Verizon’s “supercookies”—a snippet of code injected into mobile users’ web requests—silently identify and track its customers, sharing the information with AOL’s wide-reaching ad network. Vizio Smart TVs tie customers’ viewing habits to a home Internet address and sell the information to advertisers. And both programs require customers, who are often unaware of the programs, to opt out of them if they don’t wish to be tracked.
But a newer method of cross-device tracking wanders into the realm of science fiction. According to a filing from the Center for Democracy and Technology, a digital human rights and privacy advocacy organization, companies have figured out how to use inaudible sounds to establish links between devices.
Here’s how software from SilverPush, a leading provider of “audio beacons,” works: When you visit a website that uses SilverPush tracking technology, the site causes your device to emit an inaudible ultrasonic sound. If any other devices you’ve got lying around—a laptop, a phone, a tablet—has an app installed that includes SilverPush code, it’s listening for that sound. If it hears it, SilverPush knows that the two devices are close to one another and, presumably, belong to the same person.
More recently, SilverPush expanded into television advertising: Certain TV commercials include an ultrasonic audio beacon. Any nearby devices running SilverPush software will be listening for the beacon—if a device hears it, it records the match, allowing the company to figure out what ads users watch and for how long, and add that information to the user’s profile.
SilverPush product manager Piyush Bhatt says the audio tracking only operates in India, but the company, which is based near New Delhi, has established offices in San Francisco and the Philippines as well.
The creativity displayed by SilverPush and its peers has raised privacy concerns. The company’s audio-based tracking method is far more accurate than most ways advertising software quietly follow Internet users, because it takes the guesswork out of the device-matching process, says Joseph Lorenzo Hall, the chief technologist at the Center for Democracy and Technology.
The methods marketing companies use to discover links between users’ devices—whether it’s audio beacons or examining Internet traffic for markers that distinguish a certain user’s computer and browser—are often silent and secret by design.
(Bhatt said that the smartphone apps that listen for SilverPush audio beacons present the user with a screen asking for detailed permission before using the device’s microphone for the first time.)
When it comes to audio beacons, Hall says he’s not just worried about marketing companies tracking average consumers—he thinks their techniques could be used by governments for surveillance. For example, if a group of dissidents in a country like China were to meet in secret, their phones might pick up a government-planted ultrasonic audio signal from a nearby TV. If hidden code on their phones relayed to the government that they all heard the tone, agents could easily tell that the dissidents were associated with one another, and meeting surreptitiously.