On May 2, then-presumptive Republican presidential nominee Donald Trump did two rallies in Indiana, one in Carmel and one in South Bend. SAP’s Stew Langille provided an overview of the people at those rallies during a product demonstration at the Observer offices. Langille has been setting up SAP’s new data-as-a-service product, Digital Consumer Insights (DCI). With it, he was able to provide some demographic analysis of Trump’s primary crowds.
For example, he said, there were an unusually high number of Android users in the audiences.
“This is somewhat indicative of a lower income bracket,” he explained. Saying that the Samsung S5 was the most popular phone at the two events, “which is kind of an old phone. These are not people buying the latest technology,” he said. The model was released April 2014.
Carmel, the earlier rally, had 47 percent women, but in South Bend, the crowd that turned up was 52 percent women, based on DCI’s information.
Langille could provide these insights because of data SAP has under contract from one of the major US mobile carriers. The company has the carrier’s complete data set of the mobile subscribers’ movements going back to October 2015, according to Langille. Accompanying that data: lots of other information, such as the age of the mobile users, their devices, the apps they use and their home ZIP codes. The data is provided in aggregate, not subscriber by subscriber.
“Income is something that we want to do,” Langille told us as we spoke, but right now the product is only able to infer it using other data points, such as billing ZIP code.
The program illustrates just how many ways our constantly connected present makes it possible to monitor everything consumers do. It turns out that wireless service providers can profit not only from providing us connection for a fee but also from data it gathers about users of that service. The new SAP data product led us into the weeds of wireless service providers’ privacy policies, which suggested that there are many more programs like this one.
Since the demo, SAP has declined to provide similar subscriber analyses for two comparable Hillary Clinton and Donald Trump rallies since the conventions.
Data-as-a-service
Though large stadium rallies do make for especially easy settings for DCI to evaluate, Langille explained that SAP, which announced DCI in May, aims more to make enterprise quality data available to small and medium-sized businesses who want easy-to-buy information about who visits a specific area and when. For example, their launch release quotes Brooklyn Bowl’s director of marketing, who said the report help her team to understand the different makeup of the crowd that shows up for different events on different nights.
Small business owners can buy one report for $439 or five for $1,429. Reports can be purchased online, with a credit card. It comes with basic visualizations ready-made by the DCI team as well as the raw file of aggregated data, from which sophisticated users could construct their own visualizations.
So, for example, a user might request data about subscribers who passed through a few square blocks of Manhattan during one week in March 2016. Besides footfall counts, they can also get demographic information. It could construct a visualization that compared two different days in the same place, or two different places on the same day. See more refined detail in the program’s user manual.
“The product, what it does is give demographic and footfall information for retailers and ideally—really—small businesses, from mobile phone carrier data.” Langille explained. “So we have partnerships with the domestic mobile phone carriers—so: Sprint, AT&T, Verizon—and they kind of give aggregated, anonymized data to SAP, so there’s kind of an enterprise level of contract that exists there.”
Later, he explained that the company only uses one company’s dataset at a time. “We partner with different carriers. So right now we go with one carrier and see the data from that carrier and how much we like it, and potentially that could change,” Langille said.
We’ve previously reported on Placemeter, a company that uses computer vision to make counts at specific spaces. Obviously, it can only analyze as much space as its cameras can see, but the advantage of Placemeter is that it can get a count on every single person (or car, or bike, etc). DCI will only capture the subscribers of one mobile network but over a larger area that gives a statistically significant sample. Plus, it can show data that Placemeter never can, like the make and model of the phone in the person’s pocket.
So which carrier provided the data?
We dug into all four carriers’ privacy policies so you don’t have to (but—probably—you should). We learned that it really could be any of them (AT&T is a maybe).
Langille declined to specify which carrier has sold the data to SAP for this product but said, “It’s one of the four major carriers.” SAP declined again after the Observer followed up with a spokesperson.
The Observer has asked Verizon, T-Mobile, Sprint and AT&T separately if one of their companies is the partner. Verizon and T-Mobile have confirmed they are not a partner with SAP. Sprint’s privacy policy spells out the DCI use case. Under “Information we share,” it says (emphasis added) it might share “de-identified or aggregate information” for various purposes, including to:
Conduct market or traffic flow analysis and reporting or produce or facilitate production by others of business and marketing reports to share with third parties. For example, we may aggregate customer information across a particular region and create a report showing that 10,000 subscribers from a given city visited a sports stadium.
Which isn’t to say Sprint is the company selling this information to SAP, but the example given is striking. At a minimum, Sprint’s policy does permit it to sell similar data to some company (or lots of them). Sprint did not reply to multiple requests for comment.
It’s worth noting that T-Mobile’s privacy policy could be designed in a more helpful manner. First, details about its sharing are buried inside an expandable window. Then most of the language in that window sounds pretty innocuous, until a link at the bottom of that window that leads to a separate page, for “T-Mobile INSIGHTS.”
That page explains that it sells data about its users to third parties so that they can make “research reports.” In other words, the company says it isn’t supplying the data, but it could under this policy, to SAP or other companies. T-Mobile customers can opt-out of T-Mobile INSIGHTS.
While AT&T takes great care to write its privacy policy in plain language, it’s still a bit unclear how much it shares with outsiders that aren’t doing AT&T work. For example, its privacy policy FAQ includes this question: “Do you provide companies with individual anonymous data as part of your External Marketing & Analytics Program?” The short answer is “yes,” but the longer answer is a bit fuzzy.
AT&T was not able to send comment by press time, but the Observer will update.
Verizon’s privacy policy defines “Customer Proprietary Network Information” as follows: “CPNI is information that relates to the type, quantity, destination, technical configuration, location, amount of use and billing information of your telecommunications or interconnected VoIP services.”
It adds, “CPNI will not be shared with unrelated third parties for their own use.”
Verizon spokesperson Rich Young wrote the Observer in an email that any information it sells or shares is anonymized (a concept that’s always worth questioning). “Our privacy policy and customer notices describe programs we have that help advertisers reach audiences with more relevant ads and provide marketers and others with insights about wireless customer behaviors, using various information including location,” he wrote. “Our customers have clear choices about whether to participate in these programs.”
Why does it matter?
SAP wrote in its May announcement that all of DCI’s data is aggregated. In a subsequent message, a spokesperson explained that there is no nonaggregated version of the data DCI customers can get. The raw data users purchase does not include individual subscriber records, so it shouldn’t help data brokers build a specific profile of you, though it could help to refine models of demographic segments.
There’s an old adage online that if you aren’t paying for a product, then you are the product. That’s why—as frustrated as consumers get with the fact that websites track them so that data brokers can make profiles—we have collectively refused to pay for online media, so this online tracker dystopia is somewhat of everyone’s making.
On the other hand, consumers do pay for mobile phone services, they pay an awful lot, in fact. Shouldn’t they expect the companies they subscribe to to do them the courtesy of not turning them into a product anyway?
Disclosure: Donald Trump is the father-in-law of Jared Kushner, the publisher of Observer Media.
