Point 8 (ad library) suffers from an imprecision that I find hugely consequential in how we approach the overall problem.
I believe platforms have an obligation under European law to disclose more information about how ads are targeted. This post is concerned with the U.S. election, but EU law is still relevant as explained below.
Throughout 2016, as I was working with Hannes Grassegger (and later Mikael Krogerus) in preparing the German version of The Data That Turned the World Upside Down, a recurring question for us was “How do we reverse engineer what Cambridge Analytica is currently doing?”. I told them that as a mathematician with some legal knowledge I could think of only one way to do it, but it would require going the legal route and forcing Facebook and Cambridge Analytica to hand over data. A journalistic mindset told us to wait instead for the story to come out, because that would tip off Cambridge Analytica and Facebook of what was coming to them.
As soon as the article was published (Dec. 3rd 2016), I got David Carroll to file his Subject Access Request with Cambridge Analytica, as shown in The Great Hack.
But while David was going after Cambridge Analytica in court (which I couldn’t do since they hadn’t processed my data), I decided to go after Facebook. So I asked Facebook to tell me how advertisers had uploaded my contact info, how I was targeted, etc. I did have to go to (arbitration) court but they relented and did implement a tool giving more transparency on Custom Audiences, to everyone, not just Europeans. This whole process was actually fairly quick (check the details and timing here). I didn’t get everything I think should be revealed, but I dropped the matter as I figured I had done enough to make my point when people actually started caring about microtargeting and profiling. In March 2018, testifying alongside Christopher Wylie at the UK Parliament, I thought I had managed to mainstream my ideas. No one really picked up on it though. To me it is consequential that we shift from self-regulation to mandatory disclosures on the targeting component of ads. One might say this obligation only applies to Europeans, so Americans would have to fight this fight with their own means, but advertisers regularly upload contact lists across the Atlantic, in either direction. This does give many legal opportunities for Americans like David Carroll to exercise their data rights across the Atlantic.
