“Recommended for you”: Data privacy and the algorithms used by popular streaming platforms

Content overload: In today’s digital environment we have all come face to face with it. This phenomenon is especially prevalent on streaming platforms, like YouTube, TikTok or Spotify. To guide users, these platforms use recommendation engines – or algorithmic filtering technology – to curate content and make suggestions for us. But in this process of automating content recommendations, is user data being protected, or infringed upon?

It’s become so ubiquitous as to go almost unnoticed – we launch our favourite video or audio streaming platforms, and are instantly provided with a plethora of recommendations for content we are supposed to be interested in. 

Getting help curating from the mass of content available seems convenient, even helpful. But what is really happening behind the scenes of these seemingly benign recommendation engines? Are they really just serving up the content we are most likely to be interested in – or is something more pernicious happening? And what are the privacy risks to our personal data?

At the heart of these streaming services are AI technology and machine learning – more specifically, algorithms – that compile data about our viewing habits and choices, and then launch a series of automated decision processes to make content recommendations for us.

The process is triggered when we register on a platform as a user. We fill in information in our profile about our particular tastes. Along with these stated preferences, our actual consumption habits then leave a mass of digital traces, data that the streaming platforms’ algorithms cross-reference and apply content filtering to, in order to present us with what is most likely to interest us.

Destiny Tchéhouali has long been concerned about the protection of personal data of Canadians. Tchéhouali is a professor of international communication in the department of social and public communication at the University of Quebec in Montreal. But it is his role as the president of the board of directors of the Internet Society of Quebec that got him interested in how streaming platforms might rub up against existing data protection laws in Canada.

With funding from the Office of the Privacy Commissioner of Canada, Tchéhouali led an applied research project called “Alter Algo: Are algorithms really our digital alter egos?” The team aimed to understand how Canadians perceive the content recommendation systems of major streaming platforms, and to analyze the confidentiality policies of these systems to see if there are any loopholes, particularly for getting around current regulatory and legislative frameworks. In the process, the team also aimed to document the profiling practices of streaming video and music platforms, demystify machine learning, and see if artificial intelligence improves the diversity of what users consume.

“To our knowledge, there was no research contributing to information about how Canadian citizens perceive the risks associated with these content recommendation processes used by streaming platforms. We wondered if the algorithms really are our ‘alter egos’ in the digital environment – thus the play on words in our project’s name – and, if so, do these alter egos respect our privacy or invade it?”

Research process

The team started by taking a close look at the current research on algorithms and quickly found that it did not typically include investigating their impacts on privacy. Nor had much research been done on privacy practices of music or video sharing platforms.

The team conducted a comparative audit of the confidentiality policies of each platform, focusing on their general terms of use, to see if they respected or conflicted with data collection processes and treatment as recommended by the current legislative framework in Canada.

Another key research objective was to assess the trust that Canadian users place in these content recommendation processes and in streaming platforms.

“It was important for the team to get the real story because there is very little data in the research literature about how people feel, if they feel safe, and if they worry about how their data is being exploited online.”

The team organized a workshop, inviting a panel of thirty participants who are self-described users of streaming platforms in Canada, and interviewing them about their knowledge of the digital traces they leave on streaming platforms, and how their identity and digital data may be exploited by the platforms that recommend content. This set of initial questions formed the basis of a larger survey of 3,000 adult Canadians aged 18-years-old and over, all users of streaming platforms.

The last pillar was interviews with experts in digital environments, data protection and privacy, including Canadian and European experts familiar with either Canadian or European data protection regulation, to establish some comparisons with our legislative framework in Canada.

Results

“Echo chamber” and a “dictatorship of popularity”

According to the research, the platforms did not generally deliver to content users what they said they were interested in, nor did they deliver content based on viewing history. Instead, the recommendations tended to be based on popular content liked by most people (i.e., “Most Popular” or “Top Views” in Canada), creating a kind of “echo chamber”.

This “echo chamber” became even more pronounced when platforms like Netflix moved from more nuanced ratings system to the more binary “thumbs up” and “thumbs down” approach.

“The algorithms create ‘maps’ of user tastes, put all the users in categories, and the engine sends standardized recommendations. It is no longer possible to make nuanced choices. For example, if you go on Netflix you'll find the Top Views in Canada, and these do not correspond to individual tastes and preferences, but are based on what content users have watched in Canada. This ends up creating a ‘dictatorship’ of popularity, while the preferences of users are not being taken into account.”

Content recommendations lack diversity; few suggestions for regional content

Users agree to provide their personal data and share their tastes because they hope to be recommended content that matches their preferences. While the team found it was not difficult for users to find generic content, it was challenging for them to access content with a regional flavour, for example, from Quebec – even though these users reported that when they signed up for the platforms, they stated they wanted to consume local Quebec content.

“When we dig a little deeper, there is a real gap between matching user tastes and identified preferences with recommendations made, with at least 21% of Canadian users saying that they don't feel better guided in the choices they are presented with, and that bothers them.”

“Although 53% of the 3,000 people surveyed said it was easy to find generic content they like on streaming video platforms, and 49% on audio platforms – when it comes to Quebec, only 30% of Quebecers think it's easy to find content from Quebec on streaming video platforms and 36% on audio platforms.”

Users report being resigned to the situation because they feel they cannot change the algorithms or the way they function.

Personal data and consent

While many users are aware that their browsing history allows the platforms to suggest content, and some users don’t seem to mind, quite a large percentage do not believe they have freely consented to allow this. This raises a number of questions about how the notion of free and informed consent is being defined vis-à-vis streaming platforms.

“In our survey of 3,000 Canadians, we asked if they are aware that their browsing and viewing history allows the platforms to suggest content. 15% of users are not aware that all the data they leave online can be used for recommendation purposes on the platforms. At least one third, or 35%, are aware of this, and report not being not bothered by it.”

“However, when we asked if they freely consented to their browsing history being used for personalized content recommendation purposes, 40% of respondents said they don't think they freely consented. 27% said they do not know how to define the notion of free consent – they asked, ‘is it just through the box that is checked when agreeing to make my browsing history and usage data usable by the platform’?”

Feeling watched

Some users report that they tend to be less aware of their privacy concerns because they are focused on the recommendations they see on the screen.

But, according to the survey, at least one in three Canadians has the impression of being watched some of the time, with one in two saying they feel watched most of the time. For example, soon after having a discussion with a friend on Facebook or WhatsApp, they soon receive advertisements or recommendations on similar subjects.

“There is a real feeling of being watched as we share our personal information, and that this information is quickly being instrumentalized. Our research concluded that there are obvious communication channels between these platforms and tacit agreements for advertising channels to reuse the platform data for purposes other than for making recommendations.”

Resignation effect

As part of the survey, the researchers provided numerous examples that show that users’ personal data is utilized for other purposes, but users tended to trivialize the impacts and the scope – as long as they had not experienced a direct privacy breach involving their own personal data. However, they did report wanting a stronger legal framework to help protect their information.

“Participants seem resigned to their data being used, but when they were asked if they are ‘sensitive to the issue of personal data protection following incidents revealed during the last few years in relation to streaming platforms,’ 57% indicated they are sensitive, and would like to see the adoption of laws and a stronger legislative framework to make their personal information safer.”

But ultimately, users are not ready to give up their subscriptions even in the face of privacy breaches. While 40% of survey respondents said they “would unsubscribe if there is a very serious breach related to Netflix or Spotify”, the research team noted that recent scandals involving Facebook and Cambridge Analytica did not result in a wave of platform unsubscribes.

“Users will still adopt these platforms because they feel they are essential for their daily lives. And so what happens is the ‘resignation effect’. People do want to be educated about the issues and become more aware, but they also wonder what they can concretely do to protect themselves against those who deploy these algorithmic mechanisms, which continue to control our consumption choices and exploit our data.”

Report recommendations

Empowering users and “educating” algorithms

The study’s recommendations call for technical as well as regulatory solutions. The research team argues that users can be "empowered" to control their own data.

“It is clearly demonstrated in our review of the literature that 'machine learning' and even deep learning algorithms can make it possible for there to be a new generation of algorithms that observe a certain neutrality with respect to the processing and use of data.”

“It is possible to put these algorithms at the service of users so they can act based on certain parameters. For example, a theory has been developed by several researchers and authors who speak about the ‘playability’ of algorithms; that is, the capacity to make algorithms easy to control not only by the designer, but also by the final user, who through a kind of reverse engineering could set specific criteria for the algorithmic usage of personal and usage data to make recommendations.”

If users have the ability to “educate” algorithms, it will allow them to make diverse content choices and receive a diversity of content recommendations, instead of being subject to the monetizing imperatives or business model of the platforms’ owners. This could alter the current trend of automated decision making by making sure end-users are placed at the heart of the design of criteria and parameters driving the recommendations that algorithms suggest.

Improving cultural diversity and legislative tools

The team underlined the importance of increasing the transparency of the platforms’ privacy policies and the ways in which the collection, processing, use, and communication of personal data are being carried out by these platforms.

“Regulators and legislators are challenged with adapting to technological advances. Nevertheless, there are several studies that document existing flaws in the legislation, and we can begin to close these gaps by trying to be more demanding with respect to what we expect from these platforms.”

“This is necessary if we want to increase the control citizens have of their personal information and improve informed consent.”

They also recommend finding ways to promote cultural diversity. In Canada, for example, streaming platforms could be required to serve up a minimum number of recommendations for Canadian content.

Last, but not least, more pressure should be applied through a set of legislative tools, to make sure platform companies are not able to find loopholes or circumvent the provisions of the law.

“Platform owners usually defend themselves by saying that they respect the law. But we know that violations happen and that many of these platforms are not respecting the legislative guidelines that have been imposed on them.”