‘They operate in the shadows’: The industry that collects, shares and monetises all you do

YOU might be listening to your favourite new album on Spotify, using an innocuous torch app on your smartphone or maybe even having a solitary moment with a sex toy, but somebody somewhere wants to know the details. 

In the age of big data, everything that can be tracked, monitored and extracted about your daily habits, preferences and movements will be used by an opaque industry to make billions, mostly at your expense.

Whether it’s collecting data points to target you with advertising or sell it to an insurer, in the end the data we generate is costing us more than you might think.

“Companies are reaching into our pockets and are extracting information and selling it. And they’re making a huge profit off it,” says Ari Scharg, a partner at US firm Edelson PC that specialises in consumer law and class-action suits.

When it comes to our personal data, consumer advocates like him want to see a shift in the debate from one about privacy rights to property rights. Greater transparency over how companies collect and use customer data could even lead to them sharing in the proceeds of the value it creates, they say.

But a lot of tech companies don’t want you to know exactly what information you’re giving up.

You might remember the case of WeVibe, a Canadian company that was harvesting sensitive data about customers when they used its Bluetooth-enabled vibrator. Mr Scharg’s firm discovered what the company was up to and later launched a class-action lawsuit that saw the manufacturer pay $4 million to customers who bought the product.

The Chicago-based firm has an in-house technology unit consisting of forensic investigators who scour lines of code and test internet-connected products to search for clues about how they really operate and what type of data they collect.

“What our tech guys figured out is that they were intercepting the wireless signal between the phone and the (vibrator) device and they were logging the data and time of each use,” he said. The company was collecting the vibrator settings, how the vibrations settings changed over each session and the body temperature of the user, which was all linked to the email address of the customer.

The group has also brought cases against NBA champions The Golden State Warriors and NFL team the Indianapolis Colts.

Both teams had mobile apps so when users were in the stadium they could be tracked and offered discounts at stores and food outlets. To do this, the apps used beacon technology but “what was not clear was that for it to work, the app needed to turn on the microphone of the phone and constantly listen,” Mr Scharg said.

“They’re listening for a low frequency sound that no one else can hear but in the meantime they’re picking up all the conversations people were having.”

A separate class action law suit was brought by a New York resident who downloaded the app for breaching wire tap laws in the country but was dropped in May this year.

THE INVISIBLE INDUSTRY - HOW IT AFFECTS YOU

For companies that are able to extract consumer data, there is a huge industry waiting to traffic in it. Despite the billions of dollars in profits being made, the data broker industry has managed to stay “largely invisible”, as one research paper put it back in 2014.

“They do operate in the shadows,” says Dr Sacha Molitorisz, from the Faculty of Law at the University of Technology Sydney.

He did his post doctoral research on the ethics of internet privacy and says “the real problem here is the fundamental lack of transparency.”

Large data brokers like Acxiom, for instance, have thousands of data points on population segments and they extend far beyond things like age, race, sex, weight, education level, political allegiance and shopping habits. Consumers are grouped into categories like “dog owner” or “outdoor sports enthusiast”, but some are decidedly more troubling,such as “expectant parent” or “diabetes interest”.

These companies existed in the pre-internet era as well, collecting available consumer data for the purposes of direct marketing, but in the digital age the amount of personal data has exploded.

“Individuals can be profiled in such detail without those individuals ever realising,” Mr Mol

itorisz said.

For instance, data company Quantium, which is 50 per cent owned by Woolworths, has a trove of data generated by the supermarket’s Everyday Rewards program. When those data sets are linked to digital profiles held by companies like Facebook they paint a very detailed picture of who we are.

Data miners are obliged to comply with Australia’s Privacy Act, but the degree to which this protects the rights and privacy of consumers is highly questionable. Groups like Digital Rights Watch Australia say there is a worrying lack of regulation and oversight of the data broker industry.

At the direction of the federal government, the Australian Competition and Consumer Commission (ACCC) is currently conducting an inquiry into digital platforms like Facebook and Google. The inquiry is predominately looking at their impact on the media landscape but will also consider consumer data protection and privacy issues.

In its submission to the inquiry, the Australian Association of National Advertisers said the key concerns for advertisers in relation to user data are measurement transparency and data privacy.

“Advertisers expect that the collection of data by digital platforms is done with the users’ consent and that the policies relating to this consent are clearly and readily made available to the user,” it said.

But many argue that hitting accept of a terms and conditions page that is many pages long and filled with vague and hard-to-understand legal jargon does not amount to a reasonable level of consent.

“On the internet lots of information flows in ways that aren’t immediately apparent. We can’t expect every single flow of data to be revealed and to be made transparent but there really needs to be some sort of reasonable transparency. Exactly how we do that is a very difficult question but certainly this hidden trade in data needs to have some more light shined on it,” Mr Molitorisz said.

“We do still have some privacy left, and we need to fight for it.”

WEAPONISING CONSUMER DATA 

In the wake of the Cambridge Analytica scandal, the public has become increasingly aware about how valuable their personal data is, and the lengths companies like Facebook and Google will go to collect, share and monetise it.

But many consumers don’t seem to realise the ubiquity of data harvesting as a business model. Even early flashlight apps on smartphones harvested users’ address book, geolocation data and other personal information because someone, somewhere will pay for it.

“Many, many companies, including health insurers, banks, potential employers, college admissions offices, are mining data to manage their risk,” Mr Scharg said.

“Health insurers will look at how much fast food you eat and increase premiums accordingly. Auto insurers will increase your rates if you have ever subscribed to a motorcycle magazine ... This effectively weaponises consumers’ own data for use against them, all without consumers knowing that this is happening.”

The disconnect between consumer expectations and industry practices becomes apparent every now and then when a company is exposed for what it is doing with customer data. A discomforting example made headlines in April when gay hook up app Grindr faced huge backlash for selling off the HIV status of its users to third party companies.

‘NOTHING SAYS MORE ABOUT SOMEONE’ 

The age of big data has undeniably lead to new innovations, industries and more efficient commerce. Anonymised data can yield fascinating and useful insights for research and businesses but much of the industry has been left to regulate itself.

And for consumers it’s practically impossible to avoid giving up clues to your identity.

If you think listening to the new Kendrick Lamar album on Spotify is a private affair, think again. Earlier this year, the chief economist at the Bank of England said researchers were increasingly gauging the public mood by analysing Spotify streaming data.

“I find it depressing that our personal, private moments with music are increasingly being turned into data points and sold to advertisers. Or, in some cases, being mined for economic insights by central bankers,” Arwa Mahdawi wrote in The Guardianthis week.

As one Spotify employee remarked to her: “Nothing says more about someone than the music they listen to and their porn habits.”

And yours are almost certainly being mined for insights with the goal of making you part with your money some time in the future.