
Google and Mastercard Cut Ad Deal to Track Retail Sales - petethomas
https://www.bloomberg.com/news/articles/2018-08-30/google-and-mastercard-cut-a-secret-ad-deal-to-track-retail-sales
======
ilove_banh_mi
Do I have a choice, other than cancelling all of my MasterCard cards? This
business of tracking and profiling is increasingly evil. If I dystopically
discovered that someone has been following me around all the time, writing
down everything I look at or do or purchase, in public and at home, I could
not tolerate it.

~~~
noelsusman
Your only option is to refuse cards altogether because they've all been
selling anonymized data on you for years. The big hedge funds pay big dollars
for direct lines of data from the credit card companies.

~~~
i1856511
A lot of attention in the press is given to Google et. al. about purchase
profiling and tracking for ads. But the concept of purchase profiling has
existed really since the invention of the credit card. As others have
mentioned hedge funds have brokered this data for decades - but for some
reason it has not been covered as excruciatingly as it has for tech companies.
While I disapprove of the practice overall I would bet that tech companies are
actually a more responsible steward (jail warden?) for this data than credit
card bureaus, precisely because the spotlight is on them and also we have come
a long way for data security in general.

There needs to be much more coverage of this in the contemporary press as it
is applied to credit card companies, agnostic of tech co.'s making it a joint
venture.

I believe credit card co.'s gave this process momentum early on and tech co.'s
are just taking it and running with it.

The same can be said for Google location tracking vs. Verizon's straight-up
selling that data as an asset.

~~~
mrep
It is somewhat ironic that Google is probably more privacy focused and has
better security than any other company in the fortune 500 and yet they seem to
get some of the most negative criticism here.

~~~
ehnto
You can be extremely ethical about your factory farm but it's still a factory
farm.

Google is in the business of utilising your data in the interest of
advertising. No matter how you sugar coat it, the core of the business is
tracking people and exploiting that data.

Are they doing their best to be careful and ethical? It sure seems like it,
but that doesn't solve the issue.

The free services they and many tech companies provide for free are just
payment for your data. The majority of people don't realise this implicit
connection and many others do realise it but are happy with the transaction.
But it's important to note that they undermine the ability to provide these
services more ethically by setting a social norm of incredible services that
are "free".

Edit: I will add that the cost and benefit to society of this kind of service
provision is complex and nuanced, Google has obviously provided incredible
value and society has decided that advertising is a fair price to pay, else
they wouldn't be around still. But the true effects of immense tracking and
advertising are still yet to play out completely.

~~~
rrdelaney
Google is not in the business of selling your data. Google does not sell your
data. It’s pretty clear in their privacy policy:
[https://privacy.google.com/how-ads-work.html](https://privacy.google.com/how-
ads-work.html)

Disclaimer: I work at Google.

~~~
Gaelan
You're right–people often conflate "selling" with "using internally to sell
ads." There's a difference, and it's meaningful, but the point is that
Google's business model is based on gathering and exploiting as much data
about you as possible

~~~
rapnie
Yes. And isn't it also the case that, by offering their very elaborate
targeting capabilities to advertisers, they still leak your personal data to
3rd parties, though indirectly? After all, the fact that a certain
personalized ad appears in your page confirms to the advertiser that you are
in their carefully crafted target group.

~~~
icebraining
_confirms to the advertiser_

How would the advertiser know? Google is the one serving the ad.

~~~
ehnto
Tracking referals. It's a key part of ecommerce advertising metrics to keep
track of who came from what campaign.

------
zerealshadowban
I've been repeatedly contacted by Google over recent years (supposedly because
of the work I've done) but I've always felt uneasy about them and hesitated to
respond. This additional layer of tracking and the recent revelation on
location tracking regardless of explicit settings both seal the non-deal for
me.

The soul of that company is to turn the human experience into a vessel for the
paid delivery of ads, _nothing else matters._ Of course I'm sure that one can
join many interesting engineering projects there, with suitable blinders. Even
when they introduced their AR glasses, they had to show virtual billboards
assaulting one's field of vision. What you are to Google is a recipient for ad
delivery -- not a customer, not a respected human, not someone to trade with.

~~~
eitally
FWIW, the Ads org is about 8000 employees (not counting sales), out of 80000
total at Google. Cloud is about 25000 (of which about 4000 are sales and
supporting GTM functions). There's MUCH more going on at Google than ads...
and that doesn't count the enormous teams working on things like Android,
Chrome, Maps, and Youtube.

~~~
Rafuino
Uhh... ultimately Android, Chrome, Maps, and Youtube are all about siphoning
more data on you and delivering more ads

~~~
abcd_f
Let's not forget GA, Fonts, DNS and CDN services.

~~~
jeltz
And the free version Google Mail, ReCAPCTHA and Google Fiber, plus many of
their other services.

------
makecheck
I don’t think this is necessarily new for credit cards...the deal has always
been that cards have perks in exchange for them gaining valuable profiling
info (e.g. “1% cash back on restaurants!” and in exchange they have a good
idea how people spend at restaurants).

The problem is, and always has been, that in exchange for some paltry
“rewards” you have no idea just who gets sold what, or for how long, etc.

And this is a major new problem primarily because of how _big_ and _pervasive_
Google is, and how they’re into _every_ business. This means I’m no longer
sharing a few silly restaurant purchases with buyers of that data in the
restaurant business, I’m _enabling a crazy machine-learned madness that is
hyper-connected to literally everything else I do_. This should be illegal but
our laws are too slow to catch up with powerful tech.

------
mvpu
The key here is "double-blind encryption" \- assuming they got that right,
neither can see exactly what I am buying, so I'm good. Bigger point: I'd be ok
with any company tracking my activities _as long as_ one of two conditions are
met: a) it benefits me (and me only), or b) it benefits them _but_ they cannot
identify me.

~~~
Skunkleton
The privacy aspects are important, but it is also worth considering the impact
this sort of stuff has on society. We like to think of ourselves as semi-
immune to advertisement (and manipulation), but we really aren't. The 2016
presidential election proved that. Putting more and more data into the hands
of Google and others just gives them more power over the public at large. Are
we OK with that? Is the discussion even really happening?

~~~
leereeves
I'd say the 2016 election proved how hard we are to manipulate. Hillary lost
despite spending more and having nearly the entire media (with only a few
exceptions like Fox) on her side.

~~~
aslkdjaslkdj1
Hillary received far more negative coverage across the media than Trump did.

[https://www.washingtonpost.com/blogs/erik-
wemple/wp/2017/08/...](https://www.washingtonpost.com/blogs/erik-
wemple/wp/2017/08/25/studies-agree-media-gorged-on-hillary-clinton-email-
coverage)

>A December report from Harvard University’s Shorenstein Center on Media,
Politics and Public Policy delivered some sobering news for all those
investigative reporters who may have supposed that their Trump exclusives were
changing the world: None of them were breaking from the pack. “Clinton’s
controversies got more attention than Trump’s (19 percent versus 15 percent)
and were more focused,” noted study author Thomas E. Patterson. “Trump
wallowed in a cascade of separate controversies. Clinton’s badgering had a
laser-like focus. She was alleged to be scandal-prone. Clinton’s alleged
scandals accounted for 16 percent of her coverage—four times the amount of
press attention paid to Trump’s treatment of women and sixteen times the
amount of news coverage given to Clinton’s most heavily covered policy
position.”

~~~
leereeves
The actual report is here:

[https://shorensteincenter.org/news-coverage-2016-general-
ele...](https://shorensteincenter.org/news-coverage-2016-general-election/)

It notes that:

> Trump’s coverage during the general election was more negative than
> Clinton’s

Positive coverage of Trump was during the primaries, which is what the Clinton
camp wanted, calling him a Pied Piper:

> We need to be elevating the Pied Piper candidates so that they are leaders
> of the pack and tell the press to [take] them seriously.

[https://www.politico.com/magazine/story/2016/11/hillary-
clin...](https://www.politico.com/magazine/story/2016/11/hillary-
clinton-2016-donald-trump-214428)

------
annamargot
Apple is making Google get creative with ad tracking.

Safari ITP 2 doesn’t allow 3rd party cookies.

[https://adexchanger.com/data-exchanges/ding-dong-third-
party...](https://adexchanger.com/data-exchanges/ding-dong-third-party-
cookies-and-fingerprinting-are-officially-dead-in-safari/)

[https://amp.theguardian.com/technology/2018/jan/09/apple-
tra...](https://amp.theguardian.com/technology/2018/jan/09/apple-tracking-
block-costs-advertising-companies-millions-dollars-criteo-web-browser-safari)

------
bopbop
Possibly off-topic but it's so sad that the greatest minds of our generation,
the previous generation, and the next are all working out how to maximize
digital profiling to more accurately sell us things.

Second only to this is the creepy fact that tools like Deepmind are being
built with the purpose of furthering these goals - all of the chess/go beating
is literally a side line.

I think this is why people like Elon Musk - he may have some socially
reprehensible behaviours, but at least his end goals are either benign or
helpful to humanity.

------
ggm
They've been doing variations of spend track as a $value to goods and services
for years (I mean the banks) so.. I don't get it: whats significantly
different this time, compared to the spend tracking they've done as business-
intelligence for the last 20 years? They sell it to the highest targetted
bidder. If you are buying BMW accessories for an old model car, without
searching online, dont be surprised if you get ads for mercedes cars with a
BMW buy-back: your postcode or ZIPcode, plus a few other details gets "you" as
well as fingerprinting web purchase: remember your card is used in a weighted
centroid centered on your home...

------
cromwellian
There are cryptographic ways to compute a set intersection between two sets A
and B held by two different parties without A and B revealing the membership
of elements of the set.

If set A is the set of users shown ads for Merchant M, and set B is the set of
customers at merchant M who purchased something, then this intersection can
tell you what percentage of the ads were shown to people who made a purchase
without revealing who made the purchase to A or revealing who was shown an ad
to B.

There’s probably a way to do it with differential privacy as well but it might
be less efficient.

------
justfor1comment
Google: free, credit card: 20% APR, human right to privacy: priceless. There
are some things money can't buy, for everything else there's Mastercard.

------
cm2187
I don't understand how they can correlate a sale to a specific google account
without getting personal identification data. By definition if they can
associate a transaction with a user, the user has been identified and has lost
all privacy.

~~~
UncleEntity
They double ROT-13 the email address that each side collected so they can
correlate, but not identify, individual consumers -- or something, TFA didn't
specify the actual encryption algorithm.

~~~
morgosmaci
[https://en.wikipedia.org/wiki/Homomorphic_encryption](https://en.wikipedia.org/wiki/Homomorphic_encryption)

------
ChuckMcM
Google finally cracks the affiliate nut :-) This was pretty killer for me:

 _Google paid Mastercard millions of dollars for the data, according to two
people who worked on the deal, and the companies discussed sharing a portion
of the ad revenue, according to one of the people._

That is not an unusual arrangement for people with search indexes, party A
provides a search query, party B provides 10 links to appropriate content and
some advertisements, if the eyeball making the search clicks on an ad the
revenue is split between in the index provider (party B) and the traffic
provider (party A).

------
ryandvm
Well, if you're looking for some anti-Google legislation to get traction in
the US, there's probably never going to be a more interested President...

~~~
bigiain
That'd be some sort of delicious irony.

The most reprehensible president ever, curtailing the bad behaviour of the
most reprehensible global advertising company ever.

------
orbitingpluto
Tracking by credit card is so effective that some companies, such as Safeway
(*in Canada), have ceased their loyalty card programs. Loyalty card programs
are redundant and must offer incentives for consumers to choose to use them.
Now, no such incentives have to be offered to the customer to obtain the same
data.

~~~
lawnchair_larry
Safeway has not ceased their loyalty program.

~~~
dman
Why ruin a good story with facts?

~~~
orbitingpluto
They did in Canada. (And I've seen articles that say Canadians use cash less
often than in the States.)

~~~
electricEmu
You've been provided two opportunities to cite those articles.

~~~
orbitingpluto
[https://globalnews.ca/news/1249484/safeway-discontinues-
club...](https://globalnews.ca/news/1249484/safeway-discontinues-club-card-
loyalty-program/)

"You've been provided two opportunities to cite those articles." That is
worded in the most irksome manner. What is wrong with you?

------
tokyodude
Is there are opportunity for a non-tracked credit card? Would it even be
possible? I don't mean anonymous, I just mean "We promise not to share your
data period, not even anonymized" but we still have your name and address and
phone number on your account.

But even if some company offered that all the retailers could still share
their data with some aggregator which would effective work around your privacy
oriented card not sharing data.

I'd love not to be tracked and would switch cards immediately if they offered
the same services I get now and offered zero tracking. I suspect I'm in the
minority but maybe with the right PR blitz you could get regular people to
switch.

"Does your credit card spy on you? Do they sell all your purchase data to
advertisers so they can target you with ads? Yes? Welcome to 'PrivacyCard'"

or something

Next YC batch?

~~~
HohPum1l
> But even if some company offered that all the retailers could still share
> their data with some aggregator which would effective work around your
> privacy oriented card not sharing data.

If you buy in a brick and mortar store the retailer would not have your
address, only your card number. And a privacy-focusd CC company would allow
you to generate new numbers for each transaction so the retailers can't use
that to merge datasets.

~~~
foepys
Funnily enough, Google Pay (and Apple Pay even earlier) is doing exactly that
[1]. The merchant is only seeing a token that will be connected to the actual
card number in the credit card network.

Google is now closing the circle to get to know exactly what was bought -
blowing all privacy advantages away.

1:
[https://support.google.com/pay/merchants/answer/6345242?hl=e...](https://support.google.com/pay/merchants/answer/6345242?hl=en)

~~~
basicplus2
And removing the oportunity for the retailer to collect info on who shops in
their stores...

~~~
HohPum1l
An "opportunity" they never had with cash in the first place.

~~~
basicplus2
Yes but they do have the opportunity when customers pay with their credit card
directly..

An untapped opportunity perhaps

------
gboudrias
Am I the only one who finds this outrageous? I'm not surprised, but I am
angry.

~~~
iaml
This is hardly the first outrageous thing google has done.

------
chiefalchemist
Slighly off topic, whenever I see rebates (or similar) in the form of gift
cards, I always assume the the entity awarding the gift card does so because
the use of the card deepens their data profile on you.

Or maybe I'm just too paranoid?

~~~
manigandham
Yes, although gift cards are usually limited in where you can spend. It's also
an amazing amount of float for larger companies:
[https://en.wikipedia.org/wiki/Float_(money_supply)](https://en.wikipedia.org/wiki/Float_\(money_supply\))

------
bahmboo
" With it, marketers see aggregate sales figures and estimates of how many
they can attribute to Google ads -- but they don’t see a shoppers’ personal
information, how much they spend or what exactly they buy. The tests are only
available for retailers, not the companies that make the items sold inside
stores, the spokeswoman said. The service only applies to its search and
shopping ads, she said."

------
bamboozled
Privacy focused payment products will be more in demand because of these kind
of things. I look forward to it !

~~~
iscrewyou
Yeah, this is like them stepping into my house. This whole time they’ve been
peering through every window but now, they’ve let themselves in.

~~~
ethbro
Well, yeah.

They realized there's money laying on the floor of your house.

Why wouldn't they pick it up?

------
reacharavindh
This is precisely why "going cashless" is silly. At least leave the option to
those citizens that care about their privacy to be able to pay with cash and
not be tracked the heck out of them.

~~~
eyeareque
Sure you can pay with cash. But you better turn off your phone because they
also track you with your WiFi MAC address when you walk into stores.

~~~
throwawayperson
That's where IOS did much better.

~~~
reacharavindh
Does iOS randomize MAC addresses when looking for public wifi networks?

Another thing to worry about is whether iPhone really turns off the wifi radio
when it is greeted out from the menu.. I remember a setting change somewhere
around ios10/11..

~~~
throwawayperson
iOS 8 MAC address randomization

------
j88439h84
GNU Taler can't come soon enough. Http://Taler.net

> When you pay with Taler, your identity does not have to be revealed. Just
> like payments in cash, nobody else can track how you spent your electronic
> money. However, you obtain a legally valid proof of payment.

~~~
tumetab1
GNU Taler site like to state that at the same time stating they government
will have overview into all transactions.

[https://taler.net/en/governments.html](https://taler.net/en/governments.html)

I call bullshit in the comparison to cash.

~~~
j88439h84
The merchant is identified and the transaction is logged; the customer is
anonymous.

------
codedokode
That's how you become a product when there is no proper regulation.

> Before we launched this beta product last year, we built a new, double-blind
> encryption technology that prevents both Google and our partners from
> viewing our respective users

> We do not have access to any personal information from our partners’ credit
> and debit cards, nor do we share any personal information with our partners

That probably means that they do not get customers' names or email addresses
but hashes of them. So technically no personal information is transferred.

------
Tehnix
I wonder how this interacts with GDPR? Could I send a mail to VISA, asking
what information they are tracking on me? Or is it “okay” because it’s
anonymized?

~~~
tumetab1
You can always ask for what information is gathered on you.

Please do and share a blog on it :)

------
cromwellian
There are cryptographic ways to compute a set intersection between two sets A
and B held by two different parties without A and B revealing the membership
of elements of the set.

If set A is the set of users shown ads for Merchant M, and set B is the set of
customers at merchant M who purchased something, then this intersection can
tell you what percentage of the ads were shown to people who made a purchase
without revealing who made the purchase to A or revealing who was shown an ad
to B.

There’s probably a way to do it with differential privacy as well but it might
be less efficient.

This is like the fourth time this story has hit the media. Google really needs
to publish the full transparent details of their protocol and let the academic
community analyze the, if only to avoid misinformation and speculation.

------
throw2016
Data was always subject to different rules in different regions. Collation and
correlation has a multiplier effect. With negative repercussions for privacy,
dissent and democracy.

The whole approach of of trying to 'normalize' surveillance is questionable.
Since this is a discussion forum for individuals how does this benefit the
individual? It reeks of hand waving and apologism.

Some people are making money from being creepy and polluting the commons. This
is no different from polluting the environment you exist in that sustains you
for personal benefit. We now recognize and do not allow that kind of
destructive greed. How is invasive surveillance any different?

------
rathish_g
I am lost? How will they track a sale with the credit card data? Without the
store's invoice data, how can they link credit card transaction it back to a
product?

~~~
lotsofpulp
They will have the store's invoice data.

[https://blog.bluepay.com/what-is-level-3-payment-
processing](https://blog.bluepay.com/what-is-level-3-payment-processing)

If I buy from Staples.com using Amex, my Amex statement comes with an itemized
list of what I purchased. Also seen some gas stations do it.

If whatever you're doing is digital, assume it's online and everyone has
access to the data.

------
amarant
privacy concerns aside, does this mean I finally won't get ads for stuff I
recently bought anymore?

i seem to be getting a lot of "you recently bought a new camera of model xyz,
would you like to buy another one?"

if they instead recomended memorycards or compatible lenses, that would be a
better experience.

regarding privacy I've pretty much come to accept that I don't have any. This
acceptance has been a great boon to my psychological health :)

~~~
TheRealDunkirk
[https://www.wired.com/1999/01/sun-on-privacy-get-over-
it/](https://www.wired.com/1999/01/sun-on-privacy-get-over-it/) McNealy knew,
in 1999, what was happening, because he was selling the first commoditized
computers to be used for world-wide-scale tracking of user data to the
government.

------
CommanderData
Long live cash.

~~~
wu-ikkyu
Doesn't help for online purchases. Likewise crypto is too user unfriendly for
the masses to adopt and very few vendors accept it

~~~
kart23
Buy prepaid cards if you really need to have some privacy online.

~~~
wu-ikkyu
Still have to give the vendor your shipping address

------
_ks3e
Credit card data sharing has been around for a while. Fortunately, financial
institutions appear to be marginally less pathological about allowing people
to control how their personal data is used than certain large social media
companies, and there are opt-outs for pretty much all of the major financial
institutions.

According to the article, users can also opt out of the tracking _on Google 's
side_ using Google's privacy controls. However, I think it's probably best to
opt out of that data being collected in the first place, since the financial
companies are probably selling that data to other companies.

Here's the link for Mastercard: [https://www.mastercard.us/en-us/about-
mastercard/what-we-do/...](https://www.mastercard.us/en-us/about-
mastercard/what-we-do/privacy/data-analytics-opt-out.html) (the language is
kind of strange - "To opt-out from our anonymization of your personal
information to perform data analyses" \- I'm hoping it refers to opting out of
sharing your anonymized personal info, not opting out of the anonymization so
they can sell your un-anonymized personal info, but someone should confirm
this by sending them a letter).

Visa users can opt out here: [https://usa.visa.com/legal/privacy-policy-opt-
out.html](https://usa.visa.com/legal/privacy-policy-opt-out.html) (actual opt-
out page is
[https://marketingreportoptout.visa.com/OPTOUT/request.do](https://marketingreportoptout.visa.com/OPTOUT/request.do)).

Amex seems to be somewhat better about this, saying "We only share your
personal data with third parties where it is necessary to provide you with
products or services or as part of the nature of our relationship with you,
where we have previously informed or been authorized by you, in connection
with our efforts to reduce fraud or criminal activity, or as permitted by
law." (source: [https://www.americanexpress.com/us/content/customer-
privacy-...](https://www.americanexpress.com/us/content/customer-privacy-
principles.html)). Whether anonymized data is considered 'personal data' isn't
clear, though - the definition given is "any information that relates to an
identified or identifiable individual." Whether the "relates to" property
persists after anonymization is not specified.

It's also worth noting that opting out of data sharing by a credit card
network does not limit data sharing by the bank that issues the card - for
that, you probably have to contact them separately (Chase, for instance, has a
privacy number you need to call to opt out of data sharing
[https://www.chase.com/digital/resources/privacy-
security/que...](https://www.chase.com/digital/resources/privacy-
security/questions/policy-information)).

------
crb002
They are going to use the results to set up a hedge fund. Not quite insider
trading, but shady.

------
tessi3r
Wow, this is disgusting. I still can't believe how limited my options with
Visa and BofA were to opt out of data mining...

------
icco
If you don't want to be tracked, only pay cash and in person. Otherwise,
assume everyone is doing stuff like this and has been your entire life.

------
Paul-ish
Is there a privacy focused credit card?

~~~
GuB-42
Pre-paid debit cards.

------
trumped
I thought anyone could already easily buy all this data from any credit card
companies...

------
InfamousSub
Cash

------
yuhong
There is a reason why I wrote my Google DoubleClick essay. What is fun is that
credit cards directly ties an increase in debt to consumer spending, which in
turn goes to Google as ad dollars in this case

------
wpdev_63
[https://getmonero.org/](https://getmonero.org/)

