Hacker News Reader

Comment by netsharc | Hacker News Reader

I can imagine this spectacularly backfiring... "Facebook tracked all those sites I visited?!?" (What was the joke about porn videos having "Like" buttons?).

I look forward to the even more damage control...

The Guardian coverage (https://www.theguardian.com/technology/2018/may/01/facebook-...) has this quote like a parent explaining to a 5 year old why they shouldn't delete cookies:

> Zuckerberg also cautioned users against clearing cookies in their browser, saying “it can make parts of your experience worse”, and adding, “Your Facebook won’t be as good while it relearns your preferences.”

I wonder why he's so afraid of people clearing his tracking pixels.

View on HN

> What was the joke about porn videos having "Like" buttons?

"I don't understand why porn websites have a +1 under the videos? Why would I want anyone to know I use Google+?"

Somewhat relevant: A friend took my phone (playfully) and posted this as a status on my profile a while ago. I left it up because I found it funny. Now that it's easier to delete I may actually just do that.

"Delete"

He says: " … you'll be able to clear this information from your account. You'll even be able to turn off having this information stored with your account."

"your account".

What do you reckon is the chance of them removing this from their ad targeting data set "account"??? They're just going to give you a tool that shows some of it to you, then hides it from you when you click the [fuck me over more] button (and they'll record _that_ interaction too, and sell you to the "tinfoil" and "headwear" segments.

> What do you reckon is the chance of them removing this from their ad targeting data set "account"???

is there a chance smaller than zero?

Sadly there is no way to issue an FOIA request to a private company. Possibly only route would be, clear data, notice contain tracking, due for disclosure. Probably the best route for moving forward.

I wonder if the GDPR will have sharp enough teeth to force FB to disclose what it's doing with EU citizen's data here?

Unless FB seizes to have offices in the EU and stops having an HQ in the EU and also stops doing monitoring of people in the EU and also stops any regular service for people in the EU, the GDPR has teeth and people in the EU can ask facebook to send them all data they have, then ask them to delete it and revoke any future permission to process their data.

Since the GDPR covers people in the EU that means if you're in the US you can take a vacation to Italy or France or Germany and then pull that stunt on Facebook. (technically)

You mean soft delete. I'll eat a sock if FB really deletes all of your history. Another one if they make that the default and you only get the other treatment after opting in.

I mean, I am sure they will delete one of the copies of your data they have.

I am sure they aren't purging backups of the data.

Actually, to comply with GDPR, they have to (for people affected by GDPR).

Or have a documented retention policy for backups and a procedure to redelete data when those backups are restored.

Not true. You have the right to retain backups and logs etc. as long as they serve their purpose to secure your service for accidental loss of data or other security purposes and they are properly stored and secured.

What if hacker deletes your Facebook account? Under GDPR Facebook has actually obligation to keep your data safe from this scenario. Which means they have to keep logs to investigate what happened and also be able to restore your data.

You should delete backups after certain amount of time and state your policy to users.

Only if you keep them a reasonable time and the backups will gradually be purged.

You can't keep indefinite backups and comply with GDPR.

So if your 5 year old backup, which has no purpose at all, gets stolen, expect a whopping fine for being an idiot. Or your web logs get stolen and it turns out you keep them 2 years, don't expect favourable treatment as that's totally unnecessary data retention.

No, GDPR requires you to delete all the data corresponding to a user within 30 days after the said user requests deletion of account. That includes backups and logs.

The backups that you can retain are hard to justify further back than about a year (if you even manage to do that), and if you ever use them you have to make sure the data that was deleted because of a request before is not in there again.

You try deleting data from a busy Cassandra node. The tombstones, the tombstones!!!

(More than just Cassandra tho, many databases don't actually "delete", at least not immediately. They "mark for deletion", and may or may not _actually ever delete_ anything.)

The later case is different than simply updating the DeletedAt column.

The database not actually deleting is still the application properly deleting it. If the DB eventually carries that out or not is a lesser concern to me, tbh.

The concern here is that facebook doesn't actually tombstone their entries or doesn't even have their DB mark it deleted.

Well, now it'll have to, at least in Europe, GDPR requires that.

Why do we even use the word "delete" in this forum? We know that (so far) it is NOT deleting anything. It only means "hide from view". Facebook will not forget and will not forgive. Some 10-hour-question-avoiding in front of a committee (irrespective of importance) will not change FB's business model (aka money-maker) overnight.

That's not the sort of thing you can hide. One disgruntled employee would cost FB 100s millions over-night by just reporting it to someone.

We can only hope then..

Hm. Interesting. How about a 'leak bounty'? Or would that be problematic in the eyes of the law?

I'd happily put down $50 for whoever spilled the beans on what is really going on at Facebook and other companies in that vein.

The SEC does something like that already:

https://www.sec.gov/whistleblower

Nice. Pity they put a lower bound in but I can see why they would do that. Too many small investigations would eat up their time.

They'll just delete your user ID field for whatever you posted - so it won't be associated with you any longer, at least on their systems, but they will keep the content for analysis.

If that's true then (1) they're lying and (2) that's not covering it because just a few website visits later they could re-associate your old data with your 'clean' profile because it doesn't take all that many bits to de-anonymize a chunk of data.

That won't work. They also cannot retain data that could be aggregated to identify you as a person. Anonymising by removing an ID is not actually doing that, it's just theater. The GDPR has provisions for that. Bottom line is: if you start fudging things or working around it, you're going to get fined.

The classic switcharoo

He is not afraid of it, any statement he gives along the lines of "Clear your cookies" would be politically damning. An overly dramatic headline could be - 'Zuck, head of evil tracking empire that sells your data, tells everyone that they should clear their cookies which implies tracking is bad'.

Political farce aside, he does have a point, cookies are fundamentally tokens of persistence. Persistent cookies let you configure the websites without creating accounts and stay logged in on the websites you do have accounts on. Loosing that is inconvenient which means it will make parts of the experience worse.

Yep. His announcement was reasonable and as expected.

> "Your Facebook won’t be as good while it relearns your preferences"

Believe me, "my Facebook" isn't very good with the feed with five years worth of tracking... At least I can have my crappy feed with more of a peace of mind, that's a net win, right?

There was an IH podcast where the person being interviewed talked about getting the Facebook pixel up on your landing page as soon as possible.

The idea was that you would have access via Facebook to all the potentially interested people that dropped off because your landing page or product were not yet ready for launch.

From Facebook's perspective, this is data that is valuable to potential customers that want to buy ad space.

IH podcast?

indiehackers.com

Yes, retargeting campaigns are typically amongst the most effective. Hitting people with ads after they have visited your website

Are you kidding ? Imagine the crazy boost to unique views after this!

> I wonder why he's so afraid of people clearing his tracking pixels.

I know, Poe's Law, etc. etc., but I'm truly surprised at the amount of comments missing the dripping sarcasm from this last line of the post. Especially since the adjective "tracking" was used to describe the pixels. I will say that English is my native language though and HN is a diverse group.

>I wonder why he's so afraid of people clearing his tracking pixels

Are you being sarcastic? I can think of several reasons Zuck wouldn't want people clearing their cookies. The primary one being the loss (even though temporary) of data resolution for targeting ads.

Not parent, but this was sarcasm.

Somehow I don't think they would do this without their architecture being based on a pre-existing lower-resolution backup layer to maintain information and support. It's not like the model needs every piece of information coming out of Facebook users - they only need the important stuff and could conceivably delete unnecessary information and not lose anything. Given the massive redundancy coming out of thousands or millions of similar people, the global patterns won't change when some subset of users deletes their information. Even local patterns should be filled in by a fresh influx of data fairly quickly.

The unique views problem is interesting from a marketing perspective though. I doubt it will change much but for larger companies it might require adjustment.

Also interesting that they are allowing a theoretical cap on the information they collect. I imagine they'll be moving more into services to avoid future data privacy issues. That means B2B too, FYI...

I wonder why he's so afraid of people clearing his tracking pixels.

Because that would be the end of a gigantic portion of Facebook ad revenue - which should scare users (if they like Facebook) as well. Without the pixel, Facebook ads will be the joke they were when they were first introduced - hardly effective and a money losing proposition for advertisers. A few big brand advertisers that don’t care about ROI might stick around, but everyone else will leave.

Facebook still has a complete image of the things you like, your social graph, intimate details about your marital status, mobility history, personal messaging and so on.

They can still build profiles orders of magnitude more relevant than, say, Google. The web tracking is just an optimization to get the types of data Google has, too.

Most of their advertisers use the pixel to retarget people. These are by far the most profitable ads for advertisers, and often play a part in a sales funnel in which advertisers may lose money on initial traffic acquisition but make it up and then some through retargeting. Without the pixel, I don't care how many pages as I have "liked," how well they know where I've been, or how many data scientists they hire, they'll never be able to extrapolate that I was considering buying a specific brand of coffee maker at a specific site recently and be able to show me an ad for it.

Retargeting is not just an optimization. For many advertisers, it's the saving grace of the Facebook ads system that produced absurdly poor results before it was introduced. Facebook ads were the brunt of jokes back then, and it will return to that status if too many people use this feature.

Just because we now get the opportunity to tell Facebook to clear the data, doesn't mean we'll get to see it.

Or that they'll tell the whole truth. The data download option that is supposed to contain your personal profile they store doesn't include searches you've made on Facebook, nor Facebook pages that you've visited but didn't like. I know it was being saved because I'm always being suggested friends based on past searches but I didn't see any of those names in the downloaded report.

He's not wrong. If I'm going to be advertised to, I would prefer for it to be targeted.

Reply on news.ycombinator.com