What You Don’t Know About How Facebook Uses Your Data

Mark Zuckerberg, Facebook’s chief executive, went to Capitol Hill this week to explain to members of Congress how the detailed personal information of up to 87 million Facebook users ended up in the hands of a voter-profiling company called Cambridge Analytica.

What Mr. Zuckerberg got instead, as he testified before the House Energy and Commerce Committee on Wednesday, was a grilling about Facebook’s own data-mining practices.

Representative Debbie Dingell, a Democrat from Michigan, for one, wanted to know about Facebook’s use of different types of tracking software to follow consumers’ activities on millions of non-Facebook sites all over the web.

“It doesn’t matter whether you have a Facebook account,” Ms. Dingell said to Mr. Zuckerberg. “Through those tools, Facebook is able to collect information from all of us.”

Facebook meticulously scrutinizes the minutiae of its users’ online lives, and its tracking stretches far beyond the company’s well-known targeted advertisements. Details that people often readily volunteer — age, employer, relationship status, likes and location — are just the start.

And the sifting of users can get quite personal. Among many possible target audiences, Facebook offers advertisers 1.5 million people “whose activity on Facebook suggests that they’re more likely to engage with/distribute liberal political content” and nearly seven million Facebook users who “prefer high-value goods in Mexico.”

“Facebook can learn almost anything about you by using artificial intelligence to analyze your behavior,” said Peter Eckersley, the chief computer scientist for the Electronic Frontier Foundation, a digital rights nonprofit. “That knowledge turns out to be perfect both for advertising and propaganda. Will Facebook ever prevent itself from learning people’s political views, or other sensitive facts about them?”

Many other companies, including news organizations like The New York Times, mine information about users for marketing purposes. If Facebook is being singled out for such practices, it is because it is a market leader and its stockpiling of personal data is at the core of its $40.6 billion annual business.

Facebook uses a number of software tools to do this tracking. When internet users venture to other sites, Facebook can still monitor what they are doing with software like its ubiquitous “Like” and “Share” buttons, and something called Facebook Pixel — invisible code that’s dropped onto the other websites that allows that site and Facebook to track users’ activity.

Ms. Dingell asked Mr. Zuckerberg how many non-Facebook sites used various kinds of Facebook tracking software: “Is the number over 100 million?” He said he’d have to get back to her with an answer.

“There are common parts of people’s experience on the internet,” Matt Steinfeld, a Facebook spokesman, said in a statement. “But of course we can do more to help people understand how Facebook works and the choices they have.”

While a series of actions by European judges and regulators are trying to curb some of the powerful targeting mechanisms that Facebook employs, federal officials in the United States have done little to constrain them — to the consternation of American privacy advocates who say Facebook continues to test the boundaries of what is permissible.

Facebook requires outside sites that use its tracking technologies to clearly notify users, and it allows Facebook users to opt out of seeing ads based on their use of those apps and websites.

That has not stopped angry users from airing their grievances over Facebook’s practices.

In 2016, for example, a Missouri man with metastatic cancer sued Facebook. The suit, which sought class-action status, accused the tech giant of violating the man’s privacy by tracking his activities on cancer center websites outside the social network — and collecting details about his possible treatment options — without his permission.

Facebook persuaded a federal judge to dismiss the case. The company argued that tracking users for ad-targeting purposes was a standard business practice, and one that its users agreed to when signing up for the service. The Missouri man and two other plaintiffs have appealed the judge’s decision.

Facebook is quick to note that when users sign up for an account, they must agree to the company’s data policy. It plainly states that its data collection “includes information about the websites and apps you visit, your use of our services on those websites and apps, as well as information the developer or publisher of the app or website provides to you or us.”

But in Europe, some regulators contend that Facebook has not obtained users’ explicit and informed consent to track them on other sites and apps. Their general concern, they said, is that many of Facebook’s 2.1 billion users have no idea how much data Facebook could collect about them and how the company could use it. And there is a growing unease that tech giants are unfairly manipulating users.

Photo

“Facebook provides a network where the users, while getting free services most of them consider useful, are subject to a multitude of nontransparent analyses, profiling, and other mostly obscure algorithmical processing,” said Johannes Caspar, the data protection commissioner for Hamburg, Germany.

In 2015, for instance, the Belgian Privacy Commission ordered Facebook to stop systematically using “long-term and uniquely identifying” codes to track nonusers without their “unequivocal and specific consent.” The agency subsequently sued Facebook. In February, a judge in Brussels ordered Facebook to stop tracking “each internet user on Belgian soil” on other websites.

Facebook has appealed the decision. In his comments in the House hearing on Wednesday, Mr. Zuckerberg said Facebook tracked nonusers for security purposes — to ensure they could not scrape public data about Facebook users.

But, in one presentation on the case, Belgian regulators wrote: “Tracking nonusers for security purposes is excessive.”

And on Friday, the Italian Competition Authority said it was investigating Facebook for exercising “undue influence” by requiring users to let the company automatically collect all kinds of data about them both on its platform and off.

“Every single action, every single relationship is carefully monitored,” said Giovanni Buttarelli, the European data protection supervisor, who oversees an independent European Union authority that advises on privacy-related laws and policies. “People are being treated like laboratory animals.”

Regulators have won some victories. In 2012, Facebook agreed to stop using face recognition technology in the European Union after Mr. Caspar, the Hamburg data protection commissioner, accused it of violating German and European privacy regulations by collecting users’ biometric facial data without their explicit consent.

Outside the European Union, Facebook employs face recognition technology for a name-tagging feature that can automatically suggest names for the people in users’ photos. But civil liberties experts warn that face recognition technology could threaten the ability of Americans to remain anonymous online, on the street and at political protests.

Now a dozen consumer and privacy groups in the United States have accused Facebook of deceptively rolling out expanded uses of the technology without clearly explaining it to users or obtaining their explicit “opt-in” consent. On Friday, the groups filed a complaint with the Federal Trade Commission saying that the expansion violated a 2011 agreement prohibiting Facebook from deceptive privacy practices.

Facebook sent notices alerting users of its new face recognition uses and said it provides a page where they can turn the feature off.

Facebook has other powerful techniques with implications users may not fully understand.

One is a marketing service called “Lookalike Audiences,” which goes beyond the familiar Facebook programs allowing advertisers to target people by their ages or likes. The look-alike audience feature allows marketers to examine their existing customers or voters for certain propensities — like big spending — and have Facebook find other users with similar tendencies.

Murka, a social casino game developer, used the feature to target “high-value players” who were “most likely to make in-app purchases,” according to Facebook marketing material.

Some marketers worry that political campaigns or unscrupulous companies could potentially use the same technique to identify the characteristics of, for instance, people who make rash decisions and find a bigger pool of the same sort of Facebook users.

Facebook’s policies prohibit potentially predatory ad-targeting practices. Advertisers are able to target users using the look-alike service, but they do not receive personal data about those Facebook users.

Jeffrey Chester, executive director of the Center for Digital Democracy, a nonprofit group in Washington, however, warned that this look-alike marketing was a hidden, manipulative practice — on a par with subliminal advertising — and said it should be prohibited.