The Xandr File | Downloads, Media Reports, Responses

How consumer data brokers trade personal data on everyone, globally

Wolfie Christl | Last updated 26 July 2023

Some time ago, I discovered a spreadsheet file on the web that I consider the largest piece of evidence revealing how hundreds of data brokers trade personal data on everyone, including very sensitive data, globally. The file, dated 2021, provides information on more than 650,000 “segments” typically used for ad targeting. Most of these “segments” represent lists of digital IDs that refer to people with certain personal characteristics and behaviors. The file contains descriptions of these lists, not the data itself.

The segment lists were sold for ad targeting purposes via the “data marketplace” of Xandr, a digital advertising firm and data broker that was a subsidiary of AT&T in 2021 and was acquired by Microsoft in 2022. The file provides deep insights into global consumer data brokerage, the types of data sold, the companies that trade it, and their supply chains and business relationships.

I shared the spreadsheet file (23MB, download on archive.org) with The Markup (US) and netzpolitik.org (Germany), which reported on it in June 2023, sparking a number of follow-up investigations in several countries around the globe.

Original media reports by The Markup and netzpolitik.org

• From “Heavy Purchasers” of Pregnancy Tests to the Depression-Prone: We Found 650,000 Ways Advertisers Label You
  A spreadsheet on ad platform Xandr’s website revealed a massive collection of “audience segments” used to target consumers based on highly specific, sometimes intimate information and inferences (The Markup, by Jon Keegan and Joel Eastwood, 8 June 2023)
• Microsofts Datenmarktplatz Xandr: Das sind 650.000 Kategorien, in die uns die Online-Werbeindustrie einsortiert
  Ein Dokument gibt einen einmaligen Einblick in den globalen Datenhandel für die digitale Werbung. Erstmalig können wir im Detail nachvollziehen, wie invasiv und kleinteilig die Werbefirmen und Datenhändler uns kategorisieren (netzpolitik.org, by Ingo Dachwitz, 8 June 2023)
• Article focusing on German data brokers ("Unsere Recherche zeigt, wie tief deutsche Unternehmen inzwischen in das Netzwerk der Datenhändler verwoben sind und dass sie auch heikle Datenkategorien anboten. Beteiligt sind Konzerne wie die Deutsche Telekom und ProSiebenSat1", netzpolitik.org, 8 June 2023)
• English-language article focusing on Europe/EU ("Surveillance advertising in Europe: The adtech industry tracks most of what you do on the Internet. This file shows just how much. EU-based data brokers play a vital role in this system (netzpolitik.org, 6 July 2023)
• Responses from German regulators and policymakers ("Datenschutzbehörden stellen Werbefirmen auf den Prüfstand", 16 June 2023)

Twitter/Mastodon threads by Wolfie Christl

• Twitter: Initial thread, follow-up thread (Adstra, Gravy Analytics, Adsquare, Skydeo), another follow-up thread (Epsilon, Oracle, LiveRamp, Neustar/TransUnion, Eyeota)
• Mastodon: Thread

Follow-up reports with contributions from Wolfie Christl

• Europe/US - two reports about how data from digital advertising and real-time bidding (RTB) flows to foreign states and non-state actors. Authored by Johnny Ryan and Wolfie Christl, published by the Irish Council for Civil Liberties (ICCL) in Nov 2023: European report | US report | Financial Times
• Australia - report about the commercial misuse and trade of personal information, targeted advertising and consumer manipulation. A report by Reset.Australia, written by Susie Alegre, with contributions from Wolfie Christl: report "Australians For Sale"

Other articles and reports addressing the file in different countries

Netherlands

• Gelekte lijst Microsoft wijst op handel in persoonlijke profielen (Reformatorisch Dagblad, 16 June 2023)

Germany

• Datenschutzbehörden leiten Prüfungen ein gegen Datenmarktplatz Xandr und Käufer (heise.de, 16 June 2023)

Austria

• Die gefährlichen Schubladen der Online-Datenhändler (Futurezone/Kurier, 11 June 2023)

Switzerland

• Zuger Firma verdiente am Verkauf von Online-Daten (zentralplus, 8 July 2023)
• Microsoft Datenhandel: Xandr gibt Einblick (Stiftung Konsumentenschutz, 14 June 2023)
• «Fragile Senioren» oder «Depression» als Werbe-Zielgruppe: Zu welcher Gruppe Sie gehören, halten Firmen geheim (Luzerner Zeitung, 6 July 2023)

Australia

• ‘Heavy TAB gamblers’ among groups targeted by online advertising database (The Guardian/Australia, 14 August 2023)
• The data processors that know everything about you (ABC Radio National, 15 June 2023)

Greece

• Από το «αγοράζει υπερβολικά πολλά τεστ εγκυμοσύνης» έως «έχει ροπή στην κατάθλιψη»: Βρήκαμε 650.000 τρόπους με τους οποίους μας κατατάσσουν οι διαφημιστές (The Common Sense, 1 July 2023)

USA

• Tag Yourself: Here Are the Most Personal Ways Advertisers Target You (Gizmodo, 10 June 2023)

Tech policy and digital advertising trade press

• Cory Doctorow: Blog, Twitter (15 July 2023)
• Data Journalism Top 10 (Global Investigative Journalism Network, 16 June 2023)
• Analysis of ad platform finds 'audience segments' targeted with sensitive user information (IAPP, 8 June 2023)
• Tracking The Trackers (AdExchanger, 12 June 2023)
• Xandr dataset: a look at a major platform’s audience segmentation (WARC, 9 June 2021)