1

Welcome!

What is Cross-Device Tracking?

Presentation by Justin Brookman

Policy Director

Office of Technology Research and Investigation

FTC

What I’m Going to Cover

Background

Probabilistic vs Deterministic Matching Models

Snapshot of Top Sites

Open Questions

Traditional Third-Party Behavioral Tracking

Advertising Network

cookie=4qasr4sdf1

cookie=4qasr4sdf1

cookie=4qasr4sdf1

The Limitations of Third-Party Cookies

Fragile

Browser-specific

Not traditionally tied to personally-identifiable information

Often no direct relationship to get PII

Privacy concerns

DoubleClick-Abacus merger in 2001

PII (name, email)/non-PII (cookies, urls) distinction still reflected in a lot of practices, privacy policies

More devices, smarter devices

Reasons why you might want engage in cross-device tracking

Targeting

Security

Analytics

Measurement

Attribution

Reasons why you might want to engage in cross-device tracking

Attribution

Probabilistic vs Deterministic

Probabilistic: Based on inferences about likely connections between devices or users

Deterministic: Tying multiple devices to persistent unique identifier

Probabilistic Matching

cookie=4qasr4sdf1

cookie=f52dh64dhq

Android Advertising Id=0436732361

Probabilistic Matching

IP address:

23.64.176.179

(early mornings, evenings, weekends)

IP address:

164.62.9.0

(9am-6pm weekdays)

IP address:

164.62.9.0

(9am-6pm weekdays)

Cellular network

23.64.176.179

(early mornings, evenings, weekends)

Probabilistic Matching

Work??

Cell??

Home??

80%

80%

IP address:

164.62.9.0

(9am-6pm weekdays)

IP address:

164.62.9.0

(9am-6pm weekdays)

Cellular network

23.64.176.179

(early mornings, evenings, weekends)

IP address:

23.64.176.179

(early mornings, evenings, weekends)

Probabilistic Matching

Work?

Cell?

Home?

Location: 

38.883914, -77.020997

Weekday location:

38.883914, -77.020997

Evening location:

38.897634, -77.036544

Location:

38.897634, -77.036544

95%

95%

Probabilistic Matching

Work

Cell

Home

Technology news

UVa sports

Capitol Hill

Arsenal football

Technology news

UVa sports

Capitol Hill

Arsenal football

Technology news

UVa sports

Capitol Hill

Arsenal football

98%

98%

cookie=4qasr4sdf1

Android Advertising Id=0436732361

cookie=f52dh64dhq

Device Graph

id=4qasr4sdf1

Android Advertising Id=0436732361

id=f52dh64dhq

Deterministic: Log-in PLUS Broad Reach

You log onto a lot of services (e.g., social networking, email) on different devices

BUT, some of those services also provide functionality on a lot of other websites too

They have visibility into your behavior on those other services, and can create a broad cross-device profile about you

First-Party Deterministic Matching

First-Party Deterministic Matching

Login: JustinBrookman

Login: JustinBrookman

Login: JustinBrookman

First-Party Deterministic Matching

Login: JustinBrookman

Login: JustinBrookman

Login: JustinBrookman

Third-party sites/apps that embed first-party

Third-party sites/apps that embed first-party

Third-party sites/apps that embed first-party

Deterministic: Partnering with Log-in Sites

What if I don’t get log-in data?

Look for partnership with publisher who does

BUT trepidation about sharing PII . . . so identifiers often shared in hashed form

Use an algorithm to consistently convert an identifier into a different, pseudo-random identifier

E.g., justin@domain.com  b16f55bbe0ff554fb40003f8e5f96b99 (md5 hash)

Matching through hashed identifiers

Advertising Network

cookie=4qasr4sdf1

IDFA=qpcm12d5a7

Device Id=038573421

Matching through hashed identifiers

Advertising Network

md5=b16f55bbe0ff554fb40003f8e5f96b99

Log onto news site as:

justin@domain.com

Log onto shopping site as:

justin@domain.com

Log onto video service as:

justin@domain.com

md5=b16f55bbe0ff554fb40003f8e5f96b99

md5=b16f55bbe0ff554fb40003f8e5f96b99

cookie=4qasr4sdf1

IDFA=qpcm12d5a7

Device Id=038573421

Device Graph

Advertising Network

cookie=4qasr4sdf1

IDFA=qpcm12d5a7

Device Id=038573421

Use of Email to Enable Cross-Device Tracking

Purchase item at a shopping site as justin@domain.com

Use of Email to Enable Cross-Device Tracking

Purchase item at a shopping site as justin@domain.com

Click on email from shopping site

Open email from shopping site

Android Advertising Id=0436732361

cookie=4qasr4sdf1

cookie=a035fs35fm

Use of Email to Enable Cross-Device Tracking

Purchase item at a shopping site as justin@domain.com

Click on email from shopping site

Open email from shopping site

Advertising Network

md5=b16f55bbe0ff554fb40003f8e5f96b99

Is Hashed PII Still PII?

Provides a layer of protection, but doesn’t protect against all threats

Ed Felten’s blog post: “Does Hashing Make Data Anonymous?”

Would we prefer tracking by unhashed PII?

Variations of Probabilistic and Deterministic Cross-Device Tracking

Blended models

Deterministic company may extend to include probabilistic data for clients who prefer reach to certainty

Probabilistic companies may partner with deterministic companies to verify accuracy of algorithm, obtain data sets for modeling

Sharing device graphs

Leasing device graphs through cookie syncing

FTC Snapshot

Looked at top 20 sites in Alexa categories for News, Sports, Shopping, Games, and Reference

Cross-device tracking companies on a considerable majority of sites

Over 90% can collect PII from users

Numerous instances of emails, hashed emails sent to third parties

Few privacy policies discuss

How much transparency?

Self-regulatory codes

Whose responsibility?

Does it depend on the model?

AdChoices icon

How achieve transparency for IoT devices?

How much control?

How much control?

How much control?

How much control?

What should you be able to control?

Targeting?

Collection/sharing?

Rise of ad blocking?

Panel 1: A Technological Perspective

Ashkan Soltani 

	Chief Technologist, FTC

Joseph Lorenzo Hall

Chief Technologist and Director of the Internet Architecture Project, Center for Democracy & Technology

Jonathan Mayer 

PhD Candidate, Computer Science, Stanford University

Andrew Sudbury

Co-founder and CTO, Abine, Inc.  

Jurgen J. Van Staden

Director of Policy, Network Advertising Initiative

Panel 2: Policy Perspectives

Megan Cox 

	Attorney, FTC

Genie Barton

	Vice President and Director, Online Interest-Based Advertising Accountability Program, 	Council of Better Business Bureaus 

Leigh Freund 

	President and CEO, Network Advertising Initiative

Jason Kint

	CEO, Digital Content Next

Laura Moy

	Senior Policy Counsel, Open Technology Institute, New America

Joseph Turow 

	Professor, Annenberg School for Communication, University of Pennsylvania

# image2.png

# image3.png

# image1.png

# image7.jpeg

# image8.jpeg

# image9.jpeg

# image18.png

# image10.png

# image11.jpeg

# image12.jpeg

# image13.png

# image14.png

# image15.jpeg

# image16.png

# image17.jpeg

# image19.jpeg

# image20.jpeg

# image21.png

# image22.jpeg

# image23.jpeg

# image4.png