In the months since Buzzfeed began pounding out quizzes full-time, millions of people have answered the inane and occasionally probing questions with the hopes of learning just a little bit more about themselves. But apparently, according to a report published by the software engineer Dan Barker this week, Buzzfeed could also use the quizzes to find out more about you. A lot more about you.
In fact, a deep-dive into Buzzfeed’s analytics code would suggest the site has tools in place to build individualized data profiles based on users’ quiz responses — which sometimes include deeply personal information, like whether you’ve had an eating disorder or taken meds for a mental illness.
Buzzfeed, we should note, says that isn’t what it’s doing: Yes, they track user behavior on quizzes — but only once it’s been anonymized, and only in the aggregate.
“We know how many people got Paris or prefer espresso in the ‘Which city would you live in?’ quiz, but we don’t know who they are,” Dao Nguyen, Buzzfeed’s director of growth, wrote in the comments on Barker’s report.
That may very well be true, and it should comfort Buzzfeed users who took quizzes like “How Moist Are You Actually?” (That item is, for whatever reason, about sweat.) But what about people who take quizzes on, say, The Washington Post? And what about more passive data collection — cookies and other tools that watch where you go and what you do online?
“It’s … worth mentioning that this is a total minefield,” Barker told the Independent, “and lots of website owners don’t fully understand what data they’re recording.”
So let’s talk about the kind of data sites, like Buzzfeed or The Post, typically record. A lot of it is basic, humdrum Internet-y stuff: where you are, whether you’ve visited before, how many pages you click on the site, what you clicked to get there in the first place. Some of it’s more behavior-based: whether you have an account, if you’re logged in, if you get e-mail or Facebook updates, if you tweet or post things from the site. And some of it’s distinctly personal: your age and gender, for instance, or your “affinity categories” — the things your Internet activity suggests you seem to like.
Generally, Web sites are using that information to both improve your experience on the site (whether through personalized content and recommendations, or by helping the site’s owners identify the type of content people like best) and serve up advertising you’re more likely to click on. Most people would agree that’s pretty benign. In fact, it’s a win-win, with benefits both the Web site and its readers.
But Barker’s analysis points to a phenomenon that most readers — and indeed, many Web site administrators — aren’t necessarily aware of. Because of the way data is often tagged and collected, with discrete, pseudonymous ID numbers for each user, it’s technically possible to aggregate everything a user does on a site into one individualized profile. From there, it’s also possible to link those profiles to real-life user identities. From a technical standpoint it isn’t even that difficult, Barker told The Post. That type of information could then be sold off to data brokers, who can field out your name, age, race, religious affiliation and Boy Meets World soulmate to anybody who pays for it.
Barker is very clear that, since speaking to Buzzfeed, he doesn’t believe the site’s doing anything of the kind with its data. Buzzfeed has certainly insisted it’s not.
But this should still serve as a powerful reminder that truly nothing you do is anonymous online, unless you take steps to anonymize it. Even a click as trivial and unthinking as “Will You Survive the Zombie Apocalypse?” could potentially be mined for intimate, valuable information. More insidiously, the technical mechanics that govern that mining are, to most of us, invisible. I have no idea what kind of data Washington Post quizzes cull, for instance — so I asked Barker to check.
“As far as I can see, when someone answers a question, your site does not record that information at all,” he said. “In general, your quiz pages track far less information than most other pages on the site, and far less than most other news sites.”
So don’t fret, WaPo readers: You can evaluate your math know-how and congressional conversance in peace. But on the homepage, and on article pages, we’ll be watching you — and on virtually any other homepage or article page you visit, somebody else will.