Selling off Privacy at Auction

Abstract

Real-Time Bidding (RTB) and Cookie Matching (CM) are transforming the advertising landscape to an extremely dynamic market and make targeted advertising considerably permissive. The emergence of these technologies allows companies to exchange user data as a product and therefore raises important concerns from privacy perspectives. In this paper, we perform a privacy analysis of CM and RTB and quantify the leakage of users' browsing histories due to these mechanisms. We study this problem on a corpus of users' Web histories, and show that using these technologies, certain companies can significantly improve their tracking and profiling capabilities. We detect 41 companies serving ads via RTB and over 125 using Cookie Matching. We show that 91% of users in our dataset were affected by CM and in certain cases, 27% of users' histories could be leaked to 3rd-party companies through RTB. We expose a design characteristic of RTB systems to observe the prices which advertisers pay for serving ads to Web users. We leverage this feature and provide important insights into these prices by analyzing different user profiles and visiting contexts. Our study shows the variation of prices according to context information including visiting site, time and user's physical location. We experimentally confirm that users with known history are evaluated higher than new comers, that some user profiles are more valuable than others, and that users' intents, such as looking for a commercial product, are sold at higher prices than users' browsing histories. In addition, we show that there is a huge gap between users' perception of the value of their personal information and its actual value on the market. A recent study by Carrascal et al. showed that, on average, users evaluate the price of the disclosure of their presence on a Web site to EUR 7. We show that user's browsing history elements are routinely being sold off for less than $0.0005. Permission to freely reproduce all or part of this paper for noncommercial purposes is granted provided that copies bear this notice and the full citation on the first page. Reproduction for commercial purposes is strictly prohibited without the prior written consent of the Internet Society, the first-named author (for reproduction of an entire paper only), and the author's employer if the paper was prepared within the scope of employment.

The Economics of Privacy

“…The progress of information technology and the advent of the Internet have, however, vastly increased the scope and reach of those databases, ultimately giving rise to a market ecosystem of organizations that gather, merge, clean, analyze, buy, and sell consumer data. This ecosystem, although dominated by a decreasing number of players (Krishnamurthy and Wills 2009), is still rather complex and decentralized (Olejnik, Minh-Dung, and Castelluccia 2014). There is no single, unified market for personal data.…”

Why Is CSP Failing? Trends and Challenges in CSP Adoption

“…Dynamic advertising can involve techniques such as Real-Time Bidding (RTB), where the opportunity to display an advertisement to a visitor is auctioned off in real-time, and further dynamic activity such as cookie matching between the host website and the winner of the auction. There are routinely tens to hundreds of potential bidders in RTB [16], each of whom represent a large number of actual advertisers.…”

On the Privacy and Security of the Ultrasound Ecosystem

“…This profile, along with other demographic data (e.g., gender, location), is then used by ad networks to serve targeted advertisements. For instance, they are often used in realtime bidding (RTB), which enables ad buyers to compete on a per-impression basis, and adjust their bids depending on the specific characteristics of an individual user (e.g., jewellery ads could have different prices depending on the user's gender) [34]. RTB is becoming the industry standard when buying and selling ads, and a recent study shows that more than 80 percent of North-American advertisers have switched to RTB when buying ad impressions since 2011 [51].…”