People, online advertisers know more about you than you think

The story of Emily Steel in the Wall Street Journal points to an ever sore subject – online privacy protection with Rapleaf being presented as one of the largest offenders who use sensitive users’ information for its mercenary purposes. The main idea of the story is that Internet data mining firms know more than you think: your political affiliations, religious activities, income level, various likes and interests, and your activity on online dating sites, to name but a few. While these companies surely claim that they are collecting this data without tying it to you personally, it turns out this information is not so anonymous after all.

Rapleaf is one of the companies that benefitted from Facebook's latest "inadvertent" data leak, where it received personally identifiable information for people who clicked on advertisements inside Facebook apps.

Rapleaf builds profiles of Web surfers by dropping tracking cookies on its clients' websites, then matching the email addresses of registered users to data it has scraped from social networking sites. Rapleaf then sells this information to companies that want to target ads. This election year, Rapleaf's clients also include at least 10 political campaigns.

Like every Internet company whose business revolves around siphoning data out of people without their realizing it, Rapleaf is very pious when it comes to talking about user privacy. CEO Auren Hoffman wrote a blog post last month that hit all the right notes:

"One of the most important principles of individual privacy is the ability to act anonymously. When people are driving to a store or reading a book at home, they have a reasonable assumption that nobody is monitoring their behavior and attaching it to their name and address.

The same should be true on the internet: when you are online, there should be a presumption of anonymity. Nobody -- including websites, ad networks, ad exchanges, widgets, outside analytics services, etc. -- should know who you are and what you do unless you sign up or log in.

In a better world with sufficient anonymity online, your search history and the sites you visit should not be matched back to personally-identifiable information (like your name, address, email, etc.) so it cannot be stolen, used to discriminate against you, or subpoenaed by the government."

Using Rapleaf data, the Wall Street Journal managed to identify at least two individuals in the company's database, along with a trove of information about them.

Interestingly, but Rapleaf was violating its own privacy policies by collecting some of this information:

"RapLeaf's privacy policy states it won't 'collect or work with sensitive data on children, health or medical conditions, sexual preferences, financial account information or religious beliefs.'

After the Journal asked RapLeaf whether some of its profile segments contradicted its privacy policy, the company eliminated many of those segments."