Google Lets Advertisers Target By (Anonymized) Customer Data

An anonymous reader writes: Google's new advertising product, called Customer Match, lets advertisers upload their customer and promotional email address lists into AdWords. The new targeting capability extends beyond search to include both YouTube Trueview ads and the newly launched native ads in Gmail. Customer Match marks the first time Google has allowed advertisers to target ads against customer-owned data in Adwords. Google matches the email addresses against those of signed-in users on Google. Individual addresses are hashed and are supposedly anonymized. Advertisers will be able to set bids and create ads specifically geared to audiences built from their email lists. This new functionality seems to make de-anonymization of google's supposedly proprietary customer data just a hop, skip and jump away. If you can specify the list of addresses that get served an ad, and the criteria like what search terms will trigger that ad, you can detect if and when your target searches for specific terms. For example, create an email list that contains your target and 100 invalid email addresses that no one uses (just in case google gets wise to single-entry email lists). Repeat as necessary for as many keywords and as many email addresses that you wish to monitor.

Comments

Ties in with their new motto

[Anonymous Coward]

Something about evil?

Sanitized data

[phantomfive]

I've seen some sanitized data that censored the name, but included the gender, age and address.

Re:Sanitized data

[dinfinity]

- "No, I'm sorry, I really can't tell you who it is."
= "Aww, at least give me a hint."
- "Alright. He's 54 and he's President of the United States of America."

Re:Sanitized data

[Anonymous Coward]

Not to mention that by using different sources of "sanitized" data one can often reconstruct a full identity.

Sanitization is clearly bullsh**. As long as there are multiple sources of sanitized identity data, each sanitizing different things -- the system won't work.

Google pretends they exist in a vacuum. They don't. They're ultimately selling your identity -- just a piece of it -- but enough to reconstruct via multiple sources.

Re:Lots of FUD in the headline, no substance

[Anonymous Coward]

The privacy issue is the advertiser tells google that you are their customer.

Slashdot Copying from Soylnet Now

[Anonymous Coward]

Might as well cut out the middle-man and go to the source.

The submission is a cut-n-paste sans formatting from a soylent news story. You can tell its been lifted from Soylent because the third paragraph was written by myself for the soylent submission and exists no where else on the web (yet).

Re:Slashdot Copying from Soylnet Now

[evilviper]

The submission is a cut-n-paste sans formatting from a soylent news story.

Should I be offended that nobody thought to steal my Pipedot story summary, even though it predates both by several days?

http://pipedot.org/pipe/NZAB

Re:Lots of FUD in the headline, no substance

[Anonymous Coward]

> The advertisers don't get to see the email addresses, so there's no privacy issue here.

You really don't understand how this works. You are the advertiser. With this scheme you give google the list of addresses you want to track. Google can't verify if they are valid addresses or not short of sending mail to them. Anyone can run ads on google, vetting is pretty damn slack just don't run malware or porn.

EU Privacy

[Anonymous Coward]

EU needs to get off its ass and tackle Google.

Shops giving a HASH of the email address knowing Google can match it to a hash of the list of email addresses it collected by Android, is linkage. It's no anonymized, its simply passed as a hash.
*Linkage* of data by hashing is data. Unnecessary linkage of data beyond needed for a transaction is even spelled out as a no-no.

At what fucking point, are you EU lot going to protect EU Privacy rights? You handed over our fooking banking data to a foreign power, you did nothing when they tapped out networks, get off your ass and enforce the few rights EU citizens have.

Re:EU Privacy

[Epsillon]

Shops giving a HASH of the email address knowing Google can match it to a hash of the list of email addresses it collected by Android, is linkage. It's no anonymized, its simply passed as a hash.

This. Anonymised would be one-way, non reversible obfuscation of the source's identity. This is just pure sophistry foisted upon us simply because the vast majority of people this affects can't tell the bloody difference.

Re:EU Privacy

[Epsillon]

The issue here is that a third party has access to the unhashed identities and are hashing it with the same hash and seed Google use - they have to be or there would be no point in giving the results to Google. That party may not have the nous to stop Google from reassembling their massive hoard of privately identifying information if they really wanted to. They can also gain insight into which hashes have relationships with their customers (the advertisers, we're product not customer) in order to poke even deeper into people's online activities.

If you're anonymising, it means just that: The data cannot be traced back to a real identity. If you're data mining on an ongoing basis, don't use the word "anonymised" and say what you really mean, otherwise it's just meaningless, misleading bollocks.

Also to remember is that your identity isn't just your name. In fact, the name is just a convenient pointer others hang on the person that is you. You are the sum of what you do, how you think and who you associate with. Given that, the name/e-mail address/UID is irrelevant, at which point the hash itself becomes your identity, even more so than your name or SSN.

Re:EU Privacy

[Epsillon]

The real issue here is identity. You are not your name. Your name is just a convenient pointer others hang on the person that is you. You are the sum of many things; who you associate with, what you do, how you think, et cetera.

Obviously these customers are hashing with the same hash and seed Google are using; they have to be or the whole exercise would be pointless. These organisations may not have the nous to prevent Google from reassembling the original data, so there are no guarantees. Also, they're not anonymising when they're matching two separate data sources. That's not anonymisation in anyone's book. That's pure sophistry, bollocks and misleading bullshit to cover insidious mining and profiling of people's PII.

All of this becomes irrelevant, however, when you realise that, to Google, your identity is that pesky hash. Talking about anonymity at that point becomes pointless.

Re:EU Privacy

[cdrudge]

EU needs to get off its ass and tackle Google.

How is this Google's fault? Why aren't you having the EU tackle all the companies that would be sharing their data with Google in the first place? Seems like you're attacking the side affect and not the actual problem.

Re:EU Privacy

[swillden]

Obviously you can't invert md5, but if I hash my list, and you hash your list, and there is significant overlap, you can, to a reasonable but not 100% certainty, figure out which items on my list correspond to items on your list.

Depends on how it's done. For example, the advertiser could generate a bloom filter and provide that, rather than hashes of individual items on the list. Assuming the false positive rate was tuned correctly, you can use this method to arrange to provide very little information, while still generating the matches you want (plus some). Most advertisers wouldn't know how to tune the false positive rate appropriately, of course, but Google could tell them.

That's just off the top of my head, first glance at the problem. I suspect that there are even cleverer techniques that could be used, and while I don't know any details of how this system works, I do know Google engineers, and Google privacy design policies and procedures, and I'd be shocked if there were any obvious way to extract personally-identifiable information, in either direction.

(Disclaimer: I'm a Google engineer, but I'm speaking only for myself.)

Re:Ties in with their new motto

[davester666]

Sorry, now it's "Do the right thing."

Of course, this is even more ambiguous than the previous one. I, for one, have no desire for the 'right thing' to be done to me, if an MBA is the one deciding it.

Googles reassurances ring hollow

[Anonymous Coward]

Not only are you posting as an anonymous coward but you won't tell us how you plan to do it and only call criticism of what your are doing "laughable." So "trust us"

I'm not impressed. Companies don't give a shit about anything unless it gets a lot of media attention and threatens to derail their bottom line. If they can ignore a problem they will. I predict anyone bringing concerns they are being tracked to Google will be ignored and most users won't even know this is happening to them.

Google is pushing ads hard. I wonder if they are the mystery buyer of Adblock? Try uBlock instead. It's much faster than Adblock and so far the creator isn't taking money from advertisers.

Alphabet got rid of "Don't Be Evil."

[transporter_ii]

Alphabet got rid of "Don't Be Evil." So now they can carry on with a clear conscience.

And funny, I have always had a hard time remembering how to spell conscience, so I had to look it up on Google. :)

Re:Alphabet got rid of "Don't Be Evil."

[sconeu]

Well, now we know what "The Right Thing" is.

(the new motto is "Do the Right Thing".

Advertisers will Be happy

[all-the-stars]

Isn't it like the ads will be served to those only who will be interested?

Well, at least there's an opt-out.

[c]

From the announcement:

Users can control the ads they see, including Customer Match ads, by opting out of personalized ads or by muting or blocking ads from individual advertisers through Google Ads Settings.

Opt-out rather than opt-in sucks, and it does appear that my browser settings were independent of my Android Google Settings, but the option is there.

I'm ad blocking, so in theory my account ad settings are irrelevant, but belt and suspenders, etc.

Re:Well, at least there's an opt-out.

[JustAnotherOldGuy]

Users can control the ads they see, including Customer Match ads, by opting out of personalized ads or by muting or blocking ads from individual advertisers through Google Ads Settings.

If I could "control the ads" I see through their settings, I wouldn't see any. I'm guessing that "see no ads" isn't one of the settings.

Re:Well, at least there's an opt-out.

[c]

I'm guessing that "see no ads" isn't one of the settings.

It is. On Android, it's the "Unknown Sources" toggle under the Security settings area. Then you install an ad blocker.

They could have made that a little easier to get at, mind you...

Google stories

[Futurepower(R)]

Google selling targeted Gmail ads that look like emails

Google violating Russian antitrust regulations by bundling its services with Android

Many web pages load something from Google, so Google is tracking us wherever we go.

The Slashdot home page loads these from Google:
1) google-analytics.com
2) googleadservices.com
3) googletagservices.com

Re:Google stories

[x_t0ken_407]

Posting anonymous since I modded already, however, this is why uMatrix is so awesome...

Yippee! More advertising!

[JustAnotherOldGuy]

Yippee! More advertising!

Gosh, I can hardly wait for this new round of advertising to kick in; I just haven't seen enough ads lately and this will be a refreshing blast of pure consumeristic happiness.

I suppose it could theoretically mean fewer ads if they're really targeted, but as we all know, that ain't gonna happen.

All hail our targeted advertising overlords, kneel before Zod, puny consumer!

Re: Google is so innovative ...

[Alascom]

11 yr google veteran who has done 600+ interviews, confirming parent's statement.

Re:Ties in with their new motto

[lister king of smeg]

Sorry, now it's "Do the right thing."

Of course, this is even more ambiguous than the previous one. I, for one, have no desire for the 'right thing' to be done to me, if an MBA is the one deciding it.

No it isn't the last motto "don't be evil" let them be chaotic neutral. With this they are stuck in the lawful alignment or possible the good alignments, depending on the relative alignment of the person interpreting it.

old motto
lg ng cg
ln tn cn
le ne ce

new motto
lg ng cg
ln tn cn
le ne ce