Caught Red Handed: Tracing Information Flows Between Ad Exchanges Using Retargeted Ads

Abstract

Numerous surveys have shown that Web users are seriously concerned about the loss of privacy associated with online tracking. Alarmingly, these surveys also reveal that people are unaware of the amount of data sharing that occurs between ad exchanges, and thus underestimate the privacy risks associated with online tracking.

In reality, the modern ad ecosystem is fueled by a flow of user data between trackers and ad exchanges. Although online tracking itself is a well-studied phenomenon, the relationships between trackers and ad exchanges remain opaque, and the implications of this data sharing on user privacy sharing are poorly understood.

In this study, we develop a methodology that is able to detect client- and server-side flows of information between arbitrary ad exchanges. Our key insight is to leverage retargeted ads as a mechanism for identifying information flows. Intuitively, our methodology works because it relies on the semantics of how exchanges serve ads, rather than focusing on specific cookie matching mechanisms. Using crawled data on 35,448 ad impressions, we show that our methodology can successfully categorize four different kinds of information sharing between ad exchanges, including cases were existing heuristic methods fails.

Bio: Christo Wilson is an Assistant Professor in the College of Computer and Information Science at Northeastern University. Professor Wilson's research focuses on Algorithmic Auditing, which is the process of examining black box systems to understand how they work, the data they use, and ultimately how these algorithms impact individuals. To date, he has examined systems like personalization on Google Search, price discrimination in e-commerce, and surge pricing on Uber. Professor Wilson got his PhD from the University of California, Santa Barbara, and his research is supported by the NSF, the European Commission, the Knight Foundation, and the Data Transparency Lab.