In my recent blog post about reducing Ad-Tracking by using Firewall rules, I already mentioned that I might dig a bit deeper into the topic of IP-based AD-tracking.
Recently I noticed that my wife was being targeted with ads based on my browsing activity, I was both surprised and slightly unnerved. And it was undoubtedly my browsing behaviour: We were both sitting on the couch, I was looking for new cycling clothing gear when she suddenly said, “Why am I suddenly getting Ads for cycling clothing?” And while discussing it, we noticed that the same happened before with second-hand computer parts that I was researching.
We don’t share accounts or devices, yet somehow, the algorithms figured out that we’re connected. After digging deeper, I realized the culprit: shared IP-based tracking.
This is a subtle but powerful technique that advertising networks and platforms use to connect dots between individuals on the same network. It’s not magic and it’s something we might encounter every day without even realizing it.
What Is IP-Based Tracking?
Your IP address is like your online street address. Whenever you connect to the internet, your internet service provider (ISP) assigns you a unique IP address, either for your device (in rare cases) or for your network. Home networks typically share a single IP address across all devices, with your router acting as a gateway. So, for “the internet” all devices in your home network seem to be a single device. Let’s not overcomplicate right now – but of course, by using the cookies in your browser or any login information (Google, Facebook, ..) the devices can be distinguished. Advertising networks, social media platforms, and other data-driven services monitor this IP address as part of their tracking methodology.
How can this be used?
By using IP tracking, those companys can match / correlate behaviour like in the example above: I was looking for cycling gear and suddenly other devices in the same network get Ads for cycling. The companies don’t necessarily know that different persons are using the devices so they are just firing the ADs to devices from this IP, hoping that it’s me ho sees the ADs.
Another way such information can be used is Household Profiling: Advertisers aren’t just interested in individuals but also households. They can build a profile of your household’s interests, purchasing habits, and demographics, even if individual users are trying to maintain some privacy.
You might think: “okay, I’m getting a new IP every day anyways” – which is even enforced by most providers in Germany by a force disconnect after 24h. Well, yes and no. A new IP is of course a fresh start – until someone logs in to Facebook, Google, … At this moment you reveal yourself and those companies know “ah (s)he has this IP, let’s correlate the past requests from this IP to this user”.
Why IP-Based tracking Works
The “advantage” of IP-based tracking is its simplicity: It doesn’t rely on cookies, browser fingerprinting, or apps sharing any data. No piece of software is required on the client. It works entirely at the network layer. This also means that you can hardly circumvent it as well.
Unlike cookies, which can be cleared, or app trackers, which can sometimes be disabled, IP tracking is nearly impossible for average users to avoid without significant configuration. Any device which is on the same network (“Smart” TV, Tablet, Mobile, Console) can contribute to the profile.
Is My Phone “Listening”?
Well let’s come back to the initial statement if the phone is listening. I’ve heard people jumping to the conclusion that their phone must be secretly listening to their conversations when they see ads for something they only discussed verbally. But I’m pretty sure that in most cases, the explanation lies in IP-based tracking or household profiling. Like “we only talked about this holiday in xyz and suddenly I’m getting ads for this!” – of course they don’t correlate that their conversation partner will have done some online research about holidays in xyz already. It’s another device – how would you connect it to YOUR device!
While phone surveillance isn’t entirely out of the question, I would rather place the topic in the area of state security authorities as it would require hacking the phone. Especially it would consume considerable amount of battery. IP-tracking is just SO MUCH easier. There’s just NO need to recod voice, try to transcribe, try to secretly get the information to somewhere else — if they can just simply use the browsing data.
What can we do against IP-Based Tracking?
Maybe the most effective way to counter IP-based tracking is to block AD requests entirely. This requires using a firewall or DNS-level filtering solution, such as Pi-Hole, installed on your home network. However, this approach is not foolproof. Blocking all ad-related requests is nearly impossible, and the protection is limited to your home network. When you’re on mobile networks or public WiFi, the tracking resumes.
For the highly privacy-conscious, using TOR could help mask your IP address, but is often impractical for regular users. A VPN wouldn’t be of big help as it just gives you another IP address – and as long as it stays stable for a while, you have gained nothing.
Should we Care at All?
At first glance, IP-based tracking might feel like just yet another tracking method. But on a closer look, it leaves me a bit sad: You are not asked, you cannot unsubscribe, it’s extremly subtle and it’s used to profile not just individuals but even full households. – Oh and the more I think about it, the worse it gets: Think about using the Wifi of a Café or shopping center.
Maybe I’m just too pesimistc? Maybe thos ecompanies are not even interested in who and where we are – they just need enough signals to target effectively and get a good Ad-Price. But a Facbook, Google, etc are easily able to gather and connect all those breadcrums as most of us are logged into those services all the time.
To me, it represents a broader trend: the erosion of individual privacy in favor of data-driven marketing (a.k.a in favor of some big techs). But: Understanding how these techniques work is the first step toward protecting yourself – at least a little bit.