When you click on an ad in sales season, retailers get to harvest your data

Earlier this year, the consumer watchdog fined three retailers, Michael Hill, MyHouse and Hairhouse Online, almost A$20,000 each for advertising “site-wide discounts” that allegedly never applied to all items on the website.

At first glance, this might look like a straightforward case of using allegedly misleading advertising for an economic benefit. Yet the implications go further.

Years of exposure to constant promotions have trained shoppers to chase a bargain, promoting “clickbaiting”: tactics designed to lure consumers into browsing.

Businesses spend heavily to secure the spot on your social media feed, and that investment has to be recouped. The most effective way is through personalised, persistent ad campaigns that quietly push consumers to buy more.

The way these ad campaigns currently collect data leaves consumers exposed. They also feed into broader concerns about overproduction, which in turn drives overconsumption. That benefits the retailers, but it fuels waste.

Bargains and the data you give away

When you click on an ad, whether it is on a brand’s website or its social media feed, you are not just interacting with the campaign. Behind the scenes, these platforms are collecting your data, analysing your behaviour, and using it to shape personalised ads designed just for you.

Australia’s discount season kicks off in November and extends through to January. With Australians ready to consume, buying gifts for family and themselves, marketing teams go into overdrive. They flood websites and social media feeds with discount banners.

Every time a consumer clicks on an ad, they are revealing something about their shopping patterns. This information is collected through data harvesting (gathering user data) and data mining (analysing patterns in that data). The platform records and shares this information with the business to show the effectiveness of the campaign and whether it led to a conversion (a purchase, sign-up, or other intended action).

Behind this, tracking runs much deeper. Ads use “cookies”, which are tiny digital files that remember your browsing activity such as which sites you visit and how often. “Tracking pixels” quietly collect details such as your IP address, geo-location, time zone, and the type of device used. Together, these build a profile that helps predict your preferences and target you with similar ads later.

A long list of companies have access to your data

Advertisers also gather demographic and behavioural data, such as, your age, gender, interests and browsing history. They can tap data from other apps in your phone that share information through “third parties”. This is one of the vaguest terms in privacy policies. It sounds harmless, but usually hides a long list of unnamed companies getting access to your data.

This information creates a pool of bigger data which allows brands to “re-target” consumers, showing the same or related ads repeatedly. This triggers what psychologists call the “mere exposure effect”: the more you see something, the more familiar and trustworthy it feels. Over time that familiarity can nudge consumers towards buying, not because they needed it but simply because they had seen it so often. This subconsciously promotes overconsumption.

Although marketing campaigns are designed to make consumers buy, even if they do not, they still give away something of great value. Every click, scroll, or view generates data that is later used or sold to monetise; shaping targeted advertising, influencing consumer behaviour and creating economic value.

Did we really consent to this?

A government survey in 2023 showed that Australians do not fully understand the data privacy implications.

The Privacy Act 1988 forms Australia’s main legal framework, and is currently under review. But it only applies to businesses with an annual turnover above A$3 million. While most large retailers easily surpass the threshold, what’s less clear is whether the third parties in the privacy policies do.

In Australia, implied consent is often considered sufficient. If a website states in its privacy policy that it collects data, simply browsing the site is considered consent. A site provides little control over individual cookies unless the user manually adjusts their browser settings. Clicking an ad on social media can also be taken as agreeing to data collection.