Who’s Tracking You? Use This New Service to Find Out

Determining who is responsible for showing ads on websites and mobile apps, as well as who is harvesting user data, can be a daunting task. Traditionally, this information has been scattered and difficult to parse, often confined within the control of large advertising platforms. However, a new free service called DecryptAds is now making it simple to quickly learn about the entities tracking users.

DecryptAds scrapes and correlates adtech data from publicly available files such as ads.txt, app-ads.txt, buyers.json, and sellers.json. These files disclose the companies permitted to run ads or collect user data on a given site or app. The service's chief research officer, Zach Edwards, a threat researcher at security company Infoblox, and two other founders developed DecryptAds to address the need for a security perspective in analyzing adtech data.

Edwards explained that the service was created because adtech data in these files is generally only useful when cross-referenced to build a more complete picture of the advertising ecosystem for each website or app. "It's an adtech tool but we're trying to approach adtech from a security perspective," Edwards stated, emphasizing that the service is designed for various privacy and security use cases that have been underserved.

One such use case is identifying malicious ads that attempt to install malware on targeted users. Another involves detecting ad networks located in adversarial nations or detecting the growing number of AI-generated junk websites and apps. The website warns that supply-chain integrity issues rarely reside in a single file; instead, they appear as broken cross-references between ads.txt, app-ads.txt, and sellers.json files or as cloned declaration sets across unrelated domains.

DecryptAds simplifies the process of examining these files, using the popular sports network espn.com as an example. The site reveals that espn.com lists 143 ad partners and 19 registered data broker domains within its ads.txt and app-ads.txt files. The data broker information, gradually becoming available due to recent legislation in California, Oregon, Texas, and Vermont, shows that almost half of these data brokers collect geolocation data from espn.com visitors who haven't blocked ads. Other data brokers disclose collecting device fingerprints and sensitive personal information.

DecryptAds also highlights the geographical origins and beneficiaries of ad partners, displaying warnings when adtech partners are based in "geo-risk" areas like China, Russia, Cyprus, or the UAE. For instance, espn.com works with four advertising entities based in Russia, China, or the UAE, including Between Digital, an adtech firm whose publisher offers are processed through Russia's largest private commercial bank, Alfa Bank, which is subject to U.S. sanctions due to Russia's invasion of Ukraine.

The service reports that Between Digital collects ad data on approximately 55,000 partner websites. Further investigation of Between Digital's app-ads.txt file shows that the company is listed as both a publisher and a reseller for about two-thirds of its portfolio, creating potential conflicts of interest. Edwards explained that Between Digital's practices raise concerns about the fairness and integrity of the advertising ecosystem.

Overall, DecryptAds provides a valuable tool for users and organizations to gain insight into the complex advertising supply chain and identify potential security and privacy risks, ultimately empowering them to make informed decisions about the websites and apps they engage with.