Data tracking for targeted ads puts Windows 10 under French data regulator’s crosshairs

“Security, Castle, Sure, Internet” by TBIT. Public domain.

Last July, the PC operation system known as Windows 10 was released by Redmond, WA-based technology company Microsoft Corporation (NASDAQ:MSFT) to the general public. This version of Windows introduced the universal app platform which allows users to access apps across multiple Windows-enabled devices. Windows 10 took Microsoft further into the cloud as well as the company is turning towards marketing Windows as an operating system-as-a-service (OSaaS) solution which will see Microsoft offering incremental upgrades to Windows a few times each year instead of a large new release every few years.

Windows 10 is making an impact on the OS market as it has become the fourth-most used operating system around the world as of this July, trailing Android, Win7 and iOS. However, some feathers have been ruffled by default settings which give pause to those who are concerned about personal data privacy. The express option for Windows 10 installation gives Microsoft the ability to collect data from contacts, calendars, device locations and the digital assistant Cortana. Much of this data collection is used for ad personalization and content suggestions based on past online activity.

Recently, Windows 10 data tracking has gotten Microsoft into legal troubles with a data regulatory agency that has been engaged with data privacy activism in the past. France’s Commission Nationale de l’Informatique et des Libertés (CNIL) issued a formal notice to Microsoft informing the company that it has three months to take measures that will make Windows 10 compliant with the French Data Protection Act. CNIL noted multiple ways in which Windows 10 fails to satisfy French data protection law including excessive data collection from apps and the Windows Store, lack of security measures for personal identification numbers (PINs), a lack of user consent for targeted advertising and no option to block cookies. (At this point, it should be pointed out that CNIL’s official website uses cookies, as the screenshot posted here will show readers.)

This legal skirmish is part of an international data privacy kerfuffle which has led to the development of data privacy agreements between foreign governments, such as the recently adopted EU-US Privacy Shield. The legal framework, passed by the European Union in July, relies on the U.S. Department of Commerce to regularly audit consumer data transfers made by American tech companies offering products in Europe. Privacy Shield also creates redress mechanisms which can be utilized by individual citizens who feel that their data is being misused. CNIL’s recent notice pertaining to Microsoft alleges that the company’s consumer data collection practices are operating under international safe harbor rules which were invalidated by the European Court of Justice last October.

The regulatory actions involving data privacy which have been pursued by CNIL in recent years have done a good job of making headlines. Last June, the French data regulator served American Internet services company Google with a notice that it must remove links from its core Google.com search engine domain. CNIL cited a legal concept known as the “right to be forgotten” which has arisen within the EU as a right that its citizens have for requesting that personal information be removed from the Internet even if that data is factually correct.

Microsoft’s initial response to CNIL’s notice, published by tech innovation news outlet VentureBeat, indicates that the company is willing to work with CNIL but the company maintained that it has taken steps to help consumers protect their data. The statement from David Heiner, vice president and deputy general counsel for Microsoft, indicated that the company is currently working on meeting Privacy Shield requirements and would release a privacy statement in August regarding its Privacy Shield efforts.

Microsoft holds a portfolio of 213 active U.S. patents related to targeted advertisements according to the patent portfolio analysis tools available through Innography. As the text cluster will show readers, a great deal of this portfolio is focused on targeting advertisements although user profiles, media content and search queries are also significant areas of research and development focus. In 2015, Microsoft earned a total of 2,471 U.S. patents making it the ninth-most active company at the U.S. Patent and Trademark Office that year according to the Intellectual Property Owners Association.

Techniques for selecting advertisements which are more likely to engage with narrow subgroups of viewers are discussed within U.S. Patent No. 9363546, titled Selection of Advertisements via Viewer Feedback and issued to Microsoft this June. It claims a computing device storing instructions which are executable to aggregate a plurality of emotional profiles from a plurality of prior viewers of a content item, receive a targeted viewer’s current emotional status and select a content item based on a correlation of the viewer’s current emotional status with the aggregated emotional response profiles. This system is designed to encourage the selection of effective advertisements to run with video content on a per-viewer basis.

Surveying an individual’s television viewing preferences for more effective Internet-based marketing campaigns is at the center of U.S. Patent No. 9390425, issued under the title Online Advertisement Selection. It discloses a device-implemented method which involves receiving a request Internet access for the display of non-video web content, determining a location of the requesting device from its Internet protocol (IP) address, obtaining data describing advertisement interactions in television content output by a second client device associated with the IP address and selecting an advertisement to be displayed with the non-video web content based on the obtained interaction data. This innovation addresses shortcomings in advertising models traditionally used in broadcast advertising by taking knowledge from television ads campaigns and using it to inform online advertisements like banner or pop-up ads.

Methods for targeting ads based on an individual’s appearance are detailed within U.S. Patent No. 9183557, entitled Advertising Targeting Based on Image-Derived Metrics. It protects a computing device with hardware storing instructions which are executable to automatically derive a user’s physical attributes and preferences from images associated with the user. When executed, the instructions cause the computing device to search image-centric websites for public digital images associated with the user, perform facial recognition on the images and apply digital image analysis algorithms to identify physical attributes of a user. This system enables Microsoft to determine certain physical attributes of a person which might encourage certain purchasing habits, such as determining that a person wears glasses. It could also determine whether the individual travels or enjoys certain indoor or outdoor activities, which could further inform advertisement selection.

Targeted advertisements are becoming a huge moneymaker as mobile platforms have continued to spread across the world. Marketing insight firm BIA/Kelsey released a forecast last April which predicted that location-based mobile advertising revenues would increase from $6.7 billion in 2015 up to $18.2 billion in 2019, when mobile will grab the fourth-largest share in local advertising media. Tech companies engaging in targeted advertising could make CNIL a very busy agency in the years to come if it continues to work as an activist for data privacy concerns.