Tag: surveillance-economy-the-internet-watching-you-back

Posted on by

Keyboard and accessibility permissions as unusually broad observation channels

Some permissions are broad because the feature itself is broad.

A screen reader must understand what is on the screen.

An automation tool may need to control another application.

A third-party keyboard has to process what a person types.

Those legitimate requirements create unusually powerful observation channels if the same access is misused.

A keyboard can handle extremely sensitive input

Apple’s developer documentation makes the tradeoff unusually explicit for iOS custom keyboards.

By default, a custom keyboard runs in a restricted sandbox without network access. A developer can request open access, and the user must explicitly enable “Allow Full Access.” With that capability, Apple says the keyboard can send keystrokes and other input events to a server for processing and can access additional resources such as shared containers; other data such as contacts or location still require their own permission.

Apple warns developers that keyboards handle some of the most sensitive user data and says open access should not be enabled lightly. See Configuring open access for a custom keyboard.

That does not mean a full-access keyboard is malicious.

Cloud prediction, advanced language models, synchronization, and other useful features may require network communication.

The issue is that the permission creates capability well beyond drawing letters on the screen.

Accessibility access can be broader still

Android’s AccessibilityService exists so software can assist people who need help interacting with applications. Depending on how the service is configured, Android allows an accessibility service to receive UI events, retrieve the active window’s content, inspect interface elements, and perform actions on the user’s behalf.

Google’s documentation explicitly notes that retrieving the view hierarchy can expose private user information. See the AccessibilityService API reference and accessibility-service developer guide.

On macOS, Apple’s privacy settings similarly describe Accessibility permission as allowing approved apps to run scripts and system commands that control the Mac. See Apple’s Privacy & Security settings guide.

Capability is not evidence of abuse

This distinction is essential.

A password manager, screen reader, voice-control system, automation utility, or alternative keyboard may need unusually broad access to perform its advertised job.

Finding the permission does not prove that the program records everything it can see.

A stronger audit asks:

  • What specific feature requires the permission?
  • Does the app send observed information off-device?
  • What does its privacy policy say?
  • Can the feature operate with narrower access?
  • Is collection limited to the period when the feature is active?
  • Has independent analysis observed unexpected network transmission?

The permission tells you what software can do.

Network traces, source code, documentation, or enforcement records tell you more about what it does do.

The Surveillance Economy is easy to misunderstand if capability and conduct are treated as synonyms.

Broad access deserves scrutiny.

It does not deserve an automatic conviction.

Posted on by

Receipt-scanning apps and the tradeoff behind purchase rewards

A receipt looks like trash because the customer already knows what happened.

To a data system, it can be an inventory of behavior.

Store name. Date. Time. Location. Products. Brands. Quantities. Prices. Discounts. Payment clues. Loyalty information. Sometimes addresses or order details.

Receipt-scanning reward apps offer something simple in exchange for that record:

Give us the receipt. We give you points.

That bargain is worth studying because the reward makes the value of purchase data unusually visible.

Fetch describes the exchange in its current privacy policy

Fetch’s privacy policy, revised January 22, 2026, says its service provides points and rewards for activities including uploading receipts, connecting digital receipts, completing surveys, shopping, and interacting with brand offers.

The policy says commercial information may include products a user scanned, purchased, searched for, or favorited, along with rewards, deals, coupons, location and app activity. It also says information may be disclosed to brand partners, service providers, and advertising platforms for purposes including personalized offers and advertising.

See Fetch’s current Privacy Policy.

Fetch also offers an eReceipt program in which users can connect email or digital consumer accounts so purchase information can be retrieved from electronic receipts. Its policy says those receipts may contain information such as billing or mailing addresses, name, payment method, and other order details.

The company describes consent and controls around those features in the same policy.

The reward is not free; neither is the data

Suppose a paper receipt says someone bought:

  • diapers,
  • cold medicine,
  • dog food,
  • a specific brand of coffee,
  • three frozen pizzas,
  • a bottle of shampoo.

The total is less interesting than the product-level record.

Repeat that every week and the receipts begin to describe brand loyalty, household composition, shopping frequency, store preference, price sensitivity, and changing consumption habits.

That does not mean every inference is correct.

A person may shop for a spouse, child, friend, workplace, party, or neighbor. One receipt is not a biography.

But repeated purchase records can become a valuable commercial dataset.

The honest framing is an exchange

Reward apps are not automatically deceptive merely because purchase data has value.

The customer gets something too: gift cards, cash-equivalent rewards, discounts, or points.

The important questions are whether the exchange is understandable and how far the data travels afterward.

A useful audit asks:

  • What receipt fields are extracted?
  • Are digital receipts pulled from connected email accounts?
  • Are purchase histories shared with brands or advertising partners?
  • Are sensitive categories treated differently?
  • Can the user disconnect accounts or revoke consent?
  • How long are records retained?

The Surveillance Economy often hides the price of data behind a free service.

Receipt apps make the trade easier to see.

The company is literally paying you for the evidence.

Posted on by

In-store Wi-Fi and the measurement of physical visits

A phone does not have to join store Wi-Fi for the store’s wireless equipment to notice that a device is nearby.

That sounds stranger than it is.

Wi-Fi devices routinely transmit management traffic while discovering networks and maintaining connectivity. Wireless access points can observe some of that activity and use it to estimate whether devices are present in a physical space.

For retailers, that turns radio traffic into something resembling web analytics for a building.

Cisco documents the idea directly

Cisco Meraki’s location-analytics documentation describes using Wi-Fi and Bluetooth signals to understand foot-traffic patterns in physical spaces. Its system can generate “seen device” events from Wi-Fi probe requests and data frames and use those observations to estimate presence, dwell time, and repeat visits.

See Cisco Meraki’s Location Analytics documentation.

The interesting detail is that Meraki says devices can be detected even when they are not associated with the store’s Wi-Fi network, provided the wireless radio is active and detectable.

That does not mean the access point automatically knows the owner’s name.

It means it can observe a device.

Devices are not people

This distinction matters enormously.

A detected phone is not the same thing as a shopper.

One person can carry a phone, watch, tablet, and laptop. A family can share devices. Employees remain in the building much longer than customers. Delivery drivers pass through. A phone can sit in a parked car near the entrance.

Modern operating systems also use address randomization and other privacy protections that make long-term device recognition less straightforward than it once was.

So a dashboard reporting 1,000 devices seen should not automatically be translated into 1,000 customers visited.

The measurement requires assumptions.

The useful part is the pattern

When devices can be recognized consistently enough, wireless analytics can estimate questions retailers care about:

  • How many devices entered the space?
  • How long did they remain?
  • How many appeared to return later?
  • Which areas received the most traffic?
  • Did a marketing campaign correspond with more physical visits?

Those are commercially useful questions.

They also create privacy questions about notice, retention, identifiers, and whether observations are combined with loyalty accounts or other customer data.

Detection does not prove identity

A responsible investigation should separate three claims:

  1. wireless infrastructure observed a device,
  2. the operator recognized the same device again,
  3. the operator linked that device to a named person or account.

Each step requires additional evidence.

The Surveillance Economy becomes easy to overstate when those layers are collapsed.

A store may know that a radio appeared near aisle seven.

Knowing whose pocket it was in is a different claim.

Posted on by

Retail loyalty records linked to online identities

A loyalty card does something technically powerful every time it saves fifty cents on soup.

It identifies the transaction.

Without a loyalty account, a receipt may describe an anonymous basket of groceries.

Add a rewards number, phone number, app account, or other persistent identifier and the same basket can become part of a continuing purchase history.

Then the interesting part begins: that retail identity can be linked to the customer’s online identity too.

Kroger describes the connection directly

Kroger’s current privacy notice, updated September 9, 2026, says that when a customer enters a rewards number or alternate ID, purchase information can be associated with the customer or household. The company also says it may link information from multiple sources, including associating in-store shopping activity with website and mobile-app activity and linking device IDs to an account.

See Kroger’s current privacy notice and its explanation of how information is collected.

Kroger also says purchase history may be used for purchase-based advertising and that information may be shared with marketing partners to personalize advertising. See How We Share Information.

That is not a hidden accusation. It is the company’s own disclosed data model.

The reward number becomes a join key

Imagine one customer does all of the following:

  • scans a loyalty card in a physical store,
  • clips a digital coupon in the app,
  • searches for a product on the website,
  • buys that product in-store,
  • opens a promotional email,
  • logs into the same account from a phone.

Each event can be stored separately.

The account makes it possible to connect them.

That combined profile is more informative than the original rewards transaction because it describes both what the person bought and what they considered before buying it.

Target’s current privacy policy describes a similar general idea: it says the company may link or merge interactions across its website, mobile app, stores, online ads, and emails to provide a personalized experience across channels. See Target’s privacy policy.

Loyalty is not secretly surveillance by definition

Rewards programs provide real benefits. Discounts, fuel points, personalized coupons, digital receipts, easier returns, and account history are useful to customers.

The important research question is not whether loyalty programs are inherently bad.

It is how much identity stitching is necessary for the promised benefit, what additional uses are disclosed, and what controls exist over advertising or sharing.

This also separates DIT-367 from the earlier article about loyalty programs generating recurring promotional messages.

Here the issue is not how often the company contacts you.

It is how many different parts of your behavior the loyalty identity can connect.

The Surveillance Economy loves a stable join key.

Sometimes that key is a cookie.

Sometimes it is the phone number you typed at the grocery-store register.

Posted on by

Smart-home device activity as a record of household routines

A smart-home event can look almost meaningless by itself.

Front door opened.

Thermostat changed.

Motion detected in the hall.

Voice assistant activated.

Light switched off.

Put enough of those events in chronological order and they begin to describe a household.

Repetition turns sensor noise into routine

Researchers have demonstrated that relatively ordinary home sensors can be used to infer occupancy and activity patterns. A 2021 NIST-associated study on residential occupancy detection used sequences of low-cost sensor events to identify human activity and estimate whether a home was occupied. See NIST’s summary of Residential House Occupancy Detection.

NIST research has also repeatedly noted that smart-home technologies create privacy questions because users often do not fully understand what is collected, how it is used, or how different device categories behave. See NIST IR 8330 and the agency’s 2025 work on smart-home privacy perceptions.

The important point is not that every thermostat is spying on its owner.

It is that patterns emerge from combinations.

One event says little; a routine says much more

Imagine a home where the same sequence happens most weekdays:

  • bedroom motion at 6:15 a.m.,
  • kitchen activity ten minutes later,
  • front door opens at 7:05,
  • thermostat shifts into an away mode,
  • no motion for nine hours,
  • garage opens at 4:40 p.m.

No single event identifies a person.

Together they suggest a routine.

Over time, connected cameras, doorbells, thermostats, speakers, lights, locks, appliances, and security sensors can produce records about occupancy, schedules, visitors, sleeping hours, and other household behavior.

Household consent is unusually messy

A smart-home account may belong to one person while the sensors observe several.

A spouse, child, roommate, guest, babysitter, cleaner, or repair technician can generate events without ever reading the account holder’s privacy settings.

That difference matters.

NIST’s 2025 consumer guidance specifically recommends checking with other household members before installing connected devices because everyone in the home can be affected. See 7 Tips to Keep Your Smart Home Safer and More Private.

Collection does not prove abuse

A motion log may exist solely to power security alerts. A thermostat may retain occupancy data only to automate heating and cooling.

An investigator needs evidence before claiming anything more.

Useful evidence includes device documentation, privacy notices, retention settings, account exports, network traffic, regulator findings, and records showing which third parties actually received the data.

The Surveillance Economy becomes easier to see when individual events are treated as pieces of a timeline.

The smart home does not need to know your biography.

It may only need to notice what happens every morning at 7:05.

Posted on by

Wearable-device data and secondary commercial uses

A fitness tracker can collect a remarkable amount of information while doing exactly what the customer bought it to do.

Steps. Heart rate. Sleep stages. Exercise. Distance. Weight. Calories. Location during workouts. Sometimes manually entered health information as well.

None of that collection is mysterious when the feature depends on it.

The harder question is what happens after the measurement has served its obvious purpose.

Useful data can have more than one use

Google’s current Google Health documentation says Fitbit and related services can collect health and wellness data including steps, distance, calories burned, weight, heart rate, sleep stages, active minutes, and information from connected services. See Google Health’s privacy FAQ and Fitbit’s privacy policy.

Those records can support the expected functions: showing trends, calculating goals, producing sleep insights, or syncing a workout.

A dataset that rich can also be useful for analytics, product improvement, research, connected services, coaching, fraud prevention, or other secondary processing depending on the product and the user’s choices.

That does not mean every wearable vendor sells health data to advertisers.

In fact, Google currently states that Fitbit and Google Health wellness data is not used for Google Ads. See Google’s continued privacy commitment and Google Health data controls.

That is an important example because it shows why this subject has to be studied from actual policies and data flows rather than assumptions.

“Collected” is not the same as “commercially exploited”

The mere presence of a heart-rate database does not establish an advertising use.

Likewise, a promise not to use health data for ads does not tell you everything about research, service improvement, connected applications, retention, or other forms of processing.

A responsible audit asks separate questions:

  • What measurements are collected?
  • Which features require them?
  • Which outside services can receive them?
  • Is research participation optional?
  • Are analytics separated from health data?
  • Can users download or delete records?
  • What happens when a connected third-party app receives a copy?

The distinction between primary use and secondary use is the important one.

Wearables make intimate data routine

A browser history can hint at health interests.

A wearable may directly measure sleep, pulse, movement, or exercise.

That does not automatically make the device sinister. It makes transparency unusually important because the product works by collecting information the user would rarely have generated before wearing it.

The Surveillance Economy is not only about secret collection.

Sometimes the user knowingly supplies the raw material because the feature is genuinely useful.

The harder question comes later:

What else is the dataset allowed to become?

Posted on by

Connected-car telemetry as a source of behavioral data

A modern car can produce a behavioral log while doing the ordinary job of being a car.

Location, speed, hard braking, acceleration, trip timing, mileage, diagnostics, and other telemetry can support navigation, maintenance, emergency response, theft recovery, driver coaching, and remote features.

Those are real uses.

The same records can also become commercially valuable somewhere else.

GM and OnStar turned this into a documented enforcement case

In January 2026, the Federal Trade Commission finalized an order with General Motors and OnStar settling allegations that they collected, used, and sold precise geolocation and driving-behavior data from millions of vehicles without adequately notifying consumers and obtaining affirmative consent.

The FTC said the Smart Driver program collected information including hard braking, late-night driving, speeding, and precise location. According to the agency, some of that information was sold to consumer-reporting agencies whose reports were then used by insurance companies in decisions about rates and coverage.

See the FTC’s 2026 final order announcement and the agency’s 2025 original action.

The finalized order restricts certain disclosures to consumer-reporting agencies and requires additional transparency and choice.

Service telemetry and behavioral scoring are not the same thing

A car manufacturer needs some information to deliver connected services.

An emergency system cannot send help without knowing where the vehicle is. A maintenance system needs diagnostic data to identify a failing component.

But the fact that data is useful for the requested service does not automatically answer whether the same record should be used for another purpose.

A driver’s expectation can change sharply when the data moves from:

Your car detected hard braking

to:

Another company added that event to a profile used in an insurance decision.

That is the secondary-use problem in one sentence.

A vehicle can become a sensor platform

Precise location can reveal repeated destinations and routines. Driving events can describe style and timing. Diagnostic systems can reveal vehicle condition. Connected accounts can tie those observations to a named customer.

But an investigation still needs discipline.

The presence of telemetry does not prove every field is sold.

A privacy policy naming broad categories does not prove a particular recipient received a particular trip.

Strong evidence comes from data-flow documentation, contracts, regulator findings, access records, disclosed recipients, or actual reports showing how the telemetry moved.

Connected cars make the Surveillance Economy unusually physical.

The behavioral profile is no longer assembled only from clicks.

Sometimes it starts when you press the brake pedal.

Posted on by

Smart-TV viewing recognition and household media profiles

A television used to know almost nothing about what passed through it.

A smart television can know considerably more.

One technique is automatic content recognition, usually shortened to ACR. The television samples or identifies material displayed on the screen and compares it with a reference database so the system can determine what program, movie, advertisement, or other content is being watched.

The important detail is that recognition can occur at the television layer rather than inside one particular streaming app.

The Vizio case showed how broad that view can become

In 2017, the Federal Trade Commission and the New Jersey Attorney General settled charges that Vizio collected viewing histories from 11 million smart televisions without adequate notice or consent.

According to the FTC, the televisions captured second-by-second information about video displayed from cable, broadband, set-top boxes, DVDs, over-the-air broadcasts, and streaming devices. The agency said Vizio then shared viewing information with third parties and enabled demographic information to be appended to those records.

See the FTC’s Vizio settlement announcement and its explanation of what Vizio was doing behind the TV screen.

The case is old enough to be historical, but the architecture is still useful to understand.

The screen itself can become a sensor.

A viewing record says more than “this show was on”

One recognized program means little.

A long sequence can describe a household’s habits:

  • which news programs appear regularly,
  • what sports are watched,
  • which streaming services or inputs are used,
  • what hours the television is active,
  • what advertisements were displayed,
  • what genres dominate the household’s viewing.

The television does not necessarily know which person in the room chose the program.

That is an important limitation.

A household profile is not automatically an individual profile.

People share televisions. Children watch adult accounts. Guests use the same screen. A program can play while nobody is paying attention.

Settings and downstream relationships matter

A modern investigation therefore needs more than proof that a television supports recognition technology.

The useful questions are whether the feature is enabled, what data is collected, what identifiers accompany it, which company receives it, how long the records are retained, and whether the information is shared or combined with other data.

The Vizio case also demonstrated why consent language matters. A feature can be described as improving recommendations or interactivity while carrying a much larger data-collection function than the label suggests.

The Surveillance Economy does not require a camera pointed at the couch.

Sometimes the television only needs to recognize what the couch is watching.

Posted on by

Location histories collected through embedded mobile software kits

You install one app.

That does not mean only one company is inside it.

Mobile apps commonly include third-party software development kits, or SDKs, that provide analytics, advertising, crash reporting, maps, authentication, payments, and other functions the app developer does not want to build from scratch.

If an app receives device location and passes it to one of those SDKs, the location can move beyond the company whose icon the user recognizes.

That is where a simple permission can turn into a supply chain.

The X-Mode case made the pipeline unusually visible

In 2024, the Federal Trade Commission finalized an order against location-data broker X-Mode Social and its successor Outlogic. The FTC said the companies obtained precise location information from third-party apps that incorporated the company’s SDK, from its own apps, and from other brokers and aggregators. The data was associated with mobile advertising IDs and sold or licensed to hundreds of clients.

See the FTC’s final X-Mode/Outlogic order announcement and case page.

The FTC said the raw data could reveal visits to sensitive places such as medical clinics, houses of worship, and domestic-abuse shelters. The order restricted the sale or sharing of sensitive location data and imposed additional safeguards.

The important architectural point is broader than one company.

The app can be the collector the user sees.

The SDK can be the recipient the user does not.

One permission can serve several relationships

A weather app may have a legitimate reason to request location.

So might a navigation app, ride service, delivery app, or local-events app.

But the fact that the app needs location for its visible feature does not answer every downstream question:

  • Which embedded libraries receive the coordinates?
  • Are they given precise or approximate location?
  • Is an advertising identifier attached?
  • How often is the event sent?
  • How long is it retained?
  • Is it sold, licensed, or shared onward?

The permission dialog alone cannot answer those questions.

A point becomes a history through repetition

One coordinate says where a device was once.

A sequence can reveal routines.

Repeated observations can suggest where a person sleeps, works, shops, worships, exercises, receives medical care, or spends evenings. Even when a dataset begins with a pseudonymous device identifier rather than a name, repeated movement can make the profile easier to associate with a real person or household.

That is why the evidentiary chain matters.

Seeing a location permission does not prove a broker received the data.

Finding an SDK in an app does not prove every capability was used.

A stronger investigation needs network traffic, SDK documentation, privacy disclosures, contractual records, regulator findings, or other evidence showing that location actually moved from the device to a particular recipient.

The Surveillance Economy is often built from layers the user never sees.

The map pin is collected in the app.

The history may be assembled somewhere else.

Posted on by

Advertising identifiers as links between mobile app activities

Two unrelated apps do not need to share a login to recognize the same advertising identifier.

That is the point of the mobile advertising ID.

On Android, Google describes the advertising ID as a unique, user-resettable and user-deletable identifier supplied for advertising. Apps and advertising SDKs can retrieve a consistent value associated with the device user and use it for advertising functions such as personalization and measurement. See Google Play’s Advertising ID documentation and Android’s Advertising ID developer guide.

That consistency is useful to advertisers.

It is also what makes the identifier capable of linking activity across apps.

One value can join separate event streams

Imagine a weather app reports:

ad_id = ABC123

Later, a game reports:

ad_id = ABC123

A third app reports the same value.

If the same advertising system receives those events, it does not need the three app developers to exchange customer accounts directly.

The common identifier gives the system a join key.

Activity that looked separate at the app level can become one advertising profile at the network level.

The identifier itself does not contain a person’s name, search history, or purchases.

It becomes meaningful because databases attach events and attributes to it.

Resetting or deleting changes the link

Google’s current Android guidance lets users reset or delete the advertising ID through system settings. On supported Google Play services, deleting it causes attempts to retrieve the ID to receive a zeroed value instead. Google also warns developers not to cache the value because a user may reset it. See Google Play’s Advertising ID guidance.

That gives the user a real control.

A reset can break the straightforward continuity between the old identifier and the new one.

It does not guarantee that every company forgets everything it previously knew.

Historical records may remain subject to retention rules and policies, and other signals can create new connections.

The advertising ID is only one bridge

Apps can also recognize logged-in accounts, email addresses, phone numbers, app-specific identifiers, purchase records, IP-derived information, or other device and network signals.

Android itself distinguishes the advertising ID from other identifiers and provides newer privacy controls around advertising systems. See Android’s ad privacy settings.

So disabling one advertising identifier should not be described as a universal invisibility switch.

It removes or weakens one standardized connection.

That distinction matters throughout the Surveillance Economy.

The dangerous part of a dataset is often not any individual row.

It is the column that lets somebody join one table to another.

On mobile devices, the advertising ID was designed to be exactly that kind of column.