April 02, 2021

Wyden, Bipartisan Senators, Question Online Ad Exchanges on Sharing of Americans’ Data with Foreign Companies

Wyden, Cassidy, Gillibrand, Warner, Brown and Warren ask major ad exchanges whether foreign-owned companies are obtaining personal information through “real-time bidding” auctions; Sharing of Americans’ data to foreign companies could pose national security risks

Washington, D.C. – U.S. Senator Ron Wyden, D-Ore., questioned eight digital advertising exchanges about the possible sale of Americans’ personal information to foreign-owned companies, in a series of letters sent yesterday with Senators Bill Cassidy, R-La., Kirsten Gillibrand, D-N.Y., Mark Warner, D-Va., Sherrod Brown, D-Ohio, and Elizabeth Warren, D-Mass.

The senators are seeking information about the sharing of Americans’ data through “real time bidding” – the auction process used to place many targeted digital advertisements. For most online ads, although only one company wins the auction, hundreds of firms participating receive information about the potential recipient of the ad, including device identifiers and cookies, web browsing and location data, IP addresses, and age and gender.

“Few Americans realize that some auction participants are siphoning off and storing ‘bidstream’ data to compile exhaustive dossiers about them. In turn, these dossiers are being openly sold to anyone with a credit card, including to hedge funds, political campaigns, and even to governments,” the senators wrote.

“This information would be a goldmine for foreign intelligence services that could exploit it to inform and supercharge hacking, blackmail, and influence campaigns,” they continued.

The letter was sent to AT&T, Index Exchange, Google, Magnite, OpenX, PubMatic, Twitter and Verizon.

The senators asked for answers to the following questions by May 4, 2021:

  1. Please identify the specific data elements about users, their devices, the websites they are accessing, and apps they are using that you provide to auction participants.
  2. Please identify each company, foreign or domestic, to whom your firm has provided bidstream data in the past three years that is not contractually prohibited from sharing, selling, or using the data for any purpose unrelated to bidding on and delivering an ad.
  3. If your firm has contractual restrictions in place prohibiting the sharing, sale, or secondary use of bidstream data, please detail all efforts to audit compliance with these contractual restrictions and the results of those audits.
  4. Please identify each foreign-headquartered or foreign-majority owned company to whom your firm has provided bidstream data from users in the United States and their devices in the past three years. 

###