Did you know: Telcos target us with ads, too?

By Zak Rogoff

Telcos are engaging heavily in targeted advertising, via a range of lesser-known tactics, but are even less transparent about these activities than platforms.

While many of us have come to associate the growth of targeted advertising with digital platforms like Facebook, the targeted advertising activities of telcos, including most of those we cover in our Telco Giants Scorecard, have slipped under the radar. But when telcos engage in targeted advertising, it raises many of the same human rights concerns that have been extensively documented in the case of digital platforms, including discriminatory or inaccurate content algorithmically boosted to large audiences and an incentive to collect as much data as possible about individuals.

Telcos have multiple incentives to keep expanding their involvement in targeted ads. For one, their calling, texting, and cable service revenue is being undercut by internet-based alternatives. Telcos’ body of user data tends to be more precise than that of platforms, because providing their services often requires knowing a user’s phone number, address, or billing information. The relative value of this data is only increasing as new laws, like Europe’s General Data Protection Regulation (GDPR), along with increasing public pressure, make it harder for digital platforms to track web users through third-party tracking.

In 2020, we added standards to our methodology that draw attention to the underappreciated role of the targeted advertising business in generating digital rights harms. These indicators assess whether companies conduct human rights impact assessments on their targeted advertising, publish clear rules governing advertising targeting and content, disclose the volume of ads rejected, and explain how enforcement is carried out. Further, they look at data privacy by asking whether companies explain where the data used in targeted advertising comes from and how much control users have over it.

But how do telcos actually participate in targeted advertising, without the high-traffic websites and apps of Big Tech companies like Meta, Google, or Twitter on which to display ads? The following are the most common ways that the telcos we rank are involved in targeted advertising:

• Addressable TV: Telcos use demographic and other data about their customers to select ads to deliver on TV programs, so that each household sees the ad that the telco’s targeting algorithm, or the advertiser, believes is most likely to influence them.
• Location-based advertising: Telcos deliver ads via text messages or push notifications when their systems detect that users’ phones enter specific “geofences,” which are demarcated regions chosen by the advertiser..
• Identity systems and data management platforms: Telcos use these “backend” systems for tracking and analyzing individuals, either to aid in ad targeting, or to help other companies, such as digital platforms, deliver ads on behalf of their own advertisers.
• Ad networks: Telcos form contractual agreements to provide advertisements for display by a group of apps, sites, or other services, and share the revenue with them. Ad networks are part of why certain advertisements can seem to follow individual users across the web.

In the 2020 RDR Index, our targeted advertising indicators showed that the majority of the telcos we rank lacked transparent and comprehensive policies to ensure that they do not contribute to placing discriminatory, misleading, or hateful advertisements. No ranked telco demonstrated the existence of a functioning ad-policy enforcement process by releasing data on the number of proposed ads it rejects. Just as worryingly, none performed human rights impact assessments on new or existing advertising technologies. About half gave users some ability to control how their data was used for targeted advertising, but none except Deutsche Telekom stated that its targeted advertising was turned off by default.

Most of the telcos we ranked lacked transparent and comprehensive policies to ensure that they do not contribute to placing discriminatory, misleading, or hateful ads. No ranked telco demonstrated the existence of a functioning ad-policy enforcement process.

Since then, we’ve seen marked improvement from only one company, Telefónica. This year it became the first ranked telco to systematically assess the human rights impact of its targeted advertising activities. Most telcos were stagnant, though MTN lost credit because its disclosures about targeted advertising referred to a time-bound program that has since ended.^[1]

Though our targeted advertising indicators allowed us to uncover a clear lack of policies governing targeted advertising overall, we continued to lack a fundamental piece of the puzzle. Being able to eventually pinpoint what policies are most needed for each telco depends on knowing the specific advertising activities it engages in. But the ways in which telcos participate in targeted advertising are complex, as we’ve detailed above. To kick-start a much-needed push for transparency on how telcos use targeted advertising, this year we compiled supplemental data describing the targeted advertising activities each of our 12 ranked telcos is involved in. The supplemental data has no direct effect on the scores assigned in the 2022 Telco Giants Scorecard.

To compile this data, we first made a list of the known targeted advertising activities carried out by any company, including telcos. We then systematically searched our ranked telcos’ web pages, as well as journalistic sources, for evidence that telcos were or were not engaged in them. Finally, we sent each telco the list of advertising activities we believed it was carrying out, asking the company for confirmation. At the time of publication, only Vodafone, América Móvil, and MTN have provided responses, which were integrated into the findings. Though our findings are not yet comprehensive, we are confident that we have been able to compile the most prominent targeted-advertising activities that these telcos engage in. And we will continue refining our findings.

We found evidence that all of our 12 ranked telcos were involved in targeted advertising in at least one way. Eight had location-based advertising, six ran an addressable TV program, and six have implemented identity systems. Three have ad networks, while only two have data management platforms. The telcos most heavily involved in targeted advertising appear to be (in alphabetical order) Airtel, Axiata, Orange, Ooredoo, and Vodafone. Vodafone’s involvement is partly through its Indian affiliate, Vi, of which it owns about a third. These findings confirm that targeted advertising is an important component of many telcos’ current profit-making operations.

We found evidence that all of our 12 ranked telcos were involved in targeted advertising. The prevalence of these activities highlights the need for greater transparency about telco customers' data privacy.

The prevalence of targeted advertising activities also highlights the need for greater transparency about telco customers' data privacy. Even though companies’ privacy policies provided some warning that data collected through their services could be used for advertising, few telcos disclosed exactly which data this was or how it was used. Axiata is a characteristic example: According to its website, its Malaysian subsidiary Ada maintains “deep proprietary data of 375 million consumers” across South and Southeast Asia for use in targeted advertising and business analytics. It is likely that this includes information submitted by Axiata customers in the process of signing up for mobile services, though the company does not say so publicly.

Three concerning trends need to be highlighted this year, as telcos adopt and deploy targeted advertising more pervasively. European telcos we rank are experimenting with TrustPID, a new advertising identity system that allows them to attach unique IDs to web users for tracking and ad targeting. Some privacy experts have compared this new technology to a “supercookie.” Unlike a web cookie which users can delete from their browsers manually, supercookies are attached to users’ web traffic on a deeper level and cannot be deleted except by requesting the internet service provider do so through a specialized form. Meanwhile, Deutsche Telekom’s U.S. operating company T-Mobile has begun selling information to advertisers about customers’ app downloads and web browsing history, information that can reveal intimate details about a person, such as sexual orientation.

Many governments in the Global South, particularly in Africa, have begun forcing telcos to disconnect millions of mobile users unless they agree to link their government ID or biometrics to their SIM card. This is being carried out based on the questionable belief that SIM registration aids law enforcement. SIM registration provides telcos with highly accurate identity and demographic data. While we do not yet have evidence of data collected this way being used in advertising, this type of data is considered the gold standard for ad targeting.

RDR is not alone in recognizing the need for increased attention to the role of telcos with regard to privacy, and to targeted advertising in particular. Europe has recently passed data protection laws like the GDPR and has made a point of scrutinizing new technologies like TrustPID when they emerge. The U.S. federal government has, for a long time, lagged behind its European counterparts on this issue. Yet, since the 2020 RDR Index was released, the U.S. Federal Trade Commission published a report criticizing domestic internet service providers (generally telcos) for gathering and sharing “far more data about their customers than many consumers may expect”—which is sometimes used to profile them based on sensitive characteristics such as race or sexual orientation—while giving these customers inadequate tools to control the data.