A bipartisan group of senators is questioning eight big U.S. companies over the sharing of American consumer data to international bidders, which is often used for digital ads.
“We write to seek information about your company’s sharing of Americans’ personal data in order to understand how that information may be obtained and exploited by foreign governments to the detriment of our national security,” the letter (pdf) states.
Senator Ron Wyden (D-Ore.) sent the letter to the companies on Thursday, demanding clarification about the “real-time bidding” phase, which applies to the milliseconds before advertisements are presented to people on their mobile devices as hundreds of companies compete in an auction for their ad.
“As Congress debates potential federal privacy legislation, we must understand the serious national security risks posed by the unrestricted sale of Americans’ data to foreign companies and governments,” the senators wrote, noting that users personal data “would be a goldmine for foreign intelligence services that could exploit it to inform and supercharge hacking, blackmail, and influence campaigns.”
Senators demanded “each company, foreign or domestic, to whom your firm has provided bidstream data in the past three years that is not contractually prohibited from sharing, selling, or using the data for any purpose unrelated to bidding on and delivering an ad.”
The other Senators who signed the letter are Bill Cassidy (R-La.), Kirsten Gillibrand (D-N.Y.), Mark Warner (D-Va.), Sherrod Brown (D-Ohio), and Elizabeth Warren (D-Mass).
“Over the past year, multiple reports have indicated that a number of federal agencies have purchased personal data derived from mobile apps and other online services, in ways that potentially merit closer scrutiny. But the United States is not the only government with the means and interest in acquiring Americans’ personal data. This information would be a goldmine for foreign intelligence services that could exploit it to inform and supercharge hacking, blackmail, and influence campaigns,” reads the letter.
The four questions read:
1. Please identify the specific data elements about users, their devices, the websites they are accessing, and apps they are using that you provide to auction participants.
2. Please identify each company, foreign or domestic, to whom your firm has provided bitstream data in the past three years that is not contractually prohibited from sharing, selling, or using the data for any purpose unrelated to bidding on and delivering an ad.
3. If your firm has contractual restrictions in place prohibiting the sharing, sale, or secondary use of bitstream data, please detail all efforts to audit compliance with these contractual restrictions and the results of those audits.
4. Please identify each foreign-headquartered or foreign-majority-owned company to whom your firm has provided midstream data from users in the United States and their devices in the past three years.
The letter was sent to AT&T, Index Exchange, Google, Magnate, OpenX, PubMatic, Twitter, and Verizon. The senators want the questions answered by May 4.