We've found you

Google and Facebook are making you pay for their ‘free’ services by collecting your data. But how can we protect ourselves from being completely open books online? Lucy Hunter Johnston investigates

Lucy Hunter Johnston

9 December 2013

Can you imagine a world where your email was being read, your location tracked and your browsing history logged? Well, stop imagining, because this is exactly what is happening. Every move you make online is being watched. Between them, Google and Facebook are building up one of the largest collections of personal data that has ever existed.

The services purportedly don’t cost you anything (Facebook’s tagline is: ‘It’s free and always will be’), but they are taking something far more valuable than money. Data is the new currency: a report from the Boston Consulting Group last year, The Value of Our Digital Identity, predicted that the value of personal data will reach a trillion euros by 2020. Used in the right way, the increasing volume of collected data will be able to focus marketing, create personalised products and boost efficiency. ‘Much of that will be due to online services such as Facebook and Google,’ the report says, ‘that can be offered free of charge — thanks to business models that monetise personal data — yet are highly valued by consumers.’

Facebook has 1.19 billion monthly active users, while Google’s Gmail service is used by 425 million people worldwide, its search engine has a 96 per cent share of the European market (67 per cent worldwide), and its mobile operating system Android is installed on 56 per cent of UK smartphones. Since 2006 it has also owned YouTube. It’s because these systems are so vast that they are also the best; because Google has so many searches it also has the most misspelt searches, and so has amassed the best spellcheck in the world. When you use Facebook and Google, you willingly hand over information: your real name, your age and possibly what you look like. But they want a more complete set of data than this, and they get it. Most people are aware that there are online criminals who try to intercept credit card details, and are alert to ‘phishing’ scams, fake emails or strange downloads. But fewer people are aware of the far more prevalent data collection that happens quite legally, and incredibly easily. Online data collectors can access information on almost everything you do: what newspaper you read, what you want for Christmas, perhaps even your political leanings and your sexuality. This is how you are really paying for ‘free’ services — with information about every aspect of your life.

It sounds like an Orwellian nightmare, and it goes back to how the internet was put together. ‘The mindset of the average user is that there is some defined single entity that has built and provided each site to them, but the web is so much more diverse than that,’ says Alex Fowler, the global privacy and public policy leader at Mozilla, creators of the Firefox web browser. ‘The web is really a mash-up of content and services and capabilities and features and data providers. It ends up that the single web page you think you are visiting is, in fact, an amalgamation of dozens of different components.’ Every one of those different components on the page, from the advertising agencies to social network widgets, is able to see who you are, and record your information on its database.

This has happened because the internet was built to facilitate communication. In general, this is a good thing, but it also means that it is all too easy to send metadata that you don’t intend to be communicated. An example is the Facebook ‘Like’ button, which appears on 7.5 million websites including well over a third of the 1,000 most visited sites on the web. Whenever you open a website that has the ‘Like’ button, your browser sends a request to Facebook for the resources to run it. This request contains not only the web address you are on, but also sends back a Facebook ‘cookie’, a text file that has been stored on your com-puter and uniquely identifies you. And this is passive; you don’t even have to click ‘Like’ for this information to be sent. ‘Imagine that roughly every three pages you go to, you copy and paste the URL in an email, and email it to Facebook from your personal address, with your real name,’ says Brian Kennish, creator of the Disconnect browser extension, which monitors and blocks tracker sites. ‘That is effectively what we are all doing today.’

Kennish wrote the code for Disconnect in a single evening. He was working for Google at the time, and had also worked at online advertising company DoubleClick where he ‘tracked’ users and collected browsing history, but became concerned about the vast scale of the data collection industry. ‘What’s wrong with the whole thing is that it is invisible and unexpected,’ he says. ‘You are entering into a deal where you don’t know what you are trading.’

Sites such as Google and Facebook are allowed to collect and store so much data because you have agreed to their terms and conditions. But with these documents running to hundreds of pages it seems they aren’t written to protect the consumer. Your consent certainly doesn’t appear to be informed. It’s unlikely, for example, that the average Twitter user knows that their tweets have embedded location data, or that the Facebook for Android app originally permitted the company to access users’ text messages (Facebook maintains it never reads users’ messages). When it was discovered that Gmail was reading its users’ emails earlier this year, the response was: ‘Just as a sender of a letter to a business colleague cannot be surprised that the recipient’s assistant opens the letter, people who use web-based email today cannot be surprised if their emails are processed by the recipient’s [email provider] in the course of delivery. Indeed, a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties.’

In general, data is being collected to better understand who you are, so that you can be shown a targeted advert. The more information a company knows about a user, the more it can charge for the space; this is where Google and Facebook excel. On any one web page, the process of showing you a single advert may have been redirected to as many as eight different companies that are all involved in compiling a complete picture of you as a user. Disconnect runs as an add-on to your browser and is displayed on your screen as a counter, allowing you to see the number of sites that are monitoring you. Numbers usually hover around 20, but can be as high as 700 or 800, including sites as unfamiliar to the average user as Outbrain.com and Wunderloop.net.

‘There is a giant ecosystem of data collectors now. A couple of years ago you never saw a number this high,’ says Kennish. ‘Analytic systems have got so advanced that they are tracking on a second-by-second basis what people are doing on their sites. But the vast majority of stuff is still advertising; companies that you’ve never even heard of, and that you have had no direct relationship with, that are holding tons of data about you. There may be up to 7,000 in total.’ According to a 2012 study by Truste, the average site will leave 14 cookies on your computer.

Targeted ads aren’t inherently a bad thing. Andy Kahl, the director of data analysis at digital intelligence agency Evidon, uses the analogy of ordering the same slice of pizza every Friday, so as you walk into your local restaurant they start getting it ready for you: ‘But let’s imagine you go to New York and go out for pizza and a guy looks at you and says, “Hey, pepper and onions coming up.” Now that’s weird. You were literally about to give him that information because you need him to have it, but what’s creepy is that you have no visibility in how that information got from your local pizza guy to New York, and no understanding of who got to read it in between. It invokes a lot of concerns: are there people making decisions about me based on how much pizza I buy? Am I not going to get offered a new deal on health insurance? There’s no way for you to inform that data.’

Kahl and Kennish maintain that the future of the data economy isn’t necessarily bad, as long as it involves an informed consumer. While legal regulation struggles to catch up with the rapidly evolving technology, the fact remains that data collection companies, like Acxiom, are searching for ways to access better, cleaner information. It would seem logical that the next step should be to collect this directly from the individual, in exchange for personalised deals. If you sign up for a Netflix subscription having clicked on an advert, for example, then the site that hosted that advert can get paid around £30. It seems fair that some of that profit is filtered back. Apps such as Qustodian and Yes Profile now give the customer a platform with which to communicate with the advertisers, and get a share of the revenue in exchange for their information. Kennish wants the technology to evolve so there are real-time agents bidding on our behalf all the time. This could even extend to the real world. ‘People invoke this scene in Minority Report when an advertisement shows up as a hologram and addresses Tom Cruise by name,’ Kahl adds. ‘I’ve come around to the idea that that is going to happen. We can see the path between then and now, so let’s work on going about it in the right way.’

But this isn’t just about being shown a new jumper in your size; our lives online are already being negatively influenced by the data that has been collected. Airlines, in particular, have been accused of tracking visitors to their sites, and ramping up the prices if you keep on checking. Our lives offline may not be far behind. Legally it’s a thorny area, but a number of insurance companies are starting to give incentives to those who agree to share data. Prudential, for example, offers 1,000 bonus Nectar points if you allow it access to your statements, and Aetna’s CarePass service invites consumers to link its insurance to apps such as MapMyFitness, RunKeeper and Fitbit. ‘At what point do you turn up for an operation, and the insurance man is there saying, “You’ve been eating doughnuts every week, and the contract says you have to keep healthy… we aren’t going to cover you,” ’ says Nick Pickles, from UK civil liberties group Big Brother Watch. ‘In America that happens.’

Even more worryingly, there is growing unease over what might be done in the future with the data that is being amassed. ‘Some companies have taken the attitude to capture anything they can get their hands on, in the hope that it will lead to untold riches,’ says Pickles. This is already starting to play out. In May this year The Sunday Times revealed that mobile network operator EE had made an exclusive deal with Ipsos Mori, who were in talks to sell data on EE’s 27 million customers to the Metropolitan Police. EE has also joined with Vodafone and O2 to launch Weve, which will use data and location to place ads. ‘Yes, Google is using your data to target ads, but that is only one step away from being used for something else, and it’s Google that decides what that is,’ he says. ‘If Google got bought out by an insurance company, then that data gets used by it. You, the consumer, are pretty much powerless to stop any of that.’

It’s a view that is shared by many. ‘Com-panies are building large behavioural profiles so that maybe one day somebody might be interested in them,’ says Kahl. ‘Today maybe it’s being used only for advertising,’ adds Kennish, ‘but who knows how it will get used tomorrow, or whose hands it ends up in.’ He calls these databases of information ‘honeypots’ for law enforcers.

‘The only way you can really know for sure what is being done with your information,’ says Mozilla’s Fowler, ‘is if you go and read the privacy policies of every one of those domains and sites that you are interacting with. That’s basically impossible because consumers aren’t even aware of which companies they are interacting with. The system is very broken.’

Fowler’s main concern is that the sites that store our information are not always doing so securely, which leaves us personally vulner-able to identity theft and fraud. He believes that some companies are treating data security as an extra add-on, rather than a fundamental part of online policy. This means that potentially any information about you online, from emails to health records, could be made public in a malicious attack. ‘There are things that we accept in the online environment that we would never accept offline. The average consumer gets notices every year from the businesses that they trust, that their private information has been compromised through a security incident. You start to look at the collective impact of these breaches and it is bleak. You have lost control of that situation and your personal information.’

There is a concern that the large data collectors could be tempted to prioritise profits over privacy. Last year Google was fined a record £14.4 million for misleading web users by continuing to monitor those who had turned on Apple’s ‘do not track’ setting. It came up with a workaround that allowed it to track all iPhone and iPad users through the Google+ button and adverts on third-party sites, which made it look as if the user had opted in. They had not. Similarly, as browsers become increasingly adept at blocking the traditional cookie method of tracking, there is money to be made in new technology. Apple gives every iPhone an ‘advertising identifier’, while Windows has a ‘unique identifier’ to track its apps. ‘Advertising networks have turned to device fingerprinting, where they don’t even need any specific information about a user to identify them,’ explains Kennish. ‘They use information like what operating system you use, what fonts you have installed, what resolution your screen is, that can very uniquely identify a specific machine. That’s the escalation of what we are facing.’

So what can we do? ‘Right now there is no good way to fully opt out,’ says Kahl. ‘But it’s imperative for consumers to become more literate about data practices.’ Tools such as Disconnect, Ghostery and Mozilla’s Lightbeam all help clarify from a technical perspective how frequently your data is being accessed, and allow you to block certain sites. ‘Right now we don’t understand what the average user is comfortable with because the average user doesn’t have enough information to make that choice,’ he says. ‘Let’s establish the scenario where we’re not afraid of data collection. By no means should people stop being so creeped out right now, but we can work to a place where you don’t have to rely on emotional reactions; you can make an educated choice.’

MORE ABOUT

Facebook

Google

We've found you

Read More