I Downloaded the Information That Facebook Has on Me
nytimes.com
nytimes.com
Click in the search bar on Facebook. On the right is an Edit button. This shows the search history they keep on you -- all the people you've looked up. Says a lot about you. It goes back years, unless you clear it. (And who knows what "clear" really means.)
This would be a rather unsettling thing to see in your archive. They totally left it out.
- Likes on everything I liked on FB and external
- Shares via Share Buttons on external websites
- Websites I visited and where I was tracked because of Social Media buttons
- Time spent on FB
- Status updates I changed or dismissed
- Mouse hovering behavior to train the feed
- Data like my phone number that wasn’t put there by me but correlated through my friends address books
- Metadata through WhatsApp acquisition
- ...
My likes are my data, because that is what the whole Cambridge Analytica thing is about (deriving a personality model from Likes).
My search history is my data, because it helps to identify me as a person.
My phone number they obtained through my friends uploading their contact list is my data.
Clearly, I’m not entitled to all data, but to a lot more than what’s in that archive.
Edit: And of course, if they have a shadow profile on you without you having an account (like your phone number and your name through the address book your friend uploaded), that is all your data, processed without your consent and without a way for you to get hold of.
This seems like an important one. If they log all those messages, presumably they should all be there with some indication of status (deleted, published, etc.).
I can only imagine the sensitive things contained in that dataset... Things like mistakenly pasted plaintext passwords, PII, etc.
Facebook is being selective in what they export here. The result is a misleading impression about what data they have on you.
I would say if they provide everything you've directly provided, they've fulfilled their "obligation."
Obligation is in quotes, because I don't actually believe they should even be required to do this.
Post likes, shares and search history are all examples of data you've directly provided that they're omitting from the export.
As for your principles, when you ask the FBI for their file on you their obligation is not limited to data you've directly provided.
The FBI is subject to FOIA. FB is not, obviously.
It's in the Activity Log, which is omitted from the download. This is not obvious and misleading. In fact someone asked whether they could download their activity and Facebook directed them to the Downloaded Info, which omits it.[1]
As for FOIA, you're missing the point. Of course FB is not subject to such a law. The whole debate right now is whether it should be. If you request an organization's "file" on you, it should be comprehensive and not selectively omit the creepiest stuff.
[1] https://www.facebook.com/help/community/question/?id=6345563...
I would say no if before you signed up they were willing to tell you everything they "intend" to collect about once you agree.
And when I say "tell you" I mean an itemized list in plain simple english not a thousand pages of obfuscated legalese.
Because one thing is clear: the data they have on me in my archive is by far not enough to train the feed in the way it is shown to me. How do I know? Because my download archive doesn’t have that much info on me and there must be more.
Presumably the same is true for likes on posts/shares, a major feed training signal. (Find the old post, it will still show that you liked it, but post likes are not in your archive.)
But yeah, then there's the darknet of data they've gathered on you that isn't visible in any UI.
My search history and Likes are clearly data that can be associated with me as a person and thus, fall under former EU data protection laws and for sure under the GDPR.
For one reason, so they aren’t recommended to you as a possible friend in the future. Seems like a minor thing to be upset about in a possibility space of major things.
- "block" (keep track of them so they don't appear in your feed)
- "unfriend" (erase the connection; they might reappear)
But this also adds complexity which can lead to UX failures. Probably a lot of users were using "unfriend" when they really want to block someone. So then their abuser shows up in their memories and Facebook suggests they become friends or whatever and then there's a scandal because look how insensitive FB is.
So the UX designer's choices then are, try to educate all your users about the distinction here and get victims to use a block -- which is not going to be 100% successful -- or err on the safe side and just make "unfriend" work more like a block. I can see them making the latter design decision in good faith, and maybe I would too.
Note: It is very common in more technical circles like HN to just implicitly blame the user here for not understanding the options. I.e. if less than 100% of users understand "unfriend" is not a "block" then, well, they should pay more attention. (This is very common in security discussions.) But good UX design means owning the outcome and how users interact with your interface in the real world. And so simplicity often is the better route, even at the cost of some tradeoffs.
Of note, it did not contain any record of phone calls or SMS conversations I’ve had. This is probably because I didn’t give Facebook permission to collect this data, when asked.
Of course I’m under no illusion that this is the only data that Facebook has on me. Based on my (even sporadic) activity they must be able to infer lots more (and then there’s all that tracker data). They just don’t make the interesting bits downloadable.
Somehow I'm unwilling to believe that Linkedin is really an exception here. More likely they don't include all the data they have on you.
I downloaded my facebook data, and the only thing that I was surprised at is that they actually give you so much of the data they have on you. I expected them to redact most of it. Is it really reasonable to think that they don't have even more data than they let you download? They're not required by law to give it all to you, are they?
Based on users' data and behavior, one can anticipate whether or not he/she is going to quit/leave his/her current job. Microsoft recruiters can then swoop in and offer him/her a job.
Or for example, Microsoft can essentially map all the top IT talents network and use this to its advantage.
The list goes on...
The real advantage would be to map everyone and every company to get intelligence on the users and potential users of their products (Office 365)
And that sucks since it's hard to have a professional life w/o one. I've known women who were stalked/harassed because despite otherwise being pretty locked down their harassers found their linkedin and used that to harangue them.
No. They have more data. They have lots more data. Browsing history for example via trackers.
And no, we (Americans) do not have any meaningful laws. Nothing. Nor do we have any rights to privacy. We have no right to know what personal private information is being collected, bought, or sold.
There was the Bye Bye Facebook event here yesterday, 10k people from the Netherlands deleted their Facebook accounts.
Personally I'm waiting until may 25 to do this: I hope that after that date, Facebook will be legally required to really delete my data, and be liable if they don't. I'm afraid that before that date, they'll just hide that data from me, and continue adding to it by tracking, and continue selling it to advertisers outside the Facebook site.
This might turn out to be different from what a random person on the street might expect.
Yes, but obviously you've got nothing if you use an US-based service from the US. It's based around companies subject to EU laws, rather than any real notion of citizenship.
I've also personally been receiving downvotes here on HN for posting undeniable facts about Facebook (and the data collection practices of other ad companies), but that could just be a result of the numerous FB employees on this site trying to pull the wool over their and our eyes on behalf of their employer.
1. Not providing tools to see or download your data
2. Simply not providing options to turn off data collection or pretending that the options available are complete.
3. Providing tools to see and download a portion of your data, pretending that it is complete
4. Pretending to delete your data on account deletion but retaining the data, or at least a portion of the data
5. Collecting more data than they say they do
6. Collecting data on people who do not directly interact with the company services
They are in Europe: https://en.wikipedia.org/wiki/Max_Schrems
Not sure about the law (which also changes from country to country) but even if they'd be required to give all users their data, it is possible that they keep a relevant slice of the results obtained by matching that data. Releasing all that data public could reveal the inner workings of their algorithms, so I'd understand if they would rather release what people gave them while keeping most of what they inferred from that information, which of course is where the real knowledge is.
I have known for a long time, even before the scandal, that my time on the socalled social media site was coming to an end.
Being a software engineer I believe I am aware of a good deal of what is going on behind the scenes at Facebook, in terms of collecting data etc.
Talking to people which has no technical insight around privacy, and what data is collected as such, frustrates me to a whole new level than before.
It amazes me that people don't sit down for a couple of hours and tries to understand how the company works and what their business model is based on. And what data is collected from them, with or without their knowledge.
I am happy to be off and I will try to convince my peers to understand why.
For some strange reason Americans only care about privacy regarding medical info, but everything else is totally up for grabs. Never understood that dichotomy.
The article somewhat alludes to this practice as nefarious so that Facebook can serve better ads. Through a different view, one where you don't assume the worst, you could argue they keep a record of who you unfriend, so they don't recommend them as a friend again.
We are currently in a place where everything Facebook does is bad. Let's be a bit more rationale at times.
Even if you were able to delete yourself entirely from Facebook. You have been "consumed" already.
Your data was valuable in at least 2 ways: - Monetize to companies such as Cambridge Analytics. - Train Facebook's AI models using it.
What was probably happening, was that Facebook was selling your data to other companies so that they can train AI models/make conclusions etc. In addition, Facebook itself is using this data to train AI, make conclusions etc.
Facebook will no longer be able to Monetize to companies as much after this media.
However, and this is the big one, if they use your data to train their models to target individuals (and therefore "take advantage" of them), then they can claim that your data was not used. And then they sell the models, or the results of the models. Its like indirectly selling your data.
This could be a big win for Facebook, because if Facebook does not dish out our information to other companies, it will *uniquely" be placed to provide such services to the rest of the world.
And this will be almost impossible to regulate.
Meh, the models will be worthless in a few months, and that is if they aren't already worthless right now.
All those black boxes with magic coefficients from inputs to outputs are inherently unmaintainable. Toss them a black swan, and it all goes pear-shaped.
Assuming this is up-to-date this tells you who they buy from: https://www.facebook.com/help/494750870625830
In other words, it's not enough that media is accurate. Bias is just as important.
Note the wording here, which is similar to the misleading wording Zuckerberg used to avoid honestly answering certain questions in recent days:
> “allows people to see and take out all the information they’ve put into Facebook.”
This doesn't include data such as:
- Data your "friends" have "put into Facebook" about you, which could include SMS/call records of your communications with those friends and various other details.
- Data Facebook purchases or collects from data brokers or public records
- Data Facebook collects on the broader web via "like" buttons, etc
Presumably that doesn't mean an email address, they actually collate information about you the individual - what's the process of having a look at that?
Tracking cookies, personal profiling, and several other trails would probably never be exposed.
(Usually only when the sauce is for the goose. If for the gander, indignation ensues.)
How useful is the info one can even get from this?
I mean even if you interpret unfriending as enemying (which is a leap), possibly revealing interests you don't have, associations you don't have.... it's a lot weaker (to advertisers) than positive information.