If you haven't already, you might enjoy reading the EU's forthcoming GDPR regulations [1] they cover all of this and much, much more including things like:

- data should be exportable in digital formats

- you can request what information a company has about you regardless if you're a full "user/customer" (think of things like how FB tracks anyone who visits a webpage with a Like button).

- you have the right to request a manual review of computer made decisions (ex: a credit approval)

- right to have your data corrected/fixed if it's listed incorrectly

- right to escalate to each country's "supervisory authority" (this is the agency within each country that handles things)

- serious fines in case of non compliance (% of revenue, not a flat amount)

1 - https://blog.varonis.com/gdpr-requirements-list-in-plain-eng...

Agree about the overlap, but want to call to attention OP's requirement that I don't believe is part of GDPR:

> Targeted ads are required to include both a declaration that they are targeted to a user and what criteria were used to select the user.

This makes a massive difference! GDPR currently revolves around informed users making a request. OP's requirement would force companies to educate users about their methods. I see an analogy to the health warnings on tobacco ads.

Incidentally, as someone who thinks targeted ads can be beneficial, I think this would help me interpret and engage with "sincere" targeting.

This is a part of the GDPR - the language is so generic that I think much of this will come out in future court cases, but check out Article 21 and 22 of the GDPR which I think addresses this (but IANAL)

https://blog.varonis.com/gdpr-requirements-list-in-plain-eng...

People can object to be profiled and can ask a person for help like: "Why am I seeing this? Please stop"

Belated thanks for the really useful link! I hadn't looked into these opt-out/review requirements before. But, FWIW, I still think there's an important difference between a user-driven opt-out (which I also don't read as a guarantee of explanation) and proactive publication of the personalization criteria. It's still possible for an uninformed individual to never even realize content is being personalized for them, much less pass the threshold of asking how.

I was unaware of the percent of revenue fine. What happens to a company with negative revenue? Seems like Hollywood Accounting could be pervasive here.

Revenue, not profit. Revenue cannot be negative.

Nitpick: Sure it can, but it's a corner case. You can recognize revenue one quarter, and have to issue a refund to a client another quarter. If that was your only revenue, you have negative revenue for the second quarter. :)

Gross vs net

> what criteria were used to select the user.

One of the "failures" of modern AI is "human-friendly explanation": how do you explain the process behind a decision when it was based on a very complex model? At least, without having to explain the entire model being employed.

It dosen't matter which model were used or which algorithm, what matters is based on which information about this particular user it was decided what to show. If you only have his IP then ok, but if you have his browsing history then you should disclose that your targeting was based on exact browsing history or any other data you have concerning this user that was used.

Yeah, but if the entire history (some large part) is available, then it is in the interests of advertisers to run their algorithm against that. It's not informative. Needless to say, there is a lot of work being done in academia on the problem of making AI decisions comprehensible to humans. It is not clear yet AFAIK whether any ML techniques (even the most prominent approaches) are ever going to be susceptible to a simple explanation.

Couldn't you just pick the top N paths (maybe ordered by how sensitive they are to changes in input) back through the neural net, then list the data sources they ultimately trace to?

"Visited aaa.example one day ago, .34; visited abc.example three days ago, .27; therefore display ad for zzz.example"

> Yeah, but if the entire history (some large part) is available, then it is in the interests of advertisers to run their algorithm against that.

If they had to disclose what information was used to show the ad, this would at least give a small disincentive to do that.

I think there was a recent paper that explored this.

Essentially, the AI was showing how it came to a conclusion by, for example, highlighting parts of the image based on how much they contributed to a conclusion (and showed that a husky was mistaken for a wolf because of surrounding snow) or words which lead to context (showing that an AI to identify atheist vs theist texts was using email headers instead of the body).

This doesn't of course explain the entire process but it means a doctor for example can see that the AI concluded it's not the flu because while symptoms A an B were present, C wasn't there was a symptom X that is in the "Not flu" category and the doctor can then easily apply human intuition to say it's the flu after all because the patient is according to the medical record prone to X anyway.

There's a whole field studying machine learning interpretability.

This recent Distill article is a good introduction [1].

The lime [2] package, based on this paper [3], is also notable.

[1]: https://distill.pub/2018/building-blocks/

[2]: https://github.com/marcotcr/lime

[3]: https://arxiv.org/abs/1602.04938

My proposed regime is somewhat more simple:

All services are opt-in.

If anyone anywhere is charging for (or profiting from) my data, I get my cut.

Adding that information could be considered an undue burden... see the recent court ruling on California anti-abortion clinics.

Fuck that, I have a better regulation: Targeted ads are illegal, punishable by death. Let's force a different (I don't care if it's "better") business model.