A database on Microsoft's Xandr containing 650K+ “audience segments” shows how data brokers classify consumers by surveilling their online and offline activity
A spreadsheet on ad platform Xandr's website revealed a massive collection of “audience segments” …
The Markup
Context & Ripple Effects
The segment list published on Xandr's ad platform extends a reporting arc The Markup has been building since late 2022, when it documented data brokers selling comprehensive voter profiles to campaigns. What was previously inferred from broker marketing materials is now visible as an actual product catalog: 650K+ named segments sitting in the open on a major platform's own site.
It also lands on a familiar failure mode for Microsoft specifically — researchers previously found 80M US household records exposed on a Microsoft cloud service, and the same pattern repeated with an ad agency's database of personal records. The company's ad-data infrastructure keeps turning out to be both vast and loosely guarded.
First-order effects
Advertisers and agencies buying through Xandr now have a readable map of exactly what consumer classifications the platform sells — including segments built from offline activity, not just browsing behavior.
Data brokers supplying these segments face reputational and compliance exposure — their taxonomies are no longer private sales collateral but public evidence of how consumers are classified.
Third-order effects
If platform segment catalogs keep leaking into public view, they become raw material for regulators assessing data-broker practices — turning ad-tech targeting from an opaque market into something auditable against privacy rules.
The recurring pattern of sensitive ad-targeting surfaces at Microsoft and Google suggests industry self-policing is structurally unreliable, strengthening the case for external enforcement rather than platform policy documents.
The trend: Ad-platform targeting inventories are being dragged from opaque sales catalogs into public and regulatory view, one exposed segment list at a time.
My latest for @themarkup: — We reveal a spreadsheet of 650,000 advertising audience segments found on Xandr's (Microsoft) website full of thousands of sensitive segments relating to medical conditions, mental + reproductive health, sensitive locations and more. …
In this thread, I want to share some additional details about what the file from Xandr/Microsoft, which was reported yesterday (https://t.co/...), reveals about how hundreds of consumer data brokers trade personal information on billions of people at a global level.⬇️
Several data brokers including Epsilon (owned by French Publicis), Nielsen (UK), Neustar (TransUnion), Eyeota (Dun & Bradstreet), Oracle, Experian, LiveRamp sold lists of ‘union members’ via the Xandr data marketplace. ...which is highly problematic, not just under the GDPR. [ima…
Interesting piece from @themarkup about @xandr targeting techniques. It seems most people outside of the #AdTech world discover fire when they are shown targeting practices that are commonplace. The industry itself must be more educative with the public. https://themarkup.org/...
A key reason we opposed #Microsoft #Activision merger was #xandr—part of @Microsoft expanding commercial #surveillance for marketing. #Gaming & #Gamers will be a key place to collect & target via this data. #privacy #competition #consumers #FTC #health https://themarkup.org/...
Spent one more hour to extract a number of segments that are related to casino+online gambling. Several data brokers sold lists of gamblers in many different countries via Xandr, e.g. US/EU/UK, Brazil, Columbia, Chile, Japan. One company explicitly sold data on gambling addicts. …
Some more examples from my own analysis of the file. Xandr (re)sold lists of ‘disabled’ people and of the ‘poorest 10% of the nation’, payday loan prospects, people with ‘poor’ credit level, ‘poor’ income, ‘very poor’ financial stability, ‘chronically poor health caregivers’. [im…
The file is dated May 2021, but was available on the Xandr website until last week, when Microsoft who didn't respond to any media inquiry, took it offline. We don't know which segments they sell today. Microsoft still lists 63 data providers on the site. https://docs.xandr.com/.…
The effort by the online ad industry to closely target people, as in the segments file reviewed by @themarkup, constitutes “one of the greatest threats to data privacy” today, EFF's @Adam_D_Schwartz said. https://themarkup.org/...
The labels given & tracked: violating #privacy & inaccurate .... From “Heavy Purchasers” of Pregnancy Tests to the Depression-Prone: We Found 650,000 Ways Advertisers Label You - The Markup https://themarkup.org/...
Bravo @WolfieChristl. See coverage by The Markup's @jonkeegan here https://themarkup.org/... See 24mb excel sheet of 651,463 “audience segments”, including people's health conditions, religions, etc. https://web.archive.org/...
The ad industry surveils users behaviour on/offline to classify them in ‘segments’ which can be sold to advertisers. This process includes observation and inference on sensitive health, political and financial data. @WolfieChristl found the dirt: https://themarkup.org/...
In a rare look at just how deep (and weird) the rabbit hole of targeted advertising gets, we found 650,000 ways the digital ad industry labels you. And we've made it easy for you to explore the data: https://themarkup.org/...
A while back, I stumbled upon a file I consider the largest piece of evidence revealing how hundreds of data brokers trade personal data on everyone, including very sensitive data, globally. Massive investigation by @themarkup and German @netzpolitik_org: https://themarkup.org/..…
There are ways you can prevent companies from tracking you (insert https://themarkup.org/...) and avoid ending up in these segments in the first place. Or, if you are already being profiled and curious about your results, there are a few things you can do: https://themarkup.org/.…