Mobile Ads Invade Privacy: Advertisements Can Track Your Location

Mobile advertisements hosted on mobile websites and served through smartphone applications can be used to track the location and activity of individuals, researchers at the University of Washington discovered.

According to the recently published study conducted by researchers at the University of Washington’s Security and Privacy Research Lab, it is possible to use targeted advertisements to pinpoint the location of a user within several meters.

The researchers tested advertisements in 10 different mobile apps, including the dating app Grindr, image sharing service Imgur, voice-over-IP communications app Talkatone, Words with Friends and other apps that are widely available across multiple platforms.

By buying advertisements that were served to a variety of people who use the applications, the researchers were able to garner a number of details about an individual just from details collected through the ad’s appearance on their device.

Some of the information collected by the ads were considered to be sensitive details. Personal information about a person could often be determined based on a person’s app usage. Seeing that a user was served an ad through Grindr, for instance, may reveal the person’s sexual orientation.

Even more troubling, the researchers could identify when an individual users was at a specific place by using location-specific advertising. The system, offered by a number of advertising networks, will notify the person placing the ad when a user receives the location-specific advertisement. The notification comes within 10 minutes of when a person sees the ad and can identify the person’s location within eight meters of where they are.

The system works by tracking an individual user’s mobile advertising ID (MAID) number. That identifier is supposed to be private but the researchers said that it is easy to discover as they are often sent through unencrypted exchanges between the application and the ad serving server. That data can easily be intercepted and allows an ad placer to track an individual user.

While the advertising networks likely do not have bad intentions with the features and only intend to give advertisers more control over who sees their ads and when they appear, there are a number of malicious ways that attackers and others could abuse the system.

Businesses could use location-specific advertisements to track competitors, the researchers suggested. More troubling are the types of privacy-invading activities that a person could carry out. For example, because advertisements are cheap and can be highly targeted, an abusive spouse could use advertisements to track the location and activity of a significant other.

The University of Washington’s researchers even warned that foreign intelligence agencies could operate a surveillance campaign on a relatively small budget—a possibility that is especially prescient given the recent concerns about Russian government-backed operations using ads on social media to sew discord and influence the political discourse in other countries including the United States.

For individuals, there are not a ton of options for stopping such abuse performed through advertisement networks. Using a virtual private network (VPN) or ad-blocking service may help negate the tracking behavior, but the researchers suggested that ad networks would have to take action to truly mitigate the targeted efforts.