What does the BBC know about me?
The BBC has recently decided that they will no longer let me listen to any of their radio stations on Radioplayer, a product they funded (and I worked on in 2009, convincing commercial radio to go with it). Instead, I have to download the BBC Sounds app.
Having seen the data Google has about me, and the same from Apple, and the same from Twitter and from Spotify, I wondered, what information does the BBC have on me (in terms of my consumer BBC account, rather than any ex-employee information, obviously).
I left the UK in 2015, but this account is still a UK one, and I occasionally use a VPN to access BBC content. I’m not a very big user of the BBC, so there won’t be much here. But let’s see.
Finding my data
“But the plans were on display…”
“On display? I eventually had to go down to the cellar to find them.”
“That’s the display department.”
“With a flashlight.”
“Ah, well, the lights had probably gone.”
“So had the stairs.”
“But look, you found the notice, didn’t you?”
“Yes,” said Arthur, “yes I did. It was on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying ‘Beware of the Leopard.”
- The Hitchhiker’s Guide to the Galaxy by Douglas Adams, first broadcast on the BBC in 1978
The BBC has a “request all my data” form which is in your BBC Account page. Finding that, however, is easier said than done.
The way you’d find it is by following the link on the BBC Account page marked “Your privacy and the BBC” (more strictly, the text saying “Find out more” which is the only hyperlinked bit).
This takes you to an entirely different website, called “Keeping your info safe and sound”.
Find the link marked “What are my rights?” (it’s a link this time, not a heading with a “find out more” hyperlink under it, and you’ll know it’s a link because it changes to look like a link when you hover your mouse over it, unlike the headers, which look identical even though they aren’t links).
Ignore the left-hand navigation — it won’t help you here. Instead, in the main body of the article, click the blue button marked with a link symbol that says How can I see what information you have about me? (it would be churlish to point out that this is the third different style of link in as many pages, but I will anyway).
This then takes you to a page that has a link (a fourth style of link this time: an underlined passage of text) saying that “You can request this information from your account settings.” Click that.
This then takes you, in all probability, to a login screen again. Log in, because you’re nearly there… and here’s the hitherto invisible information request form. There’s a button to press to request the information. I pressed it.
As a starting point, this doesn’t strike me as an organisation that cares as much about my privacy as you’d hope.
(I should point out that, while I used a UK VPN for the above, and a UK account, I was still served the international header; so it might be that it’s easier to find this form within the UK; but if that’s the case, I don’t understand why.)
What the data says
I got the link to my data within nine hours of asking.
The BBC sends seven .csv files (which open in Excel, etc). Let’s see what I get.
“Notifications” only tells me about one web notification that I was sent in 2017. This is incomplete: I’ve since used BBC Sounds on iOS and Android, which occasionally sends me notifications for things.
Here, “appsflyer” — a marketing company — was the funnel from which I downloaded BBC Sounds in 2022. I install it irregularly; but I can tell you that I installed it (on Android) in early July to listen to Paul McCartney at Glastonbury. This event isn’t it, and is probably putting it onto my iPad, hitting a “sponsored” button in the App Store instead of a native one.
“BBC Account Information” contains the personal data I’ve told the BBC (and any change to it). It knows which Parliamentary constituency I apparently live in, as well as which BBC region I’m in — and apparently my sociodemographic category is “comfortable communities”, my sociodemographic group is “steady neighbourhoods”, and my sociodemographic type is “established suburbs, older families”. It tells me that I registered in 2009, but last updated it in 2018.
“Interaction” is every piece of media I’ve played, on iPlayer (for TV), and BBC Sounds (seen here as iPlayerRadio). It goes back to 2017.
Here’s where the BBC served me “Mrs Browns Boys” as a recommendation. I don’t think much of their date/time stamp (looks like just a time), and there seems no information here as to why I was recommended this, or, more importantly, whether I did anything with it. I suspect this report is broken.
Then, finally, the “activity” files are 2,865 lines of every web page I’ve visited, every video I’ve watched on iPlayer or listened-to in BBC Sounds. It contains details of what I visited using (Android 13.x, Chrome Mobile 108.x, Google, Pixel 6 Pro, 3120x1440), what ISP I was using (Aussie Broadband Ltd), what my current city, region, country and continent is (“Bridgeman Downs”, Queensland, Australia, Oceania — Bridgeman Downs is 15km away from where I really live).
The news website is either called GNL_NEWS or PS_NEWS (Global News Limited or Public Service, i.e. whether it’s the .com or .co.uk variant), though notably BBC Sounds is always marked PS_SOUNDS.
A ten-minute look through BBC Sounds (listening to a selection of Lisa Tarbuck going into the news) kicked off 101 events.
Going to read one page on the BBC News website seems to have kicked off 15 events, from 7.12am to 7.17am (UTC), so they know how long you read a story for, though they don’t appear to be monitoring scrolling activity.
Does this contain what the BBC Sounds app does?
I ran the BBC Sounds app (on iPhone) through a man-in-the-middle proxy, so I could see the data requests that were being made.
I was attracted to the many calls to different BBC domains; but noticed another domain being called the most: logw363.ati-host.net. The company that runs it is Applied Technologies Internet SAS; and this server is behind Amazon Cloudfront. The company, based in France, runs a product called “the Analytics Suite”, which was once called XiTi.
As seen above, it’s surprisingly chatty.
As not seen above, it’s even surprisingly chatty even if you’re not using the app.
Here, I’d been listening to BBC Radio 4, but had stopped listening a while ago. I had jumped out of the BBC Sounds app to transfer the proxy stats, and then turned the screen off. My iPhone was quiet, the screen was off, it was sitting on my desk, while I was typing on my desktop.
Yet, every minute, a little ping of data was going back to the BBC’s analytics partner.
Let’s deconstruct one of these. Here’s the data it sent at 20:56:53, which I’ll make a little prettier and easy to understand. It, of course, comes with my IP address, too.
s = 5983xx _(perhaps a session id of some kind)_
idclient = 833b14a0–64aa-4c57–9e86–8e10fxxxxxx _(my phone?)_
ess\_success = true
at = oOaObZiB-bQG48qAnvJmF1X\_7jWocBucUgC6uxxxxxx _(this looks identical to my user\_id field a little further down)_
manufacturer = Apple
apvr = \[2.10.1\] _(the version of the app)_
bbc\_st\_live\_ts = 1674903412403 _(the unix timestamp of “now”)_
app\_type = mobile-app
mfmd = \[apple\]-\[iphone10,4\]
auth\_toolkit\_version = 32.0.0
ptag = ios
s2 = 23
dls = ext
p = name=~ptnrID=~pList=bbc\_radio\_fourfm::retType=stream~appN=sounds~appT=mobile-app::mpN=smp-ios~mpV=38.2.3~mlN=echo\_ios\_swift~mlV=6.7.0~devR=::m001hnvg _(in here, you can see mention of BBC Radio 4; m001hvng is resolved to_ [_The Kitchen Cabinet_](https://www.bbc.co.uk/programmes/m001hnvh)_, the programme I first started listening to when I connected half an hour earlier)._
cn = wifi _(I’m connected to wifi, yes)_
ess\_enabled = true
vtag = 2.23.9
ts = 1674903413.142737 _(the unix timestamp of “now”, ten milliseconds later)_
stc = {“lifecycle”:{“dsls”:0,”fsau”:0,”sc”:5,”sessionId”:”CACB0C45–1E0B-4BDA-8085–030EXXXXXXXX",”fs”:0,”dsfs”:0,”fsd”:20230128},”idType”:”uuid”} _(fsd is today’s date)_
type = audio
m6 = live
a = refresh _(action? activity?)_
apid = com.bbc.sounds
user\_id = oOaObZiB-bQG48qAnvJmF1X\_7jWocBucUgC6uxxxxxx
model = iPhone10,4
app\_name = sounds
r = 750x1334 _(This is the resolution of my screen)_
m5 = int
car =
hl = 20x56x53
library\_version = echo\_ios\_swift-6.7.0
bbc\_st\_source\_page = listen
lng = en\_au
os = \[ios\]-\[16.3\]
bbc\_st\_source\_module\_name = listen-live
vc = 1
plyr = 1
vm = optin
Now: that’s when the app is in background, and I’m not using my phone. Leave it long enough, and iOS controls take over: after ten minutes, all data seems to cease, as iOS kills the background process.
When I’m using the app, it’s sending back analytics every second.
The values in the calls from the BBC Sounds app appear to be in a random order each time, which is a bit frustrating for analysis. It seems to capture every click I’m making in the app. Some of the things I can see in the logs are…
- “is_background: false” — am I using the app in the background, or the foreground?
- “action_name: stations-and-schedules” shows what I clicked
- “action-type: scroll” was when, I think, I scrolled through the list of stations at the top
- …and so on.
There’s a lot of data here, all being pumped back into the BBC via this third-party analytics provider. But, to the BBC’s credit, it seems all replicated in the lump of data I was sent when I asked for the data it held on me.
So…?
There’s no doubt that there’s some very helpful data here for someone at the BBC to use to look at my usage and give me recommendations.
The question is whether the data is so useful to the BBC that they insist on removing all other means of consuming their content other than the BBC’s own services. I’m not keen on that, and I have yet to see evidence that the BBC is using this data particularly effectively. But, who knows, perhaps they are doing so.
I’m slightly concerned about the BBC monitoring what news stories I read; and perhaps that’s a little more worrying than discovering whether I’m going back and listening to three minutes of Lisa Tarbuck for journalistic purposes. But the data is certainly less invasive than Twitter, Spotify or Google’s data on me.
Either way, this certainly beats asking fewer than 0.2% of the population to write down if they listened to a radio station; or 0.0008% of households to monitor their TV viewing, which is how they get their data now. (Yes, really.)