In order to place highly-targeted ads in front of internet users, advertising companies are categorising content by ethnicity, sexuality and political message, as well as health conditions including depression, male impotence and “special needs kids”.
Documents filed today as part of a data protection complaint show the thousands of categories Google and the Interactive Advertising Bureau (IAB), the two organisations which set the rules for the ad industry, use to classify content online.
Google marks material under the categories “Native Americans”, “Lesbian, Gay, Bisexual & Transgender”, “left-wing politics”, or “Scientology”.
It also classifies an astonishing range of content about health conditions, including Alzheimer’s, AIDS and HIV, allergies, asthma, arthritis, cold and flu, anxiety and stress, and depression, as well as allowing advertisers to show ads to people based on the categories “Birth Control”, “Male Impotence” and “Unwanted Body & Facial Hair Removal”.
The IAB does the same. One IAB Tech Lab category reads simply “Incest/Abuse Support”, another “Parenting” category is “Special Needs Kids”.
The highly sensitive nature of the categorisation has raised fears that the labels, which are broadcast to hundreds of companies bidding for advertising slots on web pages, could be used to identify individuals internet users.
“Under our data protection laws, there is special protection for data relating to people’s political views, ethnicity, religious beliefs and sexuality,” Damian Collins, chair of the digital, culture, media and sport select committee, told Sky News.
“My concern here is that tech companies are creating profiles of users based on the data trail they leave online and are selling this information to advertisers without the knowledge or consent of these users.”
Mr Collins called for “a thorough review of the digital advertising market”, echoing the data protection activists who uncovered the documents.
“Identifiable data from web browsing is broadcast to as many actors as possible in this marketplace with little practical regard or oversight for how this data is kept confidential and secure, and little ability for consumers to practically understand what is going on,” said Michael Veale, a researcher at University College London, one of the parties in the complaint.
Google and the IAB Tech Lab strongly disputed that their content categories – known in the trade as “content taxonomies” could be used to create profiles of individual users, an act which would violate both firms’ terms of service.
“We have strict policies that prohibit advertisers on our platforms from targeting individuals on the basis of sensitive categories such as race, sexual orientation, health conditions, pregnancy status, etc,” a Google spokesperson told Sky News.
“If we found ads on any of our platforms that were violating our policies and attempting to use sensitive interest categories to target ads to users, we would take immediate action.”
Dennis Buchheim, senior vice president and general manager of the IAB Tech Lab, told Sky News that the lab was designed “to allow for better placement of advertising alongside editorial, including avoidance of sensitive categories”.
However, the data protection activists behind the complaint argue that the content categories are also shared alongside personally-identifying information, including location, device type, and, crucially, historic information in cookies and IDs.
“Labels about what you read and watch online stick to you for a long time,” says Dr Johnny Ryan, chief policy officer at Brave. In December, the New Economics Foundation estimated that ad tech companies broadcast profiles about the typical UK internet user 164 times a day.
Mr Ryan, along with Mr Veale and Jim Killock of the Open Rights Group, argue that these profiles are being gathered by ad tech firms without the consent or knowledge of users, a practice which would be in breach of the GDPR.
The group filed a data protection complaint in the UK and Ireland in September, which they have now updated in Poland, alongside Warsaw-based digital rights organisation the Panoptykon Foundation.