• by Wendy Davis  @wendyndavis, November 14, 2023

The same web browsing data that fuels programmatic advertising could also be used by foreign governments to pressure military personnel and U.S. political leaders, according to a new report by privacy advocacy group Irish Council for Civil Liberties.

“RTB (real-time bidding) data are broadcast without any security measures,” the group writes in its new report, “America's Hidden Security Crisis.”

“After the broadcast there is no way to know or limit how receiving entities handle the RTB data. Nor is there any technical way to stop further distribution of RTB data,” the organization adds.

The Irish Council for Civil Liberties -- which last year described real-time bidding as “the biggest data breach ever recorded” -- says in the new report that data brokers and other ad-tech companies offer audience categories that implicate security concerns, such as “intelligence and counterterrorism,” “military personnel,” and “aerospace and defense.”

The authors claim that such audience information could be combined with other targeting-related data -- like inferences about people's financial situation or health conditions -- in ways that could expose individuals to the risk of blackmail or manipulation.

“Foreign states and non-state actors can use RTB to spy on target individuals’ financial problems, mental state, and compromising intimate secrets,” the report states. “Even if target individuals use secure devices, data about them will still flow via RTB from personal devices, their friends, family, and compromising personal contacts.”

While ad-tech companies say the data that fuels targeting is pseudonymous, the report argues that programmatic data includes information that can result in the identification of specific individuals.

The report also claims Google and other companies that collect programmatic data send information to Russia and China.

Google says it paused ad-serving in Russia in early 2022, and hasn't sent bid requests to Russia-based bidders since then. The company also says it doesn't share sensitive personal data -- such as precise location, race, religion and browsing history -- with real-time bidding buyers, and that its policies prohibit recipients from attempting to identify individuals based on sensitive data inferences.

A Google spokesperson says the report “makes misleading and inaccurate claims about Google.”

“To protect people's privacy, we have the strictest restrictions in the industry on the types of data we share in real-time bidding,” the spokesperson says. “Our real-time bidding policies simply don't allow bad actors to compromise people's privacy and security.”