Billions of user data shared daily for ads

While the scale of the RTB industry is already immense in Europe, far more data is collected in the US. (Source: IMAGO/Silas Stein)

A new report by the Irish Council for Civil Liberties (ICCL), a civil and human rights organisation, highlights the extent to which advertising companies collect and share user data for so-called Real Time Bidding (RTB). During this process, companies collect as much information as possible about the users every time they visit a website. Data packages with sensitive data such as age and location are put together and are forwarded to many advertising companies in a fraction of a second.

In this context, ICCL speaks of the “biggest data leak ever”, which is repeated daily. The organisation was able to see internal documents of the advertising industry.

According to the organisation, RTB systems in the USA and Europe record at least 178 trillion times per year what people look at on the internet and in apps or where they are at the moment. This would reveal their preferences and, in some circumstances, what life situations they are in.

The data of a single person in the USA would be collected by the RTB industry and shared with other companies on average 747 times a day; in Europe this would happen 376 times a day, on average about half as often. In Europe, data is accessed and shared 197 billion times a day.

Unnoticed by the user

The process serves ad sales and is the cornerstone of an industry that turns over more than 117 billion US dollars annually. In the auctions, ad space on websites or in apps is auctioned off in real time; the prices are based on user profiles and what details are shared with the bidders.

Users are mostly unaware of the trading of their personal data going on in the background.

Advertising companies spend more than $100 billion on RBT in Europe and the US every year, according to the report. In Europe, however, the scale of data collection is much smaller than in the US, according to the ICCL.

The largest RTB operators include Google and Microsoft. Google is the leader here. Microsoft has massively expanded its RTB activities with the purchase of the company Xandr 2021. Since the documents do not reveal any information about the activities of Facebook and Amazon, their businesses are not included in the figures.

Real-time bidding explained

RTB is used for advertising space on websites: if a user accesses a website, the ad space there is auctioned off to the highest bidder. In the background, bids are collected within milliseconds.

The bidders are provided with all known information about the site visitors: location, age, personal preferences or even religious orientation, if known. Based on this data, the bidders automatically adjust their bid amount in real time. The ad space then goes to the highest bidder, who can place his content there.

Sharing the data

In Europe, Google alone shares user information with 1058 companies, in the US with 4698 companies. Microsoft’s subsidiary Xandr is said to transfer its data records to 1647 other companies.

The information went to companies all over the world, including in Russia and China. What Google’s partners use the data for is unknown.

According to the ICCL, several past cases show that this mass surveillance is dangerous: “Data brokers used it [RTB data] to create profiles of Black Lives Matter demonstrators. The US Department of Homeland Security and other agencies used them for warrantless phone surveillance. They were implicated in the outing of a gay Catholic priest through his use of Grindr.”

In June 2021, the release of sensitive personal mobile phone data (in German) from the dating app Grindr had prompted the resignation of the Secretary General of the US Conference of Catholic Bishops, Jeffrey Burrill. Since the app is mainly aimed at homosexual people, the publication had also forced the outing of the high-ranking church representative. The information came from a data trader. (hcz)