U.S. Senator Ron Wyden has released a list of hundreds of secretive, foreign-owned companies that are buying up Americans’ data. Some of the customers include companies based in states that are ostensibly “unfriendly” to the U.S., like Russia and China.
First reported by Motherboard, the news comes after recent information requests made by a bipartisan coalition of U.S. Senators, who asked prominent advertising exchanges to provide a transparent list of any “foreign-headquartered or foreign-majority owned” firms to whom they sell consumer “bidstream data.” Such data is typically collected, bought, and sold amidst the intricate advertising ecosystem, which uses “real-time bidding” to monetise consumer preferences and interests.
Sen. Ron Wyden (D-Oregon), who helped lead the effort, has expressed concerns that Americans’ data could fall into the hands of foreign intelligence agencies to “supercharge hacking, blackmail, and influence campaigns,” as a previous letter from him and other Senators puts it.
“Few Americans realise that some auction participants are siphoning off and storing ‘bidstream’ data to compile exhaustive dossiers about them. In turn, these dossiers are being openly sold to anyone with a credit card, including to hedge funds, political campaigns, and even to governments,” the letter states.
The information requests were sent to large advertising companies, including Google, AT&T, OpenX, Twitter, Verizon, PubMatic, Index Exchange, and Magnite.
In response to the information requests, most companies seem to have responded with vague, evasive answers. However, advertising firm Magnite has provided a list of over 150 different companies it sells to while declining to note which countries they are based in. Wyden’s staff spent time researching the companies and Motherboard reports that the list includes the likes of Adfalcon — a large ad firm based in Dubai that calls itself the “first mobile advertising network in the Middle East” — as well as Chinese companies like Adtiming and Mobvista International.
Magnite’s response further shows that the kinds of data it provides to these companies may include all sorts of user information — including age, name, and the site names and domains they visit, device identifiers, IP address, and other information that would help any discerning observer piece together a fairly comprehensive picture of who you are, where you’re located, and what you’re interested in.
You can peruse the full list of companies that Magnite works with and, foreign ownership aside, they just naturally sound creepy. With confidence-inspiring names like “12Mnkys,” “Freakout,” “CyberAgent Dynalst,” and “Zucks,” these firms — many of which you’d be hard-pressed to even find an accessible website for — are doing God knows what with the data they procure.
The question naturally arises: How is it that these companies that we know literally nothing about seem to have access to so much personal information? Also: Where are federal regulations when you need them?