FACEBOOK
I Downloaded the Information That Facebook Has on Me. Yikes.
By BRIAN X. CHEN APRIL 11, 2018
What makes you tick, whom you know, where you go, even where you might end up. The information you share in your profile is a mere snippet of what Facebook and its partners really know about you. Kevin Roose, a technology columnist for The Times, explains. (By AINARA TIEFENTHÄLER, ROBIN STEIN and KEVIN ROOSE on Publish Date April 9, 2018).
When I downloaded a copy of my Facebook data last week, I didn’t expect to see much. My profile is sparse, I rarely post anything on the site, and I seldom click on ads. (I’m what some call a Facebook “lurker.”)
But when I opened my file, it was like opening Pandora’s box.
With a few clicks, I learned that about 500 advertisers — many that I had never heard of, like Bad Dad, a motorcycle parts store, and Space Jesus, an electronica band — had my contact information, which could include my email address, phone number and full name. Facebook also had my entire phone book, including the number to ring my apartment buzzer. The social network had even kept a permanent record of the roughly 100 people I had deleted from my friends list over the last 14 years, including my exes.
There was so much that Facebook knew about me — more than I wanted to know. But after looking at the totality of what the Silicon Valley company had obtained about yours truly, I decided to try to better understand how and why my data was collected and stored. I also sought to find out how much of my data could be removed.
How Facebook collects and treats personal information was central this week when Mark Zuckerberg, the company’s chief executive, answered questions in Congress about data privacy and his responsibilities to users. During his testimony, Mr. Zuckerberg repeatedly said Facebook has a tool for downloading your data that “allows people to see and take out all the information they’ve put into Facebook.”
But that’s an overstatement. Most basic information, like my birthday, could not be deleted. More important, the pieces of data that I found objectionable, like the record of people I had unfriended, could not be removed from Facebook, either.
“They don’t delete anything, and that’s a general policy,” said Gabriel Weinberg, the founder of DuckDuckGo, which offers internet privacy tools. He added that data was kept around to eventually help brands serve targeted ads.
Beth Gautier, a Facebook spokeswoman, put it this way: “When you delete something, we remove it so it’s not visible or accessible on Facebook.” She added: “You can also delete your account whenever you want. It may take up to 90 days to delete all backups of data on our servers.”
Digging through your Facebook files is an exercise I highly recommend if you care about how your personal information is stored and used. Here’s what I learned.
When you download a copy of your Facebook data, you will see a folder containing multiple subfolders and files. The most important one is the “index” file, which is essentially a raw data set of your Facebook account, where you can click through your profile, friends list, timeline and messages, among other features.
One surprising part of my index file was a section called Contact Info. This contained the 764 names and phone numbers of everyone in my iPhone’s address book. Upon closer inspection, it turned out that Facebook had stored my entire phone book because I had uploaded it when setting up Facebook’s messaging app, Messenger.
This was unsettling. I had hoped Messenger would use my contacts list to find others who were also using the app so that I could connect with them easily — and hold on to the relevant contact information only for the people who were on Messenger. Yet Facebook kept the entire list, including the phone numbers for my car mechanic, my apartment door buzzer and a pizzeria.
This felt unnecessary, though Facebook holds on to your phone book partly to keep it synchronized with your contacts list on Messenger and to help find people who newly sign up for the messaging service. I opted to turn off synchronizing and deleted all my phone book entries.
My Facebook data also revealed how little the social network forgets. For instance, in addition to recording the exact date I signed up for Facebook in 2004, there was a record of when I deactivated Facebook in October 2010, only to reactivate it four days later — something I barely remember doing.
Facebook also kept a history of each time I opened Facebook over the last two years, including which device and web browser I used. On some days, it even logged my locations, like when I was at a hospital two years ago or when I visited Tokyo last year.
Facebook keeps a log of this data as a security measure to flag suspicious logins from unknown devices or locations, similar to how banks send a fraud alert when your credit card number is used in a suspicious location. This practice seemed reasonable, so I didn’t try to purge this information.
But what bothered me was the data that I had explicitly deleted but that lingered in plain sight. On my friends list, Facebook had a record of “Removed Friends,” a dossier of the 112 people I had removed along with the date I clicked the “Unfriend” button. Why should Facebook remember the people I’ve cut off from my life?
Facebook’s explanation was dissatisfying. The company said it might use my list of deleted friends so that those people did not appear in my feed with the feature “On This Day,” which resurfaces memories from years past to help people reminisce. I’d rather have the option to delete the list of deleted friends for good.
Your Facebook account keeps a record not only of ads you have clicked on, but also of advertisers that have your contact information, which can also be viewed in your archive.
The Ad Industry Has Eyes Everywhere
What Facebook retained about me isn’t remotely as creepy as the sheer number of advertisers that have my information in their databases. I found this out when I clicked on the Ads section in my Facebook file, which loaded a history of the dozen ads I had clicked on while browsing the social network.
Lower down, there was a section titled “Advertisers with your contact info,” followed by a list of roughly 500 brands, the overwhelming majority of which I had never interacted with. Some brands sounded obscure and sketchy — one was called “Microphone Check,” which turned out to be a radio show. Other brands were more familiar, like Victoria’s Secret Pink, Good Eggs or AARP.
Facebook said unfamiliar advertisers might appear on the list because they might have obtained my contact information from elsewhere, compiled it into a list of people they wanted to target and uploaded that list into Facebook. Brands can upload their customer lists into a tool called Custom Audiences, which helps them find those same people’s Facebook profiles to serve them ads.
Brands can obtain your information in many different ways. Those include:
¦ Buying information from a data provider like Acxiom, which has amassed one of the world’s largest commercial databases on consumers. Brands can buy different types of customer data sets from a provider, like contact information for people who belong to a certain demographic, and take that information to Facebook to serve targeted ads, said Michael Priem, chief executive of Modern Impact, an advertising firm in Minneapolis.
Last month, Facebook announced that it was limiting its practice of allowing advertisers to target ads using information from third-party data brokers like Acxiom.
¦ Using tracking technologies like web cookies and invisible pixels that load in your web browser to collect information about your browsing activities. There are many different trackers on the web, and Facebook offers 10 different trackers to help brands harvest your information, according to Ghostery, which offers privacy tools that block ads and trackers. The advertisers can take some pieces of data that they have collected with trackers and upload them into the Custom Audiences tool to serve ads to you on Facebook.
¦ Getting your information in simpler ways, too. Someone you shared information with could share it with another entity. Your credit card loyalty program, for example, could share your information with a hotel chain, and that hotel chain could serve you ads on Facebook.
The upshot? Even a Facebook lurker, like myself, who has barely clicked on any digital ads can have personal information exposed to an enormous number of advertisers. This was not entirely surprising, but seeing the list of unfamiliar brands with my contact information in my Facebook file was a dose of reality.
I tried to contact some of these advertisers, like Very Important Puppets, a toymaker, to ask them about what they did with my data. They did not respond.
Newsletter Sign Up
What About Google? ( or Instagram?)
Let’s be clear: Facebook is just the tip of the iceberg when it comes to what information tech companies have collected on me.
Knowing this, I also downloaded copies of my Google data with a tool called Google Takeout. The data sets were exponentially larger than my Facebook data. For my personal email account alone, Google’s archive of my data measured eight gigabytes, enough to hold about 2,000 hours of music. By comparison, my Facebook data was about 650 megabytes, the equivalent of about 160 hours of music.
Here was the biggest surprise in what Google collected on me: In a folder labeled Ads, Google kept a history of many news articles I had read, like a Newsweek story about Apple employees walking into glass walls and a New York Times story about the editor of our Modern Love column. I didn’t click on ads for either of these stories, but the search giant logged them because the sites had loaded ads served by Google.
In another folder, labeled Android, Google had a record of apps I had opened on an Android phone since 2015, along with the date and time. This felt like an extraordinary level of detail.
Google did not immediately respond to a request for comment.
On a brighter note, I downloaded an archive of my LinkedIn data. The data set was less than half a megabyte and contained exactly what I had expected: spreadsheets of my LinkedIn contacts and information I had added to my profile.
Yet that offered little solace. Be warned: Once you see the vast amount of data that has been collected about you, you won’t be able to unsee it.
Brian X. Chen, our lead consumer technology reporter, writes Tech Fix, a column about solving tech problems like sluggish Wi-Fi, poor smartphone battery life and the complexity of taking your smartphone abroad. What frustrates you about your tech? Send your suggestions for future Tech Fix columns to brian.chen@nytimes.com.
A version of this article appears in print on April 12, 2018, on Page A1 of the New York edition with the headline: Remember Those Friends You Deleted Long Ago? Facebook Does. Order Reprints|
What You Don’t Know About How Facebook Uses Your Data APRIL 11, 2018
Facebook Data Collected by Quiz App Included Private Messages APRIL 10, 2018
Mark Zuckerberg Testimony: Senators Question Facebook’s Commitment to Privacy APRIL 10, 2018
PS Facebook is the parent company of Instagram FYI .
EVEN IF YOU ARE A NON USER of FACEBOOK:
;By David Ingram
SAN FRANCISCO (Reuters) - Concern about Facebook Inc’s respect for data privacy is widening to include the information it collects about non-users, after Chief Executive Mark Zuckerberg said the world’s largest social network tracks people whether they have accounts or not.
Privacy concerns have swamped Facebook since it acknowledged last month that information about millions of users wrongly ended up in the hands of political consultancy Cambridge Analytica, a firm that has counted U.S. President Donald Trump’s 2016 electoral campaign among its clients.
Zuckerberg said on Wednesday under questioning by U.S. Representative Ben Luján that, for security reasons, Facebook also collects “data of people who have not signed up for Facebook.”
Lawmakers and privacy advocates immediately protested the practice, with many saying Facebook needed to develop a way for non-users to find out what the company knows about them.
“We’ve got to fix that,” Representative Luján, a Democrat, told Zuckerberg, calling for such disclosure, a move that would have unclear effects on the company’s ability to target ads. Zuckerberg did not respond. On Friday Facebook said it had no plans to build such a tool.
Critics said that Zuckerberg has not said enough about the extent and use of the data. “It’s not clear what Facebook is doing with that information,” said Chris Calabrese, vice president for policy at the Center for Democracy & Technology, a Washington advocacy group.
COOKIES EVERYWHERE
Facebook gets some data on non-users from people on its network, such as when a user uploads email addresses of friends. Other information comes from “cookies,” small files stored via a browser and used by Facebook and others to track people on the internet, sometimes to target them with ads.
“This kind of data collection is fundamental to how the internet works,” Facebook said in a statement to Reuters.
Asked if people could opt out, Facebook added, “There are basic things you can do to limit the use of this information for advertising, like using browser or device settings to delete cookies. This would apply to other services beyond Facebook because, as mentioned, it is standard to how the internet works.”
Facebook often installs cookies on non-users’ browsers if they visit sites with Facebook”like” and “share” buttons, whether or not a person pushes a button. Facebook said it uses browsing data to create analytics reports, including about traffic to a site.
The company said it does not use the data to target ads, except those inviting people to join Facebook.
TARGETING FACEBOOK
Advocates and lawmakers say they are singling out Facebook because of its size, rivaled outside China only by Alphabet Inc’s Google, and because they allege Zuckerberg was not forthcoming about the extent and reasons for the tracking.
“He’s either deliberately misunderstanding some of the questions, or he’s not clear about what’s actually happening inside Facebook’s operation,” said Daniel Kahn Gillmor, a senior staff technologist at the American Civil Liberties Union.
Zuckerberg, for instance, said the collection was done for security purposes, without explaining further or saying whether it was also used for measurement or analytics, Gillmor said, adding that Facebook had a business incentive to use the non-user data to target ads.
Facebook declined to comment on why Zuckerberg referred to security only.
Gillmor said Facebook could build databases on non-users by combining web browsing history with uploaded contacts. Facebook said on Friday that it does not do so.
The ACLU is pushing U.S. lawmakers to enact broad privacy legislation including a requirement for consent prior to data collection.
The first regulatory challenge to Facebook’s practices for non-users may come next month when a new European Union law, known as the General Data Protection Regulation (GDPR), takes effect and requires notice and consent prior to data collection.
At a minimum, “Facebook is going to have to think about ways to structure their technology to give that proper notice,” said Woodrow Hartzog, a Northeastern University professor of law and computer science.
Facebook said in its statement on Friday, “Our products and services comply with applicable law and will comply with GDPR.”
The social network would be wise to recognize at least a right to know, said Michael Froomkin, a University of Miami law professor.
“If I’m not a Facebook user, I ought to have a right to know what data Facebook has about me,” Froomkin said.
(Reporting by David Ingram; Editing by Peter Henderson and Richard Chang)
|