OUT OF CONTROL How consumers are exploited by the online advertising industry 14.01.2020 Table of contents Table of contents ........................................................................................... 2 1 Summary ............................................................................................... 5 1.1 Introduction ............................................................................................ 8 2 Background: The digital marketing and adtech industry ....................... 12 2.1 Profiling and targeted advertising ........................................................ 12 2.2 Actors in adtech and digital marketing ................................................. 13 2.3 Alternative business models for digital marketing ............................... 16 2.4 Tracking and personal data processing by third party vendors ............ 17 2.4.1 Data brokers .................................................................................. 19 2.4.2 Third party data providers ............................................................ 22 2.4.3 Measurement, attribution, and ad verification ............................ 23 2.5 Unique identifiers ................................................................................. 25 2.5.1 Matching identifiers through ID syncing ....................................... 25 2.5.2 Google Play Android Advertising ID .............................................. 28 2.5.3 System level opt-out settings ........................................................ 31 2.6 Real-time bidding .................................................................................. 34 2.7 Push from civil society and regulators .................................................. 39 3 The harmful effects of profiling and behavioural advertising ................ 43 3.1 Consumers do not want to be tracked, but feel powerless .................. 43 3.2 Power asymmetries and lack of transparency ...................................... 45 3.3 Manipulation ......................................................................................... 46 3.4 Discrimination ....................................................................................... 47 3.5 Purpose creep ....................................................................................... 49 3.6 Security and fraud ................................................................................. 51 3.7 Chilling effects and freedom of expression .......................................... 52 3.8 Reduced trust in the digital economy ................................................... 53 3.9 Ad fraud and degradation of online services ........................................ 54 4 Methodology: Observing data flows from apps to third parties ............ 55 4.1 Method ................................................................................................. 56 4.2 Expected and unexpected data transmissions ...................................... 58 4.3 Limitations of the data flow analysis .................................................... 58 5 Information and choice in apps ............................................................ 60 5.1 Review of ten apps ................................................................................ 61 5.1.1 Perfect365: One-Tap Makeover .................................................... 63 5.1.2 MyDays - Ovulation Calendar & Period Tracker ............................ 67 5.1.3 Period Tracker Clue - Ovulation and Cycle Calendar ..................... 68 5.1.4 Tinder and OkCupid ...................................................................... 70 5.1.5 Grindr ............................................................................................ 72 Page 2 of 186 5.1.6 Happn ............................................................................................ 75 5.1.7 My Talking Tom 2 .......................................................................... 76 5.1.8 Muslim - Qibla Finder, Prayer Times, Quran, Azan ....................... 78 5.1.9 Wave Keyboard Background - Animations, Emojis, GIF ................ 80 6 Analysis of data flows and third parties receiving personal data ........... 81 6.1 Location data brokers ........................................................................... 82 6.1.1 Fysical ............................................................................................ 83 6.1.2 Safegraph ...................................................................................... 86 6.1.3 Fluxloop ......................................................................................... 89 6.1.4 Unacast ......................................................................................... 92 6.1.5 Placer ............................................................................................ 95 6.1.6 Placed/Foursquare ........................................................................ 99 6.2 Behavioural personalization and targeting ......................................... 102 6.2.1 Receptiv/Verve ........................................................................... 103 6.2.2 Neura .......................................................................................... 106 6.2.3 Braze ........................................................................................... 108 6.2.4 LeanPlum .................................................................................... 112 6.3 Systemic oversharing .......................................................................... 115 6.3.1 AppsFlyer .................................................................................... 117 6.4 Google and Facebook ......................................................................... 120 6.4.1 Google ......................................................................................... 121 6.4.2 Facebook ..................................................................................... 122 7 Cascading data sharing through Grindr ............................................... 123 7.1 The advertising technology in Grindr .................................................. 123 7.1.1 Twitter’s MoPub ......................................................................... 125 7.1.2 AppNexus (AT&T) ........................................................................ 131 7.1.3 Bucksense ................................................................................... 135 7.1.4 OpenX ......................................................................................... 140 7.1.5 PubNative .................................................................................... 144 7.1.6 Vungle ......................................................................................... 147 7.1.7 AdColony ..................................................................................... 153 7.1.8 Smaato ........................................................................................ 157 7.2 Self-certification and cross-device tracking ........................................ 160 7.2.1 The problem of self-certification ................................................ 161 8 Legal analysis ..................................................................................... 162 8.1 The General Data Protection Regulation ............................................ 163 8.1.1 Data subjects, controllers, and processors ................................. 164 Page 3 of 186 8.1.2 Definition of personal data ......................................................... 166 8.2 Legal basis for processing of personal data ........................................ 167 8.2.1 Consent ....................................................................................... 168 7.2.1.1 Freely given and specific ......................................................... 168 7.2.1.2 Informed and unambiguous .................................................... 169 7.2.1.3 Explicit ..................................................................................... 170 8.2.2 Fulfilment of a contract ............................................................... 171 8.2.3 Legitimate interests .................................................................... 172 8.2.3.1 Interests, rights, and freedoms of the data subject ................ 173 8.2.3.2 Interests of the controller ........................................................ 175 8.3 Conclusion of legal analysis ................................................................ 177 9 What needs to be done? .................................................................... 178 8.1 The spread of personal data is illegal .................................................. 179 8.2 Authorities must enforce the law ....................................................... 180 8.3 Marketers and publishers must take responsibility ............................ 182 8.4 Conclusion ........................................................................................... 183 9 Glossary ............................................................................................. 184 Page 4 of 186 1 Summary As we move around on the internet and in the real world, we are being continually tracked and profiled for the purpose of showing targeted advertising. In this report, we demonstrate how every time we use our phones, a large number of shadowy entities that are virtually unknown to consumers are receiving personal data about our interests, habits, and behaviour. These actors,