Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/1071 Thanks!
[Music]
and now welcome to the last Talk of the
day and it's very close to night and
it's time to tell spooky campfire
stories except this one is 100% real
spooky as it is it is a talk on Shadow
profiling and then how Facebook tracks
you even if you don't have a Facebook
account so let's give a warm Round of
Applause to Christopher and freder and
invite them on
stage
[Music]
and thank you hi everyone um it's
amazing to be at Congress this is my
first Congress so uh yeah it's just been
an absolute
like
dream I really enjoyed it um and it's it
wouldn't be possible without like the uh
the angels and the the translators and
the Heralds so can we give them a bit of
a round of
[Music]
applause thank you just by a little show
of hands how many people in here are
Android developers just
there's like five of them
cool and how many of you have used the
Facebook
SDK any any of you couple cool so I'm
going to hand over to fredri who's going
to take us for our first couple of
slides earlier this year we have filed
complaints against seven companies those
are data Brokers attech companies and
companies that do credit scoring and the
reason for our complaints and the reason
why we focused on these companies that
are really not household name names to
most people is that it is currently
impossible for most people to understand
how they're being tracked and profiled
and in whose hands all of this data ends
up as part of this research I asked one
of these tracking companies a company
called Quant that many of you probably
haven't heard of but that has certainly
heard of you for all of my
data so what you see here this is a
heavily edited and deliberately blurred
version of my browsing history so what
you see here are those are the websites
I've opened time stems device
information um this is work related so
it's quite sensitive sometimes it also
includes infer data uh a predicted value
for my gender whether I have children my
income and with all of this came partner
data from all other all kinds of
companies different data brokers who
placed me into infuriating categories
like like heavy alcohol spender at home
or affinity for baby products and
nappies here's what's so very
fascinating about that data except that
it's a lot of data some of it is heavily
personal and some of it is very wrong
but what's so fascinating is that all of
this data is from one cookie from One
browser that was placed on one of my
devices this is why today we have just
published right now um research about
how a very different tracking company
tracks people on apps that are built for
for Android and we've focused especially
uh on how Facebook tracks people who do
not have a Facebook
account earlier this year research by
the University of Oxford showed that 42%
of apps of free apps in the Google Play
Store in the US and the UK should could
share data with Facebook and what's
interesting is that this makes Facebook
the second largest tracker after after
Google's parent company
alphabet with this research that we just
published we wanted to build on this and
show what exactly this data sharing
looks like particularly for people who
don't have a Facebook account the reason
we focus on Facebook and not Google or
any of the other tracking companies is
because the very fact that apps like a
period tracker or an LED flashlight
shares data with Facebook in the first
place will come as a surprise for many
people and especially for those who have
made a conscious decision not to be on
Facebook here's what we did so we took
uh Oxford University's research from
their computer science department they
gave us a copy of their list and they
gave us a list of all of the apps of the
top 5,000 apps that use Facebook SDK we
chose the number of the L or some of the
largest ones and we also chose a few
apps that were uh that were had
sensitive data like they were either to
do with religion or they were to do with
health or some of the other stuff and a
few utility apps out of that selection
um because utility apps may also have
information about other
apps so this is the 34 that we chose as
you can see it's a real mix of uh both
big big name applications you know like
Spotify um indeed and then much smaller
applications that are made by more Indie
developers either just games that they
made sort of thing and uh but all of
these apps have over 10 million installs
and we we chose apps that
had decent install bases because we this
isn't this isn't really about the apps
themselves and developers we're not
critici we're not here to criticize
Developers for um the way they make
their apps this is all about the SDK and
the way it transmits data with or
without user
consent so take you quickly through our
analysis methodology
had a Android uh an Nexus 5 running
Android 8.1 connected through a virtual
machine uh running mitm peroxy which is
a man- inthe middle proxying tool um and
I did it transparently so the app didn't
know that it was being intercepted and
we had a look at what the data was that
was going between the app and
Facebook so our first finding was that
over 61% of the apps we tested
automatically transferred
Data before the user has any other like
they literally just open the app so
that's 21 out of
34 so for example here's kayak and uh as
you'll see pretty much immediately from
when the app is clicked that first
request is straight to graph.
facebook.com and it sends a whole load
of other data to many other companies
and besides and well let I could let
this go on for a while but ultimately
you end up on their home screen which is
kind of amusing cuz it's got this at the
bottom of it which is don't worry we'll
never share anything without your
[Music]
permission so so let's take a look at
some of this in slightly more detail and
this is a this is pretty standard this
is a VK the Russian social network um
and therea is pretty typical of how the
SDK is mented and I'm guessing probably
in the default state which is the app
doesn't app initialize when the SDK is
first load saying SDK initialized and
then when the app is in foreground it's
got activated app and then when the app
goes to background it sends a message
saying deactivated app and when it comes
back and when you close the app it says
deactivated app so you can actually
start to profile like how long a user is
using an app how often they're opening
the app this kind of stuff and uh if you
look at some of this data if you're able
to see it well clearly um you got a
unique ID that
is well we we support is personal data
because it's uniquely attached to your
browsing and whatever your app usage and
there's some other extraneous data on
here that's also quite quite telling
it's got um it's got stuff like what
version of Android you're running what
the device you're running on what your
keyboard local localization is you know
your time zone you're getting quite a
picture just from this one app of like
someone and then it doesn't take much to
go beyond
that so our second finding is some apps
also routinely send Facebook data that
is incredibly detailed and sometimes
sensitive this isn't a particularly new
finding there have been other people so
a good shout out to Exodus privacy who
also reported about the baby Plus app
and uh and mobile shiza who also earlier
this week week I think reported about um
the pregnancy Plus app that sends
granular data so there's some examples
we found in our data search so the top
example here is kayak and kayak sends
your entire search to Facebook every
time you do a search in their app which
is lovely so and it's interesting what
they send because it's not just um it's
not just the content of your search it's
also some other stuff like your user
score whatever that is and it's got uh
OB fiscated session IDs and all sorts of
other things that they're sending to
Facebook um the other one that's on the
bottom here is the King James Bible uh
and it's quite typical of a lot of ways
that app developers implement the SDK
and it allows them to track your usage
through the app so um this one when I
originally tested it they've actually
made their data slightly less granular
but when I originally tested this app um
it actually told you which vers passage
of the Bible you'd read which is what
Facebook needs to
know so and then the last bit is the the
actual advertising data that Facebook
uses and this is a a a request to the ad
Network and uh some slightly interesting
stuff that that comes from here is that
you know like the device is on charge
the M the battery percentage is full
there's free space and this isn't this
isn't even uh the most comprehensive
example I've seen other data on there
such as accelerometer positions other
slight interesting thing again all
linked with the uh the app ID the other
thing here is it's got at the top there
copper false which is the American Child
Protection uh child Privacy Act and uh
it somehow decided that I'm not a child
even though it never asked me
so so and yeah and it's crucial to
remember this happens whether you're a
Facebook user or you're not a Facebook
whether you're logged in or you're not
logged in so it's making profiles are
being made regardless of whether you're
having a Facebook account or you don't
have a Facebook account what you have to
use as some of these apps and a profile
is being built
potentially so why does this matter why
does any of this
matter so our analysis obviously only
focus on the data that ABS transmit and
we can't possibly uh say with def
definity how this data is being used but
here's what's really interesting is
that our first finding is that the vast
majority of apps share data the second
it's opened and the data that is being
transmitted um indicates what kinds of
app you use when you use them combined
with a unique ad ID and knowing what
kinds of apps somebody uses and when can
give quite a detailed uh picture of
someone's life so these are four apps
that we have actually tested the first
one is a Muslim prayer app the second
one is a period tracker indeed is a job
search um app and My Talking Tom is a
children's app so what kind of person
could that be
that looks like a person who is likely
Muslim likely female likely looking for
a job and likely have who likely has a
child so in our analysis the apps that
automatically transmit data it all comes
together with a Google ad ID that's a
user resettable unique ID that also in
our previous work on data brers and
attech companies is primarily used for
uh connecting different profiles
together even though we don't know what
is happening to this data it would be
pretty straightforward to link it
up there's also a second reason why this
data is uniquely interesting and that is
knowing what kinds of app hundreds of
millions of people use and when they use
them gives gives quite a unique insight
into the Android app market so if
combined event data such as app
installed SDK initialized and deactivate
app from different apps uh offer a very
detailed insight into the usage behavior
of hundreds of millions uh of people on
abs
and again we have deliberately focused
on app that have a lot of installs at
least 10 million and some have even 500
million installs so combined we're
looking at over two billion installs and
the kinds of data that these apps share
that really matters because it's a lot
of
data the question though is why do so
many apps share data with Facebook the
second that the app opens there are
obviously many reasons and some of these
are even good reasons y app use y apps
use third party tracking and sdks such
as the Facebook SDK um so what the
Facebook SDK for Android does it allows
app developers to integrate their apps
with Facebook's platform and it contains
a number of main components such as
analytics ads or login so this is the
reason why apps or some apps choose to
use the SDK now here's where it gets a
bit
complicated Facebook places this sole
responsibility on ABS to to ensure that
the data that they collect and
ultimately transmit to Facebook has been
obtained legally and we've reached out
to Facebook and they confirm to us again
that um it places a legal and cont
contractual obligation on the developer
who they see as the data controller to
get consent as it is required for the
use from users before sharing data with
Facebook via the
SDK however the kind of data sharing
that we've observed in the majority of
apps is the default implementation of
the SDK that's nothing we discovered
that's clearly uh admitted by Facebook
in the quick start guide for Android so
when you use the SDK its default
implementation automatically transmits
data since May and what happened in May
gdpr entered into Force um lots of
developers have been filing back reports
about The SDK um on the right you see
one of them but there are many you can
search uh Facebook's developers platform
for them this one from July 24th
somebody complains that they wanted to
integrate the login uh but the moment
the app opens it transmits people's ad
ID and they're not allowed to do this so
the reason why developers complained is
that when apps share data the second
they're opened you're unable to ask
people for their explicit and ambiguous
permission which is the bar for consent
that gdpr
requires so Facebook released the
feature uh and that feature delays what
they call the automatic event logging
but that feature was only released in
June and we in our conversation with
Facebook prior to this publication
Facebook confirmed to us in writing that
prior to the introduction of this delay
option developers were able to disable
the transmission of data but that
doesn't include something they call a
signal that the SDK has been initialized
and this is exactly what we've observed
in our research and just as a reminder
the signal that the SDK has been
initialized that's data that that that
gives a strong indication somebody's
what kind of app somebody uses and when
they're using this combined with their
Google ad
ID the big question is of course is this
even
legal and we have a very long section in
our report that explains this in a lot
of detail because it is very complicated
but what this analysis shares is that we
think that the responsibility is a lot
more complicated than saying this is
entirely the responsibility of apps
um so since we've done this analysis in
the UK and the UK is still a member of
the European Union and has implemented
the gdpr that's one legal framework that
applies we also looked at the eprivacy
and we also looked at competition law in
the underlying seam is who has what what
kind of
responsibility so the question is what
should Android developers do what should
Android developers do well up your
privacy game again we looked at Large
ABS that have lots of significant
resources at the very least ABS should
comply with relevant privacy laws and
I'm saying this so clearly because we've
seen ABS that have like two paragraphs
of privacy policies and that is
unambiguously
non-compliant
um but we also sort of like you have a
responsibility like to not transmit data
that doesn't need to be transmitted so
data minimization and giving people on
actual choice and it was quite
interesting we reached out to all of the
21 apps that automatically trans data as
well as those that share much more
detailed uh data and it was very
fascinating to see the very different
responses that we got from companies
some we had the impression didn't fully
understand the SDK and what the SDK does
when some had a very different
interpretation of what they should do
legally um some didn't really didn't
realize that this is happening and
promised that to update their apps um we
need to give some credit to Skyscanner
this is the only app that got back to us
within 3 days and said thanks very much
we've already immediately updated our
app and this is no longer happening we
haven't been able to test it
um and there's also been an app the
Weather Channel they updated their app
immediately after we tested it in
December but basically the the responses
were quite VAR varied and the general
impression is that apps that have a
gigantic user base need to do a better
job at the same time however I think our
research also gives some thoughts to
rethink third party tracking on
ABS even if our legal analysis says it's
a little bit more complicated um the
Facebook says the responsibility is with
apps so integrating if you the moment
you integrated a third party tracker
this comes with risks and so the
question is do you really need to
integrate the SDK and if you integrated
it can you do it selectively you
shouldn't assume that the default
implementation is compliant and um
whenever you implement it be very fair
and transparent to both bu's users about
exactly what it is you're doing and how
you're collecting
data so what should Facebook and Google
do so privacy by Design and by default
is not just a principle for data
protection but it's also something
that's quite relevant here um we don't
really Facebook got back to us
explaining the many different ways that
developers are able to delay the kind of
logging and or like or change the way
that the SDK works but to the best of
our knowledge there's no good reason uh
why the default shares data
automatically so if you're selling a
product that allows people to send data
to you and you make place the
reliability on the people who do this
data sharing why shouldn't this be
privacy friendly by Design and by
default there's also something
interesting that happened in both the
responses that we got from Facebook and
also Google's initial reaction to the
research that was published by by the
Oxford researchers earlier this year and
that was sort of like but other
companies also track people um and
Facebook spent a lot of time in
parliamentary hearings this year and we
had the pleasure to watch all of them
and um in one of these hearings Facebook
followed up in writing on the US Senate
hearing and in one of these written
responses they said it was also the
topic was also Shadow profiling the
tracking of non-users across the
internet and the company said that's a
standard feature of the
internet um and Google also pointed like
Amazon does this Twitter does this Etc
so in a way we need to reclaim the
internet like there's no natural law
that says that every website every app
you use send such detailed data to
hundreds of different companies every
time you use
them so what can you do so what can we
do so what what our response from Google
so there's there's two easy ways to fix
this problem you just you can lopt out
of AD personalization
and you can reset your ad ID so we gave
that a shot see how that works out so
this is what happens when you opt out of
AD personalization so the top is with
ADD personalization on and this is opted
out it's a big Improvement
there the uh the actual the real the
real Improvement is that the flag has
been changed from True to false but the
data is increased and it's still being
sent so yeah
it's um
so you can't really opt out then so your
best bet well an audience like this has
probably got one advantage you probably
got if you've got an Android phone it's
probably rooted so you could always just
block graph. facebook.com don't know
what the what the implications of that
might be there might be other stuff that
just stops working but but most users
don't have rooted phones and so the only
other real alternative is you could try
not install apps that use the Facebook
SDK but good luck working out which ones
those are cuz it's not well indicated on
any app I ever
seen so the only other options you have
is to minimize what your the data you're
uh you're sending so you could segregate
your apps have a a different profile in
your Android device for every app so
that the the the advertising IDs are
separate and then you you know your your
ID will only apply to that one app and
obviously you can always reset your ID
and opt out it doesn't really solve much
but it does at least you know it keep
keeps your profile fresh keeps it you
know it's the time frame that also makes
quite a big difference to how you are
profiled so but why should you have to
do all of
this so I'm going to release all of my
uh environment um so anyone can re
replicate what we've done I'm going to
do that tomorrow because I need to get
home and sleep but um so yeah I my
environment is going to go on Pi's
website um and then all of our
documentation is is also available on
Pi's website so if anyone else wants to
look through what all of the apps we
looked at do I'd definitely suggest you
have a look at kayak and i' just have a
look at the LED flashlight it's quite
interesting especially the consent flows
but um yeah and we also on
[Music]
tour
thank you thank you Christopher thank
you freder for the amazing talk we are
taking questions uh just to remind you
there are five microphones two in the
front and three in the back so queue up
and we're going to take a question right
now from microphone to uh what did you
send to Facebook to get your data did
you send the advertisement ID because it
would be kind of nice to ask Facebook
and then complain to the apps and then
ask Facebook again and repeat that every
week so I have actually done a DSA to
Facebook based on my advertising ID and
they responded out outside of time it
wasn't until we actually sent them that
we were going to release a report they
actually replied to my original D and
they claim they have no data and we were
going to follow up on this in a not too
distant future and they're releasing a
new tools like this clear history tool
because it's sort of like this
experience just shows that it's
excruciatingly difficult to actually
access has your data rights if you don't
have an account so there's a process
there's a form you can fill out but it's
sort of like it should be way easier to
get access to the data that that
companies hold on you if you don't have
an account thank you thank you we are
going to take a question from the
internet real
quick uh the internet wants to know did
some of the apps prevent interception of
data by pinning Facebook's SDK
certificates none of them
did of the ones I tested at least none
of them they were quite happy to send
data to a man in the
middle thank you uh microphone
one hi thanks for the talk are there any
open source projects that allow access
to these kind of sdks with privacy
sensitive uh
defaults uh not that I'm aware of I
don't think not that sorry not that I'm
aware of would this even be permitted by
the SDK terms of service sorry say again
would this kind of application or uh
libraries be permitted by Facebook or
Google's uh terms of API usage or SDK
usage we we've read them but I I
couldn't answer that on top of my head
sorry thank you thank you microphone one
again uh yeah thank you for the talk it
was very interesting and uh I think from
the top of my head that most of the apps
you researched were free to download and
now we usually uh tell the late person
uh buy your app so you won't be the
product do you have any indication of
whether this is actually true this is an
excellent question and the reason
so when you confront companies about
third party tracking in general the the
the response that you usually get is but
apps need to monetize or Publishers need
to monetize and that's why we need that
much tracking however the truth is that
this has been the argument for a very
long time and at the same time the
tracking has become exponentially more
invasive and we the argument is still
that that this is all needed in order to
show relevant ads and we sort of say
there are ways to use analytic software
there are ways to even show ads that are
fair and transparent to people but sort
of like but there's such a gap between
what's what's considered sort of
Industry practice or what's happening on
a massive scale and what would be
considered transparent and fair so
there's like a massive room for
improvement and that's why I'm not
buying the argument that that apps or
companies like Facebook and Google say
but people need to sell
ads but
uh you know if um is the microphone on
oh yeah uh but do you know if uh Paid
for apps also participate in this
tracking we haven't I I didn't do any
analysis on any paid for apps thank you
thank you um microphone 5 but since it's
the default of the SDK would be it would
be really interesting if somebody does
that
test five thank you thank you for your
research um you focus very much on
Facebook do you know whether or not the
other uh companies such as the big five
use um um an SD that similar to this
one um yeah I didn't really do much
digging on the other one ones but just
by looking at the logs as they were
coming in you see an awful lot of other
tools that developers regularly lose
there's a tool I think it's called
amplitude and then there's a there's
crash analytics from Google I believe
and they all I believe they must all
come in in SDK because the way that they
send consistent data but I haven't
tested them for what data they're
sending thank you Mike
four so my question is twofold to first
part will be um as you've said and have
we seen that there is quite clearly a
legal like they break the law by not
answering the question and stuff um out
of experience we know that Facebook's
legal team is quite strong so would you
say that there is um a chance of like
suing them and the second part would be
uh what do you say if we just automate
the process to reset the ad
ID could you say the last T again like
is is there a way or is it like useful
if we automate the process to reset the
personal ad ID so that we can just reset
the tracking every time yeah so to
answer your first question we're
considering what we're going to do next
that's what I can say on that read the
legal section like we so read the legal
section in our analysis so we didn't
want to summarize it here to because we
wanted to do ad Justice and it's a bit
complicated but I think yes there it
raises many questions and there have
been previous cases about the tracking
of non-users by social plugging and by
by pixels and so the question is sort of
like what's the what's the parallel here
and to answer your second question about
resetting your ad ID I believe that was
your question um it's it's it's not very
obvious because to reset your ad ID on
an Android device you go into settings
Google ads reset your Google advertising
ID and that res sets your Facebook ad ID
as well because it's the same ID and so
one recommendation in the report is also
sort of like this is the the privacy
settings of both Google and Facebook are
still sort of
counterintuitive and there is no good
reason to why the ad ID only resets when
you reset it manually because we know
that many people will not understand or
know what the ad ID is used for and what
implications resetting it
has thank you and speaking of the report
I would just like to point out again
that it's only been published now so you
are the first people to hear about it
and I think it deserves a round of
[Applause]
[Music]
applause so the next question is from
microphone
through hi um is there a way to delay
loading the Facebook SDK so that uh
Facebook wouldn't even have the ability
to execute code and then send the
analytics data until you really need it
to perform the function that you
initially integrad it for yes there's a
there's a couple of answers to this
question it's a good question the um so
Facebook say that any version of the SDK
4.34 or later has a delay function in it
the developers even in latest December
are still saying that functionality is
questionable as to whether it works but
the actual AP the actual graph API and
it is just an API that you need a key
for and we think that some of the larger
apps which we tested such as the wi
chats and the dropboxes might actually
Implement their own calls to the API
rather than going through the SDK which
is why they don't automatically make
calls to
graph
my thank
you um microphone tool for a followup
question so my point wasn't that uh was
actually not implementing the code
yourself but using the Facebook code but
only loading it as soon as you actually
needed is there a question oh is that
possible was the question I don't know
sorry okay thanks thank you microphone
five hi thank you um seeing the amount
of data that's transmitted um is
changing the at ID even making any sense
yes in the sense that it sends a signal
that I mean it doesn't change anything
and we say that very clearly in the
report you have a new profile it's not
your old one it's a new one and we know
how easy it is at least technically to
relink data Etc but I still think it
sends a signal that that sort of you do
want to minimize the granularity of the
targeting that's happening and at the
same time you do get a fresh profile um
we had a little bit of a curiosity and
that in our analysis the ID did not not
reset when the phone was put reset on
factory reset uh and Google got back to
us they said they tested it for several
different Android devices and they they
had a different they had different
findings so we couldn't verify Google's
test it might be that this is unique to
the environment in which we tested the
apps thank you thank you microphone
three yeah um hello uh do you have any
information how it is on Apple device
that's a great question that might be my
project for next year so some of the uh
the back reports that developers filed
were also about the uh Apple ad ID but
we haven't we haven't done the the
research but I'd be really interested to
read
it thank you uh microphone three again
so you showed that when you opt out of
AD personalization the amount of
transferred data actually increases um
do you know what kind of additional data
that
is back on the
slides I think that's like for this very
specific app yeah this and this is uh
this from skyscan and this is their
custom app data for origin selection so
when you go through their process or
when you when this was tested at least
when you went through their process and
you selected what city you wanted to fly
from it would send data um I don't know
why it sends more when the uh when
advertising uh per when personalization
is opted out I don't know that's but
just contractually when you opt it out
you're not allowed Google got back to us
to say when you've opted out of app
personalization you're not allowed to
use this data for ad
personalization first of all that's like
a restriction on the on use it's not a
restriction on collection but also it's
only a restriction on use for
advertisement we still think you could
be using it for different
purposes e surveying or what things
thank you Mike five please uh hi so I
have a question would it make sense uh
for example that when we uh do this kind
of research and we say that uh these
applications are really uh violating the
Privacy to to actually extend the so we
have the F Droid and this alternative uh
application stores to add additional
indication saying look this is a this
application is very much has a very low
privacy rating and then if somebody
wants to download it he just can decide
like there can be like five stars the
the user review and like one star for
the Privacy review and just make sure
that it's super obvious if you're
downloading a uh privacy intrusive app
not to download it or just just to be
aware that what's happening that's an
excellent point and it be that would be
a great feature to be implemented um and
one of our recommendations for Google
was that they Implement something
similar to show you know to users on
their Play Store they already show
certain other characteristics about the
app like whether it has inapp purchases
and other things why don't they show
that it's got a Tracker attached to it
or it's using the SD a Facebook
Implement integration or any of the
other things well to to add two things
one is sort of like the play stores they
have terms of terms of services and and
and and they all say you have to comply
with existing laws so what we observe
here is also sort of like there's a
discrepancy obviously uh between the
terms and how apps behave in practice
and the other thing I want to stress is
that for This research we only looked at
Facebook and Facebook is a a Tracker
that's present in many apps but there
are thousands of track of of different
tracking companies and sort of like to
assess how invasive an app is it's
really interesting to see how many
different trackers they have and the
research that we referred to at the
beginning um by Ruben bins and others at
the University of Oxford they really
looked at the number of trackers that
different apps have um and it's
sometimes it's quite a bit I mean I was
thank you there is a person at Mike 4
who's been waiting since
forever hi um I was particularly
interested in your communication with
the app uh the apps you were like you
contacted the app developers uh is there
an option to make these conversations
public I feel like it would be really
interesting and it would give me
somewhat of an angle to attack this
problem from the customer point of
view so we contacted the app on December
19 and we appreciate that this is an
unusually busy time of the year um and
we have added all responses we we
obviously can't publish the conversation
but we published the responses that the
apps shared with us and you can find
them for each of the app you can see the
response at the end uh and sort of like
many apps didn't get back to us but if
they get back to us we would obviously
consider to add their statements at a
later point this is this is really
brilliant thank you very much we have
time for a couple more questions but and
also to be fair some said they need more
time to evaluate that internally so just
to be fair um I wouldn't interpret a
lack of response as anything negative
just yet
thanks I would like to say thank you to
everyone who's asking questions today
because you are making talks even more
amazing than they are so round of
applause to everyone who has asked
speakers at least one
question please do that more often
microphone one um hi I uh hello um hi
um uh I have another question related to
communication sort of um I'm a bit
surprised of the all the amount of data
that Facebook is taking um have you ever
tried to modify the Json a little bit
and I don't know upload like one
gigabyte of them and see if Facebook
drinks it
[Music]
[Applause]
all I think that would give our general
counsel heart
attack it's interesting though actually
it actually raises a very interesting
side point is that some of the apps when
I tested them they have they're
communicating with so many trackers that
it actually like a few of them actually
crashed my environment because it's just
using up way too much memory trying to
log all of The Trackers it's trying to
connect to um and yeah when I changed to
ad personalization off or opting out of
AD personalization it actually starts
well from my experience it's a
documented bargain on a mitm proxy
that's in their GitHub there's a bug
where um the Android device starts
initiating http2 connections without any
Preamble and mitm broxy can't handle it
and it just keeps dropping all these
connections and eventually just floods
your log with
rubbish thank you I feel like next year
we might have a talk from someone who
actually decides to try it out
microphone 2 please yeah along the same
uh ideas is uh since you already fetched
these
requests um and they are bound to the
app ID uh to the ad ID is it possible to
maybe if uh fun would collect like the
last
1,000 uh ad IDs and just randomly mingle
them to different profiles so to poison
them
all I mean I'm not suggesting to do that
but impossible I said it raises a lot of
gdpr
questions you might not want to do that
I
guess don't try this at home yeah
microphone 3 please we have an
overwhelming number of questions but we
only have time for one more then thank
you very much that I can be the last one
thank you very much for your talk um one
question um have you any experience in
how successful is how successful
Facebook is is to link your at ID with
your account or what happens when you
delete your account and um I'm pretty
sure Facebook still keeps some record of
you and if they can they use any
measurements to find you again even if
you don't have your account anymore so
Facebook in their privacy policy in the
cookie policy and in the in the business
terms for Facebook Pro business terms I
don't know the exact word on top of my
head but they ex explain how they use
data and there are sections that explain
how the company uses data for people who
don't have an account um and also in our
conversation with the company that got
back to us to say this is how we use it
um we find that it's still not super
clear um and and sort of like for this
specific behavior that we were observing
um that's a very vague answer but it's
sort of it's like we don't we don't know
what they're doing so we have to because
we don't know you could you can we have
to sort of like trust statements that
are made in the policies and that the
company made elsewhere but what's
interesting the responses to Congress
where Shadow profiling was a big issue
is the response sort of like various
purposes are given and the data is
stored for varying length of time and so
that's why it's very sometimes a bit
tricky to figure out exactly what's
happening with this and we'd appreciate
if that's a bit more transparent yeah
thank you freder CER Christopher
Weatherhead from privacy International
with an amazing
[Music]
[Applause]
[Music]
talk thank
[Music]
you
[Music]
oh