Twitter ‘fesses up to more adtech leaks

Twitter has disclosed more bugs related to how it uses personal data for ad targeting that means it may have shared users data with advertising partners even when a user had expressly told it not to.

Back in May the social network disclosed a bug that in certain conditions resulted in an account's location data being shared with a Twitter ad partner, during real-time bidding (RTB) auctions.

In a blog post on its Help Center about the latest "issues" Twitter says it "recently" found, it admits to finding two problems with users' ad settings choices that mean they "may not have worked as intended".

It claims both problems were fixed on August 5. Though it does not specify when it realized it was processing user data without their consent.

The first bug relates to tracking ad conversions. This meant that if a Twitter user clicked or viewed an ad for a mobile application on the platform and subsequently interacted with the mobile app Twitter says it "may have shared certain data (e.g., country code; if you engaged with the ad and when; information about the ad, etc)" with its ad measurement and advertising partners - regardless of whether the user had agreed their personal data could be shared in this way.

It suggests this leak of data has been happening since May 2018 - which is also the day when Europe's updated privacy framework, GDPR, came into force. The regulation mandates disclosure of data breaches (which explains why you're hearing about all these issues from Twitter) - and means that quite a lot is riding on how "recently" Twitter found these latest bugs. Because GDPR also includes a supersized regime of fines for confirmed data protection violations.

Though it remains to be seen whether Twitter's now repeatedly leaky adtech will attract regulatory attention"

Twitter may have /accidentally/ shared data on users to ads partners even for those who opted out from personalised ads. That would be a violation of user settings and expectations, which #GDPR makes a quasi-contract. https://t.co/s0acfllEhG

- Lukasz Olejnik (@lukOlejnik) August 7, 2019

Twitter specifies that it does not share users' names, Twitter handles, email or phone number with ad partners. However it does share a user's mobile device identifier, which GDPR treats as personal data as it acts as a unique identifier. Using this identifier, Twitter and Twitter's ad partners can work together to link a device identifier to other pieces of identity-linked personal data they collectively hold on the same user to track their use of the wider Internet, thereby allowing user profiling and creepy ad targeting to take place in the background.

The second issue Twitter discloses in the blog post also relates to tracking users' wider web browsing to serve them targeted ads.

Here Twitter admits that, since September 2018, it may have served targeted ads that used inferences made about the user's interests based on tracking their wider use of the Internet - even when the user had not given permission to be tracked.

This sounds like another breach of GDPR, given that in cases where the user did not consent to being tracked for ad targeting Twitter would lack a legal basis for processing their personal data. But it's saying it processed it anyway - albeit, it claims accidentally.

This type of creepy ad targeting - based on so-called 'inferences' - is made possible because Twitter associates the devices you use (including mobile and browsers) when you're logged in to its service with your Twitter account, and then receives information linked to these same device identifiers (IP addresses and potentially browser fingerprinting) back from its ad partners, likely gathered via tracking cookies (including Twitter's own social plug-ins) which are larded all over the mainstream Internet for the purpose of tracking what you look at online.

These third party ad cookies link individuals' browsing data (which gets turned into inferred interests) with unique device/browser identifiers (linked to individuals) to enable the adtech industry (platforms, data brokers, ad exchanges and so on) to track web users across the web and serve them "relevant" (aka creepy) ads.

"As part of a process we use to try and serve more relevant advertising on Twitter and other services since September 2018, we may have shown you ads based on inferences we made about the devices you use, even if you did not give us permission to do so," it how Twitter explains this second 'issue'.

"The data involved stayed within Twitter and did not contain things like passwords, email accounts, etc.," it adds. Although the key point here is one of a lack of consent, not where the data ended up.

(Also, the users' wider Internet browsing activity linked to their devices via cookie tracking did not originate with Twitter - even if it's claiming the surveillance files it received from its "trusted" partners stayed on its servers. Bits and pieces of that tracked data would, in any case, exist all over the place.)

In an explainer on its website on "personalization based on your inferred identity" Twitter seeks to reassure users that it will not track them without their consent, writing:

We are committed to providing you meaningful privacy choices. You can control whether we operate and personalize your experience based on browsers or devices other than the ones you use to log in to Twitter (or if you're logged out, browsers or devices other than the one you're currently using), or email addresses and phone numbers similar to those linked to your Twitter account. You can do this by visiting your Personalization and data settings and adjusting the Personalize based on your inferred identity setting.

The problem in this case is that users' privacy choices were simply overridden. Twitter says it did not do so intentionally. But either way it's not consent. Ergo, a breach.

"We know you will want to know if you were personally affected, and how many people in total were involved. We are still conducting our investigation to determine who may have been impacted and If we discover more information that is useful we will share it," Twitter goes on. "What is there for you to do? Aside from checking your settings, we don't believe there is anything for you to do.

"You trust us to follow your choices and we failed here. We're sorry this happened, and are taking steps to make sure we don't make a mistake like this again. If you have any questions, you may contact Twitter's Office of Data Protection through this form."

While the company may "believe" there is nothing Twitter users can do - aside from accept its apology for screwing up - European Twitter users who believe it processed their data without their consent do have a course of action they can take: They can complain to their local data protection watchdog.

Zooming out, there are also major legal question marks hanging over behaviourally targeted ads in Europe.

The UK's privacy regulator warned in June that systematic profiling of web users via invasive tracking technologies such as cookies is in breach of pan-EU privacy laws - following multiple complaints filed in the region that argue RTB is in breach of the GDPR.

While, back in May Google's lead regulator in Europe, the Irish Data Protection Commission, confirmed it has opened a formal investigation into use of personal data in the context of its online Ad Exchange.

So the wider point here is that the whole leaky business of creepy ads looks to be operating on borrowed time.

Important statement from Brian O'Kelley, inventor of much of RTB https://t.co/02oHP6ZPVp pic.twitter.com/AS5Bh2zFqh

- Johnny Ryan (@johnnyryan) August 6, 2019