Hacker News Reader

Comment by aestetix | Hacker News Reader

Two questions Facebook needs to answer:

1. If I don't have a Facebook account, how can I delete the data Facebook has collected on me without creating an account?

2. If Facebook doesn't sell data, what is the purpose of shadow profiles?

View on HN

> If Facebook doesn't sell data, what is the purpose of shadow profiles?

Presumably to sell you ads, which Facebook doesn't consider selling your data--it's just selling access to you, which is only valuable because of the data. Does it really matter if they didn't sell your information if they just used it to show you the same ad they would have showed if they had sold your data? It seems they're relying on the idea that advertisements are somehow an OK form of privacy violation.

How can they show me an ad if I don't have a Facebook account?

By having data about you facebook can infer stuff about other people who are on Facebook and serve better ads to them.

From the post: "Facebook ads and measurement tools, which enable websites and apps to show ads from Facebook advertisers, to run their own ads on Facebook or elsewhere, and to understand the effectiveness of their ads."

Facebook Ads on third party websites.

https://techcrunch.com/2016/05/26/facebook-starts-selling-of...

Facebook runs an ad network (Facebook Audience - how successful, or how much used this is, I don't know though.

If you're visiting a site or using a mobile app served from facebooks ad network, you don't need to be on facebook or have a facebook account to be shown an ad.

Two ways:

1. Facebook runs its own ad network, so you might see Facebook ads even if you never go to Facebook's website.

2. You might still go to their website even if you don't have a Facebook account. Many local restaurants and community organizations only have a Web presence through their Facebook pages.

> Does it really matter if they didn't sell your information if they just used it to show you the same ad they would have showed if they had sold your data?

On the surface, that's actually a quite meaningful distinction.

But, less so when you consider that businesses go in cycles, and one day Facebook/Google/whoever could get desparate enough to decide they need some extra cash... or they could go bankrupt, and have it auctioned off...

But, the data is ultimately only useful (legally) in order to spur clicking that you get a cut of, or to deliver a prominent message/ad. Does it really matter that it’s facebook that gets the cut rather than some faceless broker? I am still assaulted with ads targeted on my personal data, and with political ads that are obviously manipulative. That (political part) is the part that ultimately unnerved people, and that part isn’t going anywhere while ads form the basis of facebook’s business.

Data collection as a whole is certainly a booming market, but it allows facebook to bypass the very reasons they were called into congress: mass manipulation. Facebook is a platform of mass manipulation. Ads are just the polite name. All of us realize that CA is a small fish compared to the other data warehousing companies out there. Does congress?

There a lot more people who would buy all the (normally private) details in Facebook profiles than you are guessing. Imagine if political advertising companies could purchase just one bit of it - say, your email address - from Facebook.

Targeting ads is the tip of the iceberg in terms of what could be done with the data if Facebook/Google/whoever gets more desperate for revenue.

What happens when your Facebook/etc data is used to deny you health insurance because you appear to be at risk for cancer? Or to deny you a job because you listen to the same style of music associated with a demographic that has higher-than-average rate of criminal records? Or to give you a higher home mortgage interest rate?

With #2, they don't sell the data because they don't need to, and because it would threaten their profits.

They use the data themselves to categorize people and sell advertisers access to the categories. As an advertiser, I don't get a list of people - Facebook keeps that hidden. What I get is the knowledge that my ad is shown to the people I want in the category I want, because Facebook does that part for me. Shadow profiles enable them to do this in a much broader way, and also allows them to build growth engines into their system so if you do decide to join facebook, you see hundreds of suggestions that make you more likely to get addicted.

Is there a rock solid proof that shadow profiles exist? I only ever seen anecdotal evidence... and Zuck said he's not aware of them.

The wikipedia page doesnt have much:

https://en.wikipedia.org/wiki/Facebook#Shadow_profiles

Mark Zuckerberg said yes, but he doesn't call the data a shadow profile [1].

With apologies to Shakespear:

"What's in a name? That which we call a shadow profile By any other word would smell as repugnant;"

[1] https://www.usatoday.com/story/tech/columnist/baig/2018/04/1...

1. how can I delete

Why should the burden be on the non-user?

Facebook put this burden on non-users, and they're currently arguing that this is "OK" in their probe.

1. You can’t. They didn’t have an incentive to prioritize this on product roadmap, at least not until now.

2. Most likely to jump start new accounts. They’ll be able to target ads at your new account better if they already have years of data about your interests.

> at least not until now.

They have it to finish before the GDPR enforcement date (25 May 2018) - at which time those organizations in non-compliance may face heavy fines.

So, all companies big and small need to have a good data governance that allows to delete data on demand. And, better than that, stop collecting any data that they don’t have been authorized to get.

https://www.eugdpr.org

When asked question 2 before the US Congress, he repeatedly said that it's for security reasons, something about identifying attackers. It sounded to me like a corporate version of crying "national defense!" They really need to give a full accounting of what those are used for.

We know the answers to these, don't we?

1. There is no way to delete it. Facebook owns it forever.

2. Owning more data is better, for selling ads, for studying trends and behavior, for purposes as-yet ill-defined, and just cuz. And they don't sell data, they give it away.

> And they don't sell data, they give it away.

I don't think they sell or give away tracking data. All the data disclosures so far has been about social graph data, which is very different data set. Detailed traffic logs from network like FB would be something that is very hard to collect, wouldn't make sense for them to give such a valuable resource out for free.

Yeah, probably right, I'm just sort of making the point that "it's always worse than you think" and/or that the worst-case scenario is probably always the correct one where Facebook data collection is concerned.

It's not your data because your browser fingerprint hypothetically coincides with somebody else's. Deleting the data would delete somebody else's data too.

No, it's still my data even if FB mixes it up with someone else's. Deleting just part of the data is their problem, not mine.

You pose an interesting question actually, when is data you generate, "your data"?

If the data is only associated with a browser fingerprint then I see the argument for it not being your data; it's just data. It's like saying Google Street view has your data because they took a picture of the front of your business or your house. Does it make a difference if it's your business or your house? If you move out, is it still "your data"?

Next, if they have your friend's contacts, is it "your data"? I sync my contacts with a number of services, but I've tended to think of this as "my data", not my friend's data. Is it because I grew knowing about the white pages; so assuming phone numbers are public, a collection of phone numbers to name is my making therefore of my property? Even if it's a collection of data about my friends?

Lastly, I think we'd all agree that combining your name and your browsing info would constitute "your data". Is it because there's non-public data associated with your name? Names aren't really unique, is it because the combination of your name and your browsing info IS unique?

Also, is facebook capable of doing this? If so how?

Never really thought about this before actually.

Ok, you can delete the data, but you can't request Facebook to send you the data it has collected on you.

#2 is probably to jumpstart profiles, but also to have a more accurate representation of the social graph. If I sync my contacts and you show up there, and my friend syncs her/his contacts and you show up there too, assuming phone number are fairly unique identifiers, they can know that we share a mutual friend and that could contribute to their analytics.

Facebook doesn't sell data, they sell the ability for other people to microtarget. If the result of all this is a law saying that Facebook/etc cannot sell your data, then Mark Zuckerberg will be very happy.

If Facebook need to answer this question then so do Google, Twitter, Amazon and basically anyone else with a big enough footprint.

Reply on news.ycombinator.com