Ask HN: I bought Voltaren at the chemist, now Google shows me ads for it. Why?
How does google know I bought Voltaren?
Is my bank purchase history shared with google somehow?
I guess it could just be coincidence? Not coincidence. Not "bank purchase history" shared with google- in most cases banks and credit cards don't know item level detail. Lots of ways this data flow could happen, at least in the US. Happy to go through specific details I have seen if you want to share more about this, but two high level points 1. Remember that when you purchase something, the data about the purchase is BOTH yours AND the entity from whom you made the purchase. Most of those entities have data sharing agreements of various kinds for all sorts of legitimate business reasons 2. It isn't google who knows about the purchase, and even the advertiser doesn't "know" you made a purchase. Advertising is zillions of two sided marketplaces, with an enormous ecosystem of data packagers and conveyers and linkers, with lots of concern about recency and freshness of data. Your purchase landed some key about you in a bucket that was mixed and repackaged with many other keys that the advertiser knows as "keys recently interested in Voltaren." Some of those keys are related to people who bought it, or who searched for it, or more indirectly who lingered while reading a page with an ad for it...and in most cases are very short lived. So give it a few weeks and many of those buckets of keys will have been completely remade. In the US, you can’t use personal health information for marketing purposes. If you can prove this link, a lot of very large organizations could potentially be in serious trouble for HIPAA violations. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance... The shop part (non-pharmacy) of a chemist isn’t a covered entity though right, so hipaa isn’t relevant at all? Depends which entity collected and sold the data. A pharmacy is a covered entity, a retail store is not. Does not appear this falls under HIPAA Where I live in Canada, most pharmacies have a separate cash for the pharmacist and the rest of the store. I wonder if there are any differences in reporting rules for the two. Is it personal health information if it's tied to an anonymous ID that contains no other details about you? I doubt the advertiser knows OP's name or address when they choose which ad to show. > Is it personal health information if it's tied to an anonymous ID that contains no other details about you? If it's deanonymized, is it then not personal information? > I doubt the advertiser knows OP's name or address when they choose which ad to show. Nonetheless, an advertisement is then targeted and it's well known that targeted advertisements reveal personal information. Is there a feasible way to prove this link? Subpoena Voltaren for documents? I don’t know that there really is. re 2., this is a Bad Thing. I fully agree that neither Google nor anyone at the drugstore 'knows' about the purchase, but the basic problem is that we've built a commercial marketplace that spies on people, but the information about people is treated as privileged commercial data in an automated and unaccountable marketplace. How does Google link the real life person who bought Voltaren at a store to the online account or fingerprint that browses the Internet? How does Google link the real life person who bought Voltaren at a store to the online account or fingerprint that browses the Internet? Often, through the payment. People use the same payment methods in the same stores over and over. This data is accumulated by the stores, and sold. if you signed up for a "points card" or some other gimmick to get 2¢ off something, the personal information you used when you signed up is added to the profile. What you bought in the store is added to your profile (within legal limits in certain jurisdictions). Some stores have devices that listen to your mobile phone's identifiers (wifi, Bluetooth, etc) and add that to your profile. Now the data profilers know what other stores you shop in. Some stores are experimenting with facial recognition (Walgreens). That gets added to your profile. If you go to several in a single day, your route between the stores can be guessed. If you go to one or more places (stores, parking garages, streets that pass parking lots) that have sensors that read the NFC chips in your car's tires, then that can be added to your profile. Now they know everywhere you go, everywhere you shop, everything you buy, how much you buy, how much you spend, your race, your gender, how you dress, what brands are displayed on your clothing, and any visible hair, moles, or tattoos. That's just off the top of my head. And people wonder, "Wow. I am a little scruffy. How did Facebook know to show me an ad for a razor?" Hmmm.... Use cash! Use cash! It's a start. But unfortunately, doesn't get you out of a lot of the other surveillance methods. Also, paying cash is yet another bit of entropy. Like using Firefox. "Also, paying cash is yet another bit of entropy. Like using Firefox. " I do not understand. I am typing this on Firefox. Felling the low entropy vibe! And don't bring a phone! Ofc the 2 of those combined makes pinpointing you even easier. Like taking candy from a baby. That doesn't help if you use a loyalty card, which a lot of people do for the promos. And even if you pay via card/phone ( which is literally multiple times faster and less hassle), the payment processor and card issuer don't know the individual items. Don't use a loyalty card. Duh! I don’t think Google linked the account directly to the purchase. My guess would be that Google linked the account to the medication based on patterns from one of its many ways it gathers data. * visits to websites about that medication * visits to websites talking about symptoms for which the medication helps * searches for the above * I would not be surprised if Google picks up interests from other accounts using the same WiFi (or even other devices on close proximity) * there are some scary stories about Google/FB/Amazon listening to conversations I do most searches in an incognito window so it can't be browser history. In some cases, it's even something like my wife joking about selling the car to a friend on WhatsApp, and suddenly Facebook show ads where you can sell the car. One time I told my wife to buy something at the grocery store (verbally, no text) and FB shows me the ad for that exact item. > I do most searches in an incognito window so it can't be browser history. Incognito mode is mostly a convenience for you to do browsing without saving local history or cookies. It doesn't stop tracking. I assume the fingerprint is different in incognito versus a regular window. But unless you are using VPN/adblockers/pihole/etc your browser is still executing third party JS and potentially sending tracking data to google using a plain https connection coming from your residential IP. I can imagine it's not that hard for Google to link different requests from the same IP with slightly different fingerprint data to be coming from the same user. edit: and for searches it is even easier, because you are communicating directly with google by performing the search, no tracker or JS necessary. We had a similar thing happening to us: Wife and I have no kids and have no plans to have them. Kid related stuff is just not part of our everyday interactions. One day we visit some friend who are a couple with kids and in that visit we TALK about babies and rising kids and whatnot. Next day my wife (who has the FB app Installed), starts getting kid's diapers ads. I dont have FB app and I dont get those ads. She uninstalled the app after that. Anecdotes like this are plausibly explained as https://en.m.wikipedia.org/wiki/Frequency_illusion So, then, completely different from what the GP suggested. My comment was an expansion on GPs second bullet point. It’s not Google that knows about the purchase, but Google that “somehow” picked up contextual info from OPs environment linking OPs online identity to Voltaren as a product. Edit: the purchase could have been involved somewhere in the chain but it’s not necessary. > Your purchase landed some key about you in a bucket that was mixed and repackaged with many other keys that the advertiser knows as "keys recently interested in Voltaren." There's not really that much ambiguity in this sentence from the second bullet point. Unless my mental model of online advertising is wrong, your physical in-store purchase should not be landing you in some Google advertising bucket. I completely agree that they should not show up. It looks like I went lightly over that sentence and focussed more on the one after: > Some of those keys are related to people who bought it, or who searched for it, or more indirectly who lingered while reading a page with an ad for it...and in most cases are very short lived. I think it's the last option. His phone probably heard him ordering Voltaren. It's also the simplest possibility (Ockham's razor). I know because after discussing extremely rare chemicals at an officemate's desk, he began seeing ads for them. Neither of us had ever Googled or emailed anything related. It was a brand new idea for a brand new project which we had started working on that morning. This is not the simplest possibility. Based on how often Google Home misunderstands the simplest queries, the tech is nowhere close to getting purchase intents out of random conversations. Besides that - do folks on hn really believe the „our phones are listening 24/7“ conspiracy theories? I scrolled down further in the thread and it seems they do... We don't want to believe but here we are. [ha, ha] Our robotic overlords don't even need to be sure, sounds-like is good enough, apply some exotic filters and odds to sell things go though the roof. My funniest was talking with someone at work (who works for a different company) then when I got home facebook suggested adding them. That I didn't have a phone at the time made it extra comical. Plenty of other people work there, it never suggested those and there are no common contacts. How the CONSPIRACY works exactly I have no idea, the candidate theories are all to hard to imagine. (Like, I'm easy to track because I have no phone?) I believe it is very possible. My android phone often asks how did I like this or that shop. Sometimes I was just passing by those shops but on average the phone is quite correct which shops I have visited. Google knows when you are in the pharmacy and might use a different routine interpreting ambient sounds when you are there. Voltarol (ibuprofen gel) is a distinct sound that even very lossy algorithm with low level of processing power can distinguish with a sufficient level of accuracy. Can you prove neither of you Googled anything related? Surely either you or your office mate could have done further research later on, which would involve searching those chemicals online and browsing Web pages related to them? Alternatively if someone near you overheard your conversation, and Googled it, then Google could link all of your locations together and conclude that you are all interested in the same thing. This is how Facebook has its creepy ability to indirectly predict what items you are interested in - usually someone near you searches for what you're talking about later on in the day, and it guesses that it's important to both of you. Agreed. There's a lot of online marketing companies that do a lot of work in this area. It's pretty easy to do if you have any kind of ID or token to link the data. It can be done with credit card numbers, a phone's location services, membership programs, coupons, etc. Here's some of the stuff Facebook does, which just scratches the surface of what is possible: please do go into detail about how data about an exact goods purchase that is linked to a specific person (ignoring the bunk about 'anonymization') can be regarded as having a legitimate business reason Marketing is a legitimate business reason. Other example, In the US, lots of jurisdictions have restrictions on ingredients. For example, dextromethorphan and pseudoephedrine. If you are buying over the counter medicines that contain these, in some jurisdictions, you need to provide an ID. > Marketing is a legitimate business reason. Pervasive targeted marketing is not a legitimate business reason. On the contrary, pervasive targeted marketing is exactly a legitimate business reason in the context of increasing revenue efficiently, as most corporations want to do. Selling cocaine is a great way to efficiently increase revenue, but it's not a legitimate way Selling cocaine is a legitimate way to increase revenue. If the cocaine is real (i.e you aren't selling flour) then why wouldn't it be legitimate? It might not be legal, but CocaCola is allowed to import coca leaves by the millions. Don't be ridiculous! It would be absurd for the Coca Cola company to be allowed to directly import coca leaves for use in their "secret" recipe. Instead, it's an intermediary (the "Stepan Company") who imports the 200,000 lbs of coca leaves each year, removes the cocaine for pharmaceutical use, and then sells the remaining "flavor" extracts to Coca Cola: https://www.nytimes.com/1988/07/01/business/how-coca-cola-ob... (which is to say, thanks for encouraging me to learn about this) I think we're getting confused on word meanings here. Legitimate is far too vague a work. I'm trying to get at the idea that just because something would WORK doesn't make it ok to do. There is what is possible under capitalism (anything legal) and then there is what is RIGHT. Selling cocaine isn't JUST illegal, it's also probably wrong due to it's addictive properties. Similarly, selling people's data and tracking people without their consent is legal, but it's also wrong in most people's opinion. its legitimate. distasteful but legitimate. It's legal, but not necessarily legitimate. Informally, people use the latter terms to articulate their view of what the law should be, rather than what it is. why use a word with a known definition to try to mean the near opposite? its confusing. if you think the thing sucks, just say it sucks. Many words have multiple definitions, as you are surely aware. Legitimate is one of them. yep, all the definitions of legitimate equivocate it to legal/lawful. except here, y'all want it to mean not-lawful. I'm legitimately not smart enough to continue this conversation. Depends if morals matter. If right and wrong are important then "legitimate" encompass them. So it s possible for something to be legal but not legitimate. There are not a lot of legal but absolutely immoral (the other way, illegal but legitimate - plenty) the actions of the FANG IMO definitely fall into the category of legal but illegitimate. Because to me good and evil are important considerations That's just not true. Please don't make things up. Here are two (abridged) definitions from the Oxford dictionary: 1. conforming to the law or to rules 2. make legitimate; justify or make lawful. You're choosing to ignore the verb make in the second definition, describing the act of conferring legitimacy on something, which necessarily implies that it was previously lacking. The second example literally says "make legitimate".
You're trying too hard to be right. :D The word you're looking for is "legal". It's legal. It's illegitimate but legal. The first three results on Google show the definition of legitimate as "allowed by law". If you want to make a moral argument for why it shouldn't be allowed, then do that. The etymology of “legitimate” and “legal” are shared but they have very different meanings. If you are not a native speaker of English then these connotations can be hard to discern since word meanings are fluid and regional, but at least in the US the meanings are quite different. > Remember that when you purchase something, the data about the purchase is BOTH yours AND the entity from whom you made the purchase. This is wrong. Because in my case the information is highly personal, while in the shop owner's case it's just business information. Opt out of VISA marketing https://marketingreportoptout.visa.com/OPTOUT/request.do Second, disable GPS, and cellphone tower ID reporting (root needed.) So Google can't correlate you with sales records. At the moment, there is no way to disable Google AGPS spying on the stock Android. Third, block Google apps from reading your IMEI/IMSI/serial number, so they can't get AGPS data from your cellphone provider if it sells it. Better, get a de-Googled ROM This is the dumbest ad strategy ever. Why on earth would ads about a product you just bought be effective marketing material. This is like how you get a million ads about dishwashers the day after you Google around and buy one. At least wait for a short duration of time to let the target run out of medicine before adversiting new stuff. The strategy is extremely effective, especially for high-priced but rarely purchased items like dishwashers, cars, flooring, etc. Consider: one of the hardest parts about advertising is figuring out when someone is ready to buy the product. That is why car companies bombard ads everywhere, just to catch you in the rare moment when you may be buying a car. Lets guess that maybe the odds of a random person wanting to buy a dishwasher is 1 in a million. Now consider someone who has just bought a dishwasher. What are the odds they need a new one or a second one? Maybe the one they bought is a few cm too tall/wide/deep. Maybe it came broken on arrival. What are the odds here? I have no data, but I would guess like 1 in ten thousand. The odds of you buying a dishwasher and then needing to buy another are much better than the odds of someone wanting to buy a dishwasher in the first place, because the hard part is finding people who want to buy a dishwasher. I'm sorry but that doesn't make sense to me at all. Is that based on anything more than intuition because if not I'd like to say that mine sides with op. I'll add some numbers too. If a dishwasher has a lifetime of 20 years and a person is 'sensitive' to adds for dishwashers for a month surrounding the time it breaks, you're talking about a 1 in 240 chance if you 'randomly' target people with a dishwasher, which should be doable to predict with a 1 in 4 chance using some basic demographics. That's roughly 1 in 1000 'total', 10x better than your 1 in 10.000 ;) The reasonable explanation I've read elsewhere is: Something like 30% of purchased products (including appliances) are DOA or returned. The follow-on advertising is hoping to capture your replacement activity. Pretty sure this doesn't apply to medication or dishwashers. :D I hope you're right about medication! People really do return major appliances though. Perhaps dishwashers less frequently than refrigerators, though people never fail to surprise me. I do not have concrete numbers, but would love to know for sure if anyone on HN is from the industry. I think once your dishwasher breaks, the time you are “live” to buy is closer to a week :). Also it is (maybe?) harder to identify a person with a broken dishwasher than one who just bought one and may need another. dishwashers have standard dimensions "A standard dishwasher is about 24 inches wide, 24 inches deep and 35 inches high. Most cabinet openings are made to fit a standard dishwasher size. Note that certain handles may affect the overall dishwasher depth. Oversized dishwashers are built wider than the standard opening." they come in three sizes compact standard and custom. Many purchases are recurring consumables. Food, clothing, medicine, office supplies, car parts- none of it lasts forever. What does it cost to be reminded that you can buy more? Also, completely unrelatedly, if you saw some armchair internet rando claim they'd debunked a major and long-standing business strategy of market sector leader, how seriously would you take them? I had a 2-4-1 offer on chainsaws sent to me. Business is subject to fads and stupidies, we have proof that open officez are a net negative, yet businesses continue. We have proof that getting people to change passwords every month is bad for security, but its still policy in many places. We have proof that using basalt or stainless rebar in RCC is more cost effective in the long run, but bs still continues. Maybe enough people who buy chainsaws are running tree trimming crews? I live on a farm and want multiple chainsaws. I've 3 currently and wouldn't mind a couple more. For urban life multiple doesn't make sense. For professional/rural it really does. > What does it cost to be reminded that you can buy more? At a certain point in my life, one where I sought fewer material comforts (and had less media exposure), I used to claim that advertising won't convince me to buy anything but it may convince me not to. There is a very fine line between persuasion and overstepping ethical boundaries. Sure, but for most people that line is not so fine. Not sure if it fits with what the poster you replied to was saying but I find it a bit curious when I buy say a guitar on Amazon and my recommendations (emails or ads in other sites) over the next few days are still guitars. I do not remember seeing one of those promotions which follow a purchase being about accessories or add-ons. No automated recommendation system is going to be perfect; it’s either going to over-recommend or under-recommend. From the way the Amazon system works, we can infer that they have decided that missing to the over-recommend side is a better business strategy than missing under. And it kind of makes sense if you think about it... really, what are the consequences of seeing these silly over-recommendations? Did you stop buying from Amazon? I bet the vast majority of people shrug or laugh, but don’t change habits. Also, big one-time purchases tend to be rare, so optimizing a recommendation system around those is probably suboptimal compared to optimizing it around frequent consumable purchases. > I bet the vast majority of people shrug or laugh, but don’t change habits. Or you tell all your friends about it and end up having a conversation about guitars/dishwashers or whatever. It may not be intentional on their part, but spin off conversations can be a nice by-product for them. Feels like it helps it stick in the mind, a bit like writing a witty TV ad. I can see what you are saying, the downside is pretty much nil. And it seems like people do buy more guitars than just one. I'm currently just entering this phase where I just now stopped regretting the purchase because I couldn't play any music out of it initially. :) I think guitars are like bicycles where the optimal number to have is n+1 where n = the number you currently own. Unless you are married or in a committed relationship, then it becomes n-1 where n = the number at which your significant other leaves you. I dunno, I’ve bought several guitars in a row… Well I've had it happen with toilet seats. In 40 years on this planet I've only ever needed to purchase that one. I'd imagine if I needed to get more than one that I would get them all at the same time. There's probably a nontrivial number of people who renovate houses one bathroom at a time. I'm sure there are. I'm also sure, having been around house flippers (my brother flipped for a while, my MIL flipped for a while) and reno (my parents, my MIL, and my wife when we were dating) a few times in my life, that they don't buy them through Amazon/online. That's the sort of thing you buy a new one because one broke and now it shows up how tatty (worn, old, messy) the other one(s) in your house are. Or someone asks where you got it ... "oh, I can't remember but Google ads showed me the same one of available at $diy_store", or whatever. Its a math mistake on Amazons part. They’ve conflated “most purchases of a toilet seat are made by someone who buys another” and “most people who buy one toilet seat buy a second”. There’s a small, but high volume group of toilet seat purchases — eg, office buildings or apartment maintenance. Preach. Simple Bayesian logic. P(buying crap) < P(buying crap | has bought crap before) Advertising is applied statistics and works on large cohorts. Nobody cares about you personally or your psychology. Upvoted, this is a great comment. Thanks for finding the words to sum it up so concisely. I've bought 3 mechanical keyboards in my life. 2 were within a week of each other because the first was defective and returned. Thus far, the clearest signal for answering the question "will I buy a mechanical keyboard in the next few days?" is "did I just buy mechanical keyboard?" It's terrible, but post-purchase advertising is an entire field of advertising, trying to get you to keep thinking about the product, trying to encourage you to re-purchase the product after it runs out, and trying to encourage you to recommend it to others (by keeping it top of mind). https://www.shopify.com/retail/examples-of-great-post-purcha... I used to think this, but people who just bought a dishwasher are probably somewhat likely to buy another dishwasher, even the same dishwasher, and there only needs to be a tiny fraction of a single percentage chance for it to be worth showing an ad impression. Presumably even for that tiny fraction of people who buy a dishwasher right after buying a dishwasher there must be a limit to how many times they will repeat the cycle, otherwise ... well, we can imagine the planet Earth completely covered in dishwashers and somewhere under the mass of white cubes, a constant mouse clicking sound and a cry of anguish... Must. BUY. M O R E <clickclickclickclick>. Well my girlfriend just bought a laptop, it was broken, she returned it, she bought a different laptop, again broken, and now bought a third one. Looking at how many products are DOA nowadays, it might be that a person that just bought something is more likely to buy it again than the average person. Also in general I've noticed there are a lot of people that return online purchases a lot, even the non broken ones, since you can't determine if the clothing fits, if the colors really look good, if it has a good texture, from pictures and descriptions online. They may not be good customers, but Google probably gets money per purchase, not for customer quality. Is she buying them secondhand? What’s the DOA rate on laptops these days? Two in a row must be rather unlikely. They are all new, I'm guessing bad luck. Agree, I bought my first dishwasher a few years ago but it seems like every 15 years or so I buy a new one. It's possibly due to those ads. Just can't help myself! And people who just bought a coffin are probably somewhat likely to buy another coffin. Yandex Ads network has a wonderful button - "I'm already bought this product" to stop ad spam on the things already at home ) Why would I want to give the ad networks additional information and make their advertising more efficient? Given they exist, I’m perfectly okay with advertisers wasting money on badly targeted ads. Then again, could be fun to screw with them a bit. I wonder what would happen if you just kept clicking I already bought this on everything that pops up. Or better yet, just write a script that clicks it every time one of those ads appears. I wonder if it's possible to go through every single item they advertise and what would happen if you did. If you want to stick it to the man there is:
https://addons.mozilla.org/en-US/firefox/addon/adnauseam/ That clicks all adds for you. Maybe it can be modified somehow to click already bought item? I suspect that when you do this the following thing happens: * Big businesses are unaffected as they use click fraud prevention services. * Businesses that don’t use that have to pay more money to Google because people clicked on their ad, and they think their marketing is effective (at least from a click through perspective). * Google makes even more money because you are clicking on all the ads and it makes them look better. They can demonstrate how well their marketing platform works even better! Because some things in life are win win. I actually prefer relevant ads vs irrelevant ads. Me too, but I also prefer fewer ads over more ads. The more efficient we make ads, the more of them there will (virtually guaranteed) be. Quantity of ads seems more like a decision for web site operators to make, balancing the wishes of viewers and clients. If a site's ads drown out the content I go there for, I'd give up on the place, but if a site's ads are "too relevant," I'd probably keep going there. I don't think they try to sell you what you've alrady bought, I think they're trying to sell you what you have shown any kind of interest in. Perhaps you filled in the order and then backed out- how would Google's recommender system know that? I mean, they sure can but not for everyone, probably (hopefully). So the moment you show any kind of interest in some kind of product, they bombard you with ads for that same kind of product, hoping that they will get you in the short window of time right before you've made a purchase. ... or not. Maybe their recommender systems have simply decided that buying product X is highly correlated with buying product Y where Y = X. Who knows? Probably not even google itself knows. Also, remember that google is not trying to sell you anything, they're only trying to maximise adoption of their ad platform by advertisers. Who cares what you actually buy? Not Google. Bought a cordless screwdriver at Amazon, now get lots of ads on Amazon for cordless screwdrivers. Bought a dishwasher, now get ads for dishwashers. Dumb I know (or I'm dumb because I don't get it) Other comment explains it though: Many people return the dishwasher or screwdrivers (they might have ordered several) - Amazon wants to make sure you buy with them (though my account history should show that I practically never return things because I hate getting returned things as new). The models use past behaviour (looking at dishwashers) to predict future behaviour (buying dishwashers). Spending cash on something is a much harder signal of interest than looking at it though. So the models would be stupid to ignore that. The question of "how many dishwashers does that person need" is hard to answer and thus mostly skipped when opportunity costs are low. Personal anecdote: Recently I cancelled an order because a better product was shown in ads post-purchase. I still get ads about leather wallets from when I was searching for one like 10 years ago. Same, but I think it's also just that Bellroy is just a massive Display advertiser. To reinforce the notion that you’ve made the right choice and keep you as a long term loyal customer. This is an expressed part of car ad strategies. For medicinal products I’d be keen to see research on whether a treatment group being re-targeted would report better efficiency of a treatment than a non-retargeted control. Along with what others have said, the system isn’t perfect and some marketers aren’t great at their job. It’s easy for recently purchased data to get mixed in with just about to purchase data. It’s easy to forget to exclude an audience of people who just bought, etc. From a boarder perspective, maybe the data is about knowing when someone else will buy a dishwasher. If people make similar journeys. Also, this person is now in a certain class of shopper (I think some this may be Experian Mosaic classes), so the advertiser knows what quality level of dishwasher this person is buying. The cheapest kitchen applicances, or premium kitchen applicances? Premium kitchen applicances on credit or premium kitchen applicances full price? This will have a massive effect of choice of other items to advertize, the difference between ads for loans (credit purcahse) or ads for international holidays (full price purchase). Cause, and effect. It throws dust into eyes of advertising efficiency measurement. Company pays for ads, and Google just sizes the ad impressions to what it can find. Brilliant if you are selling the ads. Well it makes sense in this particular use-case. Voltaren is an arthritis pain relief gel. This is something you will continue to need and would rather buy online instead of walking to a chemist when your joints are not in great shape. Well buying something tells them a lot anyhow. Brand loyalty, possible interest in consumables, favourite places of purchase.. It's not necessarily to advertise the same thing. No, it is not. In many countries, one can return the product within two weeks, no questions asked. Why wouldn't they, if they get a better deal from an ad? >VISA marketing Why is this even a thing? Maybe I should just go back to buying everything with cash, it's impossible to keep up with all the crap we need to disable or hack around A person I work with (very knowledgable about tech and IT) uses a flip phone and cash (as much as possible). If they want to send a gift they buy it locally, pack it up, and ship it. Etc. They don't even bank online. Why? Not sure but they have lots of free time and this is how they choose to spend it (trips to see a teller, back machines, part office visits, using public transport to shop for nearly everything). >Why? Not sure Maybe they are sick of surveillance capitalism and don't wish to be part of it? I'd do the same, but I really don't want a flip phone. Maybe once Pine Phone with GNU/Linux is working reasonably well, I'll switch to that. https://calyxos.org/ and https://grapheneos.org/ both go part of the way. They're hardened, privacy-preserving Android flavors that work best on Google Pixel 3 - 5. CalyxOS emulates google services so you can use basically any Android app, while GrapheneOS goes further down the security hardening hole. Huh didn't know about these, thank you! I'll look into them I actually want a good flip phone myself. I bought a locally made KaiOS phone but it has too low RAM and keep crashing. Nokia makes flip phones with KaiOS but they aren't allowed in my country sadly. Reason is I want a phone I can repair myself, all my previous phones I had to replace because some unrepairable part that didn't need to be unrepairable (one of them it was the battery!) broke down. Instead of shelling a ton of money to be tracked and buy a product that won't last, I wish I could spend my phone on something that will last. And the flip cover is convenient for me because I keep forgetting to lock my phone and managed to pocket dial even with an android. I don't do online banking on my primary bank - only on the secondary NatWest one I keep < £100 in. Its reducing the attack surface as I see it. > > Visa marketing I guess this is one of the things that just has to be forbidden by law. In Germany (and probably all of Europe), it is forbidden by law. I get the impression it's not forbidden in the UK. Here's the equivalent page from MasterCard. [0] (Incidentally, the captcha is broken so the page is unusable.) [0] https://www.mastercard.co.uk/en-gb/vision/terms-of-use/commi... > To opt-out from our anonymisation of your personal information to perform data analyses The page is super vague, and the question remains if they can fully anonymise the data, but if they can, it's allowed. Personal data is covered under the GDPR, while anonymous data isn't [0]. [0] https://ico.org.uk/for-organisations/guide-to-data-protectio... The captcha has been broken for months. I don't think it's an accident. In the UK there are data science groups at banks that target specifically extremely wealthy customers based on their transactions and balances. I think that they only focus on wealthy customers right now because they haven't scaled up properly but the plan is to eventually expand to everyone. This has happened since banks started selling investment products, wealth managers simply pull up a list of cash heavy accounts who haven't opted out of marketing where they can push investment products. Think is biz model private bankers and 'Wealth Management' arms at banks are built upon High street banks in the UK don't really have products for HNW its normally high charging OIECs that are not good value. Ok Nat west has Coutts but not just any euro trash millionaire can get an account there That's why some people are working hard to make cash disappear. > Why is this even a thing? Maybe I should just go back to buying everything with cash, it's impossible to keep up with all the crap we need to disable or hack around And some agencies may be more interested in these exclusion databases. So I don't think there is any way to get out of this maze. When you sign up to exclude from a list, you get included in many other. What’s the risk here? Am I branded as a terrorist for opting out of marketing? What’s the logic? Lists can be used for things other than terrorists Obviously, such as tracking who opted out of marketing based on their credit card spend. The question is what unintended (and specifically undesirable) consequences that poses to the members of the list. >Maybe I should just go back to buying everything with cash You should. Cash registers will just start scanning serial numbers on bills and banks and ATMs will scan them when dispensing. Better to focus on privacy laws. Because credit card rewards aren’t free? Banks compete for credit card consumers by offering rewards. Those rewards cost them money. Selling consumer information is another revenue stream to make up for the cost of rewards.
Most consumers are okay with this trade off: they get their airline miles / low interest / cash back in exchange for their purchase history. >Because credit card rewards aren’t free So this isn't covered by the 1-3% transaction fee the merchant pays every time you use your card? >Most consumers are okay with this trade off No they aren't. Most consumers aren't even aware they are paying with their privacy, so you cannot take a low opt-out rate to mean high levels of consent. It doesn’t matter if credit card providers are paid 0%, 3% or 5% on each transaction. If the law (and/or customer blowback) allows a company to sell customer information, management will eventually give in to selling it because it’s a revenue source. When called on this they will give you a story about how it “lowers customer costs” and some people will accept this as a valid excuse, but none of this changes the reality. PS: this is really a response to grandparent poster, not parent. Speaking with coworkers that aren't tech workers - nobody gives a damn. Not one, not even something resembling one. To them, they are getting paid for something they otherwise have no use for. They're aware everything is tracked about them, and they do not give a fuck. Your friends, family, and coworkers might though, so the critical mass of people not okay with this can still grow :) Credit cards are such an American thing though. Here in UK pretty much everyone uses debit cards with no rewards. I actually have a credit card just for emergencies but it offers no rewards either. In order to bootstrap adoption of CCs, the banks pushed for a law in the 60s that put all the fraud liability on the banks, not the card users (and, to a lesser extent, not on the merchants). Your CC purchases are quite protected and it's easy to dispute a charge (apparently a very big deal in the phone and online sex businesses). As debit cards became popular here (well after Europe) the banks push them hard on people who aren't excellent credit risks (good credit risks = profit), because they push essentially all the risk onto the account holder and absolve the banks of any responsibility. I have three CCs (one of each major network) and pay them off every month; it's like having three debit cards except I get a free loan of a month's worth of spending. The term used in the banking business for people like me is "deadbeat" So here's the thing - I don't understand the liability thing. At least here in the UK I have disputed transactions on my debit card several times and every single time the charges were reversed during the phone call, I had the money back instantly. Is that only available for credit cards in the US? That is correct. Citation needed. I use credit cards exclusively so I cannot say for sure, but I am extremely skeptical that banks don’t offer any fraud protection on debit cards in the US. AFAIK the main reason people prefer CC’s over debit cards for fraud prevention is simply that with a debit card your money comes out immediately if it is used by someone else, whereas with a CC there is a 30-day buffer. Literally the first links when I search for ‘fraud protection credit card debit card” are below. The TL;DR is: - you have a short window to report DC fraud before you bear the full risk; CC risk is capped - dispute a CC charge: you don’t owe anything / accrue interest until resolved; DC case you don’t get any money back until bank decides it’s not your fault. Tough luck if you needed that money to pay your rent. https://www.consumer.ftc.gov/articles/0213-lost-or-stolen-cr... https://www.experian.com/blogs/ask-experian/are-credit-cards... https://www.nerdwallet.com/article/credit-cards/credit-card-... https://creditcards.usnews.com/articles/why-credit-cards-are... https://komonews.com/sponsored/wafd/financial-focus-tips/cre... Don't you have to pay interest on your average balance even if you pay off your balance every month? Not GP, but the answer is no if you pay the balance in full every month. The issuer anyway makes money from the MDR (merchant discount rate) charged to the seller. But they would love customers who pay a partial balance regularly (at or above the minimum due) and charge them hefty interests like 20% per annum or 36% per annum or even higher, depending on a few different factors. Once you carry over balances from month to month, then every transaction attracts interest until the entire balance with interest is paid off. And then on charge cards (NOT credit cards) like American Express, you don't even have the option to carry a balence. Full balence must be paid every month in it's entirety. CC in the UK use to have some nice rewards - and there are advantages in buying some thigs via credit card holidays for example. > Better, get a de-Googled ROM If you have the patience and knowledge, I can't recommend this enough. If you don't have the patience and the knowledge, this is a good way to end up with a non-functioning phone. (It will probably be recoverable, provided that you have the patience to acquire that knowledge and don't mind being without a phone in the meantime.) When I say I can't recommend it enough, I mean it. I have been okay with simply disabling Google services for the past few years, yet Google seems to be embedding their services deeply in applications like Phone, Messages, Contacts, and Files. It is at the point where these applications would throw up a stream of notifications when Google services were disabled on Android 10. Even though they appeared to be usable, they are clearly trying to annoy people into re-enabling Google services. Which one do you use/recommend? For maximum security & privacy, go with GrapheneOS (used to be CopperheadOS back in the day). Caveat is that you won't have Google Play (or even MicroG), which means some Google apps (and paid apps) won't work and if you want apps from Google Play then you need to install Aurora app. If you want the above, but also want access to Google Play apps, then install CalyxOS. The third option is LineageOS (was originally CyanogenMod back in the day). This custom ROM is the most accessible for a variety of devices. It's good for privacy, but, because the bootloader is left unlocked (which may or may not be relevant depending on your threat model), it is the least secure of the three. Both GrapheneOS and CalyxOS have very user-friendly installation methods, but exist primarily for the Pixel line of devices. LineageOS has the most involved installation process, but it's available for the widest variety of Android devices. I've installed all three ROMs on several different devices. For the average person, CalyxOS will probably be the best bet (though I think the Trebuchet launcher in LineageOS is better). It depends upon what is available for your device and what you want out of the firmware. What I will suggest is looking at the device specific forums at XDA. You will get an idea of what is available and what is reliable. Personally, I shy away from distributions that don't include a "what works" and "what doesn't work" section in the first post. I also prefer "official" distributions. At the very least, it is easier to track updates. The next filter I use is feature based. In this context, look for distributions that don't include Gapps and offer additional privacy enhancing features. Once you have something that you think you want, read the thread for the distribution. It often reveals pitfalls, variations within the model, and variations between carriers. These pitfalls exist even with the popular distributions, which is another reason to check out the forums. I went with OmniROM this time around, but I have been happy with Resurrection Remix on other devices. Some devices have nice alternatives that are specific to them. As an example, I use KatKiss on the Asus TF300T. For a while, it was running a more recent version of Android than my much newer phone! I personally use a Pixel 3 running Grapheneos. You need a non-Verizon version of the device to do so, but there are services out there that'll hunt the devices down and even install the OS for you if you lack the time/patience
https://grapheneos.org/
https://noagendaphone.com/ The first one seems most likely to be the relevant answer to how this was tracked: https://adwords.googleblog.com/2017/05/powering-ads-and-anal... > Google’s third-party partnerships ... capture approximately 70% of credit and debit card transactions in the United States See also https://www.bloomberg.com/news/articles/2018-08-30/google-an... and https://www.technologyreview.com/2017/05/25/242717/google-no... - Google has deals with the credit card providers to get purchase data so they can link them back to your online behavior. And people still think Google et al. eavesdropping peoples homes is tinfoil hat level ... Visa doesn’t build audiences for item-level data. I used to build these audiences at oracle (there are other posts in my history about visa audiences). Geolocation is not very accurate from gps, so unless the store was off in a field by itself that’s not what happened here. The only real way to avoid this happening would be to use a new credit card for each purchase, with a fake name/billing address. Holy shit, what a great phishing tool. Send people an e-mail to opt out of Visa Marketing at a vaguely long/confusing URL and ask for their CC# and PIN. The fact that this site is real makes it more convincing. Even better: flush your smartphone down the toilet. I mean, if you have to try and double-guess your phone to make sure it's not spying on you the game is lost. I don't even know what game that is. But it's lost. Or replace your phone with a one you can trust (Linux phone). https://calyxos.org/ and https://grapheneos.org/ both go part of the way. They're hardened, privacy-preserving Android flavors that work best on Google Pixel 3 - 5. CalyxOS emulates google services so you can use basically any Android app, while GrapheneOS goes further down the security hardening hole. You still can’t trust the baseband blob which has DMA access on most devices. These two devices do not have DMA access (and also have killswitches): https://en.wikipedia.org/wiki/Librem_5 and https://en.wikipedia.org/wiki/PinePhone. Get a landline and answering machine. Receive only pager while on the go. Pagers are rather famously unencrypted, and a hospital near you is almost certainly broadcasting personal and identifying information about patients right now, in the plain, and you can easily pick it up with an SDR. > Opt out of VISA marketing > U.S cardholders may opt out of Visa using their card transaction data for VAS, a suite of aggregated data products in the United States. So while outside of US, I don't get the perks like cashabacks and no privacy either! Also google may read your email (if you are using gmail) - which contains your bank receipt (so seller), time and amount. https://support.google.com/mail/answer/6603?hl=en > We will not scan or read your Gmail messages to show you ads. They've also been asking for birthdays lately, obstensibly to verify age, but with the small print that it will also be used for ad targeting. But don't worry, they say, you can control how your information is used after you add it. On that page, the only option is whether to show the birthday publicly or not. There is no option to disable use for targeted advertising. Oh yeah, and Google frames asking for a birthdate as being "in order to comply with the law". They are deliberately ambiguous in order to imply that it is me who could be breaking the law, rather than Google. Also, the law only requires verifying age, and doesn't require storing the birthdate afterwards. That one is entirely on Google. So overall, my trust in anything that Google claims is rather low. You may not like the bevahior, butlt there's no indication of dishonesty there. Quite the contrary. If you are referring my my description, then there absolutely is dishonesty. The notice deliberately implies (1) that is is a legal requirement on me to provide a birthday, and (2) that I can disable the use of this information for ad targeting. Neither of these is the case. Therefore, dishonesty. If you are referring to reading email for ad targeting, you are correct that dishonesty in one area doesn't necessarily imply dishonestly in another. However, it does mean that a person or entity loses the benefit of the doubt, and must have independent verification of their claims. No, they'll scan it for other reasons... I don't trust Google. They are evil. What other reasons? may be to build your profile (still not showing ads), but for potential future product like social network or video platform that will show you recommendations based on your profile. Not like Google has been fined unprecedentedly large sums numerous times for deceiving users and abusing their info. thats good to know but they don't say they don't read your messages (and keep your profile) for other reasons other than ads. I remember i got a message in google search saying you have purchased this product - not sure of the year, but they were clearly reading my mail then..[1] [1] https://www.wsj.com/articles/google-to-stop-reading-users-em... Amazon went from showing every item in order confirmation emails, to showing none. That tells me they don't believe Google's promises either. Google isn't the only company that might read your email. Also, hiding order info is a way to push you back to the store to engage in more Amazon ads. That's great and all, but they literally used to. Horseshit, they were 100% doing that. My initial response out loud: Holy fuck. This exists? All valid suggestions, but at the same time the burden of this ought not to fall on the consumer. Additionally, even though a small number of individuals may have the motivation and technical ability to opt out of everything, they're still trapped by the network effect of everyone else doing it. Interesting one! But this is only for US. Is there something similar for Europe? (And for Mastercard as this is what my bank uses for my debit card) Instead of a list of instructions, it might be nice to have details on how all the things you mention actually work... That would likely be a much lengthier post with lots of detail. So much that the extent of surveillance would be lost to the reader. Are you saying that Google collects and uploads your location data (GPS and cellphone tower ID), despite opting out of data collection on Android? I might be naive but I don't see how the CC company would have the list of items you purchased. Technically the system is designed such that the CC company knows nothing of the receipt and the merchant knows nothing of the buyer. If you're using a store card, the merchant == the CC company and so knows everything about you anyways. If you're not using the store card, the merchant probably has an agreement with the CC company to share the information, so the technical implementation is irrelevant. Is there an intl equivalent? > Better, get a de-Googled ROM Which means no push, breaking an absurd amount of apps. Or better yet, use an iPhone. Then you can use your GPS. > disable GPS Is there no way to get GPS location, without sending it to Google? As I understand, GPS positioning does not require the phone to send any data? Use an iPhone? This only works if you trust Apple instead of the firm you're running from. But it does "work". iPhone is the only phone besides a GrapheneOS phone with an intact security model worth writing about. Not to say that any organization (eg Apple) is trustworthy to an outsider, but at least Apple makes a lot of money upfront from the device’s price tag. Their incentive is to not annoy their rich & powerful customer base with privacy violations. > Their incentive is to not annoy their [...] customer base [...] Apple knows how much they can get away with annoying, that's why they can push updates that slow down your phone, or make devices less repairable. Privacy is trickier though because it's based on trust not annoyance and it doesn't take much to lose it. I've already lost trust in Apple. What I do trust is that 'privacy' is currently working for Apple to increase their market share. It also conveniently keeps data away from competitors. March 2020, heydays of coronavirus paranoia. I came back home from somewhere, put my keys onto the dining table and went to the bathroom to clean up. My girlfriend, upon seeing the key-chain on the table started reproaching me for being careless about hygiene. When I returned from the bathroom I saw her washing the key-chain in the kitchen sink. This time I got angry and asked how come she hadn't thought that the usb memory-stick attached to the key-chain would be destroyed when being washed. I dried the keys along with the usb-stick, sat down at my table, opened up Facebook only to be greeted by an ad on top about water-proof usb memory sticks. I felt a chill ran down on my spine. Unfortunately, though this is an excellent story, this is just an example of a bias known as "frequency illusion".
It happens with a lot of things, like seeing the clock at 11:11 more than you do at 11:09. Or seeing lots of your make/model car but being blind to the hundred of other variants on the road. How many times have you opened up your laptop and not seen a Facebook add for something you just did, or something you discussed? You'll never notice those occasions. Most people don’t see completely irrelevant Facebook ads. Frankly, Facebook and their proxies always speak in meaningless nonsense about everything. If you asked Zuck if he ate kittens, you’d get some reply about facebooks mission and why cats are important. For some mysterious reason, all explanations for the “Facebook is listening” phenomenon are uniquely cogent, clear and dismissive. Personally, I have zero doubt that a downstream “partner”, data provider, or affiliate is processing audio data of questionable origin for ad insights. Call center companies with tight margins do it, why wouldn’t an ad company? > Most people don’t see completely irrelevant Facebook ads. Most people don't NOTICE the ones that are, either. I understand you have used Occam's razor to come to this conclusion. And its a perfectly valid point. But, this particular story has been repeated so many times around me that I am genuinely suspicious. But alas, the only way to know would be to look at the code. And even then we might not understand because its a blackbox type system which is ill understood by even its designers. It's actually possible to evoke some interesting responses from the algorithms by reducing the amount of data input. For example: When I set up a new facebook account for my mother (at her explicit wish), she had no friends or interests marked yet. Facebook showed her some random ads and posts. During the setup I was scrolling through her timeline and my phone beeped so I stopped scrolling for about 2 seconds. The post shown was a random post about some fish. When I picked it up, I saw it quickly replacing the next random post with something about the same kind of fish. So evidently it even looks at how long you look at certain content to determine your interests. I suppose it is possible to derive other algorithmic determinations using similar methods. > So evidently it even looks at how long you look at certain content It does. Instagram constantly sends back telemetry including your scroll position, which can then be used to determine what you were looking at and for how long. Scroll right past an ad? you probably won't see it again; the algorithm knows it didn't have an impact on you. Meanwhile, spend a few seconds reading what it says, and this teaches the algorithm that you are interested in similar content. How is it that no such scandal has been uncovered? Surely by now some hacker would have been able to prove that a phone is recording, sending to server, processing, and returning relevant ad. Or surely someone would have come forward or whistle blown by now. So I'll quote Hitchen's razor for you: "What can be asserted without evidence can also be dismissed without evidence." Many have tried. Steve Gibson (of GRC fame) did some wiresharking around one of his Amazon devices and found no abnormal networking traffic when he was talking to it, vs not. Alexa devices have been extensively and repeatedly shown to not be "passively listening". The same cannot be said for phone apps. Untrue. I am pushing the boat out because I rely on my memory. But there were reports from Apple contractors about what they heard on Sirri. It is always on, always listening. > But there were reports from Apple contractors about what they heard on Sirri. It is always on, always listening. These 2 sentences may not necessarily need to both be true. As I recall, one could opt in (or was it opt-out?) to an Apple program to upload bits and pieces of spoken word for its people to parse "humanly" for it to improve its speech to text. I'm no Apple fan, but I'm not sure one implies the other, here. I have acknowledged that my reasoning is less sound than the occam's razor, and I didn't really assert data impropriety. So calm down. But about your first point. I don't think even the designers and maintainers of this blackbox understand the system. Looking at it from that point of view, the chances of a hacker finding proof for this is pretty low. The thing is you can disapprove one piece without understanding the whole system. It would be pretty easy to show that a) sound is not being continually recorded and streamed over the internet and b) the device is not using enough processing power to decode speech. Both have been done, so this is veering into conspiracy theory territory. FWIW, streaming voice over the Internet isn't required for this attack - all the software needs is to send a few bytes long tag indicating the topic of an overheard conversation. The processing power required for this isn't big either - remember that 12+ years ago Microsoft Windows shipped with a speech recognition system that was in many ways better than what the phones currently offer, and worked off-line and with almost unnoticeable performance penalty. And if you're interested in probabilistic reporting ("there's 86% I've heard a word matching this tag in the last hour..."), you can relax performance requirements even further. So, out of the things you mention, the only somewhat convincing piece of evidence would be that the apps in question are not accessing microphone in the background. My dude! we are talking past each other. I am not asserting data handling impropriety. That is not what concerns me. What concerns me is they are letting these black box systems emotionally manipulate me. Why would Google be recording your mic and using it for ads where they would just be caught for doing it? I mean it's completely possible. But more likely just confirmation bias. Speaking of Occam's razor, we should just dump modern "technology" (smart phones, smart TVs, the web, IoT, even feature phones were no good). There's actually nothing hard about the concept of a mobile phone, it's just a computer (or could even be a simple PCB) with a mic and speaker. No need for "secret sauce" standards such that nobody can tell if it's secure (I mean it isn't, the bugs just get patched every week, day, nanosecond, whatever). Hell, you can even make a completely open and simple (even more important than open) phone communication standard and charge 1 billion people tens of dollars per month to use your network and become the richest person on earth. edit: I mean facebook, or whatever (also facebook would have to gain access to the mic [maybe facebook has mic permission i guess, i am unfamiliar with smart phones]) Because they have "voice assistants" that have to be always on, always transmitting, because the software that recognises your words on your mobile phone needs help. Facebook has access to your mic if you ever use it for its voice com functions (do not do that) and do not explicitly remove the permissions to access teh mic (do do that). They have been caught several times. Thing is people give them permission to record through the mic so it is legal. Do not confuse legal with good, it is evil. Well, another approach would be to do some controlled experiments: Pick a selection of somewhat-uncommon products. Get some volunteers to set up Facebook accounts on clean computers and phones with no adblockers. Monitor their incoming advertising messages for 2 weeks. Then randomly assign the products from the first step to the volunteers, give them information about the product on paper and ask them to hold verbal conversations about such such products. If they start getting adverts that happen to match the subject of those verbal conversations, something is going on. The "11:11 on the clock" story has also been repeated by millions of people for decades. That many people fall prey to a cognitive bias does not make it any less of a bias. You need to default to uncertainty. It’s not proven that it was coincidence, but it’s also not proven that it isn’t. Sometimes you never do find out what happened. Yes, it is a common cognitive bias. > But, this particular story has been repeated so many times around me that I am genuinely suspicious So, one meta-step up in abstraction? People "notice" these these things which they talk about and now you're especially sensitive to hearing them? This probably could explain most people's accounts of this, but I've been approached by companies who offered large lump sums to include their SDK which required microphone access in our mobile app, in order to fingerprint what our users were watching on TV while it was open, nominally to see what ads they were seeing. I wouldn't be at all surprised if they or others were going a good bit further than that and trying to run speech recognition on overheard conversations, unless it's illegal somehow. AdTech is frankly a revolting industry. I don't buy the speech recognition, nor have I seen it offered. But the tv 'recognition' is a big part of selling ads on connected tvs, vizio, roku etc. Bullshit, Facebook was found around 2015-2016 to be draining iPhone batteries with background audio sessions. While they may have gotten more efficient with their methods it wouldn't be surprising if they were still recording audio. There's a moral hazard that incentivizes any company that can do so to bug user's homes for advertising purposes. IMO it should be illegal. I doubt it though, on Android 11 it now tells you when your phone is recording audio (I see it during a whatsapp call for example) and as far as I know iOS has something similar (an orange dot IIRC). So they would be caught out pretty quickly if they did this. I'm sure they did it before though, ultrasonic identifications during TV ads etc were really a thing. My issue with the whole idea of background recording for advertising is that it would be incredibly costly to store this data, transcribe the audio and turn it into anything even remotely meaningful for advertisers. I also don’t know a lot on this subject so if anyone has better info that’d be great. You don't need to store the data, just transcribe it. That's basically the business model for Siri, Alexa et al. If you're worried about cost, just offload the work to the cell phone and accept the less-than-100% transcription. The only reason I don't think the big players are doing this _is_ the potential for scandal. Random apps on the app store that ask for a million permissions, on the other hand, are probably doing this. It only takes one clever hacker looking to make a name for themselves. With that said, there are plenty of cases where companies _were_ caught spying, so maybe it's not so cut and dry. You can easily process the audio on the fly and reduce it to a probabilistic estimate of whether a tag from a predefined topic set was present in the conversation. Doesn't need to be 100% accurate. You don't need to store the audio - just stream it through the recognizer. The output of such recognizer will be something on the order of 8-32 bytes (an int for tag, a float for probability, an int64 for timestamp), possibly less if one's clever - and it only needs to be stored until the next opportunity to send it out. Also: people seem to be looking at modern speech recognizers on their phones and wrongly concluding that speech recognition in general is very compute-intensive. It isn't, if you're willing to make some sacrifices on accuracy and generality, and to do it locally instead voice data off to a cloud somewhere. A proper benchmark here isn't Siri or Google Assistant - it's Microsoft Speech API, as shipped with Windows 12+ years ago. > store this data, transcribe the audio and turn it into anything even remotely meaningful for advertisers I disagree - even shitty, low CPU on-device transcription could give a signal to advertising algos. I doubt this is being done, but it is definitely within the range of possibility and wouldn't even drain your phone battery that much. All is needs to be is a list of keywords associated with your advertising profile. Purchased a hard kombucha at Whole Foods last week, Ever since, about 1/3 of my instagram ads are for it. Never had an instagram ad for it before. Maybe the subtle influences that led you to buying such a drink in the first place are directly related to increased advertising for them. Also Amazon has your Whole Foods purchasing data, so that probably trickled down somewhere. Technically my girlfriend purchased it with her Whole Foods/Amazon account, and she has not seen any ads. The first part of your comment is gaslighting. The second "trickled down somewhere" is the point. A few potential reasons: - You fit the demographic of Kombucha drinkers in your locality - You visited a Kombucha blog/website recently that used retargeting to deliver an ad to your Instagram - An initial ad that caught your attention and Instagram used “dwell time” to determine that the ad is relevant to you Good points. I do fit the demographic, I have looked up pages related to Kombucha in the past (thought not in the last 6 months), and I did dwell on the first ad in amazement. Still, I got home from the store and started seeing the ads immediately. Have you spoke with someone about it? IOS and Android can easily analyze what you say and send relevant keywords home. This is very evil genius in a way that they do not send your voice feed neither your full sentences but only keywords that the law describe as "metatags" that courts found no to be an abuse of your 4A in the past. In fact, you didn't even have to be on the phone. You could just come home and told you wife what you bough. That would be enough to send keywords and know what you maybe interested in. I know for fact my cable box (Spectrum) is listening and analyzing to my conversations. We used to talk with my wife about the most crazies stuff and less than 48 hours, Spectrum TV, Sling and YouTube would inject relevant ads. Some were extremely home made and amateurish but always spot on. Do an experiment in home. Talk about something you dont have or is irrelevant to you. For example if you have no kids start talking about them. Use keywords like "our first child", "baby sitting", "hospital", "giving birth", "baby shower", I bet you less than 48 hours later your TV will be interrupting you with ads related to baby products; ads you have never seen before. Do you have any evidence of iOS analyzing and transmitting keywords? It's one thing to say it's technically possible and another to say it's happening. Honestly speaking, this is more scary than them actually stealing data. Sure. Except in the last three years that "frequency illusion" has been happening to me with a... growing frequency. About every 2-3 months, Facebook shows my wife an ad for some completely random shit we're sure neither of us searched for before or mentioned to anyone else. I would agree with you last decade. This decade, I have my doubts. There is great statistical power in these ML models, in many cases the "random shit" will become the topic of conversation due to shared social factors that can be predicted, you simply neglect to recognize all the times the modeling failed. While this is indeed a possibility, your certitude is unwarranted. I don't know how many times I internally chuckle when I glance at the clock some time before I go to bed and it's "21:12"; a meaningful number to me as the "2112" album and the band Rush was a big part of my youth. That, and I tend to go to bed between 21:00 and 22:00. But I don't attribute it to anything but me being in a position to look at the clock around that time, and I haven't wondered if I see it any more than 21:09 or 21:30. Would be an interesting histogram, if nothing else. I have the same for Rush 21:12. Recommended. https://www.youtube.com/watch?v=AZm1_jtY1SQ No it's not. There has been more than one instance when me or friends talked about topics and a day later we get weird ads for it on Instagram. Adtech is creepy and dystopian. As what % of ads that are unrelated to anything they talked about? For me it's 9:41 FB ad tech is rudimentary if it only showed you ads to replace your USB stick and no dating sites. Hahaha As a response to those who asked questions here in the comments: When I finally overcame the shock, the very first thing I did was to ask her if she, or a guest, indeed searched for, or otherwise "input" anything related to usb-sticks or water-proofness into a computer system. The answer was no. I don't know what to make of it. I don't want to succumb to conspiracy theories of the sort that ambient sound is recorded by our devices at all times. Most plausible explanation is perhaps the one about cognitive bias. An explanation would be that, in the beginning of Covid, your scenario (needing washable USB sticks) happened to many many people. Excellent reasoning. I never thought of this but very plausible indeed. Couldn't your girlfriend (or any other third party who overheard your conversation) have searched for memory stick water damage before you sat down and opened Facebook? It doesn't seem too strange to me that advertisers send targeted ads for a certain product to an entire household if they think somebody there might need it. Only plausible explanation I can think of is that perhaps you or your girlfriend looked something up about drying a wet memory stick. This is an amazing story but I believe it is a coincidence that you just happened to notice more than non-coincidences. I say this not because I am especially skeptic or rational, I say this because a similar thing happened to me yet I know for a fact that it was a coincidence. It feels unbelievable yet 1/1000 events happen every now and then. All in all, if Facebook knew you were a technical person it’s not unlikely that an ad for a water proof usb stick would be relevant to you. I don't know the timing of the events you describe, obviously. Is it possible that after you got angry at your girlfriend, she searched on the web for "waterproof USB keys", thereby associating your IP/system with that search? Did you order the water-proof usb memory stick? It might have contained a backup of your keychain memory stick. ;) We've (my wife and I) had a few odd ones like this too. That being said, no-one has substantiated this - which, to me, doesn't mean as much as people thinks it does. Suppose you were building this capability. Would you necessarily leave it on 100% of the time, and if someone started acting 'weird' around their phone ("hey, I'm sitting in a lab, and someone is just talking to me a lot") it might be a good time to turn off the capability. Plenty of malware knows to turn itself off when someone has Wireshark installed (or a number of other "tells" that the malware can get that you might be running on a security researcher's machine). Even simply running microphone-based data gathering infrequently might be enough to confound a journalist or researcher with limited time budget. Reminds me of Volkswagen cheating function: if it detected the car was on the lab, it changed its behaviour to pollute less. So... it's very feasible for any other company to do a similar thing. Now otoh as far as I know, microphone usage is not cheap on mobile devices. So either these apps are doing sporadic on/off recording or we would see a strong impact on the phone charge life. What is the hypothesis? FB listening through a phone? The (closed?) Laptop? Alexa? I've put normal USB sticks through the washing machine, retrieved them from the dryer lint screen, and had them still work! (don't recommend it of course) I wrote it elsewhere in this thread, but something similar happened to my wife an I about "babies" . The interesting thing was that she (whose phone had the FB app installed) got the ads while I (who have never used FB apps) did not get the tailored ads. And we both live in the same place and share the same internet The straw they moved me to Signal was a Facebook video chat I had with an acquaintance, who mentioned that her sister was working at a ketamine research lab. When I closed the call, my FB timeline was full of ads for ketamine. This happened yesterday, bought some margherita pizza at 3pm, was talking about how much a little pizza oven would cost to make it crispy and if it would come out the same. At 6pm a youtube ad on the tv showed us a pizza oven. we need better legislation. advertising is a cancer on the entire earth. Sounds terrible. Did you search for "pain" or "arthritis" or "migraine" or something like that? Visit a page devoted to your condition or symptoms? Could be whatever led you to get Voltaren in the first place also led you to issue search queries or visit sites in a way that let Google infer you might be interested in Voltaren. Or even just search the pharmacy website to see if that branch had it in stock? I would think something like this would be the most likely culprit. I suspect all the people putting this claim on the same level as "my phone is listening to me" conspiracy theories are living outside of the USA. One of the first things I noticed after moving to America was that I was being served ads for oddly specific in-store purchases. I checked my bank's terms and discovered that, sure enough, they were sharing my transaction history with "non-affiliates" so that they could market to me. From memory, they did offer opt-out methods for limiting the amount of data that they shared. Maybe you could see if your bank offers the same? Well the other problem in America is the payment rails are very primitive. How does your credit card company know which items you’re buying, when the payment description will be something cryptic that you can only sometimes even match to the store name and that’s it. It’s not like your credit card company gets an itemized receipt of your purchases. I’ve actually worked at a company that was purchasing this data from banks, it was all anonymized and we were looking for trends. Maybe there are other companies that are able to buy the pii data and use it for marketing, but I think there are better, simpler sources. The stores/brands themselves can sell the data about their customers, or they are passing it to google to run targeted ads on their own customers and then google now has that data too and can use it for other things, etc. At least some credit card companies support (in some cases) getting an itemized receipt - I know I've been in my AMEX account and been able to see the full details of a purchase. It needs the credit card company, the payment processor, and the merchant to all have compatible systems that support it. I know I've seen it advertised as a feature of some business cards. Your phone is listening (or at least some are) - I thought it was crazy until I was corrected by https://twitter.com/thezedwards who actually helped build one, reformed himself, and now does pro privacy work. Did he tweet about it or? Yeah, I honestly couldn't be arsed to search in the twitter hose but he specifically corrected me on the topic. edit: and to clarify his comments were mostly that the data is not realtime, but the idea that audio recorded is then processed and within a day or two was much more realistic. Tangentially related, for the first time ever I saw Gmail losing its anti-spam game. We were doing some home-modeling and we went to Home Depot sometime early this month. And... some entity somehow discovered this. And then all of a sudden I started getting spam emails related to Home Depot's/home rebuilding. The spam emails successfully pass through gmail's filter because they seem to emanate from aol,gmail,hotmail,yahoo etc. email addresses. Here's an image: https://i.imgur.com/KqIN6oB.png I'm about as impressed as I am mortified. I thought I had my opsec down, I was using noscript, I use throwaway email addy's where I suspect I'll be spammed. But I was had too. This Hecatoncheires entity is getting ever-larger. It knows a lot. It knows me well. I have seen evidence that it knows about the medication I take, the insecurities I have, my half-baked aspirations and plans. I feel defeated at times when I see its knowledge of me manifested in the ads I am shown, I feel confronted because at the time of this writing I don't know where this leak occurred, I don't know at what vector exactly I'm being had. Google used to show personalized ads based on your emails but that process is supposedly stopped. Now Google reads your emails still to filter out spam and sort it into its default folders for promotions etc. Also I guarantee I went directly to a website for a product, a vitamin, which I never searched for and purchased it and then received ads for the exact product and brand I purchased for the next week on Google searches and other Google ads and that was after they supposedly stopped personalizing ads. I don’t know if it was the credit card company, or Google analytics being installed on their website, or then just selling my data but it was obvious that someone was sharing my data and I wasn’t being told about it. Lastly just last week I had been searching for a bed on Google, a very specific California king bed so that I could try to find the lowest price. Literally the day after I bought the bed, my girlfriend saw that exact model of bed appear on her Facebook ads. She had never searched for the bed or any bed but was browsing from the same IP address as me so I assume and that’s how they targeted her. https://www.google.com/amp/s/variety.com/2017/digital/news/g... It's ironic that you provide a Google AMP link. Try without: https://variety.com/2017/digital/news/google-gmail-ads-email... There are so many possibilities here. There is the stores you visited and the Credit card company involved along with anyone of the ad tech partners who have a cookie on you tied to your email. Now how they know you bought X 1. Say CC sells data to say Bluekai (now salesforce). If you bought a hammer, they need not have known it was from HD, a middle man might simply be bidding for anyone categorized as shopping for home improvement goods and hoping to cash in on HD lead-gen/affiliate $$$ 2. You likely searched online for these at some site and probably just don’t remember that you did. The only thing that will get rid of this is to ban/regulate “affiliate” marketing (so shady companies who don’t follow rules can’t cash in), because so long as someone is willing to pay to bring sales, it will happen on way or another. Google Maps is a huge vector most people don't think about. Seconded.
Visited the dentist recently. On my way I looked up directions in google maps, then for a week had dental insurance adds. This one is obvious though. That was on iOS with it’s pretty strict location tracking rules etc. I’d be interested to see if you can get it to show you adds just by visiting the dentist (and not searching) on a vanilla android phone (IE google’s location history on by default) Old school internet ad tech worked around what you are trying to do. We were doing this in 2003, before Google started up AdSense and well before acquiring DoubleClick. The way it worked at [former employer] was, we had a lot of digital properties. Every digital property collected analytics on all visitors. All that analytics got post-processed and cross-referenced until we could form a "profile" on every visitor. Because you leave a teeny tiny trail of information everywhere you go, we cobble it all together until we know who you are on each site. The probability just gets higher as we collect more data. And we'd collect data from everywhere - e-mail marketing campaigns, ad traffic on partner sites, user profile data, web surfing habits, and buying access to privately maintained databases. Even if everyone wore a mask and black clothes everywhere they went, surveillance cameras still capture height, gait, mannerisms. Watch long enough and you know "Gait #24434 mannerisms #593483 height #933 goes in/out of this residence at these specific times, goes to this supermarket, goes to this nail salon, sometimes goes to a house somebody else seems to live in". Maybe it's multiple people with the same gait, mannerisms, height - but in the same neighborhood? In any case, it doesn't matter if they are all different people as long as they behave the same way; we market to them the same. Your entire life is just a string of digits in a marketing-recommender algorithm. The one that kills me inside is all of the student loan scam calls I get. I see straight through them, but it makes me think about all the people who don't. Ebay sends me spam emails every day. Technically I guess it doesn't count as spam because they originate from ebay.com and I "consented" by signing up an account with them, but to me they're every bit as annoying and toxic as bona-fide spam. They have to give you an option to turn it off usual a link at the bottom of the mail.
However, never click on such a link from a real spam mail as that would tell them your email is read and you get more spam. It might be that you are just noticing the ads now that you bought the product. I read about similar observations recently. Might be a cousin of frequency illusion https://en.wikipedia.org/wiki/Frequency_illusion?wprov=sfti1 I doubt Voltaren is advertised commonly enough that he got ads before. I no longer have a Android phone, but too frequently I would buy something offline and have the item follow me - including impulse buys and things that I definitely didn't look for online. It happened with things I would talk about as well on occasion. I joked in front of my phone about visiting Greece, and a few minutes later auto-suggest in Google offered me "How much.. [is plane tickets to Greece]" Keep in mind that he is some guy on the internet. There are lots of people on the internet. While it's unlikely for it to happen to him in particular, it's not that unlikely that there is someone on the whole internet that it happened to. Now I'm not saying that it is a coincidence, merely that as far as I can tell it could be. I had the same experience with my prevous phone - a Samsung. Talked about a product that would normally be the furthest thing from my mind with a friend who took an interest in it. Next day, voila, the whole internet is plastered with ads for this product. I switched to an iPhone. Gaslighting in the Information Age: You just imagined that ad started following you around. Oh come on. It's a documented effect. It's the same thing as when you buy a new car you suddenly see the same or similar vehicles everywhere. Not every instance of someone providing an explanation for something you don't understand is "gaslighting." Who says i "don't understand" it? Just because it's an effect doesn't mean it's the explanation. By the definition of gaslighting being pretending you're imagining something that's actually happening, this is exactly what that is. Just because you don't understand gaslighting doesn't mean that everything that you don't understand can be explained away in terms of documented effects. Things happen and you can't explain them...the world and other people's opinions don't conform to some list of effects that you know about. You know this: https://news.ycombinator.com/item?id=26970960 I agree with you that the term gaslighting is overused but that doesn't mean there aren't legitimate uses of it that you can also utilize. It's been a few times now where I've talked with my wife about some new product (physically, in the room) and she starts seeing ads about it. I thought that was the explanation too, but it's happened too many times for comfort. I know my devices are (probably) not listening, but I can't explain it either. Neither of us searched for the product or saw it online or anything, we just discussed something and got ads about it a few minutes to hours later. > It's been a few times now where I've talked with my wife about some new product (physically, in the room) and she starts seeing ads about it. I thought that was the explanation too, but it's happened too many times for comfort. The wierdest instance of this is I told my wife her father should consider geting those fixed bridge dentures, next day I start seeing all-on-4 ads on the phone. I asked her if she looked it up (to rule out IP tracking) and she said she hasn't. It's a very random thing to advertise to me, I'm not the target group, I didn't look it up. A lot of it is IP tracking - I'll start browsing for guitars or some other random stuff my wife has no interest in - she'll start seeing ads for it. There are many sources of errors that people have described in other comments. The proper way to deal with this is a blinded experiment. Preparation: 1. Get two identical phones, one that you use, and one that has a dead battery. 2. Fix a set of product-categories. Experiment: Every week, 1. Label the phones A and B. Use a coinflip to decide whether the working one is A or B. Record which it was. 2. Hand the phone to someone else. They exchange the labels for 1 and 2. If heads A=1, if tails A=2, and record the coinflip. 3. Get the phone labelled 1 back. Neither of you know whether it is working or not. 4. Randomly pick a topic from the pre-fixed list and talk about the topic near the phone. 5. Let the other person remove the labels. 6. Pick out the working phone and go about your day. 7. Write down whether you see ads relating to the topic, yes or no. Analysis: Join the records, to see which weeks you used a working phone, and if those corresponded to seeing ads. I work in dental marketing and you 100% are in the target demo for All-on-4. It’s a very popular/trendy service and is being advertised heavily now because it’s profitable, (relatively) easy to do, etc. Good target markets are: Grown adults with $$$ who either don’t have teeth or know someone who doesn’t have teeth (likely parents/grandparents/in-laws). This is basically every upper-middle class adult. More people than you think are missing their teeth. Jesus. I see dental protesis ads around the time when I see my parents. I don't have the time to set up the things for them so I'm sure their cheap Android smartphones are surveillance blackholes. What other ads do you see when you’re around them? Another possibility: switching the cause and effect, e.g. maybe you received ads for fixed bridge dentures and didn't notice consciously (how many ads do we gloss over each day "not paying attention"), but later brought it up because the mind assimilates ads subliminally (arguably the whole point of advertising). This is perhaps even more creepy than just "phones listening in", but it's not an explanation I hear very often. This is a documented effect but I forget the exact name of it so I'm having trouble finding a scholarly article about it. But it's basically how advertising is "supposed" to work from the advertisers' perspective: they get their products/brand to the top of your mind for a given subject. It's possible - but this was in relation to a discussion she started, and why show those ads to me in the first place ? You could certainly test this, just have a conversation every day about something random. Pick a snack food, something with a heavy advertising budget, and near your phone start saying things "man I really want some (snack food) right now." If it's listening, you'll start getting ads specific to that snack food, best to try it with a bunch of different products to try and find a pattern. Yeah but neither of us had searched for that or anything, and I use DDG and uBO so it's not likely it'd be tracked. A friend demonstrated me this with her Google Pixel. We talked for a bit about a very conspicuous topic in presence of the phone, and the Google app (which shows a news feed when you open it) started showing articles relevant to the topic within a few minutes. At that point I believed her that her phone is listening, though I didn’t make a big deal of it because she did not make an effort to configure her phone not to. I doubt they have such a good recognition model for Greek, plus my DNS blocks Google at that level, and I have a Xiaomi phone. Not that it's impossible, but it's less likely, plus the battery would die quickly. I see. We talked in English, and there was no blocking. You don't notice all the times you talk about something and you don't see relevant advertisements. After talking about it you're primed to notice it more. Additionally this isn't isolated - you could be talking about it indirectly due to advertisments being out there (e.g. someone else sees an ad, posts / talks / youtubes about it, you talk about it and then see the ad). Ads are getting more targeted and getting closer to the kind of things you would talk about based on your interests and data that networks have collected about you, but we are still pretty far from continuous ad surveillance. > I know my devices are (probably) not listening Not thinking this is happening either. But just to speculate on a fictitious scenario.. Given a shady company, maybe even outright involved in illegal practices, where employees employ any surveillance tech they can lay their hands on. All in order to collect as much personal information as possible, from as many people as possible. As such, they won't shy away from breaking & listening in and do subsequent speech-to-text information gathering (e.g. via some Ad-obtained Windows malware, or a malicious mobile app). They trade the collected info on the data markets, selling to anyone who'd pay. Wouldn't it be likely that this data then indirectly ends up at Google, so they can indeed target - in this case Voltaren - ads to you? Also: If any illegally obtained information enters the data markets.. won't it be 'whitewashed' automatically as it is trading hands? Sure, but I don't think they're listening from a technical standpoint, because the battery consumption is much less than an active network adapter would consume. They could always either compress the audio or do a speech to text (looking for keywords rather than caring about getting the whole context correct), and batch upload the results on an interval (like when checking for email or app/system updates). That would still absolutely kill the battery. Don't the latest designs, ARMv9, make provision for battery-efficient speech-recognition models "at the edge"? If it's not here yet it will be soon. Id reckon you can boil the model down to a very small one to extract some keywords and thatll be pretty good already. Just having the ability to hear if someone is talking would take very little battery, to consequently turn on the top-10000 word model would still be barely noticeable on these powerhouses of phones we got, I think. Haven't tested it, though. Once a minute (or five, ten, whatever), turn on the microphone for one second. If voice detected, record a bit and process. Doesn't need to be always on, and as a feature missing keywords sometimes adds to the doubt that it exists ("I said 'pfizer' and got ads, you said 'pfizer' and didn't, must be something else). Doesn't your phone sometimes stay on charging for some time? I know my devices are (probably) not listening, but I can't explain it either. Neither of us searched for the product or saw it online or anything, we just discussed something and got ads about it a few minutes to hours later. It's probably statistical to a certain extent: people of your specific demographic are interested in a certain thing, and you are talking about it the same as all of your peers are, and a statistically significant amount of your peers did Google for it such that now Google assumes that anyone in your demographic will be interested. Of course that only metas the problem up one level, which is that Google knows enough about you to do this kind of analysis a) on your cohort and b) on you. > Google knows enough about you [to not even have to bother listening] Right. This was is actually much more alarming to me. Whenever this topic comes up in conversation I point out that the fact that the most attractive-seeming explanation is “they’re listening”, but they actually _aren’t_, should have one even more concerned. > I know my devices are (probably) not listening, but I can't explain it either. How do you know? It seems like one of those things that are simply to hard to keep secret. Implementation would require way to many people to keep it secret. I’m also not sure if it make finacial sense to implement, given the large number of more easily metrics available. > It seems like one of those things that are simply to hard to keep secret. I used to believe that too. You might call it the unwieldy conspiracy principle. But I'm not as certain of it anymore. Things like the Snowden revelations might seem evidence for the principle but I kind of see it the opposite. For years, thousands even tens of thousands of people knew about that and they still kept it secret. It's entirely possible it could've gone on for years more without a particularly conscientious person happening to be let in on it. The same goes for the Pentagon papers. And COINTELPRO was only uncovered due to people actively breaking into an office and stealing records. Who's to say if stories like those are inevitable conclusions that befell all the major conspiracies worth writing about in our recent history or if they are just some portion of ones uncovered. Similar maleficence has persisted in the private sector too. I'm not saying for sure they are listening in but at the same time, I'm not sure I buy unwieldiness as a surefire principle demonstrating it is not happening either. Network traffic and battery usage monitoring. It might not be your mobile devices listening. Alexa? Smart TV? I've seen examples of this too, and it's downright creepy. At the same time, I love my Google Assistant. Yes, I know. I'm the product. In America, some stores seem to share rewards member information to product companies so they can target their ads on other platforms. For example, I paid for a very specific candy from CVS using my credit card, but used my partner's CVS rewards member number and they got ads on facebook for that candy while I haven't seen a thing. ANY bonus card is basically paying you to be tracked. It’s the core mechanic. Even here in privacy conscious Germany the largest bonus card, payback Punkte, is simply giving you a 1% back just to get you to log your own purchase. Why else would they do it? Because they like you? Whenever places wantba phone number for ad and/or discount stuff, use: (Local area code) 867-5309 There's always an account, and it's a 100% gamble if this purchase you get something. What’s the significance of this number? It's a popular song wherein the artist doxed some gal named Jenny. Just google that number It's Jenny's. This feels like it should be illegal if it isn't already. Why? I'm not disagreeing with you. I'm actually inclined to agree. But this hand-wavy "this should be illegal!" type of comment is extremely common on these threads and is completely unhelpful. All uninformed data sales feel icky to me, but data sales that involve actual payment history even more so. There's incredible amounts of personal information int he stuff you buy for your day to day life, ranging from religious items to medicine, and coupled with an account from a party like Google or Facebook, this pretty much completely deanonimises the otherwise anonimisable internet profile. You can get a new internet provider and a new Gmail account, but your purchasing habits won't change and are easily mined. A real-life connection between an online account and the stuff you buy in physical stores crosses a boundary that I think should not be crossed > How does google know I bought Voltaren? > Is my bank purchase history shared with google somehow? Google buys Mastercard (if not more) transactions and ties them to your Android location history. https://www.bloomberg.com/news/articles/2018-08-30/google-an... Presumably that data would include time, amount, and vendor... but not item-level details. Right? There's something else going on here. Drugs often cost a very specific amount of money (When I buy drugs it's always something like 4.86e or whatever, not neat 4.99) so I assume it's easy to de-anonymize > neat 4.99 i get what you are saying, but calling a price ending in .99 "neat" feels very wrong It's in level 3 data. https://www08.wellsfargomedia.com/assets/pdf/small-business/... “For Level III data, only Mastercard® and Visa® corporate, purchasing, and fleet cards can qualify.” So consumer credit cards can’t get this. I'm not an expert on this, but I suspect merchants supporting level 3 data send it to the processor for all transactions, not just for corporate cards (if they even know it's a corporate card), but they only get the fee discount if it's a corporate card. Your credit card statement might not expose the data (or even get it), but the network can still sell it. I would like to contribute an anecdote which turned me from a "google is listening" skeptic to someone who turns their phone off as often as possible, especially during any kind of sensitive conversation. I'm one degree removed from this anecdote, but I have no reason to doubt its truth. A group of friends were on a road trip, driving for several days cross-country. These are university-aged young males, 20-23. None have any interest in starting a family any time soon. At the beginning of the trip, they agreed (verbally) to test if google was listening by discussing "nappies" intermittently, loudly and jokingly. They would only discuss nappies in person - everyone agreed not to mention this on any digital channel whatsoever, not to look up nappies for any reason, etc. That is, they deliberately excluded nappies from their online lives. They chose nappies specifically because they're completely irrelevant. None had ever to their knowledge been delivered an ad for nappies. None had ever purchased nappies or any baby product. Sure enough, end of the trip - ads for nappies. I would love an explanation more plausible than their phones were listening. >> I would love an explanation more plausible than their phones were listening. One of the three deviated and searched for nappies online prior to the trip. Rather than relying on external people to make judgement, you could test the hypothesis yourself: write on paper a phrase. Spend one week without ads and document all ads you see. Spend second week saying word N times per day. Also document all ads you see. Ask N people to do this and report your findings, then you might provide statistical insight and validate your hypothesis. Otherwise, who's to say one of those students didn't Google it before the trip? Does anyone have any ways to improve the design of the above experiment? "One of the three deviated and searched for nappies online prior to the trip." This is a hypothetical which was deliberately excluded when they decided to run the experiment. These are intelligent young people acting in good faith to test if they're being spied on. Why would they have googled nappies? I'm sorry but I don't find that explanation convincing at all. I agree. While they may have made an effort to control for not searching about nappies, they could have implicitly biased themselves in other ways. For example, one may have googled something similar without realising the similarity, e.g., "Baby Shark" (a popular song a few years ago) or such. In other words, nappies may be related to many other terms that they may have (implicitly) searched for. That's why running an experiment and capturing data (of searches amongst other things) could be more meaningful than anecdote from friends if a friend or such. Yes, talking about nappies a lot probably has effects on other aspects of one's internet usage. With massive data, google may well pick up these statistical trends. A similar performance to a perceptive fortune teller. Google can appear to be a mind reader. Apparently, walmart used to send targetted ads when the pattern for pregnancy was detected - which created problems where not all parties knew about it, so walmart disabled it. Another commentor's two week experiment might need to have you think about nappies for the first "control" week, to account for this bias. Also, note that "nappies" wasn't randomly selected, but suggested by the group. This choice and the ads may have had a common cause. e.g, Young adults concerned about pregnancy. It's true, there could definitely have been confounding factors and I wish there was a better record than their memories. I remain personally convinced due to knowing and trusting the involved parties, but agree that the anecdote doesn't (and shouldn't) carry much weight as objective evidence. This seems like something which privacy researchers might be interested in, and wouldn't be too difficult to run - I wonder if anyone here can point us towards any more formal experiments that have been run on this? Edit: The more I reflect, the more difficult the experiment seems to be. How does one recruit for an experiment, contact and instruct participants, etc., probably via surveilled email or messaging platforms, without creating data linking participants to one another? Do you ever get irrelevant ads? I certainly do. Multiply that by billions. You're going to find someone getting ads irrelevant to them. They could also have looked up something relevant to nappies, stayed in a house (and used internet there) where the owners have a baby, etc. They were camping so I think it's unlikely they got confused with an ad ID which was interested in nappies. For the sake of good faith I think we should exclude "they broke the rules". Frankly, my friends aren't that stupid. Recently I started ordering groceries online. I found the site "organically" but searching for products in the space. I found one which satisfied me and stuck with it. Some time later I start getting Ads in Facebook Messenger for the website. Yes, not totally irrelevant, but it's like seeing a billboard for the supermarket you're on your way to. That's just straight up ad personalization. Did everyone stop using the internet and stick strictly to cash? If not, is it possible that someone made a purchase or search that may have related to what people who need nappies might buy or search for, but didn't realize it? Today I browsed Google from my desktop PC about "Gundam" (the japonese anime) for about 1 hour. Pretty niche topic. Then when I was done, I closed all browser tabs, I unlocked my smartphone to check Instagram, and the second ads I get is a Gundam ad. I have no idea how my shadow "desktop" ad profile and shadow "mobile" ad profile matched. I share no accounts between my desktop and my smartphone : This must stop. If you log in different google accounts in private tabs, then any browser fingerprinting would immediately link them. Also, it's plausible that one of your contacts has your phone number connected with the email of your desktop google account. I think Instagram can usually figure it out from the Minovsky Particles given off by your PC for that short bit of time. LiveRamp connects all the “anonymous” identifiers together for a household. Third party SDKs also report your location to these services[0], which makes it trivial to track your phone to your location (or they could just buy that info directly from the carrier). Your home ISP's assigned IP is also in a database with your name and a unique identifier. So it doesn't matter what adblocking you use, they still know where the hits are coming from. All this data is traded around the ad "ecosystem" and integrated real-time, so it can be milliseconds from action to ad-impression. [0] https://www.nytimes.com/interactive/2019/12/19/opinion/locat... Because you aren't using an adblocker. Seriously, you should really consider uBlock Origin or similar. Google doesn't honor Do Not Track, so you should feel no obligation to honor their desire for you to look at their ads. It's always surprising when I happen to have to use devices that aren't my own, and there are ads. Disgusting! I have no sources at all, but my memory tells me that I've read that Visa, Mastercard and similar sell "anonymous" transaction info and that Google is their customer. I've been living under the assumption that Google could de-anonymize practically all that transaction info when they match it up to all their other info they track us with. Maybe I'm wrong? Visa’s audiences are merchant level, spend/frequency level. Ie “users in the top 10% of spenders at jewelry stores”. “Users who’ve bought train tickets in the past month”. Visa has very strict rules about audience size, and all the audiences are modeled. (Your criteria can’t target something like less than 20k users, and then they model that up to a few million users). In this case either the store, the pos/crm, or bank used his purchase data. Some payment providers, like WorldPay, have both online and real-world payment systems so you can imagine they could be passing back that type of targeting info. Usually when this sort of thing happens someone searched for something or a related term in the previous 30 days (typical retention period in “hot” storage for such features) and doesn’t remember doing the search. Most people, myself included, do so many searches so casually that we don’t remember doing it much of the time. Source: FB Ads and IG ranking for 7 years. Did you take your phone with you to the chemist, and did it have GPS or Wi-Fi enabled?
That wouldn’t explain the exact match but the product category, and choosing Voltaren feels like a pretty plausible coincidence given the category. IIRC this is the most probable cause. Not to be a conspiracy nut but it probably didn't help if you spoke of it out loud either Don't you use an adblocker? I could be being targeted with all sorts of stuff but I'd never know. Adblocker stops you from seeing the ad but not from google deanonymizing and linking your transactions to your search. Also lots of websites these days require you to disable adblockers to function. I don't use those websites. As others have explained, this is most likely your credit card purchasing data being sold, by your credit card issuer, to any interested party willing to pay for it. Yes, the data sold includes detailed product information linked to your identity. What I'd like to know is if the same happens when I pay with Apple Card, or when I use Apple Play with, say, a VISA card? >Yes, the data sold includes detailed product information linked to your identity. Not necessarily. I’ve only seen a few huge merchants sending level 3 data: https://paymentdepot.com/blog/level-3-data-processing/ Staples.com and airlines are the only ones where I can see the items bought on my credit card statement. Although it’s possible that some banks are not reporting that information on the statement, but I couldn’t find any more data on the subject, other than the fact that smaller businesses are not sending this information. I see Voltaren ads a lot and I mean really a ton since about two or three months. I purge my browser sessions daily and I notice that they reliably come after watching fitness videos (Training Pal and similar). I guess they target people with sports injuries. I'm also getting loads of Voltaren ads on YouTube. Apparently watching retro computing and cooking fucked videos is also linked to sprained ankles. I think Voltaren is just spending a lot of money and advertising with shotgun accuracy. The ad copy is funny - Voltaren, not just for accelerated healing, or something to that extent. Everyone I know uses it (or, more likely, cheaper generics) for pain relief, without any particular expectation that the injury will heal faster. So that's the claim they hone in on, as opposed to the thing everybody knows. Standard ad stuff, I'm sure, but it's interesting when you notice it. https://www.vanityfair.com/news/2017/05/google-tracking-cred... -- that's from a quick Google search. Even though the article says "secretly" etc...there is really no conspiracy theory-like secret to this and it's well-known that everyone sells data to whomever they can make money from. It's more like what user jonahbenton has explained in another comment. The makers of Voltaren are able to broadly advertise to anyone who might be interested in Voltaren -- they don't know specific users. But Google (or any other advertising provider) has access to info on who might be interested in Voltaren at present -- which might be decided based on various factors including your credit-card purchase data. If Google does wants to dig down, they probably can use various info to drill down to you specifically and that is what makes people rightly uncomfortable, but what I am trying to say is that in general they are not specifically targeting you for the ad -- but a broad category/bucket of "people who might be interested in Voltaren at present". One might say it is the same thing... I guarantee this type of tracking is going. And I'm sure that the marketing industry is aware that these tactics are running on borrowed time. Once the mechanics of how it's being done are collated by EFF type activists it will turn into a political narrative and action will be taken. Right now people are too confused by their strange experiences, doubting themselves and swayed by less outlandish alternative explanations. Sometimes the hooves you hear are in fact zebras not horses. The players in the surveillance ecosystem have shaped themselves into narrow forms that allow for plausible deniability. App makers, device makers, the monetization SDK providers, the re-targeting platforms with their Orwellian forecasting & optimization calculations and especially the data brokers each play their part in a division of labor as powerful as Adam Smith's pin factory. The pushback will come from the EU in my opinion. The U.S Big Tech file is going to be taken up with tackling the monopoly power of platforms for the next few years. In the meantime beware of free apps on your phone and look up how to opt out of marketing on your smart TV. Pay for sensitive items with cash. If your phone is Android use the Firefox browser with the uBlock Origin plugin. Prescription data, at least in the US, is not very private. Many entities know that you met a doctor and they know when the doctor prescribes. Between PBMs, subrogation, wholesalers, and other factors, marketers are easily able to de-anonymize your identity for targeting purposes. In my family’s case, my wife’s hospital admission and prescription was sufficient to correctly identify her as likely 10-12 weeks pregnant. Their confidence in that was sufficient to yield us a Fedex’d box containing congratulations and starter kits of enfamil, on her due date. Since they don’t read your records, just infer from events, they didn’t know that she had miscarried, and nearly died in the process. I know this, because Enfamil identified the list used to target her, and I bought it for my zip code. I also learned that my neighbor 4 doors down has type 2 diabetes, and has expressed interest in a BMW or Audi at the end of her then-current lease. (She went Audi btw) When people lecture you about various observational biases, you’re being paranoid, etc, they are full of shit. The marketing machine is way more wired up into everyday life than you can imagine. If you can prove this, at least in the USA, this would be a serious violation of HIPAA and severe penalties would apply to entities who disclosed, knowingly received, or paid for personal health information without the patient’s consent and used it for an improper purpose. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance... Lol. No. You can comply with HIPAA and “anonymize” in a manner that a marketer can use to retarget, especially by combining with other data sources. HIPAA protects you against receptionists gossiping and wholesale release of your records. Not much else. When your doctor writes a script, that data is in the hands of a data aggregation company before your pharmacist looks at it. Every pharma rep has a report card for each doctors prescription practices as a result. Insurance companies and others sell claim data in aggregate and so do downstream partners like subrogation services. Some states even shared Medicaid claim data to aid in targeting ads and analysis to fight opioid abuse. I don’t dispute that aggregated data can be sold, but there is a causal link missing between possessing aggregated purchase data and marketing to a specific person based on certain knowledge that an individual has purchased a particular drug. We need to be able to prove that. It's credit card purchasing data, which is sold and cross linked to your identity for advertising re-targeting. It is deeply invasive and should be blocked. It works like this. You go to a store and buy, say, a sexual wellness product. You then get targeted with ads online (search result ads, facebook ads, news media ads, amazon sponsored results etc) for the same product, or something related (let's say something embarrassing that you might not want other people to see). Other users on your same network or IP may also be re-targeted with the same ads. Credit card data tracking is a levelling up of surveillance capitalism. It is deeply intrusive. Not all card providers participate, but it is a significant source of revenue for them [1] [1] https://www.fastcompany.com/90490923/credit-card-companies-a... [Edit: Removed specific reference to a medication as it likely triggered anti-spam] How would the card merchant know what specific product you bought though? Is that data transmitted too somehow? Yes, the product details are included. For some merchants. It’s probably a coincidence or just the worst advertisers on the planet. Why would I show an ad to someone who literally just bought my thing? > Why would I show an ad to someone who literally just bought my thing? The majority of targeted advertising I see is for items I just bought. There’s also a reasonable explanation for this... Not every merchant shares purchase data, so if you do any research anywhere before making a purchase, they know you are interested, but as there was no tracking beacon on the site you ultimately bought from (or the purchase was misidentified or delayed or any number of reasons), that’s why you are now seeing targeted ads for it. It's pretty common. I once bought a fan online and had ads for that same fan follow me around for weeks. I believe they're called "retargeting" ads. Retargeting is generally done after you have shown interest in a product, but haven't converted yet. "Conversions" are always excluded if possible. It makes no sense to retarget a recent buyer. I agree it doesn't make any sense, and I would prefer to live in a world where ads were served as you described. They may not know you converted, especially if the ads are internet and the purchase was in-person. Have you been googling about your symptoms, illnesses or anything else that can have a connection to drugs like Voltaren? No I’m almost certain I haven’t. Because I’ve used it before and I don’t really have any questions about it so I ran out and I just go buy more. At this stage I’m just assuming it’s a coincidence. It has made me realize the holy grail for google and advertisers is to access your bank transactions and advertise to you based on that. Indeed though I find it silly when I buy something like a laptop (I’m probably good for a couple of years) and start getting bombarded by “hey laptops galore!”ads. I just bought one, don’t need another ! It would be cleverer to identify the replacement cycle for each kind of product and only promote stuff the victim is likely to be looking for at that point in time (after 3 years likeliness of looking for a laptop replacement is higher). A bank transaction would not reveal what product you bought whereas a receipt would. If prices were unique you could deduce something from a few items bought together though. In the business of advertisements the user pays for clicks. However, it would be much more reliable for the user to pay for ads that led to actual transactions instead of just clicks. Is there some reason for why this hasn't happened so far? (Or has it already happened?) Some merchants do transmit information about the purchased items: Maybe you saw the commercial unconsciously before, went out and bought it, and then saw it consciously. I‘d bet money on it that this is the case most of the time I've heard stories like this multiple times. Both on Android and iPhone. I don't believe it's a coincidence. The chemist is probably sharing the time of purchase along with items bought with Google, FB (probably indirectly but data gets there). These services probably have access to your location, either via your phone or via network provider. They try to match. If the likelihood is high enough (e.g. chemist had few customers at that time), show ad. It's possible they match using location but they might have other data that increases the matching like payment provider which has a lot of your personal data as well as knows your purchased something from that store at that time. In this thread: people who assume ad targeting systems are sophisticated enough to know what you buy at the chemist, while still stupid enough to recommend something you've already bought. OP probably googled something related before going out to buy the item :) Crazy! I read this HN thread on Safari on my mobile that i never use to access Facebook... a few hours later I’m on Facebook on my laptop in Chrome incognito mode, and one of the first ads that shows up is for Voltaren...how in the world?!? Your IP? And your mobile and laptop have been fingerprinted earlier to belong to the same person? IP address, maybe? My guess is that you either searched for something (for example) related to a sports injury or some sort of pain, or you where nearby somebody that did it. Many cases of this are just clustering. Another option would be if they're integrating something like Close-Up data. Close-Up is a company that collects prescription data and sells it to different marketing companies. They usually collect what doctors prescribe, so they can tell if pharma marketing efforts are working. I'm not sure how deeply entrenched they are in the US (or how HIPPA compliant they are). I think that usually these things are actually just a symptom of the fact we see hundreds of ads every day. Most of the time you don't consciously notice them but then, when they trigger some recognition, you do and it feels like a big coincidence - which I find almost as disturbing as the idea that they were somehow watching. The eerie feeling compounded by the fact that we are sometimes correctly targeted and there's no way to distinguish the two. Zeynep Tufekci writes a lot about the this type of thing if you're interested in it. Also known as the frequency illusion. Like when you learn about a word for first time and then suddenly it seems like it's popping up everywhere. Or when you start looking into buying a particular car model and suddenly it’s the most popular car and you see it everywhere :) How do you know you didn’t see ads for it before? Isn’t it likely you’re only noticing the ads now because you just bought it? Is it surprising that ads are targeted at someone who actually bought the product? Doesn’t this show that ad targeting works? You just happened to notice the ads after you made the purchase. What products did you buy that you didn’t see ads for? Which ads did you see that you didn’t end up buying the product? This is a case of you being aware of Voltaren because you bought it, saw the ads, and are now trying to connect the two. It's probably just coincidence. This week I was only thinking about something and there was an ad about exactly that product on Facebook, like 5 minutes later. I laughed out loud, since it was impossible. There were two explanations: - they are stealing my thoughts with 5G. - random things are random and I don't remember 99% of the ads where I couldn't correlate them to other events. (yes, there's a middle ground somewhere that they know the subjects that I'm interested in and sometimes someone throws a bullseye) Do you know companies actually send data to Google (and Facebook) to target ads? Its common and help companies target clients with ads on the internet in general (YouTube, sites, etc). It works like that: - The Chemist wants to sell things online or physically. - They pay google for ads for their products on sites related to its business lines or keywords about its niche. Google then show their ads for people in general, people interested on those subjects or to people visiting sites about those subjects. Interest is determined by search history and navigation (every google ad in a site (chemist or not) help google know you were there). Then the chemist want to target past customers with more specific ads (like reminding people of items in theirs carts): - They send google ads information about clients and past physical or online purchases / interactions. Google then match the user with its own database and connect the sent data with its own data. - Now the Chemist benefits from the google (because google can find you online) - Now other google clients benefit from this data (because now your google hidden profile is more accurate about your interests and habits) - Now Google benefits from that because it can use the purchase data to hone its models about ad-to-spend. The chemist also want to pay google a fraction of the purchases if the client saw an ad. - Google uses information sent in realtime by the Chemist and other companies, model this data and determine which people, sites and subjects have a bigger probability to turn an Ad into a sell. I have myself done that in the past and Facebook was quite accurate at turning ads into course subscriptions. I was seeing this happen in our household as well. For now, the only answer I have is using UBlock everywhere + having PiHole up and running. These two really go a long way for at least blocking the creepy ads, but I think we have passed the point of no return when it comes to preventing tracking itself. Everything is being tracked all the time by insanely advanced ad-tech. The surveillance economy is too profitable for this to change any time soon. Walmart is rolling out facial recognition across all their stores. Doesn’t matter if you pay cash. Pay with a card once and you’re identified. I consulted for Axciom and the best way to avoid their reach is to move to a country with good privacy laws or to a country that’s too poor for these big companies to care about. Even if you don't pay by card... if they have facial recognition and someone has upload your photo on facebook, or you uploaded your photo on facebook 10 years ago when you were 14, then they already know who you are, probably better than yourself, even if you deleted that photo when you were 18. Target has had facial recognition for the better part of the last decade. Not sure if they've integrated with their non-security oriented systems, but I'd be surprised if they hadn't. My money would be on coincidence. How often did you buy something and got irrelevant ads? I had such a coincidence happen to me once. I saw an ad for a product I've never heard about online... and a short while later, I saw the same ad on non-smart broadcast TV, billboard, in print or some similar place where I could be sure that the ad was not targeted. Had it happened the other way around, I would have doubted it myself, but it was clear that this could not have been anything but coincidence. Besides that, why would the company behind it spend money on promoting the very product that you already bought? If anything, the fact that you bought it would be used to not show you ads, at least until some time later when you'd be likely to buy another one. (Retargeting frequently gets this wrong because they see the interest but don't get the purchase information.) Are there credit card companies which do not sell transaction data? In Europe, are there any other credit and debit card companies which are not VISA, MasterCard, or Maestro? Maestro is MasterCard btw I say "<product>" (turquoise skirt, hand truck) with iphone laying in radius 3m. Later on while browsing the internet with Safari on the device I see ads selling this product. Other than this, Whatsapp is scanning the conversations for keywords and brand names - there is no doubt even. A few years back, I saw an online rumor, that I decided to try for myself. I left my (locked) iPhone 6 in front of a TV overnight, that was left on a Spanish channel. The next day, ALL of my Facebook ads, across all devices, were in Spanish — along with about 20% of the ads that I came across during regular web browsing. Took about a month for them to revert back to English. I do not speak Spanish. At the time, I lived in a rural New England area, where census data reported very low Hispanic population. Zero reason for me to get targeted with alternative language advertisements. I’m not a Luddite of any kind. Several decades of tech industry experience, specifically with ecommerce software engineering. Hold all available certifications for Google marketing, Facebook marketing, Hubspot marketing, along with many more. Know quite a bit more about this topic than the average Joe, and it concerns the hell out of me. Since that day, Facebook’s apps haven’t been allowed on any of my devices, and their services only get used by me for work purposes. Was it a smart TV? Is it possible that it's actually the TV that was snitching on you and not your iPhone (of course, it could be both of them!) Why did you buy Voltaren and that's probably your answer. If you bought Voltaren as a joke though an offline random process ( which is hard to do ) then you might have more evidence it's linked to the sale part. The other day I watched Mosquito Coast again after 30 years. Afterwards I saw Apple are making a TV series. That's not a coincidence I just have no idea how it happened. It was not simple, a Ad or Article I would have read, it's an interesting premise I always remembered. It was downloaded from the torrents. It was after looking at a movie then director then actor then movies then the decision to watch. But something I don't know what, helped me stop there on the chain of browsing and watch it. What I find surprising (and even mildly terrifying) is that such anecdotes don't even alarm people in many circles of the society any more. Lots of folks think this is what the future is supposed to look like and are completely ok with it. I read this HN post. I did not buy Voltaren or search for it anywhere, or chat about it anywhere. I use Twitter a few minutes ago. I see an ad for Voltaren. Initial Bayesian Conclusion Histogram: - 33% Voltaren ad push just happens to be underway, and no spying was used - 33% Google's Android Chrome knew I visited a HN link to today's post about Voltaren, somehow added this fact into my advertising profile, Android Twitter app used it to pick me an ad - 33% like above, except that since in Android Chrome I'm logged into Twitter, somehow Twitter itself was the upstream source of the interest hint Google and Facebook both have in-store conversion tracking:
https://support.google.com/google-ads/answer/6100636?hl=en-G... https://en-gb.facebook.com/business/help/1150627594978290 Wouldn’t be surprised if this data is used to refine which ad these platforms should show you. Someone's tech salary was justified to develop (or refractor) a function to automatically crawl a digitally stored purchase history and waste potentially useful ad space on the suggestion of a product that is guaranteed to already be owned by the user. Then they can put on their curriculum vitae that they worked as a "Googler" even though they added nothing to society (except confusion and paranoia). Google may even allocate tax write offs because they "filled a seat" among their ranks. I had a similar super-creepy and definitely not just a co-incidence experience a while back, which I shared on HN[0]. Short summary is that it was almost certainly the result of Google buying my credit card transaction data from Mastercard and using it to personalise my Google news feed. Curious about which country OP is in and which payment method was used. I'm in Australia, and find when I pay by credit card, this same thing happens to me where I get ads for medicines related to precription medicine I've just purchased. When I use cash however, I don't get the ads, so my best bet is that it's the credit card that's used to match the purchase to me in this scenario. Slightly related fun story from 2014: [1] http://ghostinfluence.com/the-ultimate-retaliation-pranking-... Discussed on HN earlier: Never knew about the VISA thing most people mention here. That is some wildly impressive tech. I wonder how much google is paying them. https://myactivity.google.com/myactivity Look for activity related to Voltaren (it has a search function) Tangential: a while back I bought a very specific cheese from Lidl. And the very same evening I got a Lidl ad for that very cheese on Facebook. I have never signed up as a member, the only things that connect me to that place would be my credit card. I did bring my Android phone that has got Messenger lite installed, but that's stretching it tbh. Your public ip provided by mobile/celltowers already reveals your location quite accurately (even with all location services turned off.)
So it's definitely possible. Google is an ad company, they sell your profile/interests and such to advertisers, it's their core business.
So it's not "stretching" at all... Somewhat related...If anyone shops at Kroger or their owner chains (Fred Meyer, Ralphs, etc) and use their rewards card...know that they sell your data. That use the revenue to subsidize their prices - which is why they are cheaper than other grocery stores. You can opt out of it, or simply signup for a rewards card and not use your real info. I think that Android phones can record stuff you say about marketings/ads purposes. Check if this happens for you here https://myactivity.google.com/myactivity?pli=1&product=29 I have not done anything Voltaren related and have noticed a bunch of ads. So I think they just did a big ad buy. If you purchased in the US using a discount card (eg: GoodRx), they get transaction level data from the pharmacy and can use that to retarget / market to you. It’s not PHI / HIPAA protected since it’s not flowing through insurance and is transaction data. I have on multiple occasions tested talking to the google home without triggering it to see if it's listening. "I wonder if I should buy X" but I dont actually want X and never search for it. That alone makes google ads start showing me ads about X. This happens a lot and what I find the strangest thing is that the ads are for things I just bought: travel I just booked, freezer I just bought etc. I do not need anything again that I just bought and so these ads are even of less use than they normally are... I haven't seen it in other comments, so I'll ask, do you use Gmail? If so, a confirmation email listing Voltaren could give Google all the info they need. I don't know if Google would use your email in this way, but it's feasible. SaaS idea: a tool that monitors your advertising profile (keys, whatever you want to call it) and gives you the same information that your browser+adtech markets are auctioning about you. Also allows you to delete keys you don't want to share. I did an afternoon of googling for information on the hospice industry to satisfy my own curiosity. Then I fired up my TV to watch some streaming television. Now I'm getting video ads for hospice services every time I watch TV. I’m going to guess that the drug store sold your transaction information. Who they sell it to varies from chain to chain, but it’s common practice. For example, CVS in the states sells your purchase data. If you want to avoid being tracked, use cash. Did you get a receipt by mail to your gmail, by any chance? Google analyzes receipts. When I still used gmail, it would automatically add flights to my calendar based exclusively on the receipt sent to my gmail account. this is also why Amazon started dropping the item names in the email order confirmations It could be worse. You could concievably buy Voltaren again soon. Usually you make a 5-10 year purchase, like a TV or a large kitchen appliance, and they keep showing you ads for the exact same model. Did you use a rewards/loyalty/points card? Did you google Voltaren before or after the purchase? Did you mention the product name in an FB or IG chat? You might have “googled” the term or a related term subconsciously some time before you’ve made the purchase. I do this all the time even when I’m purchasing things offline. If you mentioned it to anyone and they Googled or browsed to it where a Google embed or tracking pixel was present, Google could potentially infer your interest. Did you pay with cash? My guess is called Cruxification. Especially if you are not in EU there isn't much you can do (besides usual adblock, firefox, pihole etc...) Are you sure that you have not done some online research regarding Voltaren, either before or after purchase? Did you email anyone about it or receive any emails about it? If so... Your girlfriend googled it on the home wifi when she saw it in your medicine cabinet and your home wifi is also associated with your devices Baader-Meinhof Phenomenon: you were having ad-blindness until your purchase that brought up to your conscious level the "Voltaren" concept. As you cannot recall the previous cases where you saw the ad because it did not make it into your conscious mind, it seems that the ads started only after your purchase. Your perception works in 2 modes - bottom-up (signal processing) - and the ad didn't make it through - and top-down (pattern recognition) - exactly the experience you report - you recognise a recent pattern. > I guess it could just be coincidence? Could it be? of the billions of items you could be advertised for, why then exactly Voltaren? Do you have an android phone, by chance? I get Voltaren ads all the time on YouTube. I don't use it or any similar products. Maybe they just have a large advertising budget. If they knew you bought this, wouldn't they suppress ads for it? Why market to someone who has already closed the sale? How do you know it is not just a frequency bias? Just coz you bought the cream, now you notice the ads? It's simple hygiene: clear out browser data after each session, use private browsing (fwiw), and a VPN. My guess would be you searched to find the chemist to buy it from or searched for it in some way. 1. You are using Google logged in. 2. You are using a credit card and expecting not to be identified. Everything else is details. A housemate might have seen the Voltaren lying around, then Googled for it on your computer. Everything you don't want to share with the Gaffas: Shutdown your cell, pay in cash. Did you do searches related to the condition that caused you to be prescribed Voltaren? My bet would be on “Level 3 credit card data” being sold and insufficiently anonymized I use cash when I want anonymity. Despite what anyone says, it is still king. Apps on your smartphone are (or were) listening you. I guess it could just be coincidence? Have you ever noticed how you don't seem to see much of X, and then all of a sudden you see one X. And then you can't stop seeing X. Though, googles probably spying on you. Please check if you allowed to record voice:) Huh. Good argument for paying cash. Maybe you researched it beforehand? Did you bring an Android phone? Did you pay with Google Pay? What phone do you use? Use cash.
So how the f. did Instagram know about my Gundam browsing on desktop. - I use different Google accounts on my phone and desktop (although I occasionally log in one or the other in private tabs)
- The internet connections are different : 4G for phone, fiber for desktop
- On desktop, I use Chromium with Ad block Plus
- I do not use facebook nor instagram on my desktop PC
