What you need to know:

• News Corp, Nine and Seven could be in breach of Australian Consumer Law for describing data they collect about consumers as “anonymous” or “de-identified” when it may not be, a UNSW academic suggests.
• Dr Katharine Kemp has published a paper describing the tracking and profiling practices of the publishers demonstrating how they differ from language used in privacy policies.
• Kemp said the major media companies are following the lead of Google and Meta in collecting vast troves of personal data and tracking people on the web.
• Seven, Nine and News Corp Australia have strongly challenged the conclusions.
• Asked why Google and Meta weren't included in her recommendation, Kemp said she has written extensively about those two companies, their "alleged and actual contraventions" of Australian Consumer Law, but this paper focused on a different sector. 

Australia’s three biggest media companies – News Corp, Nine and Seven – should be investigated by the Australian Competition and Consumer Commission (ACCC) for potentially breaching consumer law over how they track consumers online, share their data, and describe it as “anonymous” or “de-identified”, a senior UNSW academic has warned.

Dr Katharine Kemp, a senior lecturer in UNSW’s Faculty of Law & Justice, has published a paper outlining how media companies are profiling and tracking consumers, contrasting those practices to what consumers are told in the companies’ privacy policies.

The short report, How to Track Consumers Who Don’t Want to be Tracked, takes aim at what Nine, News Corp and Seven have said publicly about their use of consumer data. Dr Kemp presented the paper at the ACCC’s National Consumer Congress in June.

“News Corp has emphasised that it can distinguish 16 million individual users, recognisable through a particular unique and persistent identifier, even when the user is not logged in to any News Corp service,” Kemp wrote.

“According to the [Privacy] Act, personal information will be ‘de-identified if the information is no longer about an identifiable individual or an individual who is reasonably identifiable’. It is therefore, at best, highly questionable that information connected to a unique identifier allocated to the same individual every time that individual uses a website or app, even without logging in, could be said to be de-identified.”

Seven West Media, Nine and News Corp have rejected the findings of the paper. A spokesman for News Corp Australia said: “While we can recognise a user as a discreet user, with a particular unique identifier, we do not know who they actually are. Our sites inform users, including those not logged in, about our data collection practices."

A spokesperson for the ACCC said the organisation was “aware of Dr Katharine Kemp’s paper regarding consumer data tracking. However, we are unable to comment on any potential investigations into individual businesses.”

Google, Meta lead ‘race to the bottom’

Media companies are following in the footsteps of the global advertising behemoths of Google and Facebook, Kemp noted, by building first party data banks, negotiating data matching partnerships, or plugging into unique identifiers that will replace third party cookies. Bigger media companies are using a combination of the three approaches.

“Two of the world’s largest digital platforms, Google and Meta, have gained some notoriety for their pervasive tracking of consumers’ activities and combination of data about consumers across a vast array of websites, apps and businesses, in aid of their highly profitable and powerful advertising businesses,” Kemp wrote.

“This has spurred a ‘race to the bottom’ in privacy quality as rival adtech providers vie for business in adtech services that support behavioural advertising, and competition on the basis of privacy protection goes unrewarded so long as those degrading privacy are able to conceal the nature, extent and consequences of their consumer data practices.”

But to counter this duopoly – Meta and Google accounted for 81 per cent of online advertising (excluding classifieds) in 2019, according to the ACCC – Nine and News Corp began to “boast of how many millions of Australian consumers their advertising ‘audiences’ include and the breadth of their data points on those consumers,” Kemp wrote.

Nine claimed 14 million logged in users, Seven West Media said 12 million people have a SWM-ID, while News Corp, has stated it can distinguish 16 million individuals.

Partnerships between media companies and other data holders like TEG (Ticketek) and Flybuys also mean ads on TV can be tied back to purchases in supermarkets.

Kemp said she has written and spoken extensively about concerning data practices from Google and Meta in the recent years, "including alleged and actual contraventions of consumer law in Australia or overseas in respect of consumer data representations by these platforms". She also said Amazon Australia and other online retail marketplaces have objectionable data terms.

"This paper went beyond that previous research and focused on a different sector, since the 'tech giants' are not the only companies with concerning data practices," she said. 

Privacy policies

When information is “anonymous” or “de-identified”, it isn’t governed by the Privacy Act and can be used however the companies’ like. Kemp wrote that those terms deserve scrutiny.

“The advertising press story is effectively 'We're the champion identity-farming uber-trackers, just like Google and Meta'… The privacy policies give consumers the 'nothing to see here' version of data practices. It's a pretty stunning contrast,” Kemp told Mi3.

In Nine’s Privacy Policy, the group’s businesses are listed at the start but consumers need to read “much further” to find out that if they just subscribed to the Sydney Morning Herald, their personal data could be shared with all of the businesses in the Group, including Nine’s TV stations, Stan, The Age, The Sun-Herald, The Australian Financial Review, nine.com.au, Car Advice and Drive, eight radio stations, Open Air Cinemas, Essential Kids, Good Food, Night Noodle Markets, and property website Domain.

Likewise, Seven West Media includes a list of companies within its corporate group (Seven Network, the West Australian, Prime and the Channel 7 Telethon), but only specifies later in the policy that personal data shared with one can be shared with all related companies in the group.

News Corp also provides a non-exhaustive list of its related companies when explaining that it may also collect and disclose information about the consumer to these companies – which may be located in other countries.

The three companies don’t provide an ‘opt-out’ mechanism.

“These collections and disclosures are not optional but imposed as a condition of purchasing a subscription to the newspaper, magazine, or streaming service, for example, although unnecessary for that subscription,” Kemp said.

She made three recommendations. Firstly, claims of anonymity or de-identification should be scrutinised under Australian Consumer Law. Second, while privacy reform is incoming, the publishers should reconsider their data collection practices, which “might already amount to unconscionable conduct”. Third, they should explore new ways of advertising and not just describe existing practices as “privacy-compliant”.

“It may be time to overcome last decade's fixation on tracking, profiling and hyper targeting. Most consumers say they do not like it,” Kemp wrote.

“They are not just waiting to have the ‘value proposition’ explained to them more clearly. They do not want more of the prolific tracking and combining of datasets Google and Meta have become renowned for.”

Kemp told Mi3: “I don't believe this business model is inevitable. It's like back when we thought we couldn't build fridges without chlorofluorocarbons - we're in the advertising equivalent of that era. You can do advertising without pervasively tracking and profiling people. It's just nobody's made you do it yet.”

Publisher pushback

Seven, Nine and News Corp each strongly disputed any suggestion they’re in breach of Australian Consumer Law. But Peter Leonard, professor of practice at UNSW's Business School, advisor to Gilbert and Tobin and principal at Data Strategies, said the publishers were using “loose language” to describe “anonymous” and “de-identified” data. 

“They’re making uses of terms like anonymous and de-identified that are incorrect,” Leonard said.

“There’s a lot of loose language happening around de-identification and tracking and sharing of information. Katharine, I think rightly, is zeroing in on that looseness of information and the risk it creates that people simply don’t know or can’t understand from reading privacy policies… [but] it's all about how the data is managed, not the fact that it's an online identifier or a [mobile ad ID] or a cookie, per se.”

Leonard said because re-identifying an individual is “theoretically possible”, laws should take the further step to ask what controls are in place to manage the data.

A spokesperson for Nine strongly disputed Kemp’s conclusions, saying it provides valuable news, content and sport products to consumers who understand the value exchange online.

"We are disappointed that Dr Kemp's paper does not fairly represent the terms of Nine's privacy policy. Nine is confident that our privacy policy and related practices would stand up to scrutiny. Our team includes a number of people with deep expertise in privacy and data, as well as having access to external advisers where required,” the spokesperson said.

Nine regularly reviews how it collects data, and “takes its legal obligations seriously, especially with respect to compliance under the ACL and the Privacy Act.” 

The spokesperson claimed that half of Australians would prefer targeted and relevant ads, while 82 per cent of Australians agree or are indifferent to sharing their data if they want to use a service.

Seven West Media’s Chief Revenue Officer, Kurt Burnette, said the company put its customers “at the heart of what we do and how we think”. It takes a “privacy-first approach to identity and data management and respect and provide strong protections around user’s personal information”. Burnette said the company takes seriously its responsibility to protect the personal information it holds.