Based on the findings, more than 20 consumer and civil society organisations in Europe and from different parts of the world are urging their authorities to investigate the practices of the online advertising industry.
The report uncovers how every time we use apps, hundreds of shadowy entities are receiving personal data about our interests, habits, and behaviour. This information is used to profile consumers, which can be used for targeted advertising, but may also lead to discrimination, manipulation and exploitation.
– These practices are out of control and in breach of European data protection legislation. The extent of tracking makes it impossible for us to make informed choices about how our personal data is collected, shared and used, says Finn Myrstad, director of digital policy in the Norwegian Consumer Council.
The Norwegian Consumer Council is now filing formal complaints against Grindr, a dating app for gay, bi, trans, and queer people and companies that were receiving personal data through the app; Twitter`s MoPub, AT&T’s AppNexus, OpenX, AdColony and Smaato. The complaints are directed to the Norwegian Data Protection Authority for breaches of the General Data Protection Regulation.
– The EU’s data protection law is a powerful tool to defend consumers against companies who do not respect their privacy. Consumer groups from across the EU will continue to take action against those who break the rules, says Monique Goyens, Director General of The European Consumer Organisation (BEUC).
– Every time you open an app like Grindr advertisement networks get your GPS location, device identifiers and even the fact that you use a gay dating app. This is an insane violation of users’ EU privacy rights, says Max Schrems, founder of the European privacy non-profit NGO noyb.
The harmful effects of profiling
Many actors in the online advertising industry collect information about us from a variety of places, including web browsing, connected devices, and social media. When combined, this data provides a complex picture of individuals, revealing what we do in our daily lives, our secret desires, and our most vulnerable moments.
– This massive commercial surveillance is systematically at odds with our fundamental rights and can be used to discriminate, manipulate and exploit us. The widespread tracking also has the potential to seriously degrade consumer trust in digital services, says Myrstad.
– Furthermore, in a recent Amnesty International report, Amnesty showed how these data-driven business models are a serious threat to human rights such as freedom of opinion and expression, freedom of thought, and the right to equality and non-discrimination.
What has to be done?
The Norwegian Consumer Council urges companies that rely on digital advertising to look towards alternative solutions to the currently domineering online advertising system, such as technologies that do not rely on widespread sharing and collection of personal data.
– The situation is completely out of control. In order to shift the significant power imbalance between consumers and third party companies, the current practices of extensive tracking and profiling have to end, says Myrstad.
– There are very few actions consumers can take to limit or prevent the massive tracking and data sharing that is happening all across the internet. Authorities must take active enforcement measures to protect consumers against the illegal exploitation of personal data.
The technical report was carried out by the security company Mnemonic.
The research on the online advertising industry and specific data brokers was performed with assistance from the researcher Wolfie Christl of Cracked Labs.
The legal analysis and formal complaints were written with assistance from the privacy NGO noyb.
Additional auditing of the Grindr app was performed by the researcher Zach Edwards of Victory Medium.
Graphics and illustrations can be downloaded from Dropbox (Credit: Mnemonic/Forbrukerrådet)