When you click on an ad in sales season, retailers get to harvest your data

Earlier this year, the consumer watchdog fined three retailers, Michael Hill, MyHouse and Hairhouse Online, almost A$20,000 each for advertising “site-wide discounts” that allegedly never applied to all items on the website.

At first glance, this might look like a straightforward case of using allegedly misleading advertising for an economic benefit. Yet the implications go further.

Years of exposure to constant promotions have trained shoppers to chase a bargain, promoting “clickbaiting”: tactics designed to lure consumers into browsing.

Businesses spend heavily to secure the spot on your social media feed, and that investment has to be recouped. The most effective way is through personalised, persistent ad campaigns that quietly push consumers to buy more.

The way these ad campaigns currently collect data leaves consumers exposed. They also feed into broader concerns about overproduction, which in turn drives overconsumption. That benefits the retailers, but it fuels waste.

Bargains and the data you give away

When you click on an ad, whether it is on a brand’s website or its social media feed, you are not just interacting with the campaign. Behind the scenes, these platforms are collecting your data, analysing your behaviour, and using it to shape personalised ads designed just for you.

Australia’s discount season kicks off in November and extends through to January. With Australians ready to consume, buying gifts for family and themselves, marketing teams go into overdrive. They flood websites and social media feeds with discount banners.

Every time a consumer clicks on an ad, they are revealing something about their shopping patterns. This information is collected through data harvesting (gathering user data) and data mining (analysing patterns in that data). The platform records and shares this information with the business to show the effectiveness of the campaign and whether it led to a conversion (a purchase, sign-up, or other intended action).

Behind this, tracking runs much deeper. Ads use “cookies”, which are tiny digital files that remember your browsing activity such as which sites you visit and how often. “Tracking pixels” quietly collect details such as your IP address, geo-location, time zone, and the type of device used. Together, these build a profile that helps predict your preferences and target you with similar ads later.

A long list of companies have access to your data

Advertisers also gather demographic and behavioural data, such as, your age, gender, interests and browsing history. They can tap data from other apps in your phone that share information through “third parties”. This is one of the vaguest terms in privacy policies. It sounds harmless, but usually hides a long list of unnamed companies getting access to your data.

This information creates a pool of bigger data which allows brands to “re-target” consumers, showing the same or related ads repeatedly. This triggers what psychologists call the “mere exposure effect”: the more you see something, the more familiar and trustworthy it feels. Over time that familiarity can nudge consumers towards buying, not because they needed it but simply because they had seen it so often. This subconsciously promotes overconsumption.

Although marketing campaigns are designed to make consumers buy, even if they do not, they still give away something of great value. Every click, scroll, or view generates data that is later used or sold to monetise; shaping targeted advertising, influencing consumer behaviour and creating economic value.

Did we really consent to this?

A government survey in 2023 showed that Australians do not fully understand the data privacy implications.

The Privacy Act 1988 forms Australia’s main legal framework, and is currently under review. But it only applies to businesses with an annual turnover above A$3 million. While most large retailers easily surpass the threshold, what’s less clear is whether the third parties in the privacy policies do.

In Australia, implied consent is often considered sufficient. If a website states in its privacy policy that it collects data, simply browsing the site is considered consent. A site provides little control over individual cookies unless the user manually adjusts their browser settings. Clicking an ad on social media can also be taken as agreeing to data collection.

An example from an Australian online fashion retailer privacy policy.

In Australia, you either do not see a consent box at all or instead encounter a line stating that “by browsing this site, you agree to our privacy policy”. In both cases, consent is implied.

An example of the consent box from an Australian fabric, craft supplies and homeware retailer.

Stricter rules

In contrast, a website regulated under European Union regulations must clearly explain what data it collects. Only essential cookies are active by default. Marketing and tracking cookies are switched off unless consumers actively choose to allow them.

The difference is stark. The EU imposes stricter rules on data ownership, profiling and behavioural tracking, with no tolerance for vague implied consent. In Australia, behavioural tracking and targeted advertising depend on implied consent, typically hidden in lengthy, jargon-heavy privacy polices that few consumers can navigate.

While data privacy laws are still catching up, educating consumers is crucial to helping them understand how their data is used to influence them into overconsuming.

So now you know what really happens behind every click or “agree” button; the question is, will you still fall for the trick?

This article is republished from The Conversation under a Creative Commons license. Read the original article.