report does it kind of gives those examples of the segments that they’re tracking and that can be tracked and also really calls out where the vulnerabilities are for us as a population if data brokers are tracking that. So let’s get into it. What I mean for you, what you said is creepy, but it’s like, I think I’ve preempted the we might’ve preempt the answer, but what do you think struck you most about the report?
Jordan
Yeah. So they, they do this great thing of just walking through a few really sensitive categories. And for each of them, what really strikes me is how, so there are things like gambling, alcohol, consumption, smoking, data about young people, and kind of financial information, right? And they’re all categories of people who we have kind of social responsibilities to, right? Like all like social problems that relate to alcohol, to gambling, to financial disadvantage to cost of living, protecting young people.
And it just kind of this report really neatly kind of says, Hey, you know, we’ve got this alcohol problem in Australia, and here’s all this data that you can buy that will help you advertise products to people who have, you know, alcohol problems. And hey, we’ve got this gambling problem in Australia, and here’s all this data that helps you really granularly target people who, you know, who gamble a lot.
And so like more than just the creepiness, it really strikes me how just like the way they’ve structured it, but it really just neatly puts together the, like the social objective, the kind of thing that we want to manage or take care of or that harms people and how this data really just gives organizations the tools to target those people who are vulnerable.
Arj
Yeah. I was struck by, I guess the levels of concern that were kind of came up within me when you see the different types of profiling. Cause it’s, you know, there’s to your point, very specific and sensitive kind of information, like, you know, people who have gambled in the last seven days. I mean, it’s hard to imagine a, a use case for that, that at least potentially is not very highly problematic, but of course there’s, you know, a lot of it is the more mundane stuff. It’s like people who have visited a sushi restaurant.
Okay, well, I mean, that’s what I would expect to see there. But yeah, you then get to this more sensitive kind of stuff that things are, you know, where people probably are trying to manage their own addiction around. That’s problematic.
But then even like some of the stuff that was just even just seemed to be just inference based bothered me a little bit. Like, you know, people assessed to be working parents based on the places they have visited, which is, I don’t know why, but it’s again, it’s, it’s about.
I guess it’s that kind of idea of privacy is like you wanting to reveal the parts of yourself, you know, and you want to have the autonomy over that. And it’s the ability to say, well, actually we can make an assessment about you, your relationships, the kind of things that are important to you based on other things. So it’s not even someone who has, you know, signed into some kind of app for, you know, for working parents to manage their schedules or something. It’s literally like, we’re going to piece together a few other data points and we can make this inference about you.
Jordan
Yeah, it really highlights the sensitivity of that location data that you were describing, right? There’s this whole category of like, has the person been to a school or do they regularly go to primary schools? Do they regularly attend a kindergarten or a toy store or a church or, you know, like when you know where churches are, location data suddenly becomes a proxy for you know, for religious practices.
I really encourage anyone listening to just like pull up that report and just have a foot, don’t read, you don’t have to read the whole thing, but like have a flick through just some of the, there’s a bunch of tables of just the data that was like some of the data headers. And yeah, it’s, it’s just really, um, really interesting, really surprising.
Arj
So there’s a whole section in the report that’s titled targeted advertising and manipulation. And I thought That was really interesting that they used that word and there’s this framing around manipulation. And, you know, there’s this, I guess, this is a school of thought that at the end of the day, an ad is just an act of persuasion. We put it up, we put it up in the most compelling way. And you know, you as the viewer of that ad can be persuaded or not, but you have some measure of kind of control about what you do next.
But that word manipulation, that takes it to a different place. What were your thoughts on that? And how does the report speak to that?
Jordan
Yeah, I really like their use of the word manipulation in there. And they include a definition of that term from an academic paper we’ll link. But it’s an academic paper about kind of what? Yeah, technology automation and manipulation and how we think about those things from a legal perspective.
Because not all advertising is the devil, right? Like not all advertising is manipulative and not all even online advertising is necessarily a problem here. When it becomes a problem is when it’s manipulative and their definition kind of points out three characteristics of manipulative practices.
One is where you’re exploiting an individual’s vulnerabilities. You know, you’re not just saying we have a thing, right, and buy it if you want, but you’re targeting particular vulnerabilities that you know about in a person, which is really what this data set enables, right? The second characteristic is when you’re doing that covertly, you’re not doing that openly, you’re not saying, I’m, you know, I heard you gambled last week. Maybe you want to gamble some more. You just covertly, you know, opaquely presenting this stuff. And then the third is where there’s a divergence of interests between the company doing the surveillance or doing the targeting and the individual target consumer. So you can see with all of these categories that we’re talking about, like alcohol use, gambling, smoking, financial struggle, difficulty, there’s this whole category of benevolent uses for that, right? If you were transparent about it and you’re like trying to provide quitline or gambling helplines or, you know, alcohol support or health services or financial counseling, all of this stuff, totally fine, great. Let’s, you know, like that targeting that stuff at a person with their interests in mind, not manipulative.
But targeting like with a commercial incentive to sell more of these things or to put out a you know, get a predatory loan with a high interest rate or like sign some up to a credit card because you know they you know, they’re gonna rack up the charges whatever it is That’s when the interests diverge and if you’re doing it covertly and targeting Vulnerabilities, that’s when it’s manipulative in this really negative way.
Arj
Yeah, they quote in the report I think there’s three academics, Susser, Rosler and Nissenbaum. Nissenbaum, I think we’ve quoted on the pod before, but they quote them saying manipulation inherently disrupts our capacity for self authorship. It presumes to decide for us how and why we ought to live, which I think is quite powerful. Yeah. The other thing that I found kind of interesting in this space around sort of manipulation and particularly manipulation around our vulnerabilities was the report makes this really good point, which is that Vulnerability is not a fixed characteristic and that all consumers are vulnerable at different points in their lives.
So you might think, okay, well, I don’t have a gambling addiction or I’m not, I don’t have financial stress, so I’m not going to be prone to that kind of targeting. But this idea that this kind of picture that’s built by data brokers, this kind of accumulation of so many data points and an insight into the life journey of people means that in the hands of people who are.ill-intended can, you know, they can kind of pinpoint the point where you will be vulnerable and kind of exploit that. And so it’s that, I think that sort of sense of kind of that timing and the fact that this data exists for all of time, but the insights it delivers advertisers can be so precise from a timing perspective.
Jordan
Yeah, for sure. And, and I love that definition of vulnerability there. That like it’s, it’s not also an attribute of a person, right? It’s a condition or it’s a social environmental kind of place that a person can be. And people are vulnerable when they are traveling in other countries, right? Cause they’re less, they’re not at home, they don’t have support networks. If you’re living overseas or even traveling overseas, you might not speak the language. And those are vulnerabilities that are not, these kind of big V vulnerabilities that people kind of often think about.
if you’ve recently had a child, you’re going to be mad sleep deprived. And, you know, that that’s a vulnerability that can be targeted and exploited in this way just as much as a medical condition or an addiction or something like that. So, yeah, I think it’s a really important idea of vulnerability there. And it’s again, I think a really important framing for understanding why, like the types of marketing or the types of targeting that are super problematic.
You know, like, like the, I think the advertising industry really likes to put forward the benevolent things, right? The non-manipulative, the, we heard you looked at a hat and maybe you want sunglasses as well or whatever, trying to, trying to make this stuff useful, which like, sure, but from a regulatory point of view we need to target the bad uses, right? We’ve got to like, like if we can find a way of cutting off the bad uses while still enabling the good ones, fine. But like this data gives organizations so much power to target and manipulate people that, you know, we, I think we really need to kind of manage that.
Arj
Yeah. And like, I mean, it, it takes me back to our conversations around location data in the past where the reason for collecting that information, that location information is often not only benign, but completely kind of reasonable in the context of a particular app. Like there are apps that need to tell you how to get from A to B or want to tell you the weather in your location. And so they ask you for your location.
And it makes sense in that point of time for us to say yes, and it also makes sense for them to take it. But there are these commercial imperatives now where there’s data brokers sitting in the background going, well, you’ve collected this data how about you sell it to us, we’ll pay you for it. And then once it’s there, it can be on sold to people that are willing to buy it and not all those people wanna buy it for the same fluffy intent as telling you it’s sunny and 22 degrees where you are, because they wanna know where you are for law enforcement purposes or for some other surveillance purposes.
So it really paints this picture of like, the distinction between you know, what might be benign uses of this information versus the kind of potential for malicious or, you know, ill intended actors to use it.
Um, and, you know, like, so when you read like stuff like, you know, it costs advertisers $3 and three cents to reach a thousand young people profiled as being interested in alcohol. I mean, that, that whole sentence to me is troublesome is that the fact that that’s even a possibility that you can kind of, now that you’ve made that profile And you can track a thousand people interested in alcohol. You can then tell advertisers, well, you can get to them and this is what it will cost you and this is what this enables.
Arj
One of the things I want to ask you, and maybe we talk a little bit more about some of these things like location and geofencing, but before you kind of maybe speak to some of that, address the issue about the fact that a lot of these data brokers claim that it’s anonymous. They don’t have names against this information, so they’re only selling insights and giving advertisers an ability to segment and refine who they target. But they don’t actually intruding on privacy because it’s anonymous.
Jordan
Yeah. Uh, that is a argument that is made under Australian law that I think is very sketchy, honestly, um, but the, the argument is essentially that there’s no name, right? The, the, all of this is attached to a, uh, advertising ID or something, um, that is associated with your devices and your email address maybe, but in kind of an obscured way so that if you ask, if you are a person at one of these data broker companies, they might not have your name attached to the fact that you gambled in the last week. It’s just this advertising ID. The person that that refers to gambled in the last week has a particular income, lives in a particular place. All this stuff’s just attached to that. And what they say is, well, we don’t know who that is. That could be anyone.
So it’s not personal information. There’s no privacy thing going on here. Which, like, when you get to this level of granularity of data, and when the whole point of it is that they’re sending you emails and targeting and communicating with you, they’re reaching out and touching you, interacting with you, is a kind of technical legal argument that gets made.
I’m genuinely not sure that it would hold up a court these days, but it’s a technical legal argument that gets made that hasn’t really been tested super hard. And that is kind of a fiction in my mind that we don’t have the person’s name, therefore privacy doesn’t apply.
It’s actually something that is getting addressed pretty explicitly in the Privacy Act law reform. The intent of the law reform is to kind of plug that gap so that essentially any information Like if you can individualize person, if you can pick out a person from a crowd and interact with them or target them as a specific individual, then that’s got to be treated as personal information. So all of that’s going to change legally. But yeah, the fiction is that who knows? We’ve just got an advertising idea.
Arj
Yeah. It’d be interesting to see how the, how the legislation kind of evolves. And then the other, I think the other thing that’s relevant here is the ACCC launched an inquiry as part of the digital platform services inquiry into data brokers about middle of last year. And so I think they’re due to report back interim report like in a month or so.
Um, so there’s a few things kind of honing in on this industry and be interesting to see if it has any dent. Cause I think, I think the report from reset Australia describes them somewhere as, you know, being highly prolific, I think was the word that it’s used. So Um, it’s an industry that’s very much as much as it’s under the covers, it’s very much thriving. So, um, yeah, it remains to be seen if anything will happen.
Jordan
Yeah. Well, yeah, I’m, I’m hopeful where, you know, we’re awaiting this, um, privacy law reform to move, but like, like you say, there’s a lot of other kind of. Views into, you know, lenses, people, the ACCC examining this stuff and yeah, really, so yeah, really, really great report from reset as well to just kind of, you know, very timely.
23:48
just lobbing this detail into that policy discussion right now.
Arj
So yeah, good stuff. Good one. Well, thanks for the chat.
Jordan
Chat to you next time. I’ll try to purchase at least two conversation starters before you turn up in Melbourne.
Arj
Love it.
Jordan
OK.
Arj
Thanks, Jordan.
Jordan
See you.
