Guess which Fortune 500 brands and govt agencies share data with Twitter?
(2022/12/09)
- Reference: 1670596206
- News link: https://www.theregister.co.uk/2022/12/09/twitter_pixels_data_sharing/
- Source link:
More than 70,000 websites belonging to Fortune 500 brands, government agencies, and universities share consumers' data with Twitter using data tracking code hosted on these other organizations' websites, according to research published on Thursday by Adalytics.
Twitter, like most other digital advertising platforms, offers free snippets of Javascript code that, along with a single pixel embedded in pages, tracks users so advertisers can send targeted ads.
These trackers have landed other tech giants – including [1]Meta , [2]Google , and [3]TikTok – in trouble for breaching consumer privacy rules by collecting sensitive personal data.
[4]
In its [5]report , Adalytics analyzed web crawler data "from hundreds of thousands of websites" to see which ones utilize Twitter's tracking code as of November. It found that, [6]despite public statements about suspending ads after Elon Musk took over as [7]Chief Twit , at least 70,772 websites were still using Twitter's advertising code and tracking pixel on their pages.
[8]
[9]
In addition to sharing info on their visitors including cookie IDs, IP addresses, and browsing data with Twitter, Adalytics — a data analytics org that essentially tracks web trackers — also observed some websites sharing hashed emails and phone numbers with the platform.
There is a tool that organizations can enable to restrict what Twitter can do with this web traffic data: the [10]"Restricted Data Use" (RDU) tool "enables an advertiser to limit Twitter's use of individual-level conversion events for specific business purposes only on that advertiser's behalf."
[11]
The RDU tool requires the advertiser to send a parameter to Twitter, specifying that the organization wants Twitter to limit its use of data collected "for an individual conversion event," according to Twitter's RDU page. "When enabled, Twitter will limit the use of personal data received in connection with the restricted conversion event to certain business purposes on behalf of the advertiser, such as measurement," it explains.
However, the "vast majority of these entities" haven't enabled it, according to Adalytics.
"Virtually all (>99%) of websites examined in this study that had the Twitter advertising pixel were not using the Restricted Data Usage (RDU) feature," the report said.
Fortune 500 brands, government agencies, the list goes is long
We can't name all 70,000-plus organizations hooked into Twitter's adware, but some of the Fortune 500 companies on the list include General Motors, Ford, Volkswagen, Pfizer, Disney+, Citigroup, Kohl's, Coca-Cola's Sprite website, and Cisco.
Adalytics noted that not every advertiser on Twitter uses the Twitter pixel on its own websites.
[12]
"Some brands have made the decision not to use the third party Twitter Pixel on their page," the report said. "One prominent example is [13]Apple ; apple.com and various other Apple owned properties like [14]shazam.com and [15]beatsbydre.com were not observed loading any code from Twitter."
It's also worth noting that at least two of Musk's other companies, SpaceX and Tesla, do not host any Twitter tracking code on their websites.
Major corporations aren't the only ones sharing customer data with Twitter.
Adalytics also found university websites including Purdue and the University of California, plus nonprofit groups such as Alzheimer's Association and Doctors Without Borders, all share data with Twitter. So do healthcare websites and major new publishers including The New York Times and The Wall Street Journal .
Additionally, websites belonging to government agencies including the US departments of Health and Human Services and Education as well as the Australian Government Department of Foreign Affairs were seen sending data to static.ads-twitter.com.
A US Department of Education spokesperson told The Register that its Federal Student Aid agency "uses the Twitter Pixel to understand user behavior across StudentAid.gov, improve the user experience and customer outcomes, and assess campaign and website analytics. FSA's privacy policy for [16]studentaid.gov notes the use of Twitter and other social media platforms."
The spokesperson declined to say if the DOE planned to change its data tracking policies.
The DoE was the only organization that responded to The Register 's requests for comment.
[17]Oops, web trackers may have leaked 3 million patients' info
[18]FYI: TikTok tracking pixels can be found all over the web – just like Meta, Google
[19]Musk's Hotel California erected at Twitter HQ, as some offices converted into bedrooms
[20]How do you solve the problem that is Twitter?
Adalytics also said it documented other government websites, including the FBI and US Department of Homeland Security, embedding Twitter code on their pages without enabling security features such as iframe sandbox, Subresource Integrity hashes, or content security policy headers.
"If Twitter itself were to ever suffer a breach, a foreign threat actor could leverage their control over Twitter's code to deface or hack these sensitive government websites," according to the report.
While the authors say it's "unclear" what Twitter can legally do with this treasure-trove of information it has collected about consumers, "there does not appear to be any legislation, laws, or legal mechanisms in the US that would allow organizational entities to direct Twitter to delete large amounts of log data."
Twitter did not respond to The Register 's questions. We will update this story if and when we hear back. ®
Get our [21]Tech Resources
[1] https://www.theregister.com/2022/10/20/health_group_says_tracking_pixel/
[2] https://www.theregister.com/2021/03/30/duckduckgo_tracking_protection_claims/
[3] https://www.theregister.com/2022/10/03/tiktok_tracking_pixels/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y5NpsM776Mq8H-xAkrP7ogAAANY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://adalytics.io/blog/websites-sharing-data-with-Twitter
[6] https://web.archive.org/web/20221125161257/https://www.semafor.com/article/11/04/2022/list-of-companies-pausing-twitter-ads
[7] https://www.theregister.com/2022/10/27/musk_sink_twitter/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y5NpsM776Mq8H-xAkrP7ogAAANY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y5NpsM776Mq8H-xAkrP7ogAAANY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[10] https://business.twitter.com/en/help/campaign-measurement-and-analytics/conversion-tracking-for-websites/about-conversion-tracking.html
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y5NpsM776Mq8H-xAkrP7ogAAANY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y5NpsM776Mq8H-xAkrP7ogAAANY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://www.theregister.com/2022/12/01/musk_app_store_dispute_over/
[14] https://www.shazam.com/
[15] https://www.beatsbydre.com/
[16] http://studentaid.gov/
[17] https://www.theregister.com/2022/10/20/health_group_says_tracking_pixel/
[18] https://www.theregister.com/2022/10/03/tiktok_tracking_pixels/
[19] https://www.theregister.com/2022/12/07/musk_twitter_offices/
[20] https://www.theregister.com/2022/12/06/twitter_opinon_column/
[21] https://whitepapers.theregister.com/
Twitter, like most other digital advertising platforms, offers free snippets of Javascript code that, along with a single pixel embedded in pages, tracks users so advertisers can send targeted ads.
These trackers have landed other tech giants – including [1]Meta , [2]Google , and [3]TikTok – in trouble for breaching consumer privacy rules by collecting sensitive personal data.
[4]
In its [5]report , Adalytics analyzed web crawler data "from hundreds of thousands of websites" to see which ones utilize Twitter's tracking code as of November. It found that, [6]despite public statements about suspending ads after Elon Musk took over as [7]Chief Twit , at least 70,772 websites were still using Twitter's advertising code and tracking pixel on their pages.
[8]
[9]
In addition to sharing info on their visitors including cookie IDs, IP addresses, and browsing data with Twitter, Adalytics — a data analytics org that essentially tracks web trackers — also observed some websites sharing hashed emails and phone numbers with the platform.
There is a tool that organizations can enable to restrict what Twitter can do with this web traffic data: the [10]"Restricted Data Use" (RDU) tool "enables an advertiser to limit Twitter's use of individual-level conversion events for specific business purposes only on that advertiser's behalf."
[11]
The RDU tool requires the advertiser to send a parameter to Twitter, specifying that the organization wants Twitter to limit its use of data collected "for an individual conversion event," according to Twitter's RDU page. "When enabled, Twitter will limit the use of personal data received in connection with the restricted conversion event to certain business purposes on behalf of the advertiser, such as measurement," it explains.
However, the "vast majority of these entities" haven't enabled it, according to Adalytics.
"Virtually all (>99%) of websites examined in this study that had the Twitter advertising pixel were not using the Restricted Data Usage (RDU) feature," the report said.
Fortune 500 brands, government agencies, the list goes is long
We can't name all 70,000-plus organizations hooked into Twitter's adware, but some of the Fortune 500 companies on the list include General Motors, Ford, Volkswagen, Pfizer, Disney+, Citigroup, Kohl's, Coca-Cola's Sprite website, and Cisco.
Adalytics noted that not every advertiser on Twitter uses the Twitter pixel on its own websites.
[12]
"Some brands have made the decision not to use the third party Twitter Pixel on their page," the report said. "One prominent example is [13]Apple ; apple.com and various other Apple owned properties like [14]shazam.com and [15]beatsbydre.com were not observed loading any code from Twitter."
It's also worth noting that at least two of Musk's other companies, SpaceX and Tesla, do not host any Twitter tracking code on their websites.
Major corporations aren't the only ones sharing customer data with Twitter.
Adalytics also found university websites including Purdue and the University of California, plus nonprofit groups such as Alzheimer's Association and Doctors Without Borders, all share data with Twitter. So do healthcare websites and major new publishers including The New York Times and The Wall Street Journal .
Additionally, websites belonging to government agencies including the US departments of Health and Human Services and Education as well as the Australian Government Department of Foreign Affairs were seen sending data to static.ads-twitter.com.
A US Department of Education spokesperson told The Register that its Federal Student Aid agency "uses the Twitter Pixel to understand user behavior across StudentAid.gov, improve the user experience and customer outcomes, and assess campaign and website analytics. FSA's privacy policy for [16]studentaid.gov notes the use of Twitter and other social media platforms."
The spokesperson declined to say if the DOE planned to change its data tracking policies.
The DoE was the only organization that responded to The Register 's requests for comment.
[17]Oops, web trackers may have leaked 3 million patients' info
[18]FYI: TikTok tracking pixels can be found all over the web – just like Meta, Google
[19]Musk's Hotel California erected at Twitter HQ, as some offices converted into bedrooms
[20]How do you solve the problem that is Twitter?
Adalytics also said it documented other government websites, including the FBI and US Department of Homeland Security, embedding Twitter code on their pages without enabling security features such as iframe sandbox, Subresource Integrity hashes, or content security policy headers.
"If Twitter itself were to ever suffer a breach, a foreign threat actor could leverage their control over Twitter's code to deface or hack these sensitive government websites," according to the report.
While the authors say it's "unclear" what Twitter can legally do with this treasure-trove of information it has collected about consumers, "there does not appear to be any legislation, laws, or legal mechanisms in the US that would allow organizational entities to direct Twitter to delete large amounts of log data."
Twitter did not respond to The Register 's questions. We will update this story if and when we hear back. ®
Get our [21]Tech Resources
[1] https://www.theregister.com/2022/10/20/health_group_says_tracking_pixel/
[2] https://www.theregister.com/2021/03/30/duckduckgo_tracking_protection_claims/
[3] https://www.theregister.com/2022/10/03/tiktok_tracking_pixels/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y5NpsM776Mq8H-xAkrP7ogAAANY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://adalytics.io/blog/websites-sharing-data-with-Twitter
[6] https://web.archive.org/web/20221125161257/https://www.semafor.com/article/11/04/2022/list-of-companies-pausing-twitter-ads
[7] https://www.theregister.com/2022/10/27/musk_sink_twitter/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y5NpsM776Mq8H-xAkrP7ogAAANY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y5NpsM776Mq8H-xAkrP7ogAAANY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[10] https://business.twitter.com/en/help/campaign-measurement-and-analytics/conversion-tracking-for-websites/about-conversion-tracking.html
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y5NpsM776Mq8H-xAkrP7ogAAANY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y5NpsM776Mq8H-xAkrP7ogAAANY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://www.theregister.com/2022/12/01/musk_app_store_dispute_over/
[14] https://www.shazam.com/
[15] https://www.beatsbydre.com/
[16] http://studentaid.gov/
[17] https://www.theregister.com/2022/10/20/health_group_says_tracking_pixel/
[18] https://www.theregister.com/2022/10/03/tiktok_tracking_pixels/
[19] https://www.theregister.com/2022/12/07/musk_twitter_offices/
[20] https://www.theregister.com/2022/12/06/twitter_opinon_column/
[21] https://whitepapers.theregister.com/
Yet Another Anonymous coward
> little chance of some foreign thread actor coming along and just taking everybody's data.
investors who put up more than $100M (IIRC) for Musk to buy Twitter get free access to all the data
Saudi Govt owns 4% of Twitter and Qatar another big chunk
Twitter could be a threat vector for a foeign government?
elDog
"If Twitter itself were to ever suffer a breach, a foreign threat actor could leverage their control over Twitter's code to deface or hack these sensitive government websites," according to the report.
Since Melon Husk owns twitter it appears that the threat is already there. As Pogo once said: We have met the enemy and he is us.
Google analytics
alain williams
I have long said that GA & similar should be recognised as falling foul of the GDPR. Users are tracked. Their permission is not asked for thus it is illegal.
I'm amazed Am Reg was able...
xyz
To type the word "Education" in English... Surely it's edoocaishin in 'merikan. Give us a break, it's Friday p.m. and no one touched nuffink since yesterday.
Just 'Cause
Reginald O.
They do just 'cause they can.
And, there is no one to stop them.
Re: Just 'Cause
tiggity
Well, some of us do run with scripting disabled, no third party images, cookies etc, various anti track & generally anti nasty browser addons, Pi Hole or similar blocklists... To try & avoid data leakage and "drive by" virus etc. install attempts
.. Biggest hassle is with scripting disabled by default is so many sites do nothing useful as they are so horrendously written that you often just get a blank screen as js all the way down .. a bonus of that is you learn to avoid a lot of shoddy code web sites
Is this again one of those things where your data got stolen even though you never had an account on such a fsckwitted thing as Twitter or Facebook? At least with they current staff complement there is little chance of some foreign thread actor coming along and just taking everybody's data.