So, at the very least, the ad network will be able to see your IP and know that you like athletic shoes and visited www.wereallylikeshoes.com. If you visit some other domain first-ad-network.com owns with the same IP whithin a small window of time, it can be pretty confident it's the same person and even store some client side data at that point. It feels like they can construct a reasonably good profile about their users by using that technique. That's considering the browser doesn't leak out any other potentially identifying information.
Then, the actual ad owner could have something in the URL that identifies which campaign you ultimately came from, as they probably know which interest groups they were targeting. So, when you click on the ad, they know one interest about you and, if you clicked in ads from other campaigns they run, they may reconstruct your profile well.
> at the very least, the ad network will be able to see your IP and know that you like athletic shoes and visited www.wereallylikeshoes.com. If you visit some other domain first-ad-network.com owns with the same IP it within a small window of time, it can be pretty confident it's the same person and even store some client side data at that point. It feels like they can construct a reasonably good profile about their users by using that technique.
Yes, there are a lot of user identifying bits in an IP address. Chrome has two proposals: https://github.com/bslassey/ip-blindness I'm not sure what other browsers are thinking?
> That's considering the browser doesn't leak out any other potentially identifying information.
Which they definitely do. All the browsers are working on figuring out how to thwart fingerprinting, and it's really hard. I am glad, at least, that we were able to get Google Ads to publicly commit to not fingerprinting.
> when you click on the ad, they know one interest about you and, if you clicked in ads from other campaigns they run, they may reconstruct your profile well
Yes, when people click on ads in Turtledove the advertiser does learn something. This is a huge improvement to the status quo where advertisers learn things just by bidding, or an intermediate stage where advertisers learn things when they win an auction -- users don't click on ads very often, so the amount of information leaked this way is very low.
Exactly how much information the advertiser is able to learn on a click is still very much up in the air, so if you have views on this you might consider participating on the repo?
I agree that it mitigates the problem, but it does not seem to solve the root cause of it. Aren't ads and ad targeting the main reason why companies want to store and sell that data? Other uses of user data is considered a lot shadier and respectful companies will not engage in them. If we start considering ad targeting to be a shady business practice, we may actually end the incentives for big conglomerates to want to store user data in the first place and thus end up with a system where user profiles are the exception rather than the norm.
In a less techinical point of view, ads are probably a net negative for society. People are buying things they don't need, spending time they could be doing other things and just having a worse experience they could have were not for content farms and other practices incentivised by ads. I do see the value of ads bringing services to people who wouldn't have money to pay for them otherwise, it's income distributions of sorts, but I think we can do better.
Anyway, interesting read about ip blindness. As long as the CDNs and proxies are not controlled by the same company that owns the ad networks, then it could work out. Though it's hard to find the correct incentives for the right people to own the right parts of the network. Another alternative would be something like onion, which is more distributed (although quite wasteful of resources).
* Ads render inside "fenced frames" where they cannot learn what page they are on and the page cannot learn what ad is being shown
* Reporting is available, but it is aggregate-only