Privacy Not Included (Workshop Outline)

Description

Title: Privacy Not Included
Date: 9/18
Location: 10C
Summary:

Personal data is constantly being collected, shared, and monetized—almost entirely without our knowledge or consent.

What does that mean? Should we care? Can we do anything about it?

We'll talk about how this data collection works, how data is used, and what impact this can have. Then we'll talk about what you can do about it.

Recommended but optional: Bring a Laptop

Spreadsheet

The Big Privacy Spreadsheet

Past

OPSEC workshop description 2025

00. Guess My Data

Go to Google's My Ad Center or Facebook's Ad Preferences to see what these platforms see as your interests

0. Intro

The World's most valuable resource is no longer oil, but data (The Economist)
Types of data brokers:
- People search services
- Marketing data brokers: Gather large amounts of data about your online activity and put it into pools of certain behaviors, also called inferred data
- Financial information data brokers: Credit reporting bureaus, dominated by three companies (Equifax, TransUnion, and Experian)
- Risk mitigation data brokers: Tracks identity of people, for preventing fraud, performing background checks
- Personal health data brokers: track health-related data that is not covered by HIPAA, like medical related search history, purchases of over-the-counter medication (very creepy in my opinion)
Data Broker market size:
- $252.12 Billion in 2023
- $277 Billion in 2024
- $363.4 billion in 2026
- Projected to be $519 b i l l i o n b y 2030] (h t t p s : / / w w w . r e s e a r c h a n d m a r k e t s . c o m / r e p o r t s / 6089979 / d a t a - b r o k e r - m a r k e t - r e p o r t) o r [$ or $500 Billion by 2033
Average person in the US generates $700+ per year (Proton, 2022 numbers)
Acxiom made $617 million in 2023 (Zippia)
- Acxiom averages 1500 data points per consumer, and consumers are then places in one of 7018 detailed socioeconomic cluster (visual.ly)
These statistics do not account for the market size of dark markets
Data brokers are used for:
- Selling you things
- Information research
- Identity verification
- fraud prevention
- background checks
- targeted political ads

Largest Data brokers as of 2025

Company	Headquarters	Revenue	Data Coverage	Specialties	Notable Facts
Experian	Dublin, Ireland	$7.1B	300M U.S. consumers, 25M businesses	Credit reporting, marketing data, identity verification	Offers Mosaic consumer profiles; major credit bureau
Equifax	Atlanta, GA, USA	$5.1B	220M consumers, 33M businesses	Credit scoring, employment data, fraud detection	Over 800 audience segments; suffered a major breach in 2017
Epsilon	Irving, TX, USA	$2.9B	250M U.S. consumers	Consumer behavior, purchase intent modeling, personalized advertising	Owned by Publicis Groupe; works with major brands like McDonald’s
Acxiom	Conway, AR, USA	$2.7B	260M individuals, 190M households	Demographic profiling, identity resolution, data onboarding	Division of Interpublic Group; known for deep consumer behavioral analytics
CoreLogic	Irvine, CA, USA	$1.0B	134M U.S. property addresses	Property records, location intelligence, mortgage analytics	Leading provider of real estate and insurance risk data
TransUnion	Chicago, IL, USA	$3.7B	200M U.S. consumers	Credit reporting, identity protection, audience targeting	Part of the "Big Three" credit bureaus; integrates with digital marketing platforms

I. Your data trail

Public data
- Court records: Marriage certificates, criminal records
- Voter registration data
- DMV records
Searching the Internet: As you browse, various mechanisms track your activity across websites in order learn about your behavior, interests, location, etc.
- Cookies: Small text files a website stores in your browser.
  - First-party cookies: Set by the site you're visiting
  - Third-party cookies: set by a domain other than the one you're on (usually an ad network embedded in the page) — these are what let an ad company see you across many different sites
- Tracking pixel
- Local/browser storage APIs
- Third-party scripts and trackers: JavaScript from ad networks, analytics providers (Google Analytics, Meta Pixel), or "session replay" tools embedded on a page.
- Referrer headers: When you click a link, your browser tells the destination site what page you came from — this can leak search terms, account info in a URL, or browsing paths between sites.
- Real-time Bidding (RTB) (ad auctions): Every time a page loads an ad slot, your data (approximate location, device ID, browsing context) is broadcast to potentially hundreds of ad exchange participants in a fraction of a second to bid on showing you an ad — even if no one wins, that data has already been shared.
Your smartphone, from both active use as well as passive collection as you walk around with it. Mechanisms that still work while the phone is locked:
- Wi-Fi/Bluetooth scanning: Phones probe for known networks and devices in the background. Modern iOS/Android randomize the Wi-Fi MAC address during these probes specifically to blunt retail tracking, but Bluetooth beacon detection still functions
- Background location updates: apps granted "Always" location permission keep receiving location via low-power APIs (geofencing, significant-location-change triggers) without the screen ever turning on
- Push notifications: silently wake an app briefly to sync data or check in, even with the screen off
- Motion sensors: accelerometer/gyroscope data collection (step counting, fall detection). It's tracked as a distinct "motion & fitness" permission on iOS, is often less scrutinized than camera/mic
- Voice assistant wake-word detection: if enabled, a low-power on-device process is listening for "Hey Siri"/"Hey Google"
- Find My Device / Find My iPhone-style networks: broadcasts a low-energy Bluetooth signal that nearby strangers' phones can relay to locate a device.
IRL: Participation in loyalty programs, passing by a billboard, etc.
Vehicles:
- mileage
- trip duration
- weight in seats
- precise geolocation
- current radio station
- connected devices
- infotainment system usage
- phone statuπs
- gas / break pressure
- current speed
- turn signal usage
- steering wheel rotation

All this data builds a fuller picture of who you are, where you go and when, and what you value.

The Data

Types of data:

1. Direct identifiers

Information that identifies someone on its own, no additional data needed.

Full name, government ID numbers (SSN, passport, driver's licenseState DMV's were found to be selling data about citizens to private investigators, journalist Joseph Cox reported.)
Email address, phone number, home address
Biometric data (fingerprints, facial recognition data, retina scans)
Photos/video that clearly show a person's face

2. Indirect / quasi-identifiers

Not identifying alone, but can pinpoint someone when combined with other data (this is the classic "anonymized data isn't really anonymous" problem).

Date of birth, gender, ZIP/postal code
Occupation, employer
IP address, device ID, browser fingerprintMore info about the kinds of data Google or Facebook collects from your device
Approximate location historyLocation data alone was an estimate $21 billion market, foot traffic patternsHow foot traffic data and location data are used

3. Financial information

Bank account and credit card numbers
Income, credit score, transaction history
Tax ID numbers

4. Health information

Medical records, diagnosesGrindr admitted to sharing the HIV status of its users with marketing companies., prescriptions
Insurance information
Fitness/biometric tracking data (often overlaps with wearables)

5. Sensitive/special category data
Many privacy laws (GDPR Article 9, for example) single these out for extra protection.

Race or ethnicity
Religious or philosophical beliefs
Political opinions
Sexual orientation and gender identity
Trade union membership
Genetic data
Criminal history

6. Online/behavioral data

Browsing history, search queries
Cookies and tracking pixels
Ad clicks, viewing times
Social media activity (likes, follows, comments...)
Purchase history and preferences

7. Employment/education records

Employment history, performance reviews
Educational records, transcripts, grades

8. Children's data

Often called out separately because of laws like COPPA — usually a stricter consent bar than adult data.

II. How your data are collected

A. Online Activity

Web browsing (cookies, trackers, fingerprinting)
Google search queries and clicks
Social media engagement (likes, follows, comments, quizzes filled out for fun)
User profile data
Personal data given when forms are submitted (address, age, social security)

B. Mobile Devices

GPS/location data from apps
- Your location can be inferred even when your GPS is off
App usage & behavior
- Which apps you open and when
- Time spent in each app
- Taps, scrolls, and interactions within apps
- In-app purchases or subscriptions
“Permissions” creep (e.g. flashlight apps needing mic access)
Motion/activity sensors
- Accelerometer, gyroscope, magnetometer (movement & orientation)
Bluetooth and Wi-Fi signals
Media & camera access
- Photos, videos, and metadata (e.g., geotags)
- Camera and microphone access
- Screenshots or screen recordings (in rare or malicious cases)

C. Offline Sources

Loyalty cards and credit card purchases
Cars
Public records (property, voter registration, etc.)
Data broker aggregation from multiple datasets

D. Devices and IoT

Smart home devices (thermostats, TVs, speakers, voice assistants)
Wearables and fitness trackers
Cars with onboard diagnostics or connected services

🎯 III. The Buyers

A. Advertising and Marketing

Targeted ads based on behavior, location, or psychographicsSignal employed these techniques in an Instagram ad campaign to show IG users how granular their metrics were. IG disabled the ad campaign immediately.
Personalized product recommendationsSendPulse's examples of Targeted Advertising
Influencing purchasing decisions and emotions
Evidence of "Active Listening" leakedThe Guardian and NY Post reported on this leak of a slide deck advertising software that targets adverts based on what people say near their device microphones

B. Risk Scoring and Profiling

Insurance premiums
Loan and creditworthiness evaluationThis has included targeted predatory lending. World Privacy Forum
Employment screening

C. Political Influence

Voter profiling and microtargetingThe Cambridge Analytica scandal was a well-known example where a Facebook quiz funneled the data of 87 million users to a political marketing company, who then used the data to advertise to people deemed "persuadable"The Brexit part (later AKA Reform UK) used Facebook advertising, breaking electoral laws and used their website to track private data of users without consent
Disinformation campaigns tailored to psychological profiles
Examples:
- Reform UK (Brexit party) tracked private user info without consent (Guardian, 2024)
- Cambridge Analytica (Guardian, 2018)
- Facebook-Cambridge Analytica data harvesting

D. Surveillance and Law Enforcement

Law enforcement purchasing location or facial recognition data
Protest tracking and dragnet surveillance
Examples:
- Anyone Can Buy Data Tracking US Soldiers and Spies to Nuclear Vaults and Brothels in Germany - WIRED
- Immigration enforcement agencies are purchasing location tracking software - 404 Media

IV. Consequences

Data Breaches: A breach of Gravy Analytics’ huge trove of location data threatens the privacy of millions - TechCrunch - The government took action and then it got hacked anyway:
- A location data broker that tracked ~1 billion mobile devices daily was hacked, exposing terabytes of precise GPS histories.
- A hacker claimed to have stolen several terabytes of consumers' data, including historical location data of millions of smartphones.
- Weeks earlier, the FTC had accused the company of unlawfully selling sensitive characteristics like health decisions, political activities, and religious viewpoints derived from location data.
- This was the FTC's fifth action that year against data aggregators for sensitive location data misuse.
Identity Theft and Fraud
- Dark web markets sell leaked data, hacked accounts, credit card numbers, etc.Privacy Affairs has tracked what "goods and services" go for on the Dark Web markets year by year. Dark Web Price Index for 2023
- Leaked data is then reused in phishing, synthetic ID creation, or account takeovers
Stalking & doxxingA Catholic news organization tracked a priest's use of Grindr and outed him (via Vox)
Surveillance by local law enforcement, federal law enforcement, intelligence agencies, immigration enforcement agencies
Surveillance by foreign actors - they have also found ways to collect or purchase this data
Manipulation of beliefs & behavior
Loss of autonomy
...And of course better ad recommendations

B. Regulatory Catch-up

Various states (e.g. California, New Jersey, Vermont, and Connecticut) have enacted their own laws regulating data brokers and implementing fines for noncompliance.

The cycle often looks something like: Collection → sale (often to government or ad-tech) → Data breach → Regulatory catch-up (often too slow or easily worked around)

V. What You Can Do About It

It is impossible to be completely invisible in the digital world and many of these suggestions do take a certain amount of work. However, some of these require little work and have significant effect. It's up to you how much you care about preventing further damage.

Data Privacy Strategy

No one is perfect. Just do what you feel is appropriate for you.

Five main identifiers used to define you

Email address
Phone number
Debit card
Browser
Your device (smartphone, laptop)

Main Strategies

1. Reduce data collection at the source

Use a privacy-respecting browser
- Brave, Firefox with strict tracking protection on,
- Install tracker/ad blockers (uBlock Origin) — blocks pixels, most ad-tech, and many fingerprinting scripts
- Disable third-party cookies; regularly clear cookies/local storage
Turn off ad personalization in Google, Meta, Apple account settings
Deny app permissions by default (location, contacts, mic) and grant only when actively needed, not "always"
Audit your smartphone privacy settings
Use email image-blocking or a client that proxies images (Apple Mail Privacy Protection, Gmail's proxy) to defeat pixel tracking
Opt out of data collection settings buried in smart TVs, IoT devices, and car infotainment systems (these are major, under-discussed collectors)
Choose "dumb" devices over "smart" ones. No one needs a refrigerator that connects to the Internet.

2. Break linkability (stop data brokers from "identity stitching")

Use unique email aliases per service (SimpleLogin, Firefox Relay, Apple Hide My Email) so a breach or resale doesn't tie back to one address (see Email Privacy)
Use a password manager with unique logins - Reused credentials are a linkage vector
Pay with virtual/masked card numbers (Privacy.com or Halocard) to avoid one card number tying purchases together. Some credit card providers, like Capital One, provide virtual cards natively in their service.
Use a VPN to decouple browsing from your home IP (note: shifts trust to the VPN provider — worth a nuance point in the workshop)
Avoid "Sign in with Google/Facebook" - it links account activity across unrelated services
Use separate browser profiles or containers (Firefox Multi-Account Containers) to compartmentalize shopping vs. social vs. banking

3. Remove/limit existing exposure

Submit opt-out/deletion requests to data brokers (or use a service like Optery, DeleteMe, or Consumer Reports' Permission Slip that automates this. California residents, use DROP service to automate this.
Exercise legal rights where available: GDPR "right to erasure" (EU), CCPA "right to delete" (California)
Freeze credit reports at all three bureaus to blunt identity-theft use of leaked data
Google yourself periodically and request removal of sensitive results (Google has a form for this)
Check "Have I Been Pwned" and rotate passwords/security questions on flagged accounts

4. Reduce the "surface area" you expose

Minimize what you share on social media (birthdate, location tags, employer): these feed both direct profiling and social-engineering/security-question guessing
Use Virtual phone numbers (Google Voice, MySudo) for signups that demand a number
Decline loyalty programs/surveys that trade discounts for detailed personal data, or use a minimal/generic identity for them
Review and prune app permissions and connected third-party apps (OAuth grants) periodically — these often persist long after you stop using a service - see

5. Behavioral/operational habits

Read privacy policies for data sharing/selling clauses specifically (skip to that section rather than the whole doc). See Mozilla's Nothing Personal for product reviews that focus on respect for privacy
Use "does this need to know that?" as a gut check before filling out forms
Segment your identity: a "public" persona for social/professional life vs. a more guarded one for everything else

Check out orgs like...

Electronic Frontier Foundation
Privacy Rights Clearinghouse
World Privacy Forum
The Center for Democracy and Technology
Nothing Personal and ToSDR are both sites designed to rate/review common products based on how they handle their customers' privacy

Conclusion

We're sold a world of convenience and connection, but the real cost is our autonomy. These systems are designed to erode your autonomy by limiting choices and strip away your agency by obscuring how they operate.

“Arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say.”
— Edward Snowden, NSA whistleblower

“If we don’t act to protect privacy, we risk living in a world where our lives are governed not by laws, but by corporate terms of service.” — Shoshana Zuboff, author of The Age of Surveillance Capitalism

"Seize the means of computation" — Cory Doctorow

"Data rights are human rights" — Carole Cadwalladr, the journalist who exposed Cambridge Analytica and Facebook