Project:Adtech/SITRA call

Goals

• trace personal data
• understand how it is used dynamically
• understand what is stored statically

Techniques

• technical audit through use
  • limitation: we don't know what occurs behind the scenes
• legal through request (right of access)
  • limitation: slow, cumbersome, uncertain
  • but: some places it is easier
• combination (right of access at places where audit says it will be interesting)
  • limitation: still time-consuming

Questions

• which device?
• which browser?

Actors

We focus on adtech industry, which has different roles:

• publisher
• advertisers
• ad exchanges
• data management platforms
• identity resolution services

Adtech overview

Expand

PREFIX pdio: <https://wiki.personaldata.io/entity/>
PREFIX pdiot: <https://wiki.personaldata.io/prop/direct/>
PREFIX pdiop: <https://wiki.personaldata.io/prop/>
PREFIX pdiops: <https://wiki.personaldata.io/prop/statement/>
PREFIX pdiopq: <https://wiki.personaldata.io/prop/qualifier/>
#defaultView:Graph
SELECT  ?object ?objectLabel ?rgb ?subject ?subjectLabel 
WHERE {
  VALUES (?object ?rgb){
       (pdio:Q110 "FF0000")
       (pdio:Q495 "00FF00")
       (pdio:Q559 "0000FF")
       (pdio:Q153 "333333")
       (pdio:Q491 "888800")  
       (pdio:Q807 "008888")
       (pdio:Q492 "880088")
       (pdio:Q498 "440000")
       (pdio:Q810 "004400")
       (pdio:Q556 "000044")
       (pdio:Q504 "004444")
       (pdio:Q874 "444400")
       (pdio:Q834 "440044")
    }
  VALUES ?predicate {
       pdiot:P3
       pdiot:P28
    } 
  ?subject ?predicate ?object
  SERVICE wikibase:label {
    bd:serviceParam wikibase:language "en" . 
  }
}
LIMIT 250

Luma-scape like (embedded)

Expand

PREFIX pdio: <https://wiki.personaldata.io/entity/>
PREFIX pdiot: <https://wiki.personaldata.io/prop/direct/>
PREFIX pdiop: <https://wiki.personaldata.io/prop/>
PREFIX pdiops: <https://wiki.personaldata.io/prop/statement/>
PREFIX pdiopq: <https://wiki.personaldata.io/prop/qualifier/>
#defaultView:Graph
SELECT ?item ?itemLabel ?third ?thirdLabel ?rgb WHERE {
  ?item pdiot:P260 ?third.
  BIND( "FFA500" AS ?rgb)
  SERVICE wikibase:label {
    bd:serviceParam wikibase:language "en" . 
  }
}

some publishers and their trackers (embedded)

Technical standards

• hs.fi ads.txt implementation
• includes `adform.com,583,DIRECT`
• adform.com sellers.json implementation
• includes

seller_id	"583"
seller_type	"PUBLISHER"
domain	"sanoma.com"
name	"Sanoma Oyj"

Right of Access

Expand

PREFIX pdio: <https://wiki.personaldata.io/entity/>
PREFIX pdiot: <https://wiki.personaldata.io/prop/direct/>
PREFIX pdiop: <https://wiki.personaldata.io/prop/>
PREFIX pdiops: <https://wiki.personaldata.io/prop/statement/>
PREFIX pdiopq: <https://wiki.personaldata.io/prop/qualifier/>
SELECT ?item ?itemLabel ?service ?serviceLabel ?web WHERE {
  ?item pdiop:P144 ?statement.
  ?statement pdiops:P144 ?service.
  ?service pdiot:P4* pdio:Q188.
  OPTIONAL {?statement pdiopq:P15 ?web}
  SERVICE wikibase:label { bd:serviceParam wikibase:language "en" . }
}

actors with some form of data rights portal (embedded)

• https://www.quantcast.com/privacy/data-subject-rights/
• https://access.triplelift.com/
• https://mydata.appnexus.com
• https://www.captify.co.uk/data-subject-rights-request/
• https://registry.mplatform.com/
• https://datacloudoptout.oracle.com/registry/
• https://cross-device-privacy.adobe.com
• Criteo (Q1184)