Data is the nuclear waste of the web and machine learning, Ghostery CEO Jean-Paul Schmetz tells me in the TechFirst podcast. And big tech is redefining privacy to suit their business and cut out their competitors … not to actually deliver privacy to people.
Today, our identities are as much digital as physical, maybe more. We are where we surf, what we watch, the apps we use, the games we play, the people we engage with on social.
(Subscribe to my YouTube channel)
So privacy is a big deal and getting bigger. That’s true legislatively, especially in Europe, but also technologically. Big tech has been very eager to share how privacy sensitive it is: Apple has molded its whole brand around privacy, introducing App Tracking Transparency, and Facebook is keen to say you can trust us now … we’re Meta. Google is introducing Privacy Sandbox for web and Privacy Sandbox for Android, and killing the third-party cookie … the bit of data that websites you DON’T visit can put in your browser and track you around the web.
But they all have their own definitions of privacy, which often don’t mean you giving them less data … just their competition. And Ghostery says that Google’s Manifest V3 update to Chrome will break anti-tracking and ad-blocking services.
Check out my story on Forbes here, or keep scrolling to subscribe to the TechFirst podcast or get a full transcript of our conversation.
Subscribe to TechFirst: data as the nuclear waste of our information age
Apple Podcasts
Spotify
Google Podcasts
Overcast
Other podcasting platformsTranscript: Ghostery CEO Jean-Paul Schmetz on data, privacy, and big tech
(This transcript has been lightly edited for length and clarity.)
John Koetsier: Welcome! Let’s start with Ghostery. I think a lot of people know of Ghostery, but what do you do?
Jean-Paul Schmetz: Well, so Ghostery is primarily an extension to your browser, and what it primarily does is to make this invisible world of trackers visible to you so that you can see who is getting information from you as you load webpages.
And obviously, because we’ve never met anyone who sees this information and doesn’t want to immediately stop it, we offer to block these trackers. But there’s a high level of granularity, so you can choose to trust some websites and let them have everything, and you can also block all the trackers all the time.
But our prime philosophy is to make it visible so that you know that it’s there. Because the only way tracking can work in this world is by making it invisible because no one would ever tolerate it if they had the same intuition that developers and advertisers have.
John Koetsier: It’s been a while since I’ve done it, but I remember going to Ghostery, and I think you have a service or a little thing you can do on your website and you can see which trackers are tracking me, you know, if you do this search or you go to that website or something like that, and it literally is shocking. It literally is shocking. We’re talking hundreds in some cases, which of course is entirely invisible to most people.
Jean-Paul Schmetz: Yeah.
John Koetsier: So, let’s talk Big Tech a little bit. Last couple years they have been all hot about privacy, privacy, privacy. Why is that?
Jean-Paul Schmetz: Well, I think first of all, when GDPR came out in Europe, everyone was forced to send an email to their customers and they always started by saying, “Your privacy is important to us.” So it’s, you know, obviously everyone has to talk about it.
Every Big Tech company has to talk about [privacy], and they took the approach of redefining the term to fit their own purposes.
So if you look at Meta or Facebook, it’s about controlling which friend sees what picture, but no one ever talks about what Facebook gets to see. If you talk about Apple, this is a little bit like, you know, your device is your device, so it’s still very much a 1990s device company. So they save a lot on the phone and that, up to a point, it’s true. They have a claim to privacy that is a little bit better than the others. And Google is more like a bank saying, like, “If you put all your data on our servers, you’ll be safe.” Right?
John Koetsier: [Laughing]
Jean-Paul Schmetz: It’s actually better than keeping it under your mattress, which will be your browser, etc. So they’re all redefining privacy to their own benefit in a lot of ways. And they can, they have reached a point where they can all say that they care about it.
John Koetsier: Mm-hmm.
Jean-Paul Schmetz: But obviously, I think privacy should be defined from the perspective of the user, right? It’s just, that’s the only perspective that actually counts.
John Koetsier: Maybe dive into that just a bit more, because that is interesting, right? If you see app-tracking transparency from Apple… Apple’s been very keen to define privacy as not sharing data to other parties, like a company getting data and then sharing it to others. They’re not defining it as collecting data, which, somebody… if an app is collecting data, in this case on iOS, that’s fine. That’s not violating Apple’s privacy policies. And you talked about the other tech companies as well. So, you said it should be defined from the individual… what’s that mean?
Jean-Paul Schmetz: Well, what I like to do is to try to create a picture of how the data collection would look like in real life and ask people if they would be comfortable with it, right? And if you take a look at the browser… and application apps are really like a browser that you cannot observe like you can in a normal browser because they’re kind of close to you, but they function essentially the same ways.
Imagine you would go to a store and there would be, you know, 40 guys with black suits and little headphones recording everything you do, “Oh, he picked up that product, he put it back on the shelf, he bought it,” right?
John Koetsier: [Laughing] I’m seeing an Apple commercial here.
Jean-Paul Schmetz: And then you go to the next store, it’s the same people following you around. And then you go to the movie theater and the guys are sitting with you. I mean, you wouldn’t tolerate it, right? I mean, first of all, you’d be freaked out and then you… probably some people would get beat up pretty soon and then the police would come, right?
John Koetsier: [Laughing]
Jean-Paul Schmetz: But this is what’s happening online, right? It’s just not different. And they record, I think, one of the things that you may want to look at, we have something called WhoTracks.Me which gives you the information that you just mentioned earlier, like these sites have these trackers and these trackers are on these sites.
And there was a report by the ICCL, the Irish Console of something, something — which we should put a link to — where basically it was shown that every American is exposed 750 times per day on average. So some data points are being leaked about every American 750 times a day, and Europeans are at 360, right, 360 times a day. So, probably it’s a success of GDPR, but it’s still 360 way too many, right? Because, like you don’t need 750 data per day, you also don’t need 360 data per day.
And this is the problem is that if the analog world would work like the digital world, people would simply not tolerate it. There would be zero discussion. There will be zero people saying, “Oh yeah, but that’s okay,” right, like, “that’s fine.” And in the real world, you have choice. Like, if you give your… you can pay cash, so obviously people cannot track your purchase. If you pay with credit card, then maybe some people can. If the cashier asks you for your zip code, you can also say no, right?
But in online, all of these things do not occur or they’re made super annoying by pop-ups and all sorts of consent that make no sense, right? And I think that for us, it’s to try to give people this intuition about what’s going on and the ability to simply block it.
John Koetsier: Let’s take it up a little higher level from the individual. What’s at stake in this whole privacy sweepstakes? What’s at risk? Obviously you’re right, we wouldn’t tolerate this in “real life.” Digital is also real life, but yes, I totally understand what you’re saying, meet space, physical reality.
Jean-Paul Schmetz: Exactly.
John Koetsier: But we’ve also seen that when companies collect data at scale they have influence, they have political influence potentially. What do you see at stake societally?
Jean-Paul Schmetz: I think, first of all, data, I mean, it’s interesting to look back at the history of Google and they were collecting a lot of data about the web and very little about the users, right, and they were personalizing very little. So I think the core culprit of the whole thing has been advertising for sure. This idea that targeted advertising is a lot more efficient than advertising used to be. I’m not a hundred percent sure the evidence is there, but you know, of course, more companies I guess it’s better.
When the data was collected, obviously that fueled the whole revolution of machine learning, which is truly a good thing. But in every use case of machine learning that I’ve seen up to this day, there is a way to collect the same data in a way that doesn’t expose the user.
But companies very often take the choice of… I wouldn’t even call it convenience, although it is more convenient to simply write data saying “User X has done Y” etc, etc. So it takes a bit more work to make it private, but it is always possible. But obviously you cannot use it for advertising anymore.
John Koetsier: Mm-hmm.
Jean-Paul Schmetz: And I think that at one point companies have decided “Let’s collect as much as we can.” And if you go into these big tech companies, this is often the motto, right? Let’s collect it and we’ll figure out later, and then let’s connect it to the user because it has some advantage for advertising, for A/B testing, etc., etc.
But I don’t think we would be losing that much in advertising or in machine learning if people would collect data in a way that doesn’t automatically expose the life of their users. It’s really possible to do it. We’ve proven it many times, you know, academically, etc. it is doable. It’s just not being done because there is no reason to do it. Neither users nor governments nor anyone else is actually pushing in that direction.
John Koetsier: Mm-hmm. Okay, let’s get to Google. You’re saying that Chrome, the latest version that Google is pushing out, will break anti-tracking services. How?
Jean-Paul Schmetz: So, one thing you have to understand is when you’re an extension to the browser, you have to follow certain rules that are defined by the browsers. The first browser that implemented extensions was Firefox, and they were very open in the sense that for them, it was really important to have this extensibility of the browser and a lot of freedom by the developers to do whatever they wanted. So, it was a very powerful platform. Over the course of the years, this power that you give to extension developers has been reduced and reduced and reduced. I think the first thing we lost was the ability to change the search engine, which on the one hand is good because…
John Koetsier: [Laughing] Why could that be?
Jean-Paul Schmetz: Yeah, well, you know who it benefits the most, but, I mean it’s true that you would go to your grandma’s house and she would be using some weird search engine that has been…
John Koetsier: Alta Vista [laughing].
Jean-Paul Schmetz: Yeah, well, but I mean it would have been distributed to her and someone would make money out of it. But… and over the years, this interface to the browser has become more and more restrictive. And at this point, basically Google is saying, “You cannot modify network requests going out of the browser.” They have a lot of different policies, but the one that you’re addressing regarding anti-tracking basically tell us you can block a request but you cannot modify it.
But if you can only block, what happens is that advertisers and trackers, what they do is they combine a functionality with the tracking so that if you block it, the site doesn’t work anymore. And you cannot remove identifiers like we do at Ghostery to say like, “Look, the web functions as it’s intended to do, it’s just that your IDs are not getting through.”
John Koetsier: Yes.
Jean-Paul Schmetz: Like, remove them and we replace them by the word Ghostery or some kind of word shared by many users so that they cannot identify you anymore.
John Koetsier: So, you can see why Google would want to do something like that, I’m guessing, right? I mean, because if you can modify requests, I mean, just imagine the havoc you could cause, maybe in financial applications or other stuff like that. Would that be a reason why they’re doing something what they’re doing in addition perhaps to blocking anti-tracking?
Jean-Paul Schmetz: I mean, they did a claim that it was making the extension system more efficient, faster, etc. But all extension developers have basically proven that this is not the case, meaning that the really bad cases are still possible. And they’re really not making anything better. So there’s a whole discussion at the moment at the W3C level, to sort of try to convince Google that they’re not really achieving these noble goals, if that’s what they really had in mind.
The truth of the matter is that Google has become a monopoly in browsing, because you know Edge is also using Chromium as a base. Firefox is not as strong as it used to be and gets all its revenue from Google. And Google felt that they can now squeeze the extension ecosystem.
You know, if you look back 10 years, any extension that was really cool, if it was only available on Firefox, Chrome would have to follow suit. And that happened with Adblock Plus, for example, at that time. Because if they didn’t have the extension, then users would simply switch browsers.
John Koetsier: Right.
Jean-Paul Schmetz: But at the moment, switching browsers is not really an option anymore for many people. And so they feel that they don’t need this extensibility of the browser. But my whole point is as extension developer is that if we are not there, then everyone will get the same browser. And this ability to extend this ecosystem to experiment, to provide alternative use case, will simply not be there anymore. Right? And that’s a dangerous thing, because it basically means that any product that Google wants to push will be there for everyone. No one can stop it and there will be no alternatives, right, and that’s just not the web.
John Koetsier: Yeah. Yeah. It’s interesting, I’ll bring it up just briefly, ’cause it’s literally brand new, literally passed this week. Europe passed the Digital Markets Act, and so companies that get defined as gatekeepers — so, large tech companies, often American ones, but not exclusively — but large tech companies that own platforms that others have to get to their customers through, are gatekeepers in some sense. And that will be interesting to see if under DMA, Google won’t be allowed to block those extensions. We’ll have to see, it’s so brand new. There’s so much yet to be determined there.
Jean-Paul Schmetz: I think it’s also difficult for lawmakers to get to that level of details, right?
John Koetsier: [Laughing] Yes.
Jean-Paul Schmetz: So, extensions, etc. But your point of, you explain it very well, there will be platforms in the future. I think we live in a world where digital power will be concentrated for certain things like operating system, browsers, search, etc. It’s nearly impossible that it is not, right? And it is, you know, software is built in such a way that you build on top of something, right, you’ve got to build on top of iOS. You’re going to do something like that.
And I think that the DMA is a very, very first attempt, although it’s a bit directed in a bit different way, but at saying like, what can the platform do? And what can the platform not do? Like, is there a way to have a conversation about the fact that, you know, what is the limit of Apple’s power on its application ecosystem? What is the limit of Google’s Chrome power on the extension? Like, can they really have all the power because they say, “Well, we own the platform so it’s mine and I decide whatever I want…”
John Koetsier: [Laughing] It’s my house. You wanna live in it? Obey the rules.
Jean-Paul Schmetz: Exactly. But, you know, understanding that the user, at the end of the day, they buy your phone and it’s gonna stick with them for a couple of years, they don’t really have a choice anymore, right? So they get stuck in that monopoly. And I think this discussion is going to be super important for the future.
John Koetsier: Hundred percent.
Jean-Paul Schmetz: And we are just a little, you know, and probably no politicians will ever worry too much about extensions, but we are an early sign of these sorts of things, right?
John Koetsier: Yes, those politicians are probably using those browsers that you talked about grandma having [laughing]…
Jean-Paul Schmetz: I wouldn’t say that, but… [inaudible, crosstalk]
John Koetsier: Some coupon site…
Jean-Paul Schmetz: Whatever you like.
John Koetsier: Exactly. So, big thing that Google has been pushing is Privacy Sandbox. Privacy Sandbox for the web, Privacy Sandbox on Android. Thoughts on that?
Jean-Paul Schmetz: Well, I think the core idea behind it is something that I was trying to push at Firefox a decade ago, is we have very strong, very powerful computers so all the data about you could be stored locally. There’s no limit to that. And the intelligence about targeting and machine learning etc. can also run local, right? And you have many different training models, so I think it’s perfectly okay for your device to know you intimately. I mean, why not, right? It’s your device.
It becomes a problem, of course, if there is one company in Silicon Valley that just takes all of this data, puts it in the gigantic machine and has all the data about everyone in one place accessible by every employee, right? That kind of is a big jump, but I’m a real big fan of having this distributed data locally and the targeting download locally. So that’s the good part of it.
The bad part of it is the implementation is how exactly they do it.
And as often with Google, Meta and co. it’s very self-serving, meaning that essentially everyone else loses the ability to do what they do and they keep it, right? They do not need third-party cookies. Google does not need third-party cookies. They have the browser, they have the first-party cookie and they have all consents in the world?
John Koetsier: Yes.
Jean-Paul Schmetz: So they don’t need all of the stuff that competition needs. So it’s quite self-serving for them to remove that, even though it’s philosophically right. But, you know, practically it’s just not the right company to do it and it’s not the right time.
John Koetsier: Let’s go back up a few thousand meters and look at what’s the end game here? Is there one? Are we in an endless arms race against the data merchants? How do you see privacy and digital identity playing out over the next five, 10 years?
Jean-Paul Schmetz: Yeah, I think that, you know, if… this is a bit self-serving regarding Ghostery, but if you have the ability as a user to choose products that reduce or even eliminate the data collection, it just takes enough people to do it for the advertising industry to have to change. Right?
But at the moment, what we have is one company which is the biggest in advertising, is also the biggest in browsers and has the power to essentially destroy all choice in terms of what people can do with the browser.
And that’s not okay. I do believe that as long as people have choice between software, different software achieving the same goal, there will be enough smart ones who will be early adopters and that will evangelize the rest, etc., and the world will adapt. Like, I don’t think it, you know, legislation is okay, but it’s really a last resort in a lot of ways, because if there was a genuine choice, you wouldn’t really need it, right? People would just switch.
And the problem is that the concentration of power in this platform is such that I would imagine that what would do the most for privacy would be a good antitrust regulation rather than a good privacy regulation… if you know what I mean.
John Koetsier: That is really, really interesting because you bring up a super interesting point. The biggest company in ad tech is also the biggest company in browsing, is also the biggest company in search which is intimately connected to what people want, which is extremely valuable data for marketers and advertisers.
And the DMA gives the European Union, by the way, the right to demand that a company divest of products. And, of course, the U.S. has that as well. The U.S. has antitrust acts also. That would be a massive step. That would be a huge step, but that would be incredibly interesting.
Okay. Let’s dial it down and take it to the personal level a little bit. Why is this a space you’re in? Why is this a space you’re passionate about?
Jean-Paul Schmetz: So, my evolution was first as, you know, I was doing web applications or websites as they were called many, many years ago. So that was my way of being digital. And then I became a bit obsessed with browsers and search because they were a little, you know, they were the foundations of all of that, right? So it sounded a lot more exciting and I started to work with companies like Firefox, and Google a little bit.
And at one point, I realized that, because when you do a search engine you have to get a lot of data. And so I was buying data or getting data, and I was absolutely shocked by the data I was able to buy. And, you know, eventually when you build your own search engine, which I did, and now you can try — that’s Brave Search, which is a good browser and a good search engine — you know, we noticed that Google had monopolized all the distribution of search engines by essentially paying all browsers to distribute Google Search.
So you had to build your browser, and when we decided to build the first Cliqz browser, we said, “Well, we’re going to make it private, because we’ve seen the data.” So my… I’m not a privacy freak or anything like that, it’s just that I’m able to build my own tools and I build tools that don’t do, you know, what I consider to be not super great. So the Cliqz browser was there. We closed it down, but the Cliqz Search became Brave Search, and Brave is the kind of browser that lives the philosophy that we had.
But primarily, I would say my motivation is more about building really cool stuff. Just do it in a way that doesn’t create a, what are sometimes called the data sets that are being built are a little bit the nuclear waste of the 21st century, right? Like it’s… nuclear energy is great, but it’s got this problem with waste, and the web and machine learning is great, but it’s got this waste of all this data that has been collected and really should not really be there.
And simple laws could fix that, by the way, like if you say, “Look, raw data cannot be stored for more than three months, period.” I mean, how useful is it anyway for advertising. But the queries that we’ve done in 2010 are still on Google’s server, right? And they’re still linked to our names.
John Koetsier: It’s an interesting point you make about Google paying for the right to be the default search engine on so many browsers… Firefox, also iOS, right?
Jean-Paul Schmetz: Of course, and Samsung browser, and Opera, and everything else.
John Koetsier: I think that payment, and I’m sure it’s pretty hush hush, but I think I’ve seen that that payment to Apple is in the range of tens of billions of dollars annually, like…
Jean-Paul Schmetz: Look, it’s very simple. If you take that payment, and the rumors are, you know, they’re not rumors, actually, it’s pretty clear, like it’s probably touching 14 or something billion, you multiply it by the the price-earning ratio of Apple and you find out what part of the market cap of Apple is basically resting on that. And the Apple should and could… and really should build a search engine, but they will never do it, because they will destroy a massive amount of market cap and just replace it with cost and a long journey, like they did with Apple Maps which took them a long time to get.
John Koetsier: Yes, yes, to get decent [laughing].
Jean-Paul Schmetz: Exactly.
John Koetsier: A long time to come in second.
Jean-Paul Schmetz: Exactly. And so you can imagine that there is zero interest on Apple’s side to do, frankly, what would be great for competition and would be great for everyone. They’re just not going to be able to do it.
John Koetsier: Well, also it’s not in Apple’s strategic interest to build search for the web, really. I mean, they don’t own the web. They own the iOS app ecosystem. So, I mean, which they’re going to lose to some degree. The Digital Markets Act will force them in Europe to allow third-party app stores, but they’ll dig in their heels, they’ll go kicking and screaming. That’ll take a long time and they’ll make it as hard as possible. Yeah. But many things will happen there.
Jean-Paul Schmetz: Yeah.
John Koetsier: Let’s end here. What’s your best advice for people who care about privacy and people who don’t?
Jean-Paul Schmetz: Well, I think for people who care, installing something like Ghostery on all of your browsers gives you a massive plus right away. The web will be faster because you don’t download so many trackers in the background that you don’t see anyway. And if you use it on your phone on Safari, which are available as well, your battery will last longer because there will be less network traffic. So the benefits are immediate and good.
In things that I’m not building myself, a good password manager… very, very important so you don’t use the same password everywhere and then you get your data hacked somehow. And I think just having these two things actually gets you a very, very long way. I would consider it basically sufficient. For people who don’t care about privacy, I would recommend them to take a deeper look to see if they really don’t care.
John Koetsier: Yeah.
Jean-Paul Schmetz: Meaning that, essentially watch a video or something, like get exposed to what tracking really is or read something that gives you the size of it. Because the fact that you don’t see it makes it easy not to care, but it becomes a lot more difficult when you see it, not to care about. And I never met anyone who, after seeing it, say they don’t care. In fact, one interesting thing about Ghostery is that we are heavily used in the advertising industry. So it’s very interesting that advertising people basically are heavy users of Ghostery.
John Koetsier: They know… [inaudible]
Jean-Paul Schmetz: So they know. They know how the sausage is made.
John Koetsier: They’ve seen behind the curtain.
Jean-Paul Schmetz: Yeah. They know how the sausage is made.
John Koetsier: [Laughing] Exactly. Well, Jean-Paul, this has been a lot of fun. It’s been super interesting. I want to thank you for taking some time. I want to thank you for… it’s late in your day, you’re in Munich, it’s got to be 5:30 PM, so… on a Friday, no less. And you actually went the extra step and to make sure that this recording would work, you actually used the Chrome browser. So, I mean like, you know… [laughing, holding up fingers crossed like an X].
Jean-Paul Schmetz: Yes, I will probably deinstall it right after, you know, just clean my computer.
John Koetsier: [Laughing] Exactly. Thank you for your time.
Jean-Paul Schmetz: Thanks a lot.
TechFirst is about smart matter … drones, AI, robots, and other cutting-edge tech
Made it all the way down here? Wow!
The TechFirst with John Koetsier podcast is about tech that is changing the world, including wearable tech, and innovators who are shaping the future. Guests include former Apple CEO John Scully. The head of Facebook gaming. Amazon’s head of robotics. GitHub’s CTO. Twitter’s chief information security officer, and much more. Scientists inventing smart contact lenses. Startup entrepreneurs. Google executives. Former Microsoft CTO Nathan Myhrvold. And much, much more.
Consider supporting TechFirst by becoming a $SMRT stakeholder, connect to my YouTube channel, and subscribe on your podcast platform of choice: