What Mark Zuckerberg Didn’t Say About What Facebook Knows About You

Facebook has a lot more data about us than it lets on—and its tools for providing ‘complete control’ don’t do enough

When you request and download your data from Facebook—a feature Mr. Zuckerberg repeatedly referred to in answers to questions about control—this stored browsing history isn’t there.

That is reasonable, says Antonio Garcia-Martinez, a former Facebook ad-targeting product manager and current Facebook gadfly. Facebook targets ads based on an abstraction derived from your browsing history——an abstraction such as your interest in golf. When you download your data, Facebook tells you what it thinks your interests are but doesn’t provide the specific evidence for why it thinks that.

“If you downloaded this file [of sites Facebook knows you visited], it would look like a quarter to half your browsing history,” Mr. Garcia-Martinez adds.

Another reason Facebook doesn’t give you this data: The company claims recovering it from its databases is difficult. In one case, it took Facebook 106 days to deliver to a Belgian mathematician, Paul-Olivier Dehaye, all the data the company had gathered on him through its most common tracking system. Facebook doesn’t say how long it stores this information.

When you opt out of interest-based ads, the system that uses your browsing history to target you, Facebook continues tracking you anyway. It just no longer uses the data to show you ads.

There is more data Facebook collects that it doesn’t explain. It encourages users to upload their phone contacts, including names, phone numbers and email addresses. Facebook never discloses if such personal information about you has been uploaded by other users from their contact lists, how many times that might have happened or who might have uploaded it.

This data enables Facebook not only to keep track of active users across its multiple products, but also to fill in the missing links. If three people named Smith all upload contact info for the same fourth Smith, chances are this person is related. Facebook now knows that person exists, even if he or she has never been on Facebook. And of course, people without Facebook accounts certainly can’t see what information the company has in these so-called shadow profiles.

.. There’s also a form of location data you can’t control unless you delete your whole account. This isn’t the app’s easy-to-turn-off GPS tracking. It’s the string of IP addresses, a form of device identification on the internet, that can show where your computer or phone is each time it connects to Facebook.

Location is a powerful signal for Facebook, allowing it to infer how you are connected to other people, even if you don’t identify them as family members, co-workers or lovers.

.. All this data, plus the elements Facebook lets you control, can potentially reveal everything from your wealth to whether you are depressed.

Facebook, Alphabet Inc.’s Google and a host of smaller companies that compete with and support the giants in the digital ad space have become addicted to the kind of information that helps microtarget ads.



How Facebook Figures Out Everyone You’ve Ever Met

Shadow contact information has been a known feature of Facebook for a few years now. But most users remain unaware of its reach and power. Because shadow-profile connections happen inside Facebook’s algorithmic black box, people can’t see how deep the data-mining of their lives truly is, until an uncanny recommendation pops up.

.. Handing over address books is one of the first steps Facebook asks people to take when they initially sign up, so that they can “Find Friends.”
.. Having issued this warning, and having acknowledged that people in your address book may not necessarily want to be connected to you, Facebook will then do exactly what it warned you not to do.
.. Facebook doesn’t like, and doesn’t use, the term “shadow profiles.” It doesn’t like the term because it sounds like Facebook creates hidden profiles for people who haven’t joined the network, which Facebook says it doesn’t do. The existence of shadow contact information came to light in 2013 after Facebook admitted it had discovered and fixed “a bug.” The bug was that when a user downloaded their Facebook file, it included not just their friends’ visible contact information, but also their friends’ shadow contact information.

.. Facebook does what it can to underplay how much data it gathers through contacts, and how widely it casts its net.

.. Through the course of reporting this story, I discovered that many of my own friends had uploaded their contacts. While encouraging me to do the same, Facebook’s smartphone app told me that 272 of my friends have already done so. That’s a quarter of all my friends.

..  When Steinfeld wrote “a friend or someone you might know,” he meant anyone—any person who might at some point have labeled your phone number or email or address in their own contacts. A one-night stand from 2008, a person you got a couch from on Craiglist in 2010, a landlord from 2013: If they ever put you in their phone, or you put them in yours, Facebook could log the connection if either party were to upload their contacts.
.. That accumulation of contact data from hundreds of people means that Facebook probably knows every address you’ve ever lived at, every email address you’ve ever used, every landline and cell phone number you’ve ever been associated with, all of your nicknames, any social network profiles associated with you, all your former instant message accounts, and anything else someone might have added about you to their phone book.
As far as Facebook is concerned, none of that even counts as your own information. It belongs to the users who’ve uploaded it, and they’re the only ones with any control over it.

.. It’s what the sociologist danah boyd callsnetworked privacy”: All the people who know you and who choose to share their contacts with Facebook are making it easier for Facebook to make connections you may not want it to make—say if you’re in a profession like law, medicine, social work, or even journalism, where you might not want to be connected to people you encounter at work, because of what it could reveal about them or you, or because you may not have had a friendly encounter with them.

.. If just one person you know has contact information for both identities and gives Facebook access to it, your worlds collide. Bruce Wayne and Clark Kent would be screwed.
.. The company’s ability to perceive the threads connecting its billion-plus users around the globe led it to announce last year that it’s not six degrees that separate one person from another—it’s just three and a half.

.. The network can do contact chaining—if two different people both have an email address or phone number for you in their contact information, that indicates that they could possibly know each other, too.

.. This is how a psychiatrist’s patients were recommended to one another and may be why a man had his secret biological daughter recommended to him. (He and she would have her parents’ contact information in common.)
.. And it may explain why a non-Facebook user had his ex-wife recommended to his girlfriend. Facebook doesn’t keep profiles for non-users, but it does use their contact information to connect people.

.. “Mobile phone numbers are even better than social security numbers for identifying people,” said security technologist Bruce Schneier by email. “People give them out all the time, and they’re strongly linked to identity.”

.. the social network is getting our not-for-sharing numbers and email addresses anyway by stealing them (albeit through ‘legitimate’ means) from our friends.”

What if you don’t like Facebook having this data about you? All you need to do is find every person who’s ever gotten your contact information and uploaded it to Facebook, and then ask them one by one to go to Facebook’s contact management page and delete it.

 .. Facebook functions as a reverse phone-number look-up service; under the default settings, anyone can put your phone number into the search bar and pull up your account
.. “You can limit who can look you up on Facebook by that phone number [or email address] to ‘friends.’ This is also a signal that People You May Know uses.
.. So if a stranger uploads his address book including that phone number [or email address, it] won’t be used to suggest you to that stranger in People You May Know.”