The Atlantic:
The TV is on in the background, and you’re replying to a quick email on your phone nearby. You don’t know it, but the devices are communicating. During a commercial, the TV emits an inaudible tone and your phone, which was listening for it, picks it up. Somewhere far away, a server makes a note: Both devices probably belong to you.
…
But a newer method of cross-device tracking wanders into the realm of science fiction. According to a filing from the Center from Democracy and Technology, a digital human rights and privacy advocacy organization, companies have figured out how to use inaudible sounds to establish links between devices.
…
The creativity displayed by SilverPush and its peers has raised privacy concerns. The company’s audio-based tracking method is far more accurate than most ways advertising software quietly follow Internet users, because it takes the guesswork out of the device-matching process, says Joseph Lorenzo Hall, the chief technologist at the Center for Democracy and Technology.
…
When it comes to audio beacons, Hall says he’s not just worried about marketing companies tracking average consumers—he thinks their techniques could be used by governments for surveillance. For example, if a group of dissidents in a country like China were to meet in secret, their phones might pick up a government-planted ultrasonic audio signal from a nearby TV. If hidden code on their phones relayed to the government that they all heard the tone, agents could easily tell that the dissidents were associated with one another, and meeting surreptitiously.
To address these privacy questions, SilverPush is in contact with the Center for Democracy and Technology, and Bhatt says his company is “actively engaging with all the stakeholders.”
Cross-device tracking has caught the eye of the Federal Trade Commission, which recently convened a workshop to discuss the technologies and associated risks. Hall said he hopes the FTC will issue guidelines for building transparency and control into cross-device tracking technologies. Next-generation tracking technologies like SilverPush, he says, should be required to meet a “higher bar” of warning users they’re being followed.