Ban online behavioral advertising | Electronic Frontier Foundation
Tech companies make eye-popping profits by targeting ads to us based on our online behavior. This incentivizes everyone online to collect as much of our behavioral information as possible and then sell it to the ad tech companies and data brokers that serve them. This ubiquitous online behavioral surveillance device turns our lives into open books – every mouse click and screen swipe can be tracked and then disseminated across the vast ad tech ecosystem. Sometimes this system is called “online behavioral advertising.”
Now is the time for Congress and states to ban the targeting of ads to us based on our online behavior. This article explains why and how.
The harms of online behavioral advertising
Targeting ads for us based on our online behavior is a three-part cycle of tracking, profiling and targeting.
- Track: A person uses technology, and this technology discreetly collects information about who they are and what they are doing. More importantly, trackers collect online behavioral information, such as app interactions and browsing history. This information is shared with ad technology companies and data brokers.
- Profile: Ad tech companies and data brokers who receive this information try to link it to what they already know about the user in question. These observers draw conclusions about their target: what they like, what kind of person they are (including demographics like age and gender), and what they might be interested in buying, attending or vote.
- Target: Ad tech companies use profiles they have assembled or obtained from data brokers to target ads. Through websites, apps, televisions and social media, advertisers use data to display personalized messages to particular people, types of people or groups.
This activity has proven extremely lucrative for the companies involved: Facebook, Google and a host of smaller competitors are turning data and screen real estate into advertising dollars on a staggering scale. Some companies do these three things (track, profile, and target); others only do one or two.
The industry is actually harming users. First, online behavioral targeting is almost single-handedly responsible for the worst privacy issues on the Internet today. Behavioral data is the raw fuel that powers targeting, but it’s not just used for ads. Data collected for advertising technology may be shared or sold to hedge funds, law enforcement agenciesand military intelligence. Even when sensitive information does not leave the walls of a company, this information can be accessed and used by people inside the company to personal purposes.
Additionally, online behavioral advertising has skewed the development of technology so that our devices spy on us by default. For example, mobile phones are equipped with “advertising identifiers”, which were created for the sole purpose of allowing third-party trackers to profile users based on how they use their phone. Advertising identifiers have become pivot of the data broker economy, and allow brokers and buyers to easily link data from disparate sources in the online environment to a single user’s profile. Likewise, although third-party cookies were not explicitly designed to be used for advertisements, the influence of the advertising industry has ensured that they remain in use despite years of widespread consensus. on their misdeeds.
Targeted advertising based on online behavior doesn’t just harm privacy. It also contributes to a range of other harms.
Such targeting reinforces the efforts of fraudulent, exploitative and deceptive advertisers. This allows peddlers of shady products and services to reach exactly the people who, based on their online behavior, are most likely to be vulnerable to their messages. Too often, what’s good for an advertiser actively harms their targets.
Many targeting systems start with profiles based on user behavior and then perform algorithmic audience selection, meaning advertisers don’t need to specify who they intend to reach. Systems like Facebook’s can run automated experiments to identify exactly which types of people are most responsive to a particular message. A 2018 expose of the “affiliate advertisers” industry described how Facebook’s platform allowed peddlers to make millions by targeting gullible users with misleading ads for modern snake oil. For example, this technology helps subprime lenders target financially vulnerable people and lead investment scams to thousands of seniors. Simply put, tracking amplifies the impact of predatory and exploitative ads.
In addition, advertising targeting based on online behavior has discriminatory effects. Sometimes advertisers can directly target people based on their gender, age, race, religion, etc. Advertisers can also use behavior-based profiles to target people based on proxies for these demographic characteristics, including “interests”, location, purchase history, credit status and income. Moreover, by using similar audiencesadvertisers can specify a set of people they want to reach and then override Facebook Where google to find people who, based on their behavioral profiles, are “similar” to this initial group. If the advertiser’s list discriminates, so does the “lookalike” audience. As a result of all this, targeted advertising systems – even those that only use behavioral data – can allow housing discrimination and racist voter suppression. Behavioral targeting systems can have discriminatory effects even when the advertiser does not intend to discriminate.
How to Write an Online Behavioral Advertising Ban
Given these serious harms, EFF is calling on Congress and states to ban the targeting of ads to people based on their online behavior. This ban must be narrowly tailored to protect privacy and fairness without imposing unnecessary burdens on speech and innovation.
Lawmakers should focus on the most important personal data for targeted ads: our online behavior. This includes the web searches we perform, the web pages we visit, the mobile applications we use, the digital content we view or create, and the time we log on. It also includes how our online devices document our offline lives, like our phones using GPS to track our geolocation or fitness trackers monitoring our health.
Lawmakers should prohibit any entity that serves online advertisements from doing so by targeting users based on their online behavior. This ban would apply to dominant ad tech players like Facebook and Google, among others. By “advertising” we mean paid content that concerns the economic interests of the speaker and the audience. This prohibition should apply whether or not an ad is targeted to a traditional personal identifier, such as a name or email address.
Lawmakers should also address the role of data brokers in ad tech. This sector profiles users based on their online behavior and creates lists of users to whom various advertisements can be served. But many data brokers do not run any advertisements afterwards. Instead, they sell these listings to advertisers or directly to online ad providers.
Thus, lawmakers should prohibit an ad publisher from using a list created by another entity, if it knows it is based on users’ online behavior, or if it would have known otherwise. he had ignored known facts. Similarly, a data broker should be prohibited from disclosing a list of users based on online behavior, if it knows it will be used to serve advertisements, or if it would have known otherwise. with a reckless disregard for known facts.
We suggest two limited exceptions to these prohibitions, both involving what a user does at present, not over time. First, the ban should exempt “contextual ads” based on content a user is currently interacting with. For example, when a user views a nature magazine online, they may be presented with an advertisement for hiking boots. Second, the ban should exempt ad serving based on a user’s approximate real-time location. For example, when a user visits a particular city, they may receive an ad for a restaurant in that city.
Of course, banning online behavioral advertising is just one tool in the larger data privacy toolbox. The EFF has long supported legislation requiring companies to obtain consumer consent before processing their data; prohibit data processing except where necessary to give consumers what they have requested (often referred to as “data minimization”); and to allow us to access, port, correct and delete our data. To enforce these laws, we need a private right of action and a ban on forced arbitration.
EFF looks forward to working with lawmakers, privacy and equity advocates, and other stakeholders to enact comprehensive consumer data privacy legislation in Congress and in the states. This should include banning targeted advertising based on our online behavior.