Cross-device tracking is technology that enables the tracking of users across multiple devices such as smartphones, television sets, smart TVs, and personal computers.
Cross-device tracking is a technique in which technology companies and advertisers deploy trackers, often in the form of unique identifiers, cookies, or ultrasonic signals, to generate a profile of users across multiple devices. Cross-device tracking can use audio beacons, or inaudible sounds, emitted by one device and recognized through the microphone of the other device.
This form of tracking is used primarily by technology companies and advertisers who use this information to piece together a cohesive profile of the user. These profiles inform and predict the type of advertisements the user receives.
Background Online tracking can be performed in many ways. One historical method used website sign-ins to associate activity with an account. This is a form of deterministic cross-device tracking, in which the user's devices are associated with their account credentials, such as their email or username. While the user is logged in, the company can access a history of websites visited and ads the user interacted with across computers and mobile devices.
Cookies were later deployed by advertisers, providing each user with a unique identifier in the user's browser so that the user's preferences could be monitored. This unique identifier informs the placement of relevant, targeted ads the user may receive. Cookies were also used by companies to improve the user experience, enabling users to resume activity on websites. However, as users began using multiple devices—up to around five—advertisers had difficulty tracking, managing, and consolidating this data across multiple devices as the cookie-based model suggested that each device—whether a phone, computer, or tablet—was a different person.
Other technologies such as supercookies, which stay on computers long after the user deletes their cookies, and web beacons, which are unique images from a URL, are also used by trackers and advertisers to gain increased insight into users' behavior. However, advertisers were still limited in that only one device was able to be tracked and associated with a user.
Cross-device tracking initially emerged to associate a user's activity across multiple devices with a single profile.
Browser fingerprinting can be used to identify users based on distinctive browser and device characteristics. It has raised privacy concerns because of its effectiveness and because users may have limited ability to opt out of this type of tracking.
Google's AdID can be used on smartphones in combination with cookies on a user's computer to track behavior across devices.
One cross-device tracking method uses audio beacons, or inaudible sounds, emitted by one device and recognized through the microphone of another device, usually a smartphone. Cross-device tracking has also been discussed in relation to the Internet of things (IoT), in which devices such as office equipment, cars, and home appliances are connected through the internet.
Applications Studies have shown that 234 Android applications are eavesdropping on these ultrasonic channels without the user's awareness.
Applications such as SilverPush, Shopkick, and Lisnr are part of an "ultrasonic side-channel" in which the app, often unbeknownst to the user, intercepts ultrasonic signals emitted from the user's environment, such as from a TV, to track which advertisements the user has heard and how long the person listened to them.
SilverPush—the leading company using this technology—patented software enabling them to track TV ads based on audio stream above Shopkick, another popular application, gives discounts to users who shop at stores which emit these ultrasonic beacons, allowing them to create a profile of the user Lisnr uses a user's location data in tandem with ultrasonic beacons to give users coupons related to their activities
Another study suggested that Apple, Google, and Bluetooth Special Interest groups need to do more to prevent cross-device tracking.
Privacy and surveillance concerns
Ultrasonic tracking Humans interpret sound by picking up on different frequencies. Given the variety of sound waves that exist, humans can only hear frequencies that are within a certain range––generally from 20 Hz to 20 kHz. By the age of 30, most humans cannot hear sounds above 18 kHz.
Ultrasound, which is shorter wavelengths greater than or equal to 20 kHz, enables the rapid transmission of data necessary for cross-device tracking to occur.
Another integral component of cross-device tracking is the usage of audio beacons. Audio beacons are beacons that are embedded into ultrasound, so they cannot be heard by humans. These audio beacons are used to surreptitiously track a user's location and monitor online behavior by connecting with the microphone on another device without the user's awareness.
In October 2015, the Center for Democracy and Technology submitted comments to the Federal Trade Commission (FTC) regarding cross-device tracking technology, specifically mentioning SilverPush.
Audio "beacons" can be embedded into television advertisements. In a similar manner to radio beacons, these can be picked up by mobile apps. This allows the behavior of users to be tracked, including which ads were seen by the user and how long they watched an ad before changing the channel.
In March 2016, the FTC issued warning letters to 12 app developers using cross-device tracking in their apps. The FTC warned these developers that they may be violating the FTC Act if they state or imply that their apps are not tracking television viewing habits when they in fact are.
Cross-device tracking has privacy implications and allows for more detailed tracking of users than traditional tracking methods. Data can be collected from multiple devices used by a single user and correlated to form a more accurate picture of the person being tracked. Moreover, malicious actors may use variants of the technology to de-anonymize anonymity network users.
Ultrasonic tracking technologies can pose massive threats to a user's privacy. There are four primary privacy concerns associated with this new form of tracking:
The first is media tracking: audio from the user's television may be detected by the microphone in the user's mobile device, allowing malicious actors to gain access to what the user is watching––particularly if it is salacious. Advertisers can similarly gain insight into what a user typically watches. In both scenarios, a user's real-world behavior is linked to their online identity and used for tracking. Another form of tracking permitted by ultrasonic tracking is cross-device tracking, which enables a user's profile to be connected across multiple devices based on proximity. This form of tracking, in linking different devices, can help advertisers show more targeted ads or open individuals to attacks by malicious actors. Location tracking is yet another privacy concern. Indeed, ultrasonic signals can convey location information via a location identifier, often placed in stores or businesses. Lastly, this new ultrasonic tracking poses a threat to users of Bitcoin and Tor because it de-anonymizes a user's information, since ultrasonic signals associate the user's mobile phone with the Bitcoin or Tor account.
Panoptic surveillance and the commodification of users' digital identity From cookies to ultrasonic trackers, some argue that invasive forms of surveillance underscore how users are trapped in a digital panopticon, similar to the concept envisioned by Jeremy Bentham: a prison in which the prisoners were able to be seen at all times by guards but were unable to detect when, or even if, they were being watched at all, creating a sense of paranoia that drove prisoners to carefully police their own behavior. Similarly, scholars have drawn parallels between Bentham's panopticon and today's pervasive use of internet tracking in that individuals lack awareness to the vast disparities of power that exist between themselves and the corporation to which they willingly give their data. In essence, companies are able to gain access to consumers' activity when they use a company's services. The usage of these services often is beneficial, which is why users agree to exchange personal information. However, since users participate in this unequal environment, in which corporations hold most of the power and in which the user is obliged to accept the bad faith offers made by the corporations, users are operating in an environment that ultimately controls, shapes and molds them to think and behave in a certain way, depriving them of privacy.
In direct response to the panoptic and invasive forms of tracking manifesting themselves within the digital realm, some have turned to sousveillance: a form of inverse surveillance in which users can record those who are surveilling them, thereby empowering themselves. This form of counter surveillance, often used through small wearable recording devices, enables the subversion of corporate and government panoptic surveillance by holding those in power accountable and giving people a voice––a permanent video record––to push back against government abuses of power or malicious behavior that may go unchecked.
The television, along with the remote control, is also argued to be conditioning humans into habitually repeating that which they enjoy without experiencing genuine surprise or even discomfort, a critique of the television similar to that of those made against information silos on social media sites today. In essence, this technological development led to egocasting: a world in which people exert extreme amounts of control over what they watch and hear. As a result, users deliberately avoid content they disagree with in any form––ideas, sounds, or images. In turn, this siloing can drive political polarization and stoke tribalism. Plus, companies like TiVO analyze how TV show watchers use their remote and DVR capability to skip over programming, such as advertisements––a privacy concern users may lack awareness of as well.
Some scholars have even contended that in an age of increased surveillance, users now participate online through the active generation and curation of online images––a form of control. In so doing, users can be seen as rejecting the shame associated with their private lives. Other scholars note that surveillance is fundamentally dependent upon location in both physical and virtual environments. This form of surveillance can be seen in travel websites which enable the user to share their vacation to a virtual audience. The person's willingness to share their personal information online is validated by the audience, since the audience holds the user accountable and the user vicariously experiences pleasure through the audience. Further, users' mobile data is increasingly being shared to third parties online, potentially underscoring the regulatory challenges inherent in protecting users' online privacy.
In addition, scholars argue that users have the right to know the value of their personal data. Increasingly, users' digital identity is becoming commodified through the selling and monetizing of their personal data for profit by large companies. Unfortunately, many people appear to be unaware of the fact that their data holds monetary value that can potentially be used towards other products and services. Thus, scholars are arguing for users' to have increased awareness and transparency into this process so that users can become empowered and informed consumers of data.
Surveillance capitalism