Privacy XFN

Welcome to this week's Privacy XFN, curating the best reads at the intersection of data privacy and tech. This week we’re covering new findings about Facebook's ad tools, Sundar Pichai calls for a federal U.S. privacy law, how iOS and Android compare when it comes to privacy, and much more.

—The Transcend team


Facebook's ad tools can be used to exclusively target a single user based on the interests assigned to them by the platform, according to a new report by a team of European researchers. The team called the practice "nano targeting" and said users with the four rarest interests or 22 random interests could be identified with a 90% probability.

More:

  • Facebook could impose a minimum audience size to prevent nanontargeting.
  • Researchers found that while Facebook provides a “Potential Reach” value, there are no guardrails in place to prevent advertisers from targeting a smaller number of users.
  • Facebook rejected the report's findings and said advertisers can only see the interests assigned to a user if that individual voluntarily shares this information.
  • TechCrunch notes that if Facebook is found to have violated GDPR, it could be forced to let users decide if they want to share their data for ad targeting, which could hurt its business— ads made up 98% of its 2020 revenue.

TechCrunch


Alphabet CEO Sundar Pichai says the U.S. should adopt a federal privacy law that's similar to GDPR. Pichai argues a federal privacy standard would eliminate the complexity created by having different laws spread across multiple states.

More:

  • Pichai says that while larger companies can comply with the laws, it can be difficult for smaller firms that don't have the same amount of resources.
  • He adds that any privacy law should ensure the internet remains open and interoperable.
  • Cyberattacks cost over $4B worth of losses in 2020, and Pichai says world leaders should adopt a "Geneva Convention equivalent" for the industry.

TechCrunch


An Oxford University study found there was no winner in-app privacy between iOS and Android. 89% of Android apps had at least one tracking library, compared to 79% for iOS. 93% of Android apps sent data to the U.S. compared to 83% for iOS, which is currently prohibited under GDPR.

More:

  • The study said there were "widespread" privacy violations on both operating systems and said Android did a better job of concealing the location data of children.
  • The study analyzed 12,000 apps on both platforms that were available last year, which meant Apple's iOS 14.5 "App Tracking Transparency" framework was not included.
  • Apple profits from its privacy push: the tech giant's ad business makes up 58% of iPhone app downloads that resulted from clicking on an advertisement, up from 17% a year ago.
  • Its ad revenue is predicted to increase from $5B in 2021 to $20B by 2024.

CPO Magazine

6 unique features of our Consent Manager: You may already know that Transcend’s Consent Manger is designed to move companies beyond cookie banners, but did you know it also enables more precise choices for site owners and their users?

Read post
Google announced app developers can start to fill out certain sections of its data privacy section for Play Store Apps. Developers can notify users of what information they collect, if the data is necessary to use the app and if it's encrypted.

More:

  • Google's "Data safety form" is available on the Play Console.
  • Developers must fill out the data by April 2022, but it will become visible for users two months prior.
  • Google first announced the move in May, after Apple added privacy labels in the App Store in Dec. 2020.

The Verge


A standard protocol for data rights request would benefit both consumers and companies, argues Dazza Greenwood, Protocol Lead at Consumer Reports' Digital Lab. Transcend has joined a consortium led by the consumer advocacy group aimed at developing a standard data rights protocol for consumers.

More:

  • Greenwood says a standard protocol that clearly establishes the critical components of a data rights request would make it easier for consumers to fill out and companies to process.
  • The consortium held a roundtable at MIT this week, showing progress on the protocol's development. 

Consumer Reports


Moscow rolled out its "Face Pay" facial recognition fare payment system at over 240 metro stations,  claiming to be the largest system of its kind in the world.

More:

  • Officials say all data would be encrypted, but privacy groups have warned it would be used for surveillance.
  • The Russian capital has employed facial recognition technology to enforce COVID-19 restrictions, but Moscow has also been accused of using it to detain political dissidents.
  • Not alone: nine schools in Scotland began scanning the faces of students to accept payments for school lunches, in accordance with GDPR.
  • 97% of parents have given their consent, and schools are also requesting permission from older students.

The Verge


WhatsApp announced users can encrypt their chat history on both iOS and Android. Backed-up chats won't be accessible without a password or 64 digit encryption key.

More:

  • WhatsApp says the feature will be introduced even in countries that prohibit end-to-end encryption or mandate the governments have access to it.
  • A quick recap: In May, WhatsApp sued the Indian government after it introduced new IT rules that would force the company to identify the originator of specific messages.
  • WhatsApp says the rules would force it to break end-to-end encryption.

The Guardian


In other privacy news:
  • The Irish Data Protection Commission wants to fine Facebook $42M for failing to be transparent about how it uses user data.
  • Chinese online brokers Futo Holdings and Up Fintech Holdings, which trade on the Nasdaq, admitted they could face regulatory risks from the country's new privacy law set to go into effect on Nov. 1.
  • Microsoft announced LinkedIn would leave China and be replaced by a job search site as regulators continue to scrutinize the internet sector.
  • A British judge said the audio data collected by a Ring doorbell violated the U.K. Data Protection Act and U.K. GDPR.

Improved privacy, improved ROI—a case study: When Indiegogo needed a privacy partner who could give their users a modern and secure data privacy, they chose Transcend. But that was just the start. Read how by switching to Transcend, Indiegogo was able to reduce consumer privacy request processing costs by 80%.

Read more

Privacy XFN is delivered to your inbox every Thursday morning and is sent by Transcend. We're the privacy platform that makes it easy to encode privacy across your tech stack. Learn more.