Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I had a landline phone call about xyz with an xyz-expert (also on landline) for about an hour, for the first time. After couple of days I started getting suggested links on websites as an ad exactly about xyz's services.

Question: In theory, either my landline phone company or my smartphone is listening in, then probably selling my info. Is this type of ad profiling common and/or legal? Or was it pure chance I saw the targeted ad?

Update from comments:

  • I am based in the UK
  • I never did a web search on the xyz topic, nor sent/received emails regarding this topic. That is why I am assuming phone calls are being profiled.
  • As pointed out, the legality side belongs to a different SE, so just in case if anyone can provide legal side of the question, it would be a huge bonus.

Updated question:

I am also curious if these types of practices exist at all:

  • A Landline company keeping track of certain word frequencies
  • Or my smartphone doing something similar, even when it is not in use
share|improve this question

closed as off-topic by TildalWave, Xander, Steffen Ullrich, Neil Smithline, Stephane Mar 31 at 5:31

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – TildalWave, Xander, Steffen Ullrich, Neil Smithline, Stephane
If this question can be reworded to fit the rules in the help center, please edit the question.

4  
Have you done web searches for XYZ? – Deer Hunter Mar 29 at 11:14
17  
A couple of simpler explanation here: XYZ-experts are sharing their lead list to a marketing company (make sense) or you have made web search or visited web sites about the functionality provided by XYZ – Stephane Mar 29 at 11:22
4  
When you ask "is it legal" the you should 1. consider asking on law.stackexchange.com instead and 2. mention where in the world you are living, because what's legal in Bolivia might be illegal in Sri Lanka. – Philipp Mar 29 at 11:28
23  
I'd like to add the possibility that you were always getting xyz-targeted ads, but you didn't notice that they were targeted at xyz until your discussion with an expert. It's called the frequency illusion, (or Baader-Meinhof Phenomenon) and it's possible that this sudden targeting is really just that illusion. – QPaysTaxes Mar 29 at 22:45
3  
@QPaysTaxes a.k.a. confirmation bias – Jan Doggen Mar 30 at 6:31
up vote 31 down vote accepted

Data dealers often buy data from multiple sources and aggregate it to generate an all-compassing user-profile from it. For example:

  • xyz company sold your telephone number and what the conversation was about.
  • social network which asks for your phone number for password recovery sold your telephone number and your ip address at some point in time.
  • advertisement network sold the tracking cookie ID for that IP address at that point in time.

Now the data dealer has linked your call with xyz to your identity on the advertisement network and can pay the advertisement network to show you xyz-related advertisement.

To avoid this from happening in the future:

  • Look at the privacy policy of any companies and websites you interact with and refuse to do business with them when the policy allows them to resell your data.
  • Do not reveal more personal information to internet services than strictly necessary.
  • Use a browser plugin like Ghostery or Privacy Badger to block web trackers (keep in mind that an advertisement filters like AdBlock only blocks visible advertisement and are not designed to prevent invisible trackers from tracking you).
  • Inform yourself about what rights to privacy you have according to your local laws and make use of them (for example, in many EU countries you have the right to order companies to tell you what private information they have about you and can order them to delete it).
share|improve this answer
    
Comments are not for extended discussion; this conversation has been moved to chat. – Rory Alsop Mar 30 at 9:16
1  
AdBlock won't block trackers, no. uBlock Origin, on the other hand, will, and I highly recommend it. – ArtOfCode Mar 30 at 11:52

The whole discussion of privacy issues today has turned to matters of profiling and patterns, think, prediction. Prediction is the big thing these days. "You might also be interested in xyz..." This is because others who did searches on abc and Wxyz ALSO were interested in xyz, and you also looked for some of these terms, you get classified as a target for xyz. It's also called pattern-of-life analysis, and it's what data-miners are salivating for.

Then there is the agreement you have with your phone company. You made a call to a company in the xyz business, and THAT association is all that is needed for your phone carrier to connect you up with a paying advertiser in the xyz biz, or more likely, allow their advertising agency to do so. Check your phone company's privacy policy. And while you're at it, check the email headers of the mail you got, whether it originated from the business represented, or from your phone carrier or some other advertising agency.

A javascript blocker, such as NoScript, in your browser is highly recommended to prevent Java scripts from running without your approval. AdblockPlus is also a superior tool for blocking ads.

share|improve this answer
    
NoScript dials back, and ABP shows ads... – Deer Hunter Mar 29 at 15:14
2  
As a side note, it's JavaScript, Java, and Flash. The three are all different and all blocked my NoScript. – QPaysTaxes Mar 29 at 19:44
    
+1 for clearly mentioning the possibility that the phone company might have sold the list of outcoming calls (which they must keep anyway). It is a far easier, and cheaper, possibility than listening to all the OP's conversations and parsing them for advertisement purposes. – A. Darwin Mar 30 at 6:41

There is no need to analyze the actual data (eg have someone listen to your call), when there are metadata, unprotected by privacy laws, readily available in convenient format. Just by looking into phone log it can be seen that:

  • You (your number) was called by xyz (Xyz's number)
  • The conversation lasted for about an hour so it can be concluded it went very well.

That's it. This is excellent source that's already there, machine-readable, just waiting to be fed into advertising algorithms.

Metadata are the most important data. Knowing who calls whom and how long they talk is in most cases enough.

Imagine that: a guy called HIV clinic for 3 minutes and then suicide support line and talked for 2 hours. Nobody listened so nobody knows what they were talking about, right?

share|improve this answer
    
Great example, thank you. – zx8754 Mar 30 at 8:54
1  
"unprotected by privacy laws"... I'm not so sure. Granted, collecting metadata and distributing them to three-four letter agencies seems to be legal, but what about selling these data to other companies? – A. Darwin Mar 30 at 8:55
    
@A.Darwin I oversimplified to highlight the fact that metadata almost never enjoy same level of protection. – Agent_L Mar 30 at 15:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.