Worried about privacy? If you’ve been in a pub recently, you should be – because there’s a good chance Sam Amrani knows where, when and for how long. The same goes for Starbucks and Pret A Manger, as well as UK train stations and motorway services: anywhere, in fact, that has a Wi-Fi hotspot operated by BT or Virgin Media, or Sky’s The Cloud.
These large public networks form the backbone of Amrani’s global collection of 1.1 billion “proximity sensors,” which his London-based startup Tamoco uses to track the movements of around 100 million smartphone-owners, including 12 million in the UK.
“Online you’ve had this for years,” he says. “‘How many people have spent 20 minutes on this website? Who has put this in their basket?’ But never in the real world.” By combining the signals from Wi-Fi sensors, Bluetooth beacons, GPS, QR codes and metadata such as device type, battery level, date and dwell time, Amrani, 28, wants to provide that surveillance. Why? To sell it to advertisers, of course. So, instead of being followed round the internet by the coat we looked at on ASOS, we’ll be dogged by the sofa we sat on in John Lewis? Amrani laughs. “As long as you were there for five minutes.”
To access the real-time data collected by smartphones, Tamoco teams up with apps that have users but find it hard to make money: mobile games, offline maps or deals apps. Amrani says it has partnerships with 1,000 apps. Install one, agree to the terms and conditions, and Tamoco can link your location to its sensor network, then sell the data to brands, with a share of the revenue going to the app.
What’s an advertising ID?: In order to send you personalised advertising, Android and Apple iOS devices link your data to a unique number, called the Identifier for Advertisers (IFA or IFDA). If you want to opt out, you can turn it off. You'll still get ads, but they won't be personalised for you, and your phone will stop building your profile. If someone's turned off their IDFA, Tamoco just receives a string of zeroes.
How do I turn it off on an iPhone?: From the home screen, go to Settings > Privacy > Advertising. Then tap Limit Ad Tracking.
How do I turn it off on Android?: From the home screen, go to Settings > Google > Ads. Then tap “Opt out of Ads Personalisation”
Past campaigns include a tie-in with Unilever to offer Magnum ice lollies at a summer pop-up, and with food company Danone, which used Tamoco for yoghurt deals in supermarkets. Shoppers in Sainsbury’s got Activia; in Morrisons, the offer was for Oikos.
Amrani and his co-founder Daniel Angel saw the potential in location data at Orange, where they worked together on the company’s innovation team. But when they pitched the idea to their bosses they were told it wasn’t interesting, so, in 2012, they left to launch Tamoco.
For four years, they ran QR campaigns, sticking barcodes on everything from posters to beer mats. But that field wasn’t going anywhere, so in mid 2016 they changed course and – along with newly-recruited CEO Rune Bromer – started aggregating sensors. Does tracking on this scale infringe privacy? Not at all, says Amrani: it’s simply giving you more suitable ads. The argument for online surveillance is extended to the physical world.
Amrani insists Tamoco's data is totally anonymised, but it would be more accurate to call it pseudonymised, because it is linked to a single unique number, called the Identifier for Advertisers (IFA or IFDA). This puts it in a grey area when it comes to privacy, explains Yves-Alexandre de Montjoye, a computational privacy researcher at Imperial College London.
"Just because it doesn't contain your name, that doesn't mean it's impossible to identify you," he says. "You have a database with a unique advertiser ID of a person who is using a certain number of apps, that has been moving around the city in certain way, that they constantly monitor over a long period of time. It's probably not going to be too hard for me to figure out which one of these IDs is yours."
In September last year, researchers at French nonprofit Exodus Privacy identified tracking software in more than 300 Android apps, including ones from Tinder, the Weather Channel, and Super-Bright LED Flashlight. The information was used by Google to serve ads through its ad platforms DoubleClick and AdMob.
Proximity sensors aren’t foolproof: they can’t tell whether someone’s buying a Chicken Caesar & Bacon baguette at Pret or standing outside smoking. But if Tamoco’s staked out an area with multiple routers and beacons, it can determine where you are down to the nearest step – which brings us back to pubs. “We have every pub in the UK geofenced, that’s 54,000,” says Amrani. “I think we have every pub and bar in the world: 1.4 million locations.” Drinking: it’s worse for you than you thought.
This article was originally published by WIRED UK
