134

This is pretty much a follow-up to this meta announcement by SE. Ideally that announcement would have resolved the issue, but the language in it was vague and evasive, and there have been no clarifications by SE in the 2.5 weeks since it was posted.

The trigger for this issue was a report that one of the ads on SO was trying to start an audio context in the browser. One of the answers shows that the main purpose of the suspect script is to fingerprint the browser. I looked a bit at that script myself, and that ad contains a ~80 kB minified Javascript file that really looks like the only purpose of it is to query all kinds of obscure details about the environment, and I can't see any other purpose for this except tracking users without the restrictions cookies or other systems impose.

The original response from Stack Exchange was the following:

We are aware of it. We are not okay with it.

This is still there on the original post and not retracted. The later meta post by SE paints an entirely different picture. It is evasive and in my opinion missing the point entirely. The Stack Exchange response claims that no PII is collected, which is really not what this is about. Fingerpinting is about being able to track a user across sites without the browser security getting in the way, identifying the user is a separate process. You don't have to collect PII to fingerprint users, but it's still a very invasive thing to do with a drastic effect on the privacy of users.

The Stack Exchange response also claims that the ads comply with some advertisments standards and other regulations. As far as I can tell this is simply repeating the claims of the ad tech provider. But it's also avoiding the original question, are those ads fingerprinting Stack Exchange users and tracking them across sites?

So I'll request a response from SE on the following questions specifically to clarify the, at least to me confusing previous response:

  • are ads that create fingerprints of the browser environment considered acceptable by SE?
  • are ads that use fingerprinting to track users across sites considered acceptable by SE?
  • does SE consider the activity of the ad mentioned in the original meta post either fingerprinting or tracking across sites?
  • if SE is allowing ads to fingerprint and track users, how can this be reconciled with the SE privacy policy?
Improve this question
9
  • 2
    Its worth remembering nick's SRE and he's trying to build some mititgations in from what he said on twitter. Juan's a CM. Practically - the folks making these decisions are in another team altogether.
    – Journeyman Geek Mod
    Sep 3, 2019 at 4:13
  • 7
    You don't have to collect PII to fingerprint users, but it's still a very invasive thing to do with a drastic effect on the privacy of users. Once information becomes sufficient to fingerprint users, doesn't that make it PII by definition?
    – JAD
    Sep 3, 2019 at 6:36
  • @JAD the subtle difference is this is the "same user" versus this "same user" is JAD. The former is not considered to be PII.
    – rene
    Sep 3, 2019 at 7:02
  • 2
    @rene Fair enough, but I'm not 100% convinced GDPR cares about that distinction. The former can easily be augmented to the latter once "same user" logs in to facebook for example.
    – JAD
    Sep 3, 2019 at 7:15
  • 9
    @rene iirc it just needs to be personally identifiable. So "this user with the browser specs x, y, z and a1-a9001 which is enough to distinguish them from any other user" is PII as far as I can tell (GDPR perspective, anyways)
    – Magisch
    Sep 3, 2019 at 7:20
  • @Magisch that is interesting. I'll take this with me to the DPO I have a meeting with shortly.
    – rene
    Sep 3, 2019 at 7:43
  • 6
    @rene a real or pseudonym name is not required for information to be PII. If I have enough data points to know if it is you, the individual officially known as rene, then it is PII, even if I do not have that official name and your alias is only 492304923 or any other ID in my system. The key crux is that the information could be reasonably used to personally identify you and distinguish you against others. It's the uniqueness that makes it PII, not a name. Same reason what SE has about me being PII, despite them not having my full name anywhere.
    – Magisch
    Sep 3, 2019 at 7:49
  • 4
    @Magisch I find it best to avoid the term “PII” in a GDPR context because it doesn't imply the full breadth of the personal data definition: any information relating to an identifiable natural person. But what the GDPR says isn't that relevant here, as the requirements from the ePrivacy directive are more interesting: when accessing the user's device for non-necessary reasons (whether with cookies, fingerprinting, or similar technologies) the site needs to collect consent first. Of course, literally no one does that properly.
    – amon
    Sep 3, 2019 at 9:08
  • Thank you for raising this important issue. I encourage everyone to use something like uBlock origin addon on Firefox when using any website, to minimize being tracked.
    – brett
    Oct 12, 2019 at 22:33

2 Answers 2

Reset to default
7

From the privacy policy:

In providing this opportunity, Stack Overflow and its third party partners may collect and use your personal information to tailor your advertising experience to suit your interests, skills, as well as to monitor your account activity in order to optimize our Products and Services.

We seek to limit what information advertisers and similar third parties have access to, as well as to ensure that your user experience on the public and private Stack Overflow network is not overwhelmed by advertising initiatives. However, our advertising products and services require us to collect certain personal and non-personal information on you, which includes:

  • Data from advertising technologies like cookies, web beacons, pixels, ad tags, and browser/device identifiers
  • Information you have provided to us directly including profile information, your Developer Story, and in limited instances your job history
  • Usage analytics including your visits to the Network, browsing and search history
  • Information from our advertising partners (e.g., device type and location)

So it looks like yes, but it would be interesting to get the official response.

Improve this answer
7
  • 3
    I'm not a lawyer, but I'd expect that clause to cover stuff like user agent, screen resolution and similar stuff, but not the kind of fingerprinting the ad in question actually did.
    – Mad Scientist
    Sep 2, 2019 at 21:41
  • 10
    Another option is that it's just a CYA clause that's never meant to actually have any effect. But, once again, that's just wishful thinking.
    – John Dvorak
    Sep 2, 2019 at 21:42
  • 34
    The ToS says one thing, an employee says a different thing, and a different employee attempts to lie. The three sources combined contradict each other - one says it happens, one says it shouldn't, and one pretends it doesn't happen. We have no idea where the company really stands unless they provide a canonical answer.
    – Zoe
    Sep 8, 2019 at 11:19
  • 7
    @PrincessOlivia I think what we're seeing is the insanity that comes from having established a particular mission and then building a revenue stream that conflicts with with that mission. If SO is like so many other companies, executives who favor the company (thus protecting its revenue stream) will inevitably end up in power over those who favor the mission.
    – Roy Tinker
    Sep 23, 2019 at 19:45
  • 2
    The obvious solution is to stop relying on the benevolence and competence of the entire Internet, and install a suite of blocking extensions that blocks most of this without breaking too much. uBlock Origin with just the basic lists + PrivacyBadger seem to be a good pair.
    – Jan Schejbal
    Sep 23, 2019 at 21:04
  • 1
    IANAL But as a EU citizen with GDPR I should be able to get access to that data of me. Anyone tried that?
    – aggsol
    Sep 24, 2019 at 6:59
  • 2
    The way described here does not constitute a valid consent under EU law. Something everybody already knew but now has a EU court ruling. This implies there is currently no valid consent and secondly the statement in it's current form wouldn't meet the minimum requirements for being clear and unambiquous ( iapp.org/news/a/cjeu-clarifies-cookie-consent-requirements ) So unless SE can succesfully argue it isn't bound by the GDPR and ePrivacy directitive (I can't determine that on the spot) it is currently in violation for it's EU based users (as are many other sites)
    – Eddy
    Oct 21, 2019 at 14:43
4

The nature of almost every ad network is that you allow third-party content into your site under specific conditions and agreed upon guidelines (example: no un-initiated sound, no auto-play video etc.).

In this case it appears that SE/SO does have policies in place.

However, at the end of the day SE, like any site that has ads, can only be reactive when ads that violate their policy appear. Its a game of whack-a-mole. They can only report user complaints to their third-party which might be able to locate that ad campaign and target it away if they were given enough information to identify the ad (screenshot etc).

This is the state of advertising on the internet and not a SE specific issue. Pretty bad overall.

I'm not justifying SE in this (though I feel their hands are tied as the recourse available is limited) but the issue is probably happening a level beyond the ad network too.

Improve this answer
3
  • 3
    Your explaination is a prime reason why third party ad networks are unacceptable to use for any website in any context.
    – Magisch
    Sep 24, 2019 at 9:47
  • There was a technology (I think it was from Douglas Crockford / Yahoo) called Adsafe that was meant to allow third party code in websites to run in a sort of sandbox. The ads didn't have direct access to global objects or the DOM, instead they had to do things through specific APIs. adsafe.org.
    – rjmunro
    Sep 24, 2019 at 13:08
  • According to the official statement, they are completely aware of this and find it ok: This is a normal and standard practice for digital advertising. (...) We're therefore going to continue to allow our advertisers to use IAS"
    – vgru
    Oct 3, 2019 at 22:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .