The recent furore over tracking mobile phones is a warning of what happens when sensor data goes too public. Over the past week first Apple and then Google have been caught capturing location traces from users’ phones without their knowledge or consent. The exposure has been replete with denials and nuanced responses — and indeed a not-so-nuanced response purportedly from Steve Jobs. This is almost certain to end up in court, especially in Europe. The details, both technical and managerial who-knew-what, are still unclear. It’s just about possible that one or both cases were caused by over-enthusiastic engineers without management approval, and we should of course suspend judgment until more details emerge. We can, however, explore possible motives. The Apple case involves tracking a phone over a protracted period of time and storing the resulting trace as GPS co-ordinates in an unencrypted file. This is invisible to “normal” users, but is visible when a phone has been “jailbroken,” and is sync’ed with the user’s desktop. As soon as the story broke there was an application available for Macs to overlay the trace onto a map. We did this with a colleague’s phone, and the trace goes back around a year. In places it’s surprisingly accurate; in others is shows clear signs of distortion and location artifacts. Apparently Google Android performs similar tracking, but over shorter periods and with the results stored less openly. It’s not quite clear whether the tracks recorded in either handset are forwarded back to their respective mother-ships, but that’s certainly a risk. In the Apple case, traces are collected even if location-based services have been switched off at the application level. It has to be said that this whole affair is something of a disaster, both for the companies concerned and for location-based and pervasive services in general. What the fall-out will be is unclear: will people move back to “dumb” phones to protect their privacy? Experience suggests not: the convenience is too great, and many people will conclude that the loss of privacy they’ve experienced, though unacceptable per se, is insignificant compared to the overall benefits of smartphones. Indeed, if one were being particularly conspiracy-minded one might suspect that that the whole affair is a set-up. Management (one might argue) must have known that they’d be found out, and so made sure that the tracking they were performing was benign (no transmission back to base) so that, when the story broke, people would be momentarily offended but afterwards would be inured to the idea of their phones tracking their locations (it happened before and had no bad consequences, so why worry about it?) even if those traces were later pooled centrally. To a company, some personal data is so valuable that it’s worth risking everything to collect it. The reason location traces are important has nothing to do with the exposure of the occasional adulterer or criminal, and everything to do with profiling and advertising. Big data isn’t just lots of small data collected together: it’s qualitatively different and allows very different operations to be performed. A smartphone is a perfect personal-data-collection platform, being ubiquitous, always-on and increasingly used to integrate its owner’s everyday life. The Holy Grail of mobile e-commerce is to be able to offer advertisements to people just at the moment when the products being advertised are at their most valuable. Doing this requires advertisers to profile people’s activities and interests and respond to subtle cues in real time. Imagine what a trace of my every movement does. It can show, to first order, how often I travel (and therefore my annual travel spend), what I see, and how I see it. Combined with other information like my travel history, booking references and internet search history, it can show what I’m interested in and when I’m likely to be doing it to a surprisingly high accuracy. It can identify that I commute, my home and work locations, my commute times and other routines. If I travel with other smartphone users it can identify my friends and colleagues simply from proximity — and that’s before someone mines my social network explicitly using Facebook or LinkedIn. Now consider what this profile is worth to an advertiser. Someone with access to it, and with access to the platform on which I browse the web, can inject advertisements tailored specifically to what I’m doing at any particular moment, and to what I may be doing in the future. It can offer distractions when I’m commuting, or offers for my next holiday before I leave, and group discounts if I persuade my friends to join in with some offer. Basically a location trace is almost incalculably valuable: certainly worth an initial bout of injurious comment and lawsuits if it leads to getting hands legitimately on that kind of data. With spam email one needs response rates in the fractions of percent to make a profit: with access to a detailed user profile one could get massively better responses and make a quite astonishing amount of money. Location tracing, like loyalty cards, gains most of its value from information asymmetry: the data provider thinks that a few vouchers is good value for the data being given away, even though the actual value is enormously more than that. If you’re not paying for the product, then you are the product. It’s not necessarily dystopian, may lead to better services, and may in fact be the price we pay for keeping basic services free on the web given the unexpected lack of many other business models. But it’s not something to be given away for free or without consideration of where and to whom the benefits accrue, and what a properly constituted fair trade-off would be.