An attorney’s observation that in-game ads on her Android tablet reflected audiobooks she checked out from the San Francisco Public Library raises privacy concerns about library reading material. The piece surveys historical privacy debates, interviews with librarians and researchers, and a plausible theory that remarketing data from library services could be used to target ads. Hashtags: #SanFranciscoPublicLibrary #OverDrive #Libby #Boundless #BiblioCommons #GoogleAnalytics #FacebookPixel
Keypoints
- An attorney noticed Android in-game ads reflecting SFPL audiobooks she recently checked out, highlighting library reading privacy concerns.
- The article traces the history of reader privacy in libraries and emphasizes the need for protecting patron privacy as libraries move online.
- Researchers analyzed network traffic and proposed remarketing as a plausible mechanism linking borrowing history to targeted ads.
- OverDrive’s privacy policy discusses data collection for personalization and, in some cases, for remarketing, while OverDrive says it does not sell user data and does not display ads in Libby.
- SFPL responded that OverDrive does not share Libby data for advertising, though tracker and ad-tech activity on SFPL’s site suggests potential pathways for targeting.
- The case illustrates opacity in ad-targeting within library ecosystems and underscores calls for stronger privacy controls and transparency.
MITRE Techniques
- [T1119] Automated Collection – Tracking pixels and third-party cookies are used to profile users’ interests across library sites to support advertising, e.g., “11 ad trackers, 19 third-party cookies, and includes both a Facebook pixel and Google Analytics.”
Indicators of Compromise
- [Domain] SFPL-related domains – sfpl.org, sfpl.bibliocommons.com
- [Domain] Analytics/ads domains – google-analytics.com, googletagmanager.com
- [Domain] Ad-tech/partner domains – Branch.io, Piano.io
- [Domain] Content/advertising partner – PressReader.com
- [Domain] Social/tracking domain – facebook.com
- [Cookies] Third-party cookies and tracking technologies – 19 third-party cookies, 11 ad trackers
Read more: https://www.theregister.com/2024/05/18/mystery_of_the_targeted_mobile_ads