About the Humain.inc "ARG"
This is going to be a little long, so please bear with me. Mods, I apologize if this isn't directly following the stated purpose of the subreddit; I still think it's highly relevant to people who are seeing the marketing for this project but haven't found this information. Informed Consent is a right, and I'd like to ensure people are aware of what they're getting into.
Humain.inc is a data-collecting campaign underneath an ARG.
I am not saying you shouldn’t engage with this project if you find it interesting. Do whatever you like. However, I’ve seen a few people talking about this (and even seen someone mentioning making a discord server for it), without bringing up this massive, glaring red flag that I found today.
Let's Shed a Little Light on The Subject
If you’ve visited the website, you’ve almost certainly scrolled to the bottom and found the Privacy Policy, among other fictitious documents. The reason I say ‘fictitious’ blatantly is because they, themselves, admit it’s fake, just not right there. If you want to know what they really are, who’s actually behind this campaign, and what they’re actually collecting, you need to click on the Privacy Policy link at the bottom of their website.
Here you can see NewPower Studios LLC’s actual Privacy Policy. They give a disclaimer here, and only here, though it does appear at both the top and bottom of the page:
>About this site. humain.inc is a promotional website for a fictional research company depicted in humAIn, a creative work produced by NewPower Studios. The company "humAIn" is not real. Content on this site that references research programs, candidates, integration protocols, or related topics is fictional. This Privacy Policy describes how NewPower Studios, LLC ("we," "us," "our") — the actual operator of this website — collects and uses information from real visitors.
This, on its face, is not that big of a deal. Yes, you can sort of tell it’s fictional from looking at the page, and if you do a single extra ounce of legwork, like looking up HumainInc to verify the supposed history, you’ll find nothing - save for those ‘training videos’ or whatever on YouTube.
Let’s keep reading, though. What are they actually collecting? Who are they collecting it for? Why are they doing it? I’m not saying the answers to these things are automatically bad, but when your data is being collected through this smokescreen of an ARG, you should know exactly what’s being collected and why.
Luckily, their real Privacy Policy answers this.
The very second item gives some basic information:
>We collect the following categories of personal information from visitors to humain.inc:
Identifiers and contact information you submit voluntarily — for example, your email address if you submit a candidate intake form or contact form.
Internet or other electronic network activity information — IP address, browser type, device type, referring URL, pages visited, and time spent on the site, collected automatically.
Inferences drawn from the above — for example, whether you arrived from a podcast advertisement, to help us understand the effectiveness of our marketing.
Approximate geographic location derived from IP address. We do not collect precise geolocation.
Okay, so what? We’ll get to that in a second. First, I’d like to show you another big block of text from that Privacy Policy (emphasis mine):
>4. Third-party services and tracking technologies
We use the following third-party services on humain.inc. Some of these services may "share" personal information for cross-context behavioral advertising as defined under the CCPA/CPRA.
AudioGo (operated by AdsWizz Inc.)
We use AudioGo's conversion tracking pixel to measure the effectiveness of audio advertising campaigns we run on AudioGo's network of streaming and podcast publishers. The pixel transmits information including device identifiers, IP address, and the page you visited to AudioGo. AudioGo's privacy practices are governed by AdsWizz's privacy policy, available at https://www.audiogo.com/lang?page=privacy-policy.
When the AudioGo pixel fires, AdsWizz may forward a request — including a mobile advertising identifier (Apple IDFA or Google Android Advertising ID) where available — to Tapad, Inc. (a cross-device identity-resolution provider owned by Experian) for the purpose of linking your visit to other devices associated with you. Tapad's privacy policy is available at https://www.tapad.com/privacy and Experian's at https://www.experian.com/privacy.
We honor the Global Privacy Control (GPC) browser signal as an opt-out of this pixel. If your browser sends a GPC signal, the AudioGo pixel will not fire on your visit and no information will be transmitted to AdsWizz or Tapad as a result of this Site.
So, What Does This Mean?
When you visit the site, regardless of whether or not you fill out the ‘Candidate Intake Form’, a hidden piece of tracking code called the AudioGo conversion pixel *instantly* fires. AudioGo is an ad network (owned by a huge ad-tech company called AdsWizz) that serves ads on podcasts and streaming radio. The pixel’s job is basically to grab your IP address, device type, browser, info, and invisible mobile or device advertising identifiers.
AdsWizz doesn’t just go to NewPower and say, “Hey, someone clicked!” The information collected - according to the pipeline laid out in their privacy framework - allows them to take those device IDs and forward them to a third-party company called Tapad.
Tapad’s entire business model is “cross-device identity resolution”. They have a global ‘identity graph’ that functions as a data aggregator for device IDs. So, they receive the device identifier, then use AI and machine learning to match it against billions of other data points on their graph.
This means they aren’t just logging that you visited the website. They are calculating that the phone that visited the website also belongs to the exact same person who owns a specific laptop, a specific tablet, and any other devices they have information on, all operating (typically) on the same home network.
Why is this even relevant? Well, Tapad is owned by Experian, who you likely know as one of the three major credit bureaus. They are also a *massive* data broker. They take the digital web built by Tapad and use it for ‘Offline Identity Resolution’. Meaning, they take the cluster of devices identified by Tapad and use the information *they* have collected through other means to attach those device IDs to a real-world name, address, email, and purchasing history.
TL;DR: You click the link, which triggers a pixel that grabs and sends your device ID to an ad network. That network sends it to an identity resolution company, which links the visit to every other device you own. That web of devices is then fed directly into an Experian-owned database to build a comprehensive, cross-context behavioral advertising profile tied directly to your real-world identity.
Why Should You Care?
Alright, I do not have the time or desire to make an entire argument against this kind of thing right now, but it's highly relevant so here I am anyway. The bare-bones is thus: they are not just collecting information on you. They are using that information to build a general idea of who, exactly, can be advertised to using [x]; in this case, it's an ARG about human-AI integration. You are not just 'a consumer', you are training data for their advertising algorithms.
And they're not even doing you the basic kindness of making that clear. They've hidden the thing that would tell you that underneath the facade of the ARG. By the time you hit the bottom of the website, where the only links to the disclaimer are, you've already been shown something that looks like an official, legal privacy policy. Chances are, you see that link at the bottom and go, huh, redundant, and move on.
It's shady. Hence why I'm here, telling you about it. Personally, I don't really care about whether or not you like or dislike this. I care that you know and have all the information so that you can make an informed decision about whether or not this is something you want to participate in.
So, How Can You Protect Yourself?
1. Don't visit the website.
Boring, I know, because it seems interesting. But this is the most surefire way to avoid it. Just move on.
2. Use a browser that automatically sends GPC signals.
I'm not going to get into the entirety of how this works because this post would be so, so stupidly long if I did. A GPC signal is, basically, your computer telling the website, "Hey, don't track me." That's not entirely accurate and is oversimplified, but again. An explanation written by someone more knowledgeable than me is available elsewhere on the internet.
If you still want to visit the site, you should do so on a browser like DuckDuckGo or Brave, which send GPC signals by default. You can also add extensions for this specifically, like Privacy Badger or DuckDuckGo Privacy Essentials, if you use Chrome or Firefox.
3. Look up your state's privacy laws and send the "Do Not Sell or Share Request" email.
They state explicitly that they honor California's privacy laws and make no mention of other states, but they are legally required to respect the privacy laws of any state that has them. There's a high likelihood your state has opt-out laws for data harvesting. Do some googling, figure out if you've got that on your side, and then - I'm going to take a leap here and say even if you don't reside in a state with specific privacy laws for this - send the "Do Not Sell or Share Request" email to the address they've provided, media@humain.inc.
Bonus Reading & References
You'll notice I've included a bunch of links. Some of those are to research papers, which I'm going to cite here, for those directly curious. These are entirely free to access.
Brookman, J., Rouge, P., Alva, A., & Yeung, C. (2017). Cross-Device Tracking: Measurement and Disclosures. Proceedings on Privacy Enhancing Technologies, 2017, 133-148.
Englehardt, S., Han, J., & Narayanan, A. (2018). I never signed up for this! Privacy implications of email tracking. Proceedings on Privacy Enhancing Technologies, 2018, 109–126.
Koduri, M. P., Lim, P. X., Li, Z., Kumar, S., Saleem, M. A., & Moy, R. (2021). Cross-Device Identity Resolution using Machine Learning: A Scalable Device Graph Approach. The International FLAIRS Conference Proceedings, 34.