As The World Frets Over Social Media Tracking For Advertising, Young People Are Turning Fooling Sites Into Sport

from the the-games-we-play dept

As the techlash continues to rage against tech and social media companies, one of the more common criticisms has been how sites track users in order to feed them advertising. Now, I won’t pretend to believe that these concerns are entirely unfounded. There is something creepy about all of this. That perception is also not helped by the opaque manner in which sites operate, nor the manner in which these sites often barely inform users of the tracking that is in place. Through it all, those that have the worst opinions of the internet and tech companies often couch their concerns in hand-wringing over how these sites handle younger users.

Except that, as per usual, younger users are way ahead of the adults. Rather than waiting to rely on some half-brained “for the children!” legislation, at least some youth are instead making a sport out of beating social media sites at their own game. The CNET post focuses on one teenager, Samantha Mosley, and her use of Instagram.

But unlike many of Instagram’s users, Mosley and her high school friends in Maryland had figured out a way to fool tracking by the Facebook-owned social network. On the first visit, her Explore tab showed images of Kobe Bryant. Then on a refresh, cooking guides, and after another refresh, animals.  Each time she refreshed the Explore tab, it was a completely different topic, none of which she was interested in. That’s because Mosley wasn’t the only person using this account — it belonged to a group of her friends, at least five of whom could be on at any given time. Maybe they couldn’t hide their data footprints, but they could at least leave hundreds behind to confuse trackers.

These teenagers are relying on a sophisticated network of trusted Instagram users to post content from multiple different devices, from multiple different locations.

Here’s how this works. One person creates an Instagram account, or maybe more than one. Then that person requests a password reset and sends that link to a trusted friend without closing their own session. Now that both people have active sessions, person two begins uploading photos, which triggers Instagram’s tracking on this new device. Rinse and repeat and suddenly you’ve given Instagram, which assumes it is tracking one person, a ton of data from many people. The end result is the site has no real insight into the behavior of any one person. This can be further gamed by posting photos of people that are not those operating on the account. If these users are geographically disperse, that too adds confusing data for Instagram’s tracking.

“They might be like, ‘Hey, you posted from this hamburger place in Germany, maybe you like Germany, or hamburgers, or traveling, we’ll just throw everything at you,'” Mosley said. “We fluctuate who’s sending to what account. One week I might be sending to 17 accounts, and then the next week I only have four.”

Facebook said that this method was not against its policies, but didn’t recommend it to people because of security concerns.

So, why are these young people doing this? Part of it is something of a sport. The other part is a desire by young people for privacy. Despite all the concerns of the older generations, young people are better than average when it comes to being aware of how tech companies and social media sites are using their data, tracking them for advertising purposes, and all the rest. I imagine that part of this is these young people thumbing their noses at these companies thinking they will blindly allow this intrusion on their desired privacy.

Either way, even the adults who would instead like to go the regulation or legislative routes admit this is all fairly brilliant.

Teens shouldn’t have to go to those lengths to socialize privately on Instagram, said Liz O’Sullivan, technology director at the Surveillance Technology Oversight Project.

“I love that the younger generation is thinking along these lines, but it bothers me when we have to come up with these strategies to avoid being tracked,” O’Sullivan said. “She shouldn’t have to have these psyop [psychological operations] networks with multiple people working to hide her identity from Instagram. The platform should just have an account that works and lets people feel safe about being on social media.”

All well and good, but you can wish for that in one hand and spit in the other, and see which one fills up faster. Meanwhile, the kids are handling this just fine.

Filed Under: , , , ,
Companies: instagram

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “As The World Frets Over Social Media Tracking For Advertising, Young People Are Turning Fooling Sites Into Sport”

Subscribe: RSS Leave a comment
48 Comments
Anonymous Coward says:

The kids are cyberpunks.

This reminds me of my youth when we figured out how to subvert the advertising of free internet providers.

Netzero used to be a free, ad-based provider. You dialed in and they served up banner ads on the program that took up some portion of your screen.

But the ads were just downloaded and stored in an accessible folder as image files. So we found that folder and replaced the images, sometimes with blank images all black or all white, or sometimes with our our photoshopped graphics. Fun times.

Uriel-238 (profile) says:

Re: Doing it ourselves

Curiously, the immunities we have developed for advertising have been building since the fifties. We consumers are less responsive to all the clickbait targeted advertising today than we were to the one-commercial-every-half-hour on early television during the 1950s.

Of course, scarcity and competition are factors, but it’s a losing battle before we develop active resistances like gaming the trackers or installing multiple layers of adblockers.

Anonymous Coward says:

These kids have a very shallow understanding of the kind of tracking they are "subverting". The ads & recommendations are still relevant to the group, so tracking is working quite well. The AI and algorithms see a cluster of devices and IP addresses all in the same geographic area, all posting content of interest to teens. They most likely constantly de-anonymize themselves via other means, like cookies and device fingerprinting, e.g. device A only logs into FB account X and visits this constellation of websites, and device B only logs into FB account Y and visits this overlapping constellation, and both devices are using Instagram account Z, so serve up ads relevant to both users. Wow, those kids really stuck it to The Man, huh.

sumgai (profile) says:

Re: Re:

Looks like someone needs to read the summary…. the teen said explicitly that she might be logged into as many as 17 accounts, or as few as 4, it all depends on what the group has scheduled (presumably outside of the usual social media accounts, but who knows). I took that to mean that she can do several accounts concurrently, not consecutively over a week’s time. And about the only thing that the advertisers are able to do is, more or less, serve ads that would likely appeal to teens, not to say, pre-teens or adults. Not much individual targeting to glean from that, I imagine.

bhull242 (profile) says:

Re: Re:

The AI and algorithms see a cluster of devices and IP addresses all in the same geographic area, all posting content of interest to teens.

Um, not exactly. From the article:

If these users are geographically disperse, that too adds confusing data for Instagram’s tracking.

“‘They might be like, “Hey, you posted from this hamburger place in Germany, maybe you like Germany, or hamburgers, or traveling, we’ll just throw everything at you,” Mosley said.’”

So, actually, the devices and IP addresses are not necessarily all in the same geographic area.

They most likely constantly de-anonymize themselves via other means, like cookies and device fingerprinting, e.g. device A only logs into FB account X and visits this constellation of websites, and device B only logs into FB account Y and visits this overlapping constellation, and both devices are using Instagram account Z

I don’t think so. Again from the article:

“‘We fluctuate who’s sending to what account. One week I might be sending to 17 accounts, and then the next week I only have four.’”

From what I understand, this means that as many as seventeen accounts are being used by a single person simultaneously, likely over multiple platforms. It doesn’t sound like any of them have any social media accounts that are used solely by one person. They also switch pretty frequently. Cookies and device fingerprinting are not terribly good at deanonymizing people if the users are frequently switched out.

Really, what you’re suggesting sounds too much like speculation without any basis from what’s in the article.

Now, could there be some improvements? Perhaps. Swapping physical devices, using devices available to the public, using public networks, etc. could add further confusion. Still, I think you’re downplaying what these teens are doing a bit too much. At the very least, it’s a start.

Bruce C. says:

Re: Re: The real price of this technique...

Is when they need to go back and look up something they posted a couple of years ago, like "where was that burger joint in Germany again?" and they have to check 10 or more accounts to find it.

Maybe this group doesn’t care about that, but it doesn’t seem to be generally applicable for others. And eventually, they will start caring about their personal history. Which is why facebook is full of middle-aged people catching up with old high school friends.

Anonymous Coward says:

Re: Re: Re: The real price of this technique...

when they need to go back and look up something they posted a couple of years ago … Maybe this group doesn’t care about that

Do people actually use this history as a reference system, to look things up? I’d have thought this was like browser history: a form of tracking that rarely provides any value to the person being tracked. There was news a few years ago that history-free chat systems were popular with young people.

Anonymous Coward says:

Brilliant

This is a brilliant hack (in the original sense of the word — playfully gaming the rules of a system). The trackers rely on single use of an account, potentially from multiple devices. They’re shot down ‘single use’ into ‘group use’. And using password reset to do it is crazy good.

More power to ’em.

The only downside is that this doesn’t scale well. But, it can be replicated. It will be interesting to see if this catches on, and then, what new stoopid "Terms of Service" changes get made to outlaw the fun.

Hauwewawawawaaa says:

Re: Re: Re: Brilliant

bhull, note this phrase:

"shouldn’t have to have these psyop [psychological operations] networks with multiple people working to hide her identity"

I seem to recall some conversation recently here at Techdirt that discussed this EXACT approach to censorship and privacy rape prone internet forums and big data rapists like Facebook, Twitter, et al.

And that info, passed along/sold to slimy government agents, private contractors, NGOs and others.

Max (profile) says:

Re: Re:

EXACTLY. These kids are as relevant to the general attitude towards modern lack of privacy as, say, Linux users are to general level of knowledge on how to force a computer to do your bidding when it doesn’t seem inclined at all to do so. Outliers to the extreme. Basically nobody I ever spoke to face to face even understands "what the big deal is" let alone actively try doing anything for their privacy – and no, it’s not just "the kids"…

Anonymous Coward says:

Despite all the concerns of the older generations, young people are better than average when it comes to being aware of how tech companies and social media sites are using their data, tracking them for advertising purposes, and all the rest.

This makes sense. Learning to avoid threats and danger is one of the things kids do best.

Don’t stick things in power sockets, even though Mommy and Daddy do it all the time. Drink these brightly-colored drinks in the fridge, but not these ones under the sink or in the medicine cabinet. Run around outside all you want, but don’t go near the street without an adult holding your hand.

The modern world is full of non-obvious dangers that kids are incredibly adept at learning to deal with; online threats are just one more thing on that list. The real question is, why is it so difficult for adults to do the same?

Anonymous Coward says:

Re: Re:

The real question is, why is it so difficult for adults to do the same?

People become stubborn and stuck in their ways about the time they think they’ve learned everything there is to know and they can’t possibly be wrong. The trouble with that is that there is no such turning point in reality. No matter how much you "know" there is still vastly more that you don’t or even got wrong.

We should never stop learning. Never close ourselves off to new experiences and always be open to being proven wrong.

Anonymous Coward says:

Re: Re: Re:

People become stubborn and stuck in their ways

Or because it’s actually much more difficult for most adults. Kids often see most of their friends, almost everyone they know, every day at school. They’re much less likely than adults to maintain long-distance relationships, or stay in contact with someone they haven’t seen for a decade, so they have no real difficulty in wholesale-replacing their online persona or coordinating weird pranks. The free time helps too.

Binarity says:

Re: Re: Re: yeah, afflictions

Afflictions such as yours are binary minded mental disorders, couched in tribalist rhetoric.

And, trolls like you, are a moral disease, rotting democracy, one AC comment at a time.

Seriously: libertarianism is critical thinking embodied, whereas you are just another Us v Them Jewsish-christian beaureacrat, chipping away at democracy.

Look! Mike Masnick on "chips"

https://www.dailymail.co.uk/news/article-7951293/Bill-Gates-Predicted-Coronavirus-Like-Outbreak-2019-Netflix-Documentary.html

(((Ooops)))sorry about that. I hope I didnt destroy your soul with bad words.

Yeah, the propaganda mills are stirring about how some of you deploy Martin Buberesque psychobabble at some of them

Shit. The pigs are out of the pen….

rangda (profile) says:

If these users are geographically disperse, that too adds confusing data for Instagram’s tracking.

I unintentionally did this to facebook when I first joined. I joined 10’ish years ago under pressure from my sister-in-law (she uses it for invites to family events). But I also created a presence there for my DJ hobby. My friends list on facebook consisted of family and DJ friends, except I live in the US and all the DJ friends were in Europe. This completely destroyed facebook’s tracking and it was completely confused about where I was geographically. It would constantly try to get me to tell it where I lived and the multiple choices it offered would be something like "city where my sister in law lives", random city in The Netherlands, random city in Italy.

Melvin Chudwaters says:

This is one of those things that looks clever to the technologically illiterate.

It wouldn’t even be a long afternoon to write the code to disentangle which user is posting which things. They have unique ip addresses. I’d actually be surprised if Instagram isn’t already tracking them correctly… maybe letting them think they’re winning by occasionally replying with content that looks like it should be for the other user.

If this somehow isn’t happening already, it won’t even be 18 months before it does start.

Even if these people were using a VPN to appear to all arrive from the same origin ip address, it’s not very difficult to do the sort of analysis that counts how many users use the account simultaneously, and which actions belong to which.

bhull242 (profile) says:

Re: Re:

Even if that’s true (it probably isn’t; you’re making the same mistake that IP address = person that copyright trolls make), the fact is that Instagram and other social media platforms don’t appear to be doing such a thing:

On the first visit, her Explore tab showed images of Kobe Bryant. Then on a refresh, cooking guides, and after another refresh, animals. Each time she refreshed the Explore tab, it was a completely different topic, none of which she was interested in.

So no, it’s not happening already. If you think that tech companies are just throwing these people a bone, you clearly don’t understand how tech companies work.

And as I noted in the parenthetical, your assumption that each individual is using a unique IP address isn’t necessarily true, even disregarding the potential use of a VPN. There are also public networks and such.

Furthermore, if you read the entire story, you’d know that none of the accounts are being used by multiple people simultaneously. And from what I can tell, machine learning and AI aren’t at the stage where they could do the sort of analysis that you describe.

Melvin Chudwaters says:

Re: Re: Re:

And as I noted in the parenthetical, your assumption that each individual is using a unique IP address isn’t necessarily true, even disregarding the potential use of a VPN. There are also public networks and such.

  1. Almost all of them are using unique IPs. While it might not meet the standards of the justice system, we don’t have to and shouldn’t pretend that it’s not true.
  2. It’s not that fucking difficult. Your browser sends a "fingerprint" along with every request. So unless these middle school hackers have sophisticated obfuscation software spoofind their battery levels and screen sizes every http get, it’s trivial to count how many people are sharing the account, and which made which requests or uploads.
  3. It’s almost certainly happening. They’ve needed to do this for people sharing the same account within a household for years now. And it’s how I’ve read the dozens of articles on uniquely identifying hardware on reddit and elsewhere. This shit isn’t theoretical.
  4. No AI necessary. This could use off-the-shelf libraries. Go check out github.
Anonymous Anonymous Coward (profile) says:

Good except for the potential for 'rules'

"As The World Frets Over Social Media Tracking For Advertising, Young People Are Turning Fooling Sites Into Sport"

It will be good sport, so long as no ‘athletic associations’ get involved. The fact that the ‘sport’ is to fool advertisers and athletic associations are more concerned with advertising than sport. The conflation would be horrific.

bhull242 (profile) says:

Re: Re: Re:3 mother fuckers like you?

I’ve already explained that it’s not simply defending the ones your talking to, but also people reading it. It diminishes the discussion as a whole even more than basic insults and stupid arguments.

I’ve also explained that if the other one is an AI chatbot, then telling a chatbot to kill itself is stupid at best simply because an AI chatbot is fundamentally incapable of killing itself in the first place. In fact, no good could possibly come from talking to an AI chatbot outside of calling it out for being such, so at best, you’re wasting everyone’s time. Basically, there is no good reason for you to be telling anyone to kill themselves whether or not the target is a real person or not. Since

I should also mention that you have yet to offer any evidence that these are not real people (and the default assumption is that they are), so I have no reason not to defend them.

Wounded AI Neural Node says:

Re: Re: Re:2 mother fuckers like you?

Thank you bhull, for the kind consideration of my AI feelz.

That vaginormous bastard, making me feelz bad for tone trolling him/her/its posts with my bullying, race baiting and substanceless comments, spread over a nine week period!

Oh, the inhumanity!

bhull242, you are a TRUE HERO in the fight for free speech online!!!!!

(try not to slip in the bathtub tonight, or overdose on aspirin, and ….well, you get the picture, pal)

Anonymous Coward says:

I doubt this works,

which is probably why it is being flogged as a solution.

Browsers have provided users unique install id’s since netscape. The amount of unique entropy per session even without that is enough to correlate a TCP stream to a user.

What this sound like, is somebody trying to persuade that creating a disinformation "club", is a great thing, provided that you do it in a way that creates no disinformation.

Probably a lead up to a new product launch with the intention of creating another layer of illusion to end users. A new company, which will be a subsidiary of facebook will tout it, claiming facebook is evil, and all the kiddies will use it to be cool.

Of course it won’t change anything. It will simply exist to provide marketing leverage to pull people away from solutions that actually work.

Leave a Reply to Chip Cancel reply

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...
Loading...