Facebook and Google have ad trackers on your streaming TV, studies find, Ars Technica

        

Modern TV, coming to you over the Internet instead of through cable or over the air, has a modern problem: all of your Internet-connected streaming devices are watching you back and feeding your data to advertisers. Two independent sets of researchers this week released papers that measure the extent of the surveillance your TV is conducting on you. They also sort out who, exactly, is benefiting from the massive amounts of consumer data that is taken with or without consumer knowledge.

The first studyPDF), conducted by researchers at Princeton and the University of Chicago, looked specifically at Roku and Amazon set-top devices. A review of more than 2, 000 channels across the two platforms found trackers on 69% of Roku channels and 89% of Amazon Fire TV channels.

The most prevalent tracker, Google’s doubleclick.net, showed up in 975 of the top 1, 000 Roku channels, with Google analytics trackers showing up in 360, the researchers found. Over on the Amazon side of things, perhaps unsurprisingly, Amazon trackers were the most prevalent, showing up in 687 of 1, 000 channels. Doubleclick trackers were found on 307 channels, and Facebook trackers were on 196.

Tracking not only includes sending information about video titles, which you might expect, but also includes permanent device identifiers and wireless SSID information , the researchers found. A majority of the channels sending information back through trackers sent it unencrypted in plaintext, the researchers also found.

The second studyPDF), conducted by researchers at Northeastern University and Imperial College London, examined a broader range of cloud-connected consumer devices. In addition to the same over-the-top (OTT) plug-in devices the Princeton and Chicago researchers investigated, the Northeastern and Imperial College researchers also looked at several different smart TVs and other devices.

The TVs were the worst for how many “unique third-party destinations” they contact, the researchers found, corroborating the findings that a great deal of data is sent in plaintext. Facebook, Amazon, and Doubleclick were again among the top recipients of consumer data, along with Akamai and Microsoft, which both act as hosting providers, as the researchers note.

Perhaps most surprising, however, was Netflix. “Nearly all TV devices in our testbeds contact Netflixeven though we never configured any TV with a Netflix account, “the researchers write (emphasis theirs). “This, at the very least, exposes information to Netflix about the model of TV at a given location,” if not more.

An old problem, getting worse

The companies that make and distribute content have always sought as much granular data as possible about the way consumers consume. For markets based on ad sales, the measurement makes sense — how much you can charge a company to place an ad depends in large part on how many eyeballs its ad can be expected to reach.

The dominance of that model applies across all media types that need to make money, which is all of them. A newspaper company has always been able to tell how many issues it sells in a day or a week, and it has been able to tally some data on its subscriber base. A digital media outfit knows very well how many people read a story or watch a video. Television is, of course, no different. Quantification powerhouse Nielsen launched its TV ratings service — a massive audience measurement tool — back in 1950.

The digital revolution, however, has made data gathering extremely precise, granular, and permanent, with extremely troubling implications for user privacy . The pair of research papers makes clear to what degree user tracking happens and certain mechanisms through which it happens, which is useful information to have. But it’s not new, and business is proving slow to change since it has a financial incentive not to.

A deep dive by ProPublica (back in) drew attention to highly detailed consumer tracking by TV manufacturer Vizio. The company eventuallyreached a settlement with the Federal Trade Commissionin 2017 over the allegations that it tracked 11 million viewers’ usage data without knowledge or consent. Vizio also faced a class-action suit about the tracking, and the company used the TV displays themselvesto inform device owners about the activity.

Consumer options

Other than opting out of the 21 st-century media landscape entirely, consumers’ options for preventing the trackers from scooping up and sharing information are extremely limited, both studies found.

Past research finds that “viewers find sharing of their data with advertisers unacceptable,” the Princeton study concluded. But “our findings show that such concerned users have limited options at their disposal. As emerging platforms, OTT services lack tools, controls, and countermeasures available on the Web and mobile platforms.”

Even folks who are familiar with ad-blocking services on their computers and mobile devices can’t do much about it on a TV device, the researchers found. “Widespread collection of persistent device identifiers like MAC addresses and serial numbers disables one of the few defenses available to users: resetting their advertising IDs.”

Users can use options to limit ad tracking on Roku devices or disable interest-based ads on Amazon Fire TV devices, the study said. Enabling “limit ad tracking” on a Roku reduced the number of advertising ID leaks to zero “but did not affect the number of trackers contacted by the channels.” Disabling interest-based ads on a Fire TV, meanwhile, caused 50% fewer channels to leak advertising ID information, but “the remaining traffic, including the other identifiers communicated to trackers, remained largely the same. “

Owners of smart TV sets can delvedeep into their device’s settingsto find options, which may include disabling automatic content recognition or limiting the use of personalized ads. Available options vary by device manufacturer.