But every time this comes up the threads are flooded with people saying it doesn't actually happen and the ad companies just work out what you're interested in by what you're browsing.

And that all this information gathering for targeting absolutely matters.

Fly-by-night ad networks might engage in this. Ad networks that are in the sights of regulators, and can be slapped with $X billion fines, that may well exceed the marginal revenue produced by improved tracking[1] are going to be a bit antsier around doing that sort of thing.

[1] How much more money will a $100B ad business make if they improved tracking accuracy by %1? It's some positive number, but significantly less than $1B.

Would a top tier ad network be exposed to any liability if the fly-by-night did the sketchy work, then the top tier bought that “anonymized” data?

Probably not direct legal risk[1] if they weren't the ones collecting the data, but integrating with all that shit has the incredible risk that your counterparty might just go up in smoke next week, while leaving you with a busted product, and all the reputational damage fallout.

It's picking up pennies in front of a steamroller. You'd have to be a truly desperate PM to consider it.

[1] Still all the legal risks of holding that data, but they are easier to mitigate.

So instead they buy that data from the fly-by-night operators and carry on as usual. That's the key problem here, this data only needs to be collected by one shady operator, "the market" will handle the rest.

Two different things. The popular conspiracy theory is that the phone listens to and presumably transcribes your conversations, sending them to a third party. The example the OP gave is specifically listening for TV content: they’ll have hashes of known ads/shows/whatever to compare against rather than do something like live transcription.

Don’t get me wrong it’s shitty and gross. But they are different things.

The only reason they don't do that is because our devices aren't powerful enough to do it all the time.

I don’t disagree with you but the fact remains: they aren’t doing it.

A dedicated chip?

Yes?

I'm just glad we are not there yet.

Both iOS and Android show when your microphone is active so the whole conspiracy theory about it always listening to you and sending it back is pretty bullshit. And no one has yet found evidence of such network traffic either.

True, but the theory is far older than the indicators. So maybe Facebook stopped being sneaky once those controls came in? Not saying I believe them, but there's still room for doubt there.

Facebook doesn't have to be the one doing it - a 3rd party that controls an app on users' phones could be selling transcribed data to companies that want to run individually tailored ads on Facebook.

except it's always listening for you to say "siri" or "google assisstent". Some androids also show what music is playing nearby. You can thankfully opt-out but the ability to is still there.

They do that with local processing. For the music thing it calculates a hash locally and send it to their servers.

That still requires the microphone to be active, right?

Yes, but it doesn't record anything. It calculates a hash locally and sends that hash to their servers, where it is then identified.

Couldn't you do the same with tv shows and ads?

At least on iOS, not without hacking the operating system. Siri’s ability to listen for a wakeword without an microphone indicator requires privileges that normal apps don’t get. On Android, as far as I can tell, the same is true, except that some phones ship with preinstalled third-party apps which can then get extra privileges.

It runs on a specific coprocessor, even.

This seems very similar in principle to the perceptual neural hash that Apple created and uses to check every file on any Apple device. I recall that some people had an issue with that, because there is no guarantee what hashes will be added to the database, and no real way to know what file they will map. So, the hash could be anything, and could send anything, which is entirely up to the whins of whatever company or entity that deploys such a product. Effectively, this just means that you can in fact check nearly anything happening on an input, if it maps to some perceptual hash that is similar enough to one the server has in its db.

Actually there are no servers involved; it uses an on-device database:

> When music plays nearby, your phone compares a few seconds of music to its on-device library to try to recognize the song. This processing happens on your phone and is private to you.

https://support.google.com/pixelphone/answer/7535326?hl=en&s...

...They don't even need to hash content. Advertisers can just add ultrasound beacons to the audio track.

Imperceptible to human hearing, but readily picked up by a listening mic. In fact, there are static analysis tools for picking out apps that access such API's in FDroid, along with taking measures to feed said apps dummy data. At least for Android anyway.

Your phone notifies you when an app accesses the microphone. If this is happening so much, how is it not blatantly obvious?

Why do you think iOS and Android now prompt for microphone usage?

iOS has prompted for microphone usage since 2013

Android phones that are 8 major versions out of date because the OEM won't support them probably don't have that feature.

8 major versions, that is surely less than 5% of the Android population. I'm sure the security flaws in those non-updated phones is far more serious than the lack of microphone indicator.

I was being a bit tongue-in-cheek with the 8. However, it is just as valid to talk about unpatched security flaws.

According to https://source.android.com/docs/core/permissions/privacy-ind..., the microphone indicator is only in there since Android 12. Android 12 and 13 cover only 50% of Android phones, according to https://gs.statcounter.com/os-version-market-share/android/m.... There were some "access to the microphone is restricted for background apps" changes earlier, reported for Android 9. But I wouldn't rely on them, and even if those restriction always worked, that still made ~10% of Android phones vulnerable.

It seems highly inefficient to listen to users 24/7 given the other more specific signals that are available. Rather have a transaction data point around everything someone has purchased then what they talk about.

For context, this is the worldwide stats that Google reports:

https://imgur.com/a/mqBE8wM

30% on Android 13 is absolutely not believable, both from personal experiences and data collected.

Ice Cream Sandwich was the best android, and nobody can tell me otherwise.

Agreed. Android 4 was peak Android. Most of my favorite Android games are from that era and very few of them run anymore. I wish Google either make a sandboxed emulation layer for those old abandoned games.

Wait... what? As someone who's always tried to target the oldest Android version I can which Google Play will still allow uploading (for a long time, Android 2.3), this is alarming. Why don't they run now? I don't actually play games on Android myself.

No idea of what API they're hitting but basically half of my old humble library won't run anymore - they show a warning about old APIs, show the title screen, then crash to desktop.

Even some old games I paid for are gone from the Play Store too. Like, I paid for Puffle Launch and it's just plain gone from my library.

Edit: ahah, I was looking in the wrong spot! Its still in my "not installed" list, just not in my "family library". Either way, not compatible with any device I own.

Ah, 2011, the age of so many Angry Birds clones...

I just found https://archive.org/details/PuffleLaunchAPK and https://archive.org/details/PuffleLaunchAmazonAPK (both point to each other), with a note that says that the latter generally works and the former crashes. I can verify this; on my (Android 8, 32-bit compatible) device the Play version crashes with:

  08-10 14:55:03.864 25995 25995 E linker  : ERROR: OOPS:     0 cannot map library 'libmono.so'. no vspace available.
  08-10 14:55:03.864 25995 25995 D AndroidRuntime: Shutting down VM
  ...
  08-10 14:55:03.865 25995 25995 E AndroidRuntime: FATAL EXCEPTION: main
  08-10 14:55:03.865 25995 25995 E AndroidRuntime: Process: com.disney.PuffleLaunch, PID: 25995
  08-10 14:55:03.865 25995 25995 E AndroidRuntime: java.lang.UnsatisfiedLinkError: Bad JNI version returned from JNI_OnLoad in "/data/app/com.disney.PuffleLaunch-rjdXjIyhGz7STdfxQ9xH2g==/lib/arm/libmono.so": 0

I'm always on the lookout for old interesting games, and maybe there are workarounds for the other titles in your library too. What's the list?

I tried looking up that "no vspace available" error (which is the real error message) and found no explanation. I wonder whether it's something like trying to map a .so segment as memory that's both executable and writeable but it's no longer allowed? And IIRC Android's runtime linker was rewritten sometime around Android ~4 because the original was not very well written, so that might be the cause of the incompatibility. Come to think of it, the large parts of libc that were also completely replaced (mostly with code from OpenBSD and FreeBSD IIRC) because they were terribly buggy will probably cause compatibility issues too.

Puffle Launch wasn't an Angry Birds clone, it was the barrel scenes from Donkey Kong Country expanded into a full game.

One problem is that some games aren't just incompatible, but also were enshittified with ads and nonsense after I paid for them (before they were killed altogether).

Offhand, the ones I remember: a paid version of Angry Birds Space, Amazing Alex (Rovio's excellent take on The Incredible Machine), Swords and Soldiers (fortunately there's a Steam version of that), Noodlecake's "Wave Wave", Pool Break Pro, and some classic ports like Dead Space, Spy vs Spy, and Ur-Quan Master, but there are better non-mobile ways to play those games.

> the ad companies just work out what you're interested in

The word "just" doesn't belong in that sentence. The ad companies being able to know things about you without actually listening to you is even more scary.

Evil-Ad-Company Neo: "You're telling me I can know things about my customers by secretly listening to them?"

Evil-Ad-Company Morpheus: "No Neo, I'm telling you that with the right license agreements, data sharing partnerships, and algorithms, you wont need to secretly listen to them."

I mean showing you ads for diapers because you googled "best diapers" falls under that same category and I daresay isn't evil at all

I am pretty convinced that modern advertising - from the most inane and innocent to tracking users 24/7 pretty clearly falls under evil. Gone are the days of advertising trying to raise product awareness and convert purchases - that field now exists to create demand. It induces desires in the recipients that play on psychological factors like FOMO to create customers out of thin air - and that process causes we the consumer to pay a constant attention tax and suffer higher levels of stress in our daily lives.

Advertising is evil.

I'm not a radical about many subjects, but I'm certainly radically anti-advertising.

Advertising is nudge theory without the do-gooder mystique

You do realize all forms of media embed advertising directly into the content going right back to the beginning, right? There's nothing modern about it. Showing you a product when you actually want to see it is the most effective way to induce demand. All your favorite shows, movies, youtube personalities, etc. still do this.

Well, seeing that:

- I use ad blockers for my browser on both mobile and PC

- pay for the ad free version of all of my streaming providers

- don’t use apps that have ads and don’t have a method to pay to get rid of them

If you think that the product that the lead actor in the series your marathoning through on your streaming provider isn't there on purpose, then you've just not been paying attention. There's a reason shows blur out logos on people's clothing or the crew covers them up with grip tape, or set dressers turn the cans/bottles/boxes of products around so the main logos are not visible. Even having copyrighted posters on the wall in frame can cause licensing issues.

This isn't true. Originally advertising was designed around the premise of explicitly highlighting utility and functionality of goods/content. It wasn't until Bernays came along and adapted his uncle Sigmund Freud's theories into practice by designing advertising to manipulate people into believing that they actually need the product.

Modern advertising is not just "showing a product to induce demand". Car adverts don't just highlight functionality, they use mass market analytics to play emotionally driven messaging and visuals so that you associate that feeling with the car ad.

Do you know what Bernays called what services he offered before the word got tarnished?

Propaganda.

The documentary "Century of Self" by Adam Curtis [0] certainly opened my eyes to the damage that Bernays has inflicted on society in general.

[0] https://www.youtube.com/watch?v=eJ3RzGoQC4s

Same. Filed under haunting things you can never unknow.

Two years after the 'Century Of Self', Adam released 'The Power Of Nightmares' (2004): https://www.youtube.com/watch?v=yK3wz-OyR1U

It explores the power fear has to shape behavior.

> Bernays came along and adapted his uncle Sigmund

and then bernays' nephew started netflix

Those two categories are really far away from each other.

Googling X is a voluntary act to search for X.

Speaking about X with a friend, while the phone sits in a bag nearby, has exactly zero connotations of wanting to search for X.

* * *

> Advertising, by its very nature, is emotional manipulation with the goal of getting you to give up some of your money for something you most likely don't really need and won't improve your life all that much

I've heard somewhere that ads are rich people screaming "give me money".

(i know, i know, but i like it)

> To me, that's evil.

Bill Hicks on marketing: https://www.youtube.com/watch?v=tHEOGrkhDp0

> I've heard somewhere that ads are rich people screaming "give me money".

That makes me think of this Paul Graham piece on "the PR industry, lurking like a huge, quiet submarine beneath the news." [0]

[0] http://www.paulgraham.com/submarine.html

He makes one really good insight:

> If you really want to be a critical reader, it turns out you have to step back one step further, and ask not just whether the author is telling the truth, but why he's writing about this subject at all.

Followed quickly by being hopelessly naïve about the future:

> Whatever its flaws, the writing you find online is authentic. It's not mystery meat cooked up out of scraps of pitch letters and press releases, and pressed into molds of zippy journalese. It's people writing what they think.

I don’t have any ethical concerns with ads. My concern is that it ruins the experience of whatever content I’m trying to consume.

Surprisingly though, for some reason I don’t find podcast ads to be as offensive.

>you most likely don't really need and won't improve your life all that much, if at all

People are spending money because they see that they are getting value from something. If people didn't want it or thought it was worseless they would not buy it.

>If people didn't want it or thought it was worseless [sic] they would not buy it.

Thinking something is "worthless" and not wanting something are opinions. A lot of modern advertising attempts to change peoples' opinions, so that they do want something, and think something has worth. It's just like propaganda, which actively attempts to sway peoples' opinions.

Of course, there's only so far you can take this. Convincing anyone who isn't seriously mentally impaired that a sandwich made with literal shit isn't worthless is probably not going to work. But away from the extreme end, there's a lot of room to manipulate people.

Sure, if you take the most benign examples, it doesn't sound so bad. But it's so much worse than that. Going back to 2012 for "acting on data analysis gone wrong"

Target Sends Coupons to Pregnant Girl and Unawares Dad Explodes

https://www.workplaceethicsadvice.com/2012/02/target-sends-c...

> Pole had identified about 25 products that, when analyzed together, allowed him to assign each shopper a "pregnancy prediction" score. More important, he could also estimate her due date to within a small window, so Target could send coupons timed to very specific stages of her pregnancy.

And things just get worse from there, as companies figure out more and more ways they can extract information from the information they have about you, and share it with each other.

But that story was made up. (Not that Target does data analysis - the specific "teenage girl had sex!" anecdote).

No no no. First we start with trusted brands you know and love. We use the trust you have in them to slowly build a market around them. With our ad strategy, you’ll start seeing our product as related to Trusted Brand A. You will start seeing comments and reviews for our Brand in the same browsing contexts more and more until our Brand is now correlated enough to Trusted Brand A to remove purchase inhibitions.

After that, we just wait. We know we have you. It’s just a matter of time till you need a product like ours (you’re already our target demo), or an impulse buy occurs.

Without evening knowing it. You’ve been manipulated into trusting our brand, and you’ll think it was all an organic choice.

Nothing malicious or dangerous here.. move along.

sorry, i don’t mean to be dense here but could you spell out the implications for me? why is what you’re suggesting more scary?

They're saying it's scarier that ad companies can figure out these things without the data because it means that you can't protect yourself by withholding your data.

> you can't protect yourself

but what are you protecting yourself from? What's the threat model?

Among other things, I would say the unknown collation of personal history, interests and spending activity that is often auctioned off to the highest bidder.[1][2] In an even more automated society than today, social scoring becomes the norm, and with it access to services.

With prolific cases as Robodebt and the Toeslagen Affaire, we can only hope these automated scoring systems remain isolated from governmental overreach.[3][4]

[1]: https://themarkup.org/privacy/2023/06/08/from-heavy-purchase...

[2]: https://themarkup.org/privacy/2023/06/23/how-your-attention-...

[3]: https://en.m.wikipedia.org/wiki/Robodebt_scheme

[4]: https://en.m.wikipedia.org/wiki/Dutch_childcare_benefits_sca...

You're protecting yourself from targeted psychological manipulation. It's like the difference between someone spraying a cyber-attack over the entire IPv4 space. or spending a while trying to drill into a specific server. The latter is much scarier and harder to resist, but it's basically what targeted advertising is these days. They supposedly want to just help you find what you want to buy, but they do this by trying to make you want things you wouldn't actually need otherwise.

I like to think I'm immune (the only ad I've ever taken up was years ago for Privacy(.com), and only because I then knew about it later, and could choose to pursue it on my own), but I wouldn't be surprised if at some point before I started being allergic to every type of advertisement imaginable, some ads managed to get my attention for one reason or another. (maybe subliminal messaging's done something before, I dunno.)

I'm not too concerned about it since I know it's been kept to a minimum, so at this point basically everything I've done is something I actually wanted to do, there are no concerns about having been manipulated. But that's just because I've managed to avoid seeing targeted ads almost whatsoever.

Of course, someone who has been successfully manipulated would also think they've escaped manipulation. Isn't that the scariest part

Depends on the method of manipulation but yeah that is the scary part. It's probably part of what scares people into being so privacy conscious in the first place. Though for me it's more that I get really, really annoyed getting told to do things, because it triggers pathological demand avoidance. But that's just manipulating me in reverse (it's really easy to make me hate/avoid something just by annoying me with it)

At some point a reality check should be possible. Do you find yourself spending money on advertised-things?

That's the metric I usually use. It's absolutely inconclusive, but it works for peace of mind at least. Have I seen any ads for something I bought? Usually the answer is "no". I'm still at the mercy of sort order on sites like Amazon and eBay, but that's much less scary because if I really care, I can sort by lowest price first.

By my own moral compass. If a company says "lots of people on Amazon are looking to buy what we have, let's make sure we're present in that market", that's completely moral. Compare that with, "a child is preparing for their math test tomorrow by watching a video, let's interrupt them and make them watch a commercial about our sugary, addictive, and unhealthy drink".

Is it even possible to not spend money on advertised things?

Mostly by not spending money frivolously.

The house I live in was advertised when it was on sale, all the food at the store gets advertised, all the non-bespoke clothes I can buy get advertised, as do most of the bespoke ones, every car gets advertised...

The difference is whether those ads were exposed to you before you bought it. Was it a factor in your decision?

Not whether it's something in the world that's ever been marketed at all, because literally everything has.

Generally yes. Especially the grocery store is constantly advertising hundreds of items, and I've looked at their ad pages more than once. And it's pretty hard to find houses outside of advertising platforms, and I used to watch enough TV that I'd seen ads for every clothing store and every car before I had a chance to find them on my own.

Deanonymizing people across datasets for one. Maybe attacker or maybe next gov that goes full Hitler and subpenas tech companies to introduce social karma and you are put on a no-fly list because you expressed interest in UK royalty or have a cousin in Iran. Invisible bubble and radicalization for another.

Firstly there is the emotional response: I don't want to be followed around in everything that I do for someone else's benefit, and I not at all convinced of arguments that targetted advertising is done for my benefit.

Then there is the fact that a large amount of data about me is being stored, possibly insecurely for people with even less scruples to analyse. I have very little to hide (white, middle class, straight, male, cis, no criminal activity beyond some unlicensed TV/film access, etc – there is little or nothing about me that would be frightening for anyone else to know) but there are many out there who do have things that could be (unfairly) held against them with terrible consequences. Consider women in Texas where there is effectively a reward/bounty program to encourage snitching on those who have had, or are considering, an abortion, or people in law enforcement who don't want certain groups to be able to derive their home address with any accuracy, people in one or more closets through fear of being ostracised from their family/community and left pennyless & without support, and so forth. I grew up with friends who were gay when it was still effectively illegal to be, despite what the Sexual Offences Act (1967) said, and when getting beaten up for being gay was almost acceptable (“act more straight, and it wouldn't have happened”: something a friend was once told by a policeman that saw no cause for arrest) – the fear of consequences from collected information “getting out” and/or being used to derive other information (true or otherwise) is real and for many people not at all irrational.

Back to my icky feelings, which are perhaps a little bit less rational: I wouldn't be happy with someone following me between shops, watching what I'm perusing, then to the pub and noting who I was there with, then back to my home, in order to be able to serve me relevant ads (perhaps for shoes that would be more comfortable for that much walking? or for condoms because they noticed I was accompanied by a female friend, and you never know, right, nudge nudge wink wink), and I'm not happy about the same happening in a more virtual environment. How do I trust that is really (or only) why I'm being followed? And I how do I know who else my stalker is selling news of my activity to?

[actually, the “I have little or nothing to fear” isn't entirely right – any of us could suffer from plain old identity theft in various ways]

I understood this to mean the amount of information they have is enough to uniquely fingerprint you and associate that with your derived wants and needs.

> The ad companies being able to know things about you without actually listening to you is even more scary.

This has been true for years to the extent that the nature of your purchases can tell a lot about you. https://www.forbes.com/sites/kashmirhill/2012/02/16/how-targ...

That was an official feature of the Facebook app at one point. Like 10 years ago. It's absurd that anyone would deny this. It was right there as a feature! Default off I think. But it was definitely there.

I can’t speak for Android. But exactly how does a mobile app turn on your microphone on iOS without you giving it explicit permission?

I just did a virtual visit with a doctor that used a video conferencing service that work without an app on iOS and just used Safari. I had to give the page explicit permission to use my microphone

What makes you think they don't get permission from the user?

Nielsen has sent me about $30 so far begging me to wear a microphone that records me all day. They repeatedly call and have started fedexing me letters instead of USPS.

I open them to get my increasing amount of cash.

That data must be valuable???

Put the microphone on your cat while you're gone for the day.

so this really does happen then? Because I used to be convinced it wasn't a coincidence when I saw ads online for some niche uncommon topic I had recently talked out loud about.

This matches the audio signature of the TV ad - basically, it's like Shazam, but for TV ads.

It's currently not economically possible to listen to user's conversations, transcribe them to text, and serve ads based on that. It would cost orders of magnitude more in processing power than you could get from the extra sales.

This might change in the future, of course

Yeah, my understanding was that it was audio fingerprinting tv ads, not transcribing anything, but I wouldn’t be surprised if they were trying to vacuum up other stuff. That said, I think it should be feasible to do basic low-accuracy transcription on-device, especially with all the neural engine hardware making inference more efficient.

Wouldn't cost that much if the transcribing is done on device

This would be immediately obvious in a cursory analysis of performance. On-device transcription is not only computationally infeasible, it would also require model capabilities far beyond what is currently SOTA.

Google had (and has afaik) significant challenges implementing multiple wake-word detection for precisely this reason.

Transcribing a couple of words accurately on-device without a major performance penalty (so that it can be running in the background always) is just _barely_ coming out now.

I would have to take your word for it but my phone is able to transcribe speech with no problem and no internet connection.

Of course running it 24/7 in the background would ruin my battery, you would have to be smarter than that.

Which phone/app? I would be very surprised if a manufacturer has an entirely on-device real-time ASR model, maybe I'm behind.

rewind.ai has entered chat.

There's this weird narrative I see that "computers just aren't powerful enough" to do things I remember them already doing on Pentium 1 class machines in the 90s.

> It's currently not economically possible to listen to user's conversations, transcribe them to text, and serve ads based on that.

Anedoctally I belive Meta does something like that because I consistently get ads on Instagram about topics I talk with a friend on Whatsapp and sometimes that is done completely via audio messages. Though I might be wrong and leaked the topics in text messages among other possibilities.

I think it can be economically feasible. They can have a model optimized for their topics which can be orders of magnitude faster than general-purpose speech recognition. Low accuracy probably wouldn't be an issue as they are able to fine tune the user topics of interest via its interactions with the ads (e.g. click rate, time spent before scroll).

So your app already had microphone/audio permission granted for legitimate reasons or were they going to do the pop-up after the update?

Nah, we didn’t ask for any permissions at the time iirc, except gps if/when people wanted to use that to hop the map to the right spot.

Why broadcasted ads which are the same for everybody? Is it trying to track effectiveness of these ads?

Why not? Your cable company would like to charge you extra if you mute the ads or use the bathroom during ad breaks. That's just capitalism.

Exactly. Going to bathroom during ads is just a display of disrespect to creators and marketing people. You could go during the show instead.

Probably to target an ad for the same product/service at someone who was in the same room as a TV ad. About 10 years ago I worked for an ad targeting company and we got ~50% more click-through on a web ad just by showing it shortly after a TV ad aired in that location (just using the geoip timezone and hoping they might've been watching the right channel), if you could do that only for people who've actually been exposed to the TV ad there's the potential for huge uplift there.

Oh, that's clever.

When I worked on audio firmware for the BlackBerry, one of the external devices I had to support was called a "security plug", which just shorted the headset mic and headphones to ground. It always seemed kind of silly to me because there was still the handset mic on the phone that could be activated separately.

Did an external mic not stop the internal one from working? I assume the plug was a box-checking exercise more than anything.

I think the default audio routing was setup to stop the internal mic, but if you used the mixer API, you could do weird, custom things.

"Adtech is such a thoroughly gross field."

Someone else on HN called it "elegant" last week.

https://news.ycombinator.com/item?id=36975056

I work in ad tech and elegant is not a word I’d use. It’s very, very loosely coupled and has a grave transparency problem.

> "The current movement to avoid tracking is an extremely powerful centralizing force."

What a biased, myopic comment. As if ad companies are a grassroots movement against centralisation. As if ad tech is not in the hands of the powerful few tech companies.

They have defended ads in 2021 as well. I wonder where they work. I mean, somebody must be writing the backend for all these ad companies.

Adtech is psychological manipulation. Radicalisation uses the same techniques: Create the perception of a vacuum and then provide the solution to fill it.

One is actively censored and you can go to jail for, the other isn't even on the legislative agenda. There are semi-understandable reasons, but it's far from entirely non-hypocritical.

- Do you trust your constituency to make up their own minds or not?

- Who are you trying to protect?

  - From what?

  - From whom?

And this is without even mentioning online advertising as a (seemingly increasing) vector of scams, frauds, malware and viruses.

When I worked at Meta, the execs said that many users think they're being spied on when they see ads based on a conversation they've had in real life, but the execs categorically denied that this could be happening, and said it's all just a coincidence. I thought this was a completely unfounded denial, since Meta had no way of auditing 3rd party apps on the user's phone, and it's perfectly plausible for another app to spy on their conversations and then use that to provide targeted ads to the Facebook account associated with the individual's email.

Realistically, in a simple statistical way, plain "coincidences" have a significant "expected value". I.e., if you simply take the billions of people across the planet, and look even across a single day, lots of coincidences occur.

Now, add in psychological effects - "synchronicity", "frequency illusion" ("Baader-Meinhof"), "recency illusion", confirmation bias, etc... I'd expect a fair bit of compounding*.

Then, add in simple use of statistics, statistical inference, etc. and basic tracking of user navigation around the web, on a given website, etc.

I've had these experiences, perhaps one or two times a year, on average. Experiences where I was VERY surprised by ads presented. Experiences that would easily suggest a microphone must have been on when it shouldn't have been. Sometimes, I realized I'd used someone else's device in a way that could be tied to me. Other times, while some "leaps" would be involved, I could basically deduce myself that someone who had looked for information on some "X", and information on some "Y", might really be thinking about some "Z" that isn't easily arrived at from either X or Y in vacuo.

Spying, in the sense you suggest, can't be ruled out by the above. But, I would ask - why even spy? Is a company like "meta" really going to get much more useful (from their perspective) info by doing so? Particularly given the COST? It's becoming more realistic, arguably, but, really, these companies have had more than enough info on just about anyone for well over a decade to keep their algorithms and such well-occupied.

People gladly hand over tons of data constantly ... with full awareness and intentionality, and otherwise. The vast majority have no idea what statistical inference and other techniques can suggest based on seemingly obliquely connected info. Further, most users are so accustomed to "cookies" and other hidden types of tracking, and ignoring EULAs** ... really, it's hard for me to imagine a good case for doing anything more ... "invasive" and ... legally / otherwise dubious.

Edit: mostly came back to add one of my favorite (ab)uses of (statistical) inference:

https://youtu.be/Oseqh7SMIvo

(also, added the bit below about EULAs)

* Outweighing significantly, I'd suggest, other quirks of human perception, memory, etc. that may diminish awareness and recognition of potentially related events. I write "suggest" mainly because I don't have ready refs to offer this second and don't have time to dig a couple up ... IIRC, the research that exists strongly favors compounding, though, of course, this could be argued to be influenced itself by human psychology (including social and economic factors, e.g., "publish or perish" etc.).

** Jargon buried in legalese, what a genius way to get just about anyone to agree to just about anything! If only John, King of England (in 1215), had been more skilled in the ways of the EULA - perhaps "King Charles III" would be emperor of the world now. Oh utopia denied ... kek.

> Billions of people > lots of coincidences

While that is a positive take that could explain it, I am not convinced by that number crunch. 2/situations per year, per person, that is still "a lot" to be considered plausible statistical coincidence.

In many cases it’s more than simple:

You had the conversation with someone and that someone googled/shopped/amaozned/clicked it. Or did before already, you don’t initiate every conversation in your life after all.

Now go and try getting a denial that they are not using the fact that you share a wifi with someone as parts of the recipe for the recommendation cake.

The arrow of causality can also go the other way. X corp is currently running a campaign targeting your area/demographic. A friend of yours sees and X ad and mentions something X-related to you in a private conversation. The next day, you see an X ad too.

Wdym? You cannot target specific individuals when creating ads on FB/IG?

You can (e.g. by email address), which is why it's impossible for Facebook to guarantee that ads weren't targeted based on listening in on conversations. It has no ability to determine how an advertising purchaser generated / obtained the data it is using to for ads targeting.

You could roughly 10 years ago: https://news.ycombinator.com/item?id=34780696

And, it looks like that feature still exists: https://www.facebook.com/business/help/170456843145568

"Upload a list of emails to create a custom audience"

Seems easy enough.

"since Meta had no way of auditing 3rd party apps on the user's phone"

https://en.wikipedia.org/wiki/Onavo

Wow what, facebook allows ad targeting based on a user's email?

Yup. The typical use case is e.g. if someone logs in to your e-commerce site with their email and looks at a product but doesn’t purchase, then you can show them an ad for that product to try to remind them to go back and buy it.

It’s a really creepy feature though that can easily be abused.