top | item 18646489

Companies use smartphone locations to help advertisers and even hedge funds

448 points| pcl | 7 years ago |nytimes.com | reply

168 comments

order
[+] bad_user|7 years ago|reply
iOS now forcing "While Using" option on all apps is the greatest thing ever. Before this, some apps where forcing the "Always" option on users. Uber and Waze come to mind.

iOS also gives you a warning from time to time about apps using your location in the background. I think iOS right now has the best location management.

---

People are surprised when seeing the Activity section in Google's account details, then freak out about Google tracking their location. At the very least Google is being transparent about it and gives you the option to turn that shit off.

Also I was pleasantly surprised to discover that Google Maps now remembers searches you've made without location history or app activity tracking being active. This wasn't the case about a year ago, when I last tried it, a dark pattern of sorts. They probably changed the behavior being forced by the GDPR or something similar.

So if you haven't done so, turn off "Location History" in your Google account: https://myaccount.google.com/activitycontrols (I turn everything off and I don't see a difference in usability)

---

On the article, I love the maps and the animations. Visualization is the best way to make people understand the threat.

On GDPR, I've seen people complaining about the high cost for implementing it, however for privacy it is a godsend.

[+] jacquesm|7 years ago|reply
You can't turn it 'off', you can 'pause' it. That's a linguistic difference, sure, but it is quite telling that there is no respect at all for a users desires even in the language that is hardcoded in. It's as annoying as 'not now' for 'no' or '10 different things you should know about "x"', when you really should not.
[+] Despegar|7 years ago|reply
>On GDPR, I've seen people complaining about the high cost for implementing it

The bigger cost is to people's privacy, which is hard to quantify and hard for people to articulate why it's necessary. Collection and use of people's data is opaque and not at all transparent.

Which is why GDPR and other privacy legislation is needed.

[+] Tsubasachan|7 years ago|reply
If carriers let outsiders buy cell tower data there is literally nothing you can do except switch on airplane mode.
[+] isoprophlex|7 years ago|reply
Strange, for me Google maps doesn't remember anything I searched for. It tells me to turn on location history. And I'm an EU citizen.

Google can fuck right off with their location tracking. When I got my phone, it defaulted to asking me invasive questions about places I was visiting. The option to turn off those nag screens was hidden so deeply I felt compelled to neuter the entire shebang. Disgusting dark patterns.

Screenshot taken just now: https://imgur.com/a/ewSCeRn

My next phone will be an Apple device due to this insidious crap.

[+] darren_|7 years ago|reply
> Also I was pleasantly surprised to discover that Google Maps now remembers searches you've made without location history or app activity tracking being active. This wasn't the case about a year ago, when I last tried it, a dark pattern of sorts. They probably changed the behavior being forced by the GDPR or something similar.

Location history wasn't ever needed for remembering searches, FWIW.

[+] zanny|7 years ago|reply
I at least get a substantial value add to my life having Google track me everywhere. It might be overly sentimental but being able to see everywhere I've been in the last ~seven years on Maps feels to me like one of the great innovations Google has made. If people accept Google will sell that data to subsidize the cost of persisting it you get a permanent record of everywhere you've gone. I think its cool to have.

Its something you can probably build off the shelf - log position with durations, draw vectors on Open Street Maps. But Google has already given me the convenience in exchange for my privacy. Its one of the rare times I'm alright with that tradeoff.

[+] kop316|7 years ago|reply
I respectfully disagree on Google being entirely transparent about tracking location, especially if you run Android + Google Play Services. I have a tablet (Pixel C) that runs LineageOS + Google Play Services and a Phone (Nexus 5x) that runs LineageOS vanilla (no MicroG, no UnifiedNLP, no Google Play Services). Some things I have noted:

- When you install MicroG/Google Play Services, they take over location services (i.e. they run in /system/priv-app, and if you disable their location, location on the device is disabled totally).

- Android by default has the default on option to scan wifi and Bluetooth when you turn them off to find wifi/bluetooth and coorelate it to your location.

- On my Pixel C, when if I try "high accuracy" or "battery saver" mode Location services, Google Play has tried to force me to agree to their location tracking and I have disagreed every single time. Location services does not work if I use "device only" (which is supposed to only use GPS).

- I have noted that on my phone now, if I disable location and then reenable it when I have moved more than 20-30 miles, the GPS has to reacquire the signal and can take up to 2 minutes (I also tried it when I drove several hundred miles, it took several minutes to reacquire). This is indicative of the GPS module being off totally. This was not so when it had Google Play Services on, it was able to reacquire my location extremely quickly, sometimes almost instantaneously even if I moved a long distance. I suspect that Google Play was still tracking my location even if I turned off location services (due to it totally controlling my location).

- EDIT: Another interesting note is that on my phone has had location services off and then turned just back on (i.e. no GPS lock), it appears to give the last time GPS was acquired as my current location. OSMAnd shows that location but says it doesn't know my location, but other apps do not realize that. I am suspecting that Android does not necessarily have a "stale" location, just the last reported location.

Putting my tin foil hat, I hypothesize Google anonymously tracks your location even if your location services if off (allowing them to do traffic, how busy a restaurant is, etc.).

EDIT: As correctly pointed out, networked assisted GPS is a thing, and may also play into the differences in GPS reacquiring. I believe that network assisted GPS is in AOSP. When I turn on and off GPS in Android, it appears to have the almanac for where to look for satellites based on SatStat, and how quickly my phone acquires the GPS signal is a function of where it used to be compared to where it is now. In addition, UnifiedNLP [1] scans for networks/cell towers and correlates it to location, it does not appear to implement networked assisted GPS. [1] https://github.com/microg/android_packages_apps_UnifiedNlp

[+] code4tee|7 years ago|reply
“We’re not doing anything not disclosed in our terms of service.” is rapidly becoming a no longer acceptable answer to consumers.

Don’t tell me a weather app needs to know my location all the time to give me the best weather info then sell my location to the highest bidder. Don’t tell me that buried in some 20 pages of leagalese in your Ts&Cs is some vague references that make this “legal.”

[+] random878|7 years ago|reply
I would respectfully disagree.

It is not acceptable to roughly the amount of people (and I include myself) who make a deliberate and self conscious decision to oppose it.

This is a small, small group. I have a phone with Replicant OS, which puts me within a niche group of an already niche group (those willing to install alternative OS and strip Google on their phone). In a wider computing sense - what percentage of HN use GNU/Linux? Of them, who runs as fully Free OS? What percentage of them are rocking a 12y.o. librebooted thinkpad?

The general public are apathetic at best. Contrary to popular opinion, people are not ignorant to the behaviour of tech giants - they just don't care enough to stop. Clearly, it is still an acceptable answer to consumers.

It's like claiming that people don't go vegetarian or vegan because they aren't aware of the suffering. Of course they are aware. It's just easier to keep eating hamburgers and live with the cognitive dissonance.

It's the same with these apps.

[+] nerdbaggy|7 years ago|reply
Not sure if I agree. Dark Sky likes to have your location all the time because it enriches the data for everybody else. The promise not to ever sell our data, but they do say they are approached usually at least once a week about selling it https://blog.darksky.net/location-privacy/
[+] ja1215|7 years ago|reply
Freakonomics did an episode not too long ago with the new CEO of Ford. The guy was practically salivating at the mouth about all the data new vehicles will be collecting and how Ford could potentially monetize it all. Scary times ahead.
[+] wesd|7 years ago|reply
I submitted that article on HN but it didn't get any attraction.

It seems Ford CEO thinks they can collect and monetize drivers data: -- So the case I would make is that we have as much data in the future coming from vehicles, or from users in those vehicles, or from cities talking to those vehicles, as the other competitors that you and I would be talking about that have monetizable attraction.

--The issue in the vehicle, see, is: we already know and have data on our customers. By the way, we protect this securely; they trust us. We know what people make. How do we know that? It’s because they borrow money from us. And when you ask somebody what they make, we know where they work; we know if they’re married. We know how long they’ve lived in their house, because these are all on the credit applications. We’ve never ever been challenged on how we use that. And that’s the leverage we’ve got here with the data.

[+] avgDev|7 years ago|reply
It is a smart business move as there is money to be made.

Insurance companies did it first by offering dongles that you can plug into your OBDII that would basically feed your driving data back to them.

I agree that it is scary and just feels not right. General population is so ignorant these days that most honestly don't care. They will just accept these things.

This data will be valuable to insurance companies, government, car manufacturers and who knows how else it could be used. You can literally tell who made a modification to their car and read all the data from the vehicle.....meh, future sucks.

One day we will wake up when we have zero freedom, all of our moves will be tracked...and we won't be able to have any privacy at all.

[+] afpx|7 years ago|reply
Hedge funds have been using location data to ‘predict’ corporate earnings for at least 5 years, that I know of. There’s also speculation that they use the data to identify locations of VIPs and where they’re going (by clustering activities of the VIP’s entourage). It’s unfortunate that news organizations as reputable and prominent as the NYT only get on these stories so late in the game. This information would have been more useful to the public back in 2013.

What I don’t understand is why these types of activities by hedge funds aren’t considered insider trading.

[+] kasey_junk|7 years ago|reply
Because the hedge funds are by definition not insiders? They are literally not using non-public corporate data at all.

Insider trading laws don’t exist to make sure there isn’t information assymetry, the market is all about that assymetry. Insider trading laws are about insiders stealing from other shareholders.

[+] catacombs|7 years ago|reply
> It’s unfortunate that news organizations as reputable and prominent as the NYT only get on these stories so late in the game. This information would have been more useful to the public back in 2013.

It's likely The Times just didn't have enough, or access to, this data to do solid reporting.

If there are people in and out of the industry who are willing to share data that can advance an important story, these things might get out faster.

[+] Aeroi|7 years ago|reply
Interested in these strategies. Is most of the location based data relevant to consumer companies and retail sectors? Trying to think of how hedge funds would apply this location data to other sectors.

I've wanted to use a weather mesh network for a while in commodities and other spaces, but the info has been hard to collect without building a private sensor network.

[+] devit|7 years ago|reply
Why is selling this data not illegal and harshly prosecuted?

You'd expect to find this data being stolen by trojans and sold for bitcoin by anonymous actors on blackhat sites, not by registered companies with offices and employees.

[+] asdff|7 years ago|reply
It’s astounding to me that this same country with HIPAA laws protecting name, ethnicity, age, and any identifying information in hospital records has nothing on the books to guard that very same information which can easily be bought and sold if it came from anywhere other than a hospital.
[+] Despegar|7 years ago|reply
A privacy bill is in the works right now. And a lot of big ad-tech companies (Google, Facebook) are fighting to shape it in their favor.
[+] cityzen|7 years ago|reply
America is corrupt so corporations can spend a little money and shape legislation around these issues.
[+] rollulus|7 years ago|reply
I like it how iOS displays this arrow when location services are or were used, and how one can see in "Privacy -> Location Services" a brief history of which app did what, and enable or disable location access at all per app.
[+] izacus|7 years ago|reply
That does nothing for IP based geo location though. Every rest request to modern cloud services gets geotagged and those tags can be surprisingly accurate in populated areas for people that use wifi.
[+] fouc|7 years ago|reply
That reminded me to check my privacy > location services settings and look for any apps that have "Always" and change them to "While Using" only
[+] llampx|7 years ago|reply
I wish there was something similar on Android. I used to keep my Location services off but needed to switch it on for Google Maps and HERE maps so I got lazy and leave it always on.

Its shameful that Android 2.3 let you have more control of your phone than Android 8.1.

[+] shaki-dora|7 years ago|reply
The production value of these lavish spreads by the New York Times is impressive.
[+] 52-6F-62|7 years ago|reply
IIRC Mike Bostock used to work for them and while there was responsible for D3js and more. They've taken the smart path in publishing and took the transition to digital seriously.

https://bost.ocks.org/mike/

[+] addedlovely|7 years ago|reply
Agree, that's some lovely parallax that normally stutters for me on other sites / implementations.
[+] s369610|7 years ago|reply
helps if your graphics editor also develops sveltejs, ractivejs and rollup
[+] throw2016|7 years ago|reply
Here is an idea for online advertising. Use IP and text based contextual targeting. No stalking required.

Stalking everyone and building increasingly creepy online profiles to target better is an abuse of basic human privacy, if you stop to think about it, and completely unethical and takes your hurtling down the path to a surveillance society.

The only reason its even possible because of the lacuna in a new space and laws catching up, and when they do, it won't be possible. The idea that making money makes everything ok is a primitive and fundamentally antisocial ideology. And if everyone thought like that would end civilization as we know it.

[+] bigpicture|7 years ago|reply
The next thing I want Apple to do: If an app will request location services, it must: 1. Have a specific publicly available URL that contains all "location data" terms, conditions, and privacy information. 2. Monitor that URL and reset the permission dialog if the URL ever changes. 3. Immediately disable location services for that app if the URL disappears.
[+] pookieinc|7 years ago|reply
What is the correct way to regulate this?

The problem is that, from small business to mammoth company, there is no codified, unified, agreed upon manifesto when it comes to handling data at any level. A "Constitution" of sorts that explains the rights and / or wrongs of the data usage of the average user. Somewhere where a user can look at a document, see which company falls where on the spectrum, decide if they are comfortable with the sharing of that, and actively signs off on it. As an addendum, it's also important to think, while my for example, email data might be shared, it will enable certain benefits that I sign off on like Google providing me flight details, etc., but it comes at what expense.

You'd get a wide spectrum of those who couldn't care less to those who are tin-foiled, but no matter where you fall on this spectrum, you'd at least know which software does what. If that manifesto-like document is broken, consequences would be maintained.

[+] makecheck|7 years ago|reply
The way to do it is to push for new data formats where the inherent value of even “leaked” information is going to be limited by the format (e.g. expires in some form, and/or must always be combined with some new recently-refreshes data to be considered valid).

Unfortunately, something of that magnitude in this age would probably require the cooperation of large entities like Google and Facebook. Guess who profits from the current leaky model.

Honestly, Apple may be just about the only one capable of shifting the tide. They’re big, they claim a privacy focus, and they’ve delivered some (e.g. Apple Pay, iMessage). If they could come up with more secure technological replacements for the things that are currently leaked by apps, we might have a chance.

The “one time card” approach of Apple Pay seems like the basis for such a system. For example: stop giving apps “my location” tied specifically to me, instead give them “location of unspecified user” where that token goes away after one app transaction.

[+] Vinnl|7 years ago|reply
I think there's a lot to say for the EU's approach: the societal benefits of location-based tracking (more targeted and hence relevant advertising, for example, or apps that are free to use) is not considered to outweigh the societal downsides (e.g. undermining democracy), so it's simply not allowed at all unless the user explicitly and unambiguously agrees with their data being used for that purpose.
[+] moneil971|7 years ago|reply
Are people reading this article surprised that your devices know your locations? We are constantly getting "helpful" notifications that should make it VERY clear that's happening: "Parked car location updated" "It's 8am, are you on your way to work?" "Can you share feedback about that restaurant you were at but didn't check in at?" If people don't already know, then good for the Times for making sure everyone is checking their settings and paying attention.
[+] askaboutit|7 years ago|reply
It’s going to take serious amounts of data leaking before something is done to combat this.
[+] jacquesm|7 years ago|reply
A couple of politicians having their affairs outed would do it.
[+] matty_makes|7 years ago|reply
Someone should create an app that translates a companies T&C into layman terms with simple stuff like "they track your location", "sell your usage data", etc. Just need a team of lawyers to interpret them, and a nice web site.

Call it something like AppSideEffects.com "Things that may be harmful when using these apps/web sites"

[+] eximius|7 years ago|reply
Think bigger: companies should be required to present their terms in plain English. Not all things need lawyers.
[+] beau|7 years ago|reply
Why do Apple and Google get a pass here? Who knows what apps are doing with your photos and contacts. Apple doesn't. Facebook was grilled for not aggressively shutting down an app that sold much less sensitive information.
[+] bilbo0s|7 years ago|reply
FB didn't explicitly give you the ability to shut the offending app down.
[+] larrybud|7 years ago|reply
There needs to be a distinction at the api & permissions level between course and fine geolocation. My weather app doesn't need to know my exact address... location within a half mile or mile would be fine. Similarly with "gas station locator app". But my GPS navigation app DOES need fine location.

If you could control this permission at the app level, many of the privacy issues brought out in the article would be mitigated.

[+] catacombs|7 years ago|reply
I would love for someone from The Times who worked on this story to share the source of their data.

No one on Twitter nor in their interview on The Daily answered my main question: What was the source?

Sure, they don't want to reveal private information about the people they highlighted, but what about the millions of dots they plotted on the map?

That data came from somewhere. Did someone leak it? Did The Times buy it? Some transparency would be great.

[+] Vinnl|7 years ago|reply
> On Fysical’s map, a bright red box near the Capitol steps indicated the general location of President Trump and those around him, cellphones pinging away.

My main worry is that these practices allow many people to doxx and subsequently bribe journalists, lawyers, politicians, etc.

This feels like a judicial security hole. I wonder if something like responsible disclosure for software security issues could help, and what the moral issues are with that: doxx the people in charge of the laws, then contact them to say that you will make public how you obtained their personal data in <x time>, so they better make sure that the judicial hole is plugged before that time.

[+] kkarakk|7 years ago|reply
i quite like when apps use my location info to do unique things like recommend places in the vicinity that are good(foursquare) or give me specific filters for a location(snapchat) phones should obfuscate the location provided in some way so that users can take advantage of location services without continuously sharing my movement to the backend