Landmark
Litigation.
Online advertising causes the
We are going to court to stop it.
Secret dossiers
about you?
Let's take a peek.
Video: a peek inside the system
building secret dossiers about you
We know online ads track us. But what do they do with the data they get from doing this?
Now we know. ICCL's evidence includes the online advertising industry rulebook that specifies the intimate characteristics put into hidden dossiers about you.
This data about you - based on what you think is private - could prompt an algorithm to remove you from the shortlist for your dream job. A retailer might use the data to single you out for a higher price online. A political group might micro target you with personalised disinformation.
What you do online,
exposed everywhere.
Graphic: thousands of companies
snoop on what you do online.
The private things we do and watch online are collected from a vast online advertising system that operates behind the scenes on virtually every website and app. The system is called “Real-Time Bidding” (RTB).
Almost every time you load a page on a commercial website or use an app, a high speed advertising auction happens behind the scenes that determines what ad will appear in front of you. This auction broadcasts private information about what you are doing online, and where you are, to many other companies in order to solicit their bids for the opportunity to show you their ad.
Though this RTB data can contain very sensitive information, industry documents confirm that there are no technical measures to limit what companies can do with this information, nor who they pass it on to.
Online advertising's
illegal data.
Video: the dangerous data that
online ads broadcast about you
The online advertising "RTB" system broadcasts intimate data about us as we use websites and apps, including things like what you are reading or watching or listening to, inferences about your sexual preferences, religious faith, ethnicity, health conditions, your political views, and where you physically are - sometimes right up to your GPS coordinates.
RTB data also includes ID codes about you. This helps tie together many pieces of RTB data over time, so that very intimate profiles can be built about you, including parts of your life that you do not intend to put on the record.
Biggest. Data. Breach. Ever.
(Repeated daily)
The online advertising industry broadcasts information about us, and about what we are doing online, to large numbers of companies. This happens hundreds of billions of times, every day.
Table: top RTB companies
Live on 9.8 million websites1Source: Builtwith's statistics on Google DoubleClick/Authorized Buyers installations on websites https://trends.builtwith.com/ads/DoubleClick.Net. Does not include additional 4 million redirected websites, so the figure may be considerably larger.
Number of daily broadcasts unknown
Broadcasts to 1,042 companies2Source: Google publishes a list of data recipients at https://support.google.com/admanager/answer/9012903.
AT&T (Xandr)
131 billion broadcasts, daily3This is likely to be a low estimate.
Source: the company's previous web page said in 2019 that it had “a peak of 11.4 billion daily impressions". Separately, a partner company revealed in 2017 that it took AppNexus roughly 11.5 RTB auctions (which entail unlawfully broadcasting personal data) to deliver a single advertisement (an "impression"). Therefore, the 11.4 daily impressions reported in 2018 equated to roughly 131 billion auctions per day.
Broadcasts to 1,647 companies4Source for number of data recipients: Xandr lists the companies it passes data to at https://docs.xandr.com/bundle/service-policies/page/third-party-providers.html#ThirdPartyProviders-Ad-serverPartners.
Index Exchange
120 billion broadcasts, daily5Source: the company says it runs 120 billion "auctions" on a "pretty typical day" at https://www.indexexchange.com/ix-traffic-filter-meeting-2020s-business-challenges-with-machine/.
Broadcasts to unknown number of companies
Pubmatic
100 billion broadcasts, daily6PubMatic cites this figure in an article of the technical challenges of processing such massive quantifies of data, at https://pubmatic.com/blog/optimizing-data-processing-at-scale/.
100 billion broadcasts, daily7Source: according to marketing material of the Google infrastructure that OpenX uses, which cites the number of OpenX's RTB auctions a day. https://cloud.google.com/customers/openx.
Verizon Media
600 billion ad requests, daily8Source: Verizon Media claims "We’re ramping up our DSP supply access to reach 600 billion bid requests per day" in https://www.verizonmedia.com/insights/reach-your-roas-goals-with-verizon-media.
Number of daily broadcasts unknown
Broadcasts to unknown number of companies
Smaato
60 billion ad requests, daily9Source: the front page of Smaato.com claims "1800000000000+" ad requests per month. Dividing this by 30 gives the daily number used.
Number of daily broadcasts unknown
Broadcasts to 1,044 companies10Source for number of data recipients: Smaato publishes a list of the companies it passes data to at https://www.smaato.com/partner-list/.
Facebook Audience Network
Broadcasts to unknown number of companies
Broadcasts to unknown number of companies
What happens in Hamburg
stays in ...everywhere.
Video: Holding a New York based
industry body to account under European Law
The online advertising industry is governed by reckless and harmful rules set by IAB TechLab, the industry trade body. IAB TechLab's members include big tech (Google, Facebook, Amazon...), data brokers (Equifax, Experian, Acxiom...), advertising agencies (Groupm, Publicis, IPG...).
It is headquartered in New York. But being in New York does not protect IAB TechLab from European law. Nor does it protect the thousands of companies that use IAB TechLab’s rules to share and trade our most intimate secrets.
IAB TechLab has a European presence in Hamburg. ICCL approached Spirit Legal, a German law firm, to act against IAB TechLab and two other defendants that use its systems at the Landgerichte Hamburg.
Boldly going
where enforcers
have failed to go.
Enforcers have failed to act.
So we must.
In early 2018, an RTB industry insider, Dr Johnny Ryan, contacted data protection authorities in Ireland and the UK to "blow the whistle" about the massive data breach at the heart of online advertising. Then, having left the industry and joined the privacy company Brave, he sent the Irish Data Protection Commission a formal GDPR complaint and evidence in September 2018, and the Open Rights Group and Dr Michael Veale filed the same complaint in the UK. After that, 25 NGOs and individuals filed variants of the complaint across the European Union.
Dr Ryan submitted several further rounds of evidence, including material showing that RTB data had been used to influence a Polish election, to secretly profile Irish people who have HIV, and to track the movements of homeless people in San Francisco.
But three years later, Europe’s privacy watchdogs have done nothing to end the most massive data breach ever recorded. In fact, two years after finally opening an investigation of Dr Ryan's RTB evidence, the Irish Data Protection Commission has yet to write the “statement of issues” paper that outlines what it will investigate.
Enforcers have failed to act. So we must.
“By challenging the online advertising industry's standards, our lawsuit takes aim at Google, Facebook, Amazon, Twitter, Verizon, AT&T and the entire online advertising & surveillance industry. This industry tracks us, and builds hidden dossiers about our most intimate secrets. Starting today, we mean to change that.”
Dr Johnny Ryan, ICCL Senior Fellow
You can support ICCL's work.
The Irish Council for Civil Liberties has been at the forefront of every major rights advance in Irish society for over 40 years. We helped legalise homosexuality, divorce, and contraception. We drove police reform, defending suspects' rights during dark times. ICCL is Ireland’s leading human rights organisation, and our work on digital and data issues has global impact.
ICCL is completely independent from Government, and relies on donations and gifts. You make our work for human rights and freedom possible. Thank you.
Press materials
Video:
Main explanatory film
All clips
Broadcast quality (4K). Free to use or embed.
For comment: Dr Johnny Ryan
For media queries: Sinead.Nolan@iccl.ie +353874157162
Complaint documents
Contact
Irish Council for Civil Liberties,
Unit 11, First Floor, 34, Usher's Quay,
Dublin 8
Phone: +353-1-9121640
Email: info@iccl.ie
