Cross-device tracking: Difference between revisions

{{Use dmy dates|date=April 20212023}}

'''Cross-device tracking''' refers tois technology whichthat enables the tracking of users across multiple devices such as smartphones, television sets, smart TVs, and personal computers.<ref>{{Cite documentweb|title=A Privacy Analysis of Cross-device Tracking |website=Usenix |last1=Jebara|first1=Tony|last2=Bellovin|first2=Steven M.|year=2017|last3=Kim|first3=Hyungtae|last4=Li|first4=Jie S.|last5=Zimmeck|first5=Sebastian|s2cid=23378463 |url=https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-zimmeck.pdf}}</ref><ref>{{Cite journal |last1=Yuan |first1=H. |last2=Maple |first2=C. |last3=Chen |first3=C. |last4=Watson |first4=T. |date=1 July 2018-07-01 |title=Cross‐deviceCross-device tracking through identification of user typing behaviours |url=https://onlinelibrary.wiley.com/doi/10.1049/el.2018.0893 |journal=Electronics Letters |language=en |volume=54 |issue=15 |pages=957–959 |doi=10.1049/el.2018.0893 |bibcode=2018ElL....54..957Y |s2cid=55463759 |issn=0013-5194|doi-access=free }}</ref>

More specifically, cross-device tracking is a technique in which technology companies and advertisers deploy trackers, often in the form of unique identifiers, cookies, or even ultrasonic signals, to generate a [[profiling (information science)|profile]] of users across multiple devices, not simply one.<ref name=":15">{{Cite journalbook |last=Arp |first=Daniel |title=2017 IEEE European Symposium on Security and Privacy (EuroS&P) |chapter=Privacy Threats through Ultrasonic Side Channels on Mobile Devices |chapter-url=https://ieeexplore.ieee.org/document/7961950%E2%80%8B |journalyear=IEEE2017 European|pages=1–13 Symposium|doi=10.1109/EuroSP.2017.33 on Security|isbn=978-1-5090-5762-7 and Privacy|pagess2cid=1–13698921 |via=IEEE Xplore}}</ref> For example, one such form of this tracking uses audio beacons, or inaudible sounds, emitted by one device and recognized through the microphone of the other device.<ref name=":15"/>

There are many ways in which online tracking has manifested itself. Historically, when companies wanted to track users' online behavior, they simply had users sign in to their website.<ref name=":23">{{Cite book|last1=Jebara|first1=Tony|last2=Bellovin|first2=Steven M.|last3=Kim|first3=Hyungtae|last4=Li|first4=Jie S.|last5=Zimmeck|first5=Sebastian|date=2017|title=A Privacy Analysis of Cross-device Tracking|url=https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/zimmeck|language=en|pages=1391–1408|publisher=USENIX Association |isbn=9781931971409978-1-931971-40-9}}</ref> This is a form of deterministic cross-device tracking, in which the user's devices are associated with their account credentials, such as their email or username.<ref name=":2">{{Cite journal|last=Brookman|first=Justin|year=2017|title=Cross-Device Tracking: Measurement and Disclosures|url=https://petsymposium.org/2017/papers/issue2/paper29-2017-2-source.pdf|journal=Proceedings on Privacy Enhancing Technologies|volume=2017|issue=2|pages=133–148|doi=10.1515/popets-2017-0020|doi-access=free}}</ref> Consequently, while the user is logged in, the company can keep a running history of what sites the user has been to and which ads the user interacted with between computers and mobile devices.<ref name=":2" />

In October 2015, the [[Center for Democracy and Technology]] submitted comments to the [[Federal Trade Commission]] (FTC) regarding cross-device tracking technology, specifically mentioning [[SilverPush]].<ref name="cdt">{{cite web |url=https://cdt.org/files/2015/10/10.16.15-CDT-Cross-Device-Comments.pdf |title=Re: Comments for November 2015 Workshop on Cross – Device Tracking |publisher=[[Center for Democracy and Technology]] |accessdateaccess-date=1 April 2016}}</ref><ref name="register">{{cite web |url=https://www.theregister.co.uk/2015/11/20/silverpush_soundwave_ad_tracker/ |title=How TV ads silently ping commands to phones: Sneaky SilverPush code reverse-engineered |newspaper=[[The Register]] |accessdateaccess-date=1 April 2016}}</ref>

Audio "beacons" can be embedded into television advertisements. In a similar manner to [[radio beacon]]s, these can be picked up by [[mobile app]]s.<ref name="FTC letter">{{cite web |url=https://www.ftc.gov/system/files/attachments/press-releases/ftc-issues-warning-letters-app-developers-using-silverpush-code/160317samplesilverpushltr.pdf |title=FTC letter to app developers |accessdateaccess-date=1 April 2016}}</ref> This allows the behavior of users to be tracked, including which ads were seen by the user and how long they watched an ad before changing the channel.<ref name=ars>{{cite web |url=https://arstechnica.com/tech-policy/2015/11/beware-of-ads-that-use-inaudible-sound-to-link-your-phone-tv-tablet-and-pc/ |title=Beware of ads that use inaudible sound to link your phone, TV, tablet, and PC |website=[[Ars Technica]] |accessdateaccess-date=31 March 2016|date=13 November 2015 }}</ref>

In March 2016, the FTC issued warning letters to 12 app developers using cross-device tracking in their apps.<ref name=ftc>{{cite web |url=https://www.ftc.gov/news-events/press-releases/2016/03/ftc-issues-warning-letters-app-developers-using-silverpush-code |title=FTC Issues Warning Letters to App Developers Using 'Silverpush' Code |accessdateaccess-date=1 April 2016|date=17 March 2016 }}</ref> The FTC warned these developers that they may be violating the [[Federal Trade Commission Act of 1914|FTC Act]] if they state or imply that their apps are not tracking television viewing habits when they in fact are.

Another study suggested that Apple, Google, and Bluetooth Special Interest groups need to do more to prevent cross-device tracking.

<ref name=":132">{{Cite journalbook|last1=Korolova|first1=Aleksandra|last2=Sharma|first2=Vinod|year=2018|title=Cross-App Tracking via Nearby Bluetooth Low Energy Devices|journal=Proceedings of the Eighth ACM Conference on Data and Application Security and Privacy |chapter=Cross-App Tracking via Nearby Bluetooth Low Energy Devices |year=2018|series=CODASPY '18|location=New York, NY, USA|publisher=ACM|pages=43–52|doi=10.1145/3176258.3176313|isbn=9781450356329978-1-4503-5632-9|s2cid=3933311 }}</ref>

Cross-device tracking has [[Internet privacy|privacy]] implications and allows for more detailed tracking of users than traditional tracking methods. Data can be collected from multiple devices used by a single user and correlated to form a more accurate picture of the person being tracked.<ref name=ars/> Moreover, malicious actors may use variants of the technology to de-anonymize anonymity network users.<ref>{{cite web|author = Vasilios Mavroudis|display-authors=et al|title = On the Privacy and Security of the Ultrasound Ecosystem|website=ubeacsec.org|publisher=Proceedings on Privacy Enhancing Technologies|url=https://petsymposium.org/2017/papers/issue2/paper18-2017-2-source.pdf|accessdateaccess-date=30 November 2017}}</ref>

In addition, scholars argue that users have the right to know the value of their [[personal data]].<ref name=":17">{{Cite journal|title=ScienceDirect|issue=2|pages=289–303|last1=Malgieri|first1=Gianclaudio|last2=Bart Custers|title=Pricing privacy – the right to know the value of your personal data|date=April 2018|journal=Computer Law & Security Review|volume=34|doi=10.1016/j.clsr.2017.08.006|hdl=1887/72422|s2cid=64962762|hdl-access=free}}</ref> Increasingly, users' [[digital identity]] is becoming commodified through the selling and [[Monetization|monetizing]] of their personal data for profit by large companies.<ref name=":17" /> Unfortunately, many people appear to be unaware of the fact that their data holds monetary value that can potentially be used towards other products and services.<ref name=":17" /> Thus, scholars are arguing for users' to have increased awareness and transparency into this process so that users can become empowered and informed consumers of data.<ref name=":17" />

The increased usage of cross-device tracking by advertisers is indicative of the rise of a new era of data extraction and analysis as a form of profit, or [[surveillance capitalism]], a term coined by [[Shoshana Zuboff]].<ref name=":52">{{Cite journal|last=Zuboff|first=Shoshana|year=2015|title=Big other: Surveillance Capitalism and the Prospects of an Information Civilization|journal=Journal of Information Technology|volume=30|issue=1|pages=75–89|doi=10.1057/jit.2015.5|s2cid=15329793 |issn=0268-3962|doi-access=free}}</ref> This form of capitalism seeks to commodify private human experience to create [[Futures exchange|behavioral futures markets]], in which behavior is predicted and behavioral data is harvested from the user.<ref name=":52"/> Zuboff suggests that this new era of surveillance capitalism eclipses Bentham's panopticon, becoming far more encroaching and invasive as, unlike a prison, there is no escape, and the thoughts, feelings, and actions of users are immediately extracted to be commodified and resold.<ref name=":52"/> Thus, since cross-device tracking seeks to create a profile of a user across multiple devices, big tech companies, such as Google, could use this behavioral data to make predictions about the user's future behavior without the user's awareness.<ref name=":52"/>

In addition, health and wellness applications also have a dearth of privacy protections as well: a study found that many health apps lacked [[encryption]] and that regulators should enforce stronger [[Data privacy]] protections.<ref name=":7">{{Cite journal|last1=Huckvale|first1=Kit|last2=Prieto|first2=José Tomás|last3=Tilney|first3=Myra|last4=Benghozi|first4=Pierre-Jean|last5=Car|first5=Josip|date=25 September 2015|title=Unaddressed privacy risks in accredited health and wellness apps: a cross-sectional systematic assessment|journal=BMC Medicine|volume=13|issue=1|pagespage=214|doi=10.1186/s12916-015-0444-y|pmid=26404673|pmc=4582624 |doi-access=free }}</ref> The study stated that of the 79 apps they tested, none of the applications locally encrypted the users' personal information and 89% of the applications pushed the data online.<ref name=":7" /> The lack of adequate privacy and security measures surrounding users' personal medical data on mobile applications underscores the lessening degree to which users can trust mobile app developers to safeguard their personal information online.<ref name=":7" /> While mobile application developers continue to confront privacy and security concerns, users are increasingly looking to ways to visualize their data through wearable devices and applications that track their workout and exercise routines.<ref name=":9">{{Cite journal|title=ScienceDirect|issue=2|pages=289–303|journal=Computer Law & Security Review|volume=34|doi=10.1016/j.clsr.2017.08.006|date=April 2018|hdl=1887/72422|s2cid=64962762|hdl-access=free|title=Pricing privacy – the right to know the value of your personal data|last1=Malgieri|first1=Gianclaudio|last2=Custers|first2=Bart}}</ref> Indeed, researchers discovered that these self-tracking devices play a role as a tool, a toy, and a tutor in users' lives.<ref name=":24">{{Cite journal|last1=Lyall|first1=Ben|last2=Robards|first2=Brady|date=1 March 2018|title=Tool, toy and tutor: Subjective experiences of digital self-tracking|journal=Journal of Sociology|volume=54|issue=1|pages=108–124|doi=10.1177/1440783317722854|issn=1440-7833|doi-access=free}}</ref> In the tool role, the self-tracking device functions as a mechanism to help the user in some capacity, often to achieve personal health goals.<ref name=":24" /> The toy role underscores how some self-tracking users see it as a fun game, particularly with regard to rewards and viewing the visualized data.<ref name=":24" /> Lastly, the tutor role reflects how users gain insights from and motivation about their activity from the apps themselves.<ref name=":24" /> Other scholars have characterized self-tracking as performing for the system, or controlling what is (or isn't) recorded, performing for the self, tracking themselves to gain insight into their behavior, and performing for other people, or the importance of how other people viewed the person being tracked, as well as the control the person being tracked had over their data and thus how they are perceived.<ref name=":10">{{Cite journal|last1=Gross|first1=Shad|last2=Bardzell|first2=Jeffrey|last3=Bardzell|first3=Shaowen|author3-link=Shaowen Bardzell|last4=Stallings|first4=Michael|date=2 November 2017|title=Persuasive Anxiety: Designing and Deploying Material and Formal Explorations of Personal Tracking Devices|journal=Human–Computer Interaction|volume=32|issue=5–6|pages=297–334|doi=10.1080/07370024.2017.1287570|s2cid=2557583 |issn=0737-0024}}</ref>

Scholars are convinced the current notice-and-consent model for privacy policies is fundamentally flawed because it assumes users intuitively understand all of the facts in a [[privacy policy]], which is often not the case.<ref name=":21">{{Cite web|url=https://www.amacad.org/publication/contextual-approach-privacy-online|title=A Contextual Approach to Privacy Online|website=American Academy of Arts & Sciences|date=October 2011 |access-date=18 April 2019}}</ref> Instead, scholars emphasize the imperative role of creating a culture in which privacy becomes a [[social norm]].<ref name=":21" /> In effect, users of online technologies should identify the social activities they use on the internet and start questioning websites' governing norms as a natural outgrowth of their web browsing.<ref name=":21" /> In effect, these norms need to prevent websites from collecting and sharing users' personal information.<ref name=":21" /> In addition, starting with a user's personal values and seeing how these values correlate with online norms may be another way to assess whether or not privacy norms are being violated in odd cases.<ref name=":21" /> Ultimately, scholars believe these privacy norms are vital to protecting both individuals and social institutions.<ref name=":21" />

There are large implications for this technology within the legal field. Legally, The [[Federal Trade Commission]] has a responsibility to prevent deceptive practices by technology companies, such as those that could lead to consumer injury.<ref name=":6">{{Cite journalSSRN |last=Hoofnagle|first=Chris Jay|date=1 September 2017|title=FTC Regulation of Cybersecurity and Surveillance|location=Rochester, NY|ssrn=3010205}}</ref> The FTC has made efforts to prevent invasive [[web tracking]], tracking in physical space, [[malware]], insecure and poorly designed services, and the use of deception to engage in surveillance.<ref name=":6" /> For instance, in the realm of invasive web tracking, the FTC has brought lawsuits against companies who engage in '[[history sniffing'––a]], a technique that enables companies to ascertain which links a user clicked on based on the color of the link.<ref name=":6" /> Concerning tracking in physical space, the FTC has also cracked down on Nomi, a company that scans the [[MAC address]]es of customers' phones in stores.<ref name=":6" /> MAC addresses function as a [[unique identifier]], enabling the connection to wireless networks.<ref name=":6" /> In the case of malware, the FTC has placed pressure on companies such as CyberSpy, a self-proclaimed email attachment company that claimed to secretly record users' key presses.<ref name=":6" /> The FTC has also cracked down on companies like Compete, a browser toolbar, because it decrypted users' personal information on the internet, putting users at risk.<ref name=":6" /> Lastly, in cases during which deception is used to engage in surveillance, the FTC has investigated private investigators, who surveil individuals on another person's behalf.<ref name=":6" /> In addition, audio beacon technology, used by an application called Silverpush, could violate the FTC's policies because users were not made aware as to when the ultrasonic signals were being recorded.<ref name=":6" />