Doc Searls Weblog

Here’s the popover that greets visitors on arrival at Rolling Stone‘s website:

Our Privacy Policy has been revised as of January 1, 2020. This policy outlines how we use your information. By using our site and products, you are agreeing to the policy.

That policy is supplied by Rolling Stone’s parent (PMC) and weighs more than 10,000 words. In it the word “advertising” appears 68 times. Adjectives modifying it include “targeted,” “personalized,” “tailored,” “cookie-based,” “behavioral” and “interest-based.” All of that is made possible by, among other things—

Information we collect automatically:

Device information and identifiers such as IP address; browser type and language; operating system; platform type; device type; software and hardware attributes; and unique device, advertising, and app identifiers

Internet network and device activity data such as information about files you download, domain names, landing pages, browsing activity, content or ads viewed and clicked, dates and times of access, pages viewed, forms you complete or partially complete, search terms, uploads or downloads, the URL that referred you to our Services, the web sites you visit after this web site; if you share our content to social media platforms; and other web usage activity and data logged by our web servers, whether you open an email and your interaction with email content, access times, error logs, and other similar information. See “Cookies and Other Tracking Technologies” below for more information about how we collect and use this information.

Geolocation information such as city, state and ZIP code associated with your IP address or derived through Wi-Fi triangulation; and precise geolocation information from GPS-based functionality on your mobile devices, with your permission in accordance with your mobile device settings.

The “How We Use the Information We Collect” section says they will—

Personalize your experience to Provide the Services, for example to:

• Customize certain features of the Services,
• Deliver relevant content and to provide you with an enhanced experience based on your activities and interests
• Send you personalized newsletters, surveys, and information about products, services and promotions offered by us, our partners, and other organizations with which we work
• Customize the advertising on the Services based on your activities and interests
• Create and update inferences about you and audience segments that can be used for targeted advertising and marketing on the Services, third party services and platforms, and mobile apps
• Create profiles about you, including adding and combining information we obtain from third parties, which may be used for analytics, marketing, and advertising
• Conduct cross-device tracking by using information such as IP addresses and unique mobile device identifiers to identify the same unique users across multiple browsers or devices (such as smartphones or tablets, in order to save your preferences across devices and analyze usage of the Service.
• using inferences about your preferences and interests for any and all of the above purposes

For a look at what Rolling Stone, PMC and their third parties are up to, Privacy Badger’s browser extension “found 73 potential trackers on www.rollingstone.com:

tagan.adlightning.com
acdn.adnxs.com
ib.adnxs.com
cdn.adsafeprotected.com
static.adsafeprotected.com
d.agkn.com
js.agkn.com
c.amazon-adsystem.com
z-na.amazon-adsystem.com
display.apester.com
events.apester.com
static.apester.com
as-sec.casalemedia.com
ping.chartbeat.net
static.chartbeat.com
quantcast.mgr.consensu.org
script.crazyegg.com
dc8xl0ndzn2cb.cloudfront.net
cdn.digitru.st
ad.doubleclick.net
securepubads.g.doubleclick.net
hbint.emxdgt.com
connect.facebook.net
adservice.google.com
pagead2.googlesyndication.com
www.googletagmanager.com
www.gstatic.com
static.hotjar.com
imasdk.googleapis.com
js-sec.indexww.com
load.instinctiveads.com
ssl.p.jwpcdn.com
content.jwplatform.com
ping-meta-prd.jwpltx.com
prd.jwpltx.com
assets-jpcust.jwpsrv.com
g.jwpsrv.com
pixel.keywee.co
beacon.krxd.net
cdn.krxd.net
consumer.krxd.net
www.lightboxcdn.com
widgets.outbrain.com
cdn.permutive.com
assets.pinterest.com
openbid.pubmatic.com
secure.quantserve.com
cdn.roiq.ranker.com
eus.rubiconproject.com
fastlane.rubiconproject.com
s3.amazonaws.com
sb.scorecardresearch.com
p.skimresources.com
r.skimresources.com
s.skimresources.com
t.skimresources.com
launcher.spot.im
recirculation.spot.im
js.spotx.tv
search.spotxchange.com
sync.search.spotxchange.com
cc.swiftype.com
s.swiftypecdn.com
jwplayer.eb.tremorhub.com
pbs.twimg.com
cdn.syndication.twimg.com
platform.twitter.com
syndication.twitter.com
mrb.upapi.net
pixel.wp.com
stats.wp.com
www.youtube.com
s.ytimg.com”

This kind of shit is why we have the EU’s GDPR (General Data Protection Regulation) and California’s CCPA (California Consumer Privacy Act). (No, it’s not just because Google and Facebook.) If publishers and the adtech industry (those third parties) hadn’t turned the commercial Web into a target-rich environment for suckage by data vampires, we’d never have had either law. (In fact, both laws are still new: the GDPR went into effect in May 2018 and the CCPA a few days ago.)

I’m in California, where the CCPA gives me the right to shake down the vampiretariat for all the information about me they’re harvesting, sharing, selling or giving away to or through those third parties.* But apparently Rolling Stone and PMC don’t care about that.

Others do, and I’ll visit some of those in later posts. Meanwhile I’ll let Rolling Stone and PMC stand as examples of bad acting by publishers that remains rampant, unstopped and almost entirely unpunished, even under these new laws.

I also suggest following and getting involved with the fight against the plague of data vampirism in the publishing world. These will help:

1. Reading Don Marti’s blog, where he shares expert analysis and advice on the CCPA and related matters. Also People vs. Adtech, a compilation of my own writings on the topic, going back to 2008.
2. Following what the browser makers are doing with tracking protection (alas, differently†). Shortcuts: Brave, Google’s Chrome, Ghostery’s Cliqz, Microsoft’s Edge, Epic, Mozilla’s Firefox.
3. Following or joining communities working to introduce safe forms of nourishment for publishers and better habits for advertisers and their agencies. Those include Customer Commons, Me2B Alliance, MyData Global and ProjectVRM.

______________

*The bill (AB 375), begins,

The California Constitution grants a right of privacy. Existing law provides for the confidentiality of personal information in various contexts and requires a business or person that suffers a breach of security of computerized data that includes personal information, as defined, to disclose that breach, as specified.

This bill would enact the California Consumer Privacy Act of 2018. Beginning January 1, 2020, the bill would grant a consumer a right to request a business to disclose the categories and specific pieces of personal information that it collects about the consumer, the categories of sources from which that information is collected, the business purposes for collecting or selling the information, and the categories of 3rd parties with which the information is shared. The bill would require a business to make disclosures about the information and the purposes for which it is used. The bill would grant a consumer the right to request deletion of personal information and would require the business to delete upon receipt of a verified request, as specified. The bill would grant a consumer a right to request that a business that sells the consumer’s personal information, or discloses it for a business purpose, disclose the categories of information that it collects and categories of information and the identity of 3rd parties to which the information was sold or disclosed…

Don Marti has a draft letter one might submit to the brokers and advertisers who use all that personal data. (He also tweets a caution here.)

†This will be the subject of my next post.