The Price of Free Privacy Leakage in Personalized Mobile In-App Ads Article Authors – Wei Meng, Ren Ding, Simon P. Chung, Steven Han, and Wenke Lee Presentation By – Ammar Bagasrawala

Motivation Advertisements are an essential part to the mobile app ecosystem By providing personalized ads, ad networks can increase the effectiveness of the ads they supply How much data are users giving away to pay for “free apps”? Our mobile phones have become very intimate devices Privacy leakage is a serious issue in the mobile ecosystem https://www.twenga-solutions.com/en/insights/wp-content/uploads/sites/71/2016/04/mobile-advertising-tips.png

Background Ecosystem of mobile advertising Publishers, advertisers, and ad networks Ad networks can obtain information about users and are responsible for generating user profiles Targeting in mobile advertising Topic targeting – ad content related to application content Interest targeting – user has expressed interest in the topic the ad content contains Demographic targeting – users within specific groups targeted Lack of isolation for in-app advertising https://medspaleads.com/wp-content/uploads/2016/09/target-margeting-on-mobile.jpg

The Price of Free Problem Goals of this study What personal information about users can a mobile ad provider know and use? Could personalized mobile in-app ads be served as a channel of private information leakage? Methodology Focused on Android and Google’s mobile ad network AdMob Surveyed over 200 people and collected data Tested whether correlation existed between users and the ads they saw Trained models to predict user information from ads Results Google’s ads are highly personalised based on interests and demographic information User attributes can be predicted with accuracy

Data Collection Blank Android app No ad control API Sent requests from single IP address Sends 100 ad requests to ad networks without setting any targeting attributes Impact of experiment on the subjects ad profile was low Landing URLs were used as the representation of ads in the analysis, and were categorized into 1 of 24 interest categories http://cdn.abclocal.go.com/content/creativecontent/images/cms/888605_1280x720.jpg

Ad Personalization - Interests Mobile ads are highly personalized based on user interests For over 79% of the users, at least 21% of the categories in the ad interest profile are correct For 11% of the users, at least 83% of the categories in the ad interest profile are correct For 41% of the users, more than 57% of their ad impressions match their real interests Google can not only build and use accurate interest profiles for users, but also that they are actively personalizing a large fraction of their ad deliveries.

Ad Personalization – Demographic Data Gender Parental status User income Advertisers not explicitly targeting income Religion Ads shown due to correlation with other categories Political affiliation No explicit evidence

Privacy Leakage Ads in Android are not isolated from developers In web advertising, Iframes used Demographics learning from personalized ads Applied machine learning algorithms for predicting user information Accuracy of predictions used as metric Dummy, and augmented dummy classification models used as baseline https://dmsp.digital.eca.ed.ac.uk/blog/handsoff2014/files/2014/02/PRIVACY.jpg

Privacy Leakage Results At least 1 classifier performed better than the dummy’s for a category Accuracy was higher for age, gender and parental status Education, ethnicity, and religion do not have classifiers that perform significantly better than dummy’s

Article Criticism Structure and flow of the article increased readability and understanding of key ideas Experiment was controlled and allowed results to be reliable Reasoning behind results and decisions made was clear Related literature successfully used to enhance understanding of mobile ecosystem

Issues and Improvements Small sample size and uneven demographic distribution of the data set Data set should be cleaner and more distributed Only looks at Google’s ad network Analyse other ad networks to compare the security implications with Google’s Geo-location is excluded from the study Might be interesting to compare ads obtained with geo-location factored in

Questions?