I asked an online tracking company for all of my data and here's what I found | Privacy International

Skip to main content

I asked an online tracking company for all of my data and here's what I found

Long Read

Post date

7th November 2018

It’s 15:10 pm on April 18, 2018. I’m in the Privacy International office, reading a news story on the use of facial recognition in Thailand. On April 20, at 21:10, I clicked on a CNN Money Exclusive on my phone. At 11:45 on May 11, 2018, I read a story on USA Today about Facebook knowing when teen users are feeling insecure.

How do I know all of this? Because I asked an advertising company called Quantcast for all of the data they have about me.

Most people will have never heard of Quantcast, but Quantcast will certainly have heard about them. The San Francisco-based company collects real-time insights on audience characteristics across the internet and claims that it can do so on over 100 million websites.

Quantcast is just one of many companies that form part of a complex back-end systems used to direct advertising to individuals and specific target audiences.

The (deliberately) blurred screenshot below shows what this looks like for a single person: over the course of a single week, Quantcast has amassed over 5300 rows and more than 46 columns worth of data including URLs, time stamps, IP addresses, cookies IDs, browser information and much more.

[A screengrab of the Data Subject Access Request PI obtained from Quantcast]

Seeing that the company has such granular insight into my online habits feels quite unnerving. Yet the websites, where Quantcast has tracked my visit, are just a small fraction of what the company knows about me. Quantcast has also predicted my gender, my age, the presence of children in my household (in number of children and their ages), my education level, and my gross yearly household income in US Dollars and in British Pounds.

[A screengrab of the Data Subject Access Request PI obtained from Quantcast]

Quantcast has also placed me in much more fine-grained categories whose names suggest that the data was obtained by data brokers like Acxiom and Oracle, but also MasterCard and credit referencing agencies like Experian.

Some of the categories are uncannily specific. My MasterCard UK shopping interests, for instance, includes travel and leisure to Canada (I have in fact been to Canada recently for work) and frequent transactions in Bagel Restaurants (I can remember one night out where I’ve purchased quite a few bagels). Experian UK classifies me according to my assumed financial situation (for some inexplicable reason I’m classified as” City Prosperity:World-Class Wealth”), the data broker Acxiom even placed me in a category called “Alcohol at Home Heavy Spenders” (was it because I went shopping for a birthday party at home?), and a company called Affinity Answers thinks I have a social affinity with the consumer profile “Baby Nappies & Wipes” (very, very wrong).

Ads seem trivial, but the sheer scope and granularity of the data that is used to target people ever more precisely is anything but trivial. Looking at these categories reminds me of what the technology critic Sara Watson has coined the uncanny ‘valley of personalisation’. It is impossible for me to understand why I am classified and targeted the way I am; it is impossible to reconstruct which data any of these segmentations are based on and - most worryingly - it is impossible for me to know whether this data can (and is) being used against me.

[A screengrab of the Data Subject Access Request PI obtained from Quantcast]

The murky world of third-party tracking

Quantcast is one of countless of so-called “third-parties” that monitor people’s behaviour online. Because companies like Quantcast (just like Google, and Facebook) have trackers on so many websites and apps, they are able to piece together your activity on several different websites throughout your day.

My Quantcast data, for instance, gives an eerily specific insight into my work life at Privacy International. From my browsing history alone, companies like Quantcast don’t just know that I work on technology, security, and privacy – my news interests reveal what exactly it is that I am working on at any point in time. My Quantcast data even reveals that I have a personal blog on Tumblr.

For each and every single one of these links, Quantcast claims that it has obtained my consent to be tracked – but that is only part of the story. Quantcast has no direct relationship with the people whose data they collect. Therefore, most people have never heard of the company’s name, do not know that they process their data and profile them, whether this data is accurate, for what purposes they are using it, or with whom it is being shared and the consequences of this processing.

Quantcast claims that it has obtained my (and likely your) consent because somewhere, on some website, I must have mindlessly clicked “I ACCEPT”....