On the surface, online advertising makes sense: people can use websites and services for free; publishers, websites, and app developers can monetise their products; and advertisers can reach their audiences.

But here is the catch: over the past decade AdTech systems have become exponentially more invasive. Targeted advertising depends on massive amounts of data about people being collected, shared and processed.

What this means is that most of what you do online - such as the websites you visit, the apps that you use, what you do on them, what you watch, what you buy, what you read, your location, your interests, and more, is being tracked, shared, and used to profile you.

An entire complex and opaque ecosystem is exploiting your data for their bottom line. As a result, tracking and profiling has become virtually inescapable and the ecosystem is so leaky and complex, that it has become impossible to know where your data ends up.

Intrusive data collection is not the only reason why the current AdTech ecosystem comes at a hidden cost. Targeted ads can be discriminatory (you might not be not shown a job ad because you're a woman or given a loan because you live in the wrong neighbourhood).

They can also seek to be manipulative (you are served tailored information to target those that are most vulnerable).

And you as a user have no control over how this data is shared and repurposed (for example, with data brokers and others who are selling your personal information to people outside the advertising ecosystem, including political actors).

Finally, collecting and sharing these personal data with innumerable third parties comes with a huge and growing security risk, for instance, if data is breached or insufficiently protected.

In fact, this risk is the same, regardless of whether tracking is done for advertising or for other purposes.

Tracking data can be very personal and reveal intimate information (such as when the gay dating app Grindr was found to have shared people’s HIV status with two analytics companies), which puts people and communities at risk of harassment, stalking, identify theft and more.

Even with the best intentions and motivation, it is extremely difficult if not impossible to opt-out of all the existing tracking methods. And that's without getting to the point that this should not be the default and rather an opt-in. From endless opt-out buttons to invisible tracking pixels to cross device tracking and fingerprinting techniques, it is almost impossible to make companies respect your decision not to be tracked.

You might be wondering how all of this tracking and data sharing is even legal.

Privacy International has spent the last years looking at how people's data is exploited, including investigating and challenging the hidden online data ecosystem built on tracking, profiling and targeting us.

Using the new standards set by the EU's General Data Protection Regulation, Privacy International is seeking to promote regulatory scrutiny of the industry and hold specific actors to account.

In November 2018, we complained about seven companies in the hidden data ecosystem to Data Protection Authorities in Ireland, the UK, and France.

As a result of our submission, the Irish Data Protection Commission (DPC) has now opened a formal probe into Quantcast’s data practices. We believe AdTech companies' practices are in breach of GDPR and want to continue to hold these companies to account.

But this alone is not enough. We believe that you know what's at stake and be able to take action too.

Here are step by step guides to help you fight back against online tracking.

We have also written a series of explainers to simplify concepts and topics related to online advertisement:

Tracking: the reality and mechanism behind AdTech tracking how it turned the internet into a surveillance machine  

Cookie banners and consent boxes: why they are so annoying and deceptive

Real-Time Bidding (RTB): a widely spread technology used for targeted advertisement that implies the sharing of your data with hundreds of companies

In addition to this, and because we are not the only ones concerned and working on these issues, we have created a resource page presenting initiatives led by other organisations and individuals tackling AdTech as well as a timeline of complaints against AdTech.

This includes examples of harms, legal actions, research and explainers, illustrating the scale of the problem and the different action taken.