> They have access to IP+time, your search query, and
> cookies for correlation to other requests. It's
> valuable information
Valuable for blackmail, but not really useful for anything else; the commercial value of information rapidly degrades over time. Knowing I want to buy a new fridge today is very valuable, knowing I wanted to buy one last month is nearly worthless.
> IP+time is enough to get your personal identity
> information from your ISP (physical location of the
> endpoint, billing information), I have no idea if
> Google's relationship with ISPs is good enough to
> buy that or if it's only available to cops.
Despite what the RIAA think, a user agent's IP is nowhere near accurate enough for use as identification.
I hope that ISPs do not release personal identity or billing data to arbitrary third parties. I know my ISP (sonic.net) claims they don't[1], and even privacy-insensitive companies such as AT&T have privacy policies that would forbid them from selling personal data[2].
Even if it were possible for random companies to obtain personal data from an ISP, I doubt that Google would have any interest in participating.
I love targeted advertising because it is so blatantly obvious and hilariously over-optimistic.
I search for a lot of random crap with more curiosity than intent to buy. I looked up the price for several windmills , the late 19th/early 20th century style, (~$1000, by the way). For weeks or months afterwards, I saw windmill ads on a sizable fraction of the websites I visited.
To be fair, it's far more likely that I am going to by a windmill than a random ad viewer, but the probability is still staggeringly low. There had to be a hundred other products I was more likely to buy than the windmill, that would be more valuable to show me. But no! I had viewed their product and I! Must! Be! Targeted!
I really wonder what the set of products that do well from targeted ads looks like.
It does well because the probability of you buying a windmill multiplied by profit per sale is still more valuable than something non targeted like tampons (some of the advertisers get the numbers wrong but not the ones at scale.)
Interestingly, from the CPMs I've seen re-targeted/re-marketed ads perform on par or below contextually targeted ads. No one even comes close to Google for contextually targeted ad inventory (unless you are operating in a narrow niche and you are selling inventory directly, but lots of time and money to even match them.)
>>Valuable for blackmail, but not really useful
>>for anything else; the commercial value of
>>information rapidly degrades over time.
>>Knowing I want to buy a new fridge today is very
>>valuable, knowing I wanted to buy one last month is >>nearly worthless.
I think that blackmail is already bad enough. Considering which topics somebody might want to learn about on the internet, various diseases for example.
>>I hope that ISPs do not release personal
>>identity or billing data to arbitrary third parties.
I hope that too. But this information is gathered and stored somewhere in flawed systems which are operated by humans which might decide to follow their own interests more than the interests of the customers. I know of at least one story where an employee of a search engine has been using his privileges to stalk other people.
> I hope that ISPs do not release personal identity or billing data to arbitrary third parties.
My ISP, Time Warner/RoadRunner, claims that they will do so. It's kind of ambiguous because their declaration combines several services and kinds of data covered by different laws. I think the applicable part for their cable ISP service is:
In the course of providing Time Warner Cable Services
to you, we may disclose your personally identifiable
information to [...] consumer and market research firms,
credit reporting agencies and authorized representatives
of governmental bodies.
Selling their DHCP logs and customer records to a commercial data aggregator (who could then sell it to anyone) appears to be compliant with their privacy policy.
Valuable for blackmail, but not really useful for anything else; the commercial value of information rapidly degrades over time. Knowing I want to buy a new fridge today is very valuable, knowing I wanted to buy one last month is nearly worthless.
That depends on what they can get out of the data, besides the obvious. I'm thinking of the story about Target knowing that a girl was pregnant before even her father did[1]. Even longer trends can probably be derived, regarding personality traits, income, etc. That information is worth a lot even months or years after it was captured.
"Despite what the RIAA think, a user agent's IP is nowhere near accurate enough for use as identification."
Maybe not when I'm coming from our company's NAT (700+ employees behind a single IP address) - but the number of people on my Comcast connection is limited.
I hope that ISPs do not release personal identity or billing data to arbitrary third parties. I know my ISP (sonic.net) claims they don't[1], and even privacy-insensitive companies such as AT&T have privacy policies that would forbid them from selling personal data[2].
Even if it were possible for random companies to obtain personal data from an ISP, I doubt that Google would have any interest in participating.
[1] https://wiki.sonic.net/wiki/Category:Policies#Privacy
[2] http://www.att.com/gen/privacy-policy?pid=2506