By now, internet users realize that they are being tracked online. But what many don’t realize is that every click they make contains information that is sold to advertisers, who wage real-time bidding wars for their attention.

Northeastern doctoral student Ahmad Bashir developed a new technique to discover the extent to which personal data gets funneled to online advertising companies. He discovered that online ad companies communicate with each other to share personal data and that tools designed to protect privacy such as ad blockers are not as effective as users think.

“People don’t always know their info is being sold at real-time,” says Bashir, a fifth-year doctoral student at Northeastern who who has spent the past five years studying the online advertising market. “The system needs to be more transparent, and the users should be aware what is happening with their data.”

He recently co-authored a paper on this topic with Northeastern professor Christo Wilson titled Diffusion of User Tracking Data in the Online Advertising Ecosystem. Bashir and Wilson traveled to Washington, D.C., earlier this month to accept an award at the Future of Privacy Forum, an event for advocates of cybersecurity and privacy issues, and to share their work with policymakers and privacy experts.

Bashir says that when users visit a website, such as Amazon or Google, little bits of information called “cookies” are taken by the website to identify them. Cookies make it so users don’t need to log in to their favorite website every time they visit it. Many internet users know all this by now.

But they may not realize that websites remember more than usernames. Bahir says that websites build portfolios of their visitors based on, say, the items that they purchase or add to their online shopping carts. He says that users are also unaware that third party trackers could be collecting data about the websites they frequent.

All this information is very valuable to advertisers, who don’t hesitate to sell it to the highest paying bidder. In a process known as real-time bidding, says Bashir, advertisers are constantly competing against each other to flaunt their products and services on your screen.

Even the use of Adblock, a popular browser extension that filters out the majority of ads that appear online, does not protect user data from from being sold to advertising companies as much as users think they do. Bashir and Wilson found that advertisers that aren’t blocked by Adblock will still share user data with advertisers that are.

They say that better understanding the extent to which ad companies are sharing user information will help lawmakers create better cybersecurity policies and tools that protect privacy. In the coming weeks, the Future of Privacy Forum will print a digest of summaries of all the award-winning research papers to distribute to policymakers, privacy professionals, and the public.

“This feels special because you can see your work shaping real impact,” says Bashir. “Eventually this paper will be distributed through D.C. and help close the gap between academia and policymakers.”

Their ultimate goal is to make online advertising more transparent, which, they say, will enable users to make more informed decisions about how they choose to protect their personal data.

“The U.S. has a limited patchwork of privacy regulations, coupled with weak enforcement,” says Wilson. “Europe is way ahead of us in this regard. If we can help more people understand, then we create more pressure for policymakers.”

For media inquiries, please contact media@northeastern.edu.