One Company May Know Everything About You

A disturbing story at the intersection of innovations in war and our surveillance economy broke last week. Reuters reported on a letter sent by U.S. Central Command to Sen. Ron Wyden (D-OR) back in April, revealing that U.S. military troop locations had been tracked using commercial location data. Such information collected from phones and other connected devices can uncover patterns and movements to inform attacks on military targets. Wyden told Reuters that we need to “start treating the adtech industry as a national security threat.”

I can’t say that this danger was top of mind for us when we opted out of spying on our readers and eliminated programmatic advertising on prospect.org. But it’s indisputable that carrying around a tracking device in your pocket can lead to a myriad of potential dangers beyond getting a geolocated ad for a nearby restaurant. That this information can be sold to third-party data brokers heightens those threats.

More from David Dayen

There are ways for the military to anonymize data on the devices it requisitions, and discourage use of browsers like Chrome that have surveillance embedded inside them. But endless tracking leads to more quotidian outcomes than deciphering troop movements. And soon, the architecture that makes the tracking work could fall into the hands of a foreign acquirer.

Publicis Groupe is the largest of the Big Three global advertising conglomerates (the others are WPP and Omnicom), and by itself it captured almost one-third of all global billings last year. A couple of weeks ago, Publicis announced its intention to buy LiveRamp in a $2.5 billion deal. This is the company that combines multiple inputs of an individual’s personal data (web activity, subscriptions, apps, travel, retail, financial, and even medical history) to generate an “identity graph,” a precise profile of our lives and actions.

LiveRamp is said to have built identity graphs on 245 million Americans, virtually every U.S. adult. These can be used in any context, from web to apps to smart TVs. “LiveRamp makes possible the data integration empowering cross-platform tracking,” said Jeff Chester of the Center for Digital Democracy. And in the past, it has reportedly sold identity graph information segmented by military or pregnancy status, among others.

Publicis, a French multinational, has been gradually acquiring data firms, from data broker Epsilon to “end-to-end data solution” Lotame. Publicis represents global juggernauts like Coca-Cola and McDonald’s, and its global reach could expand the identity graph everywhere. It is even the largest Western advertiser in China, with about 20 percent of the Chinese media agency market and partnerships with Tencent and Alibaba. Its clients hold massive troves of personal information which LiveRamp can make more valuable through targeting at the individual level.

Regardless of any international ties, the leading ad conglomerate controlling personal data on hundreds of millions of people courts risk on multiple levels. From a market power perspective, Publicis could charge more for access to, or simply hoard, the identity graph to dominate adtech markets. Competitors are already warning about this. Second, identity graphs in centralized hands magnifies the possibility for data breaches. Third, Publicis has misused data before, including an incredible case where it apparently extracted data from recordings between patients and doctors so it could target patients with ads about … OxyContin. That led to a $350 million settlement.

Plus, owning LiveRamp can facilitate Publicis using personal data to set prices. LiveRamp has been experimenting with personalized pricing in “clean room” testing. A recent, revelatory research paper showed that AI chatbots inevitably recommended more expensive products to users when they had an advertising sponsor behind them, while concealing prices when they were higher than alternatives. Imagine Publicis clients using LiveRamp to individualize purchase options, given the experience of these kinds of conflicts.

“Publicis’s takeover of LiveRamp provides a digital data treasure trove of insights on people in the U.S. and elsewhere, part of today’s data arms race empowering the commercial and government surveillance sectors,” said Chester.

State and federal lawmakers have been scrutinizing surveillance pricing in recent months. A crackdown on surveillance pricing that advocates deemed insufficient has passed into law in Maryland, while a more wide-ranging bill advanced through the legislature in Colorado. State attorneys general could get involved in the Publicis-LiveRamp merger.

But because Publicis is a French company, the Committee on Foreign Investment in the United States (CFIUS) must also approve the deal. The national security implications will likely be played up, especially with the recent revelations about commercial advertising data and troop movements. Wyden told the investigative site The Capitol Forum that Publicis-LiveRamp is “exactly the kind of deal CFIUS should be taking a close look at.” The ties between Publicis and China will probably come up too; in previous cases, CFIUS required that a Chinese company divest of their stake in Grindr because of the personal data aspect.

Publicis has expressed a willingness to accept some conditions, but has refused to allow LiveRamp to operate independently, agree to divestitures, or place limits on data sharing and integration.

There are lots of reasons to be concerned about one company gaining control over the precise movements, affiliations, financial transactions, and social links of nearly every American.