You Can Now Tell Facebook to Delete Its Internal Record of Your Face | Hacker News Reader

You Can Now Tell Facebook to Delete Its Internal Record of Your Face

onezero.medium.com

296 pointsGarbage165 comments

I'll speculate that facebook will never "delete its internal record of your face" as the title states. They're using misleading words to make this sound like a significant concession, when it isn't.

Suppose Alice appears in photos with Bob. And that Carol appears in other photos with the same Bob. Facebook can infer the Alice..Bob..Carol relationships.

If Bob "opts-out", facebook will still know that Alice appears in photos with unnamed person, and also that Carol appears with same unnamed person. So they'll infer the Alice..unnamed person..Carol relationships.

If, hypothetically, facebook offered Bob the option "do not use my face in your algorithms." Then maybe they wouldn't link Alice and Carol. But all facebook is offering here is "don't associate my face to my account".

This cleverly gives facebook some cover. Bob might ask facebook, "don't use my face to surveil my friends", but facebook can say "how could we possibly do that? We don't associate your face with your account, so we can't associate your face with your preference, even if we wanted to."

We'll end up with a website called "Do Not UseMyFace" and you'll take a picture of your face and upload it to the FCC in an effort to stop RoboFacing.

Which will ensure that not only Facebook but also every other social media outlet will now have your face tied to your identity.

No no you ruined the joke that comes 15 years later!!!!

They might as well call the site "PleaseHackMe."

From the article:

"When you opt out of facial recognition on Facebook, the company will delete your template, meaning it will have no original reference point for your face and therefore cannot find your face at all."

...

When people turn off their face recognition setting, we can no longer create a face template for them for any purpose, including A.I. research,” the spokesperson told OneZero.

I think d10 is saying that, by deleting your face template, they will still have "unnamed person 7749" in 45 different photos, which happen to be YOU, which they won't every say again, but you're still in there, linked up to all those people... possibly creating new relationships between people that don't have the same friends but went to the same wedding, all because you're in both sets of photos.

Exactly. They're not promising not to create co-occurrence matrices with a specific unknown user as far as I can see.

No we don't. See https://news.ycombinator.com/item?id=20903110

Ok, sounds good and I belive you - it is nice hearing from the team directly involved in this project.

Sounds like they'd have to have my face on file so that they'd be able to identify "oh yeah, this is one who has opted out".

How else would it work?

That’s not accurate. If you are not a user or don’t have the FaceRec setting on, we will not create a Face Template and won’t be able to recognize you in pictures.

Source/Disclaimer: I work at FB and this feature is managed by my team.

Unfortunately, I am unable to trust your words at this moment in time. I'm sure many others will agree.

While I desperately want to trust you on a human to human interaction, and I genuinely do want to trust you, we’ve been misled with disingenuous language by companies at FB’s scale so many times for years, I’m finding it difficult to trust FB at all—it isn’t you, at all, it’s Facebook’s and similar companies intentional fogging of language which leads do this distrust.

And while I do want to trust you, I can’t trust that the company/industry itself wouldn’t figure out a way to exploit it at a later date :(

It really does make me sad that I can’t trust what you’re saying, i think a fundamental part of humanity is wanting that level of trust, and it’s been intentionally exploited.

I totally agree with you. I will never trust what Facebook says. And not only that. When I look at pesenti's clarifications, the only think I can think of is: "They will probably start safe and really not create any face templates for now (during people's attention is on this topic), but after a few weeks/months (when the topic is no longer discussed) they will start doing it anyway. That is the amount of trust I have for Facebook (and Facebook is not alone in that category). Nothing good can ever come from Facebook.

> I work at FB and this feature is managed by my team.

How do you feel working at Facebook? Do you feel pressure from your peers on the outside about the moral compass of the company?

Maybe you can't answer these things if you aren't using a throwaway account, but I'm very interested in hearing how Facebook employees perceive the company themselves, as well as how they're treated by company outsiders.

My impression is that a lot of engineers are opposed to how Facebook operates and that this reputation must make recruiting and retention difficult.

> How do you feel working at Facebook?

See https://news.ycombinator.com/item?id=19036507 or https://news.ycombinator.com/item?id=20768607

> Do you feel pressure from your peers on the outside about the moral compass of the company?

Pressure is too strong a word. I do get into discussions with friends and family on the topic.

> My impression is that a lot of engineers are opposed to how Facebook operates and that this reputation must make recruiting and retention difficult.

That's mostly not accurate. Remember that these engineers can freely express their opinion internally or question Zuck live every week.

> My impression is that a lot of engineers are opposed to how Facebook operates and that this reputation must make recruiting and retention difficult.

In machine learning and computer vision they are a very desired company to work at, at least on the research side of things (FAIR). They have very good people and world famous ones, lots of powerful hardware to work with etc. I'm sure they have no problem with recruiting brilliant people from all over the world.

Let me guess: it defaults to on?

No, it now defaults to off. New users and users who only had the “tags suggestions” setting have that setting off by default.

This doesn't sound like the use case that the parent comment was describing. Parent comment was about what is inferred if you are a user and no longer have FaceRec setting on, but used to have it on at one point, and opted out. That's why the speculation was that "facebook will never "delete its internal record of your face" as the title states."

Edit: not to be snarky, because I'm pretty sure that wasn't your intention, but it sounded like you were doing exactly this:

> This cleverly gives facebook some cover. Bob might ask facebook, "don't use my face to surveil my friends", but facebook can say "how could we possibly do that? We don't associate your face with your account, so we can't associate your face with your preference, even if we wanted to."

Everyone understands how opting out works and what it means (I mean, some of your bosses pretend they don't, but even they do). Of course you can't create a template when the setting that disables template creation is on. The question is what do you do with data that you inferred in the past, and what kind of privacy can be expected if you opt out of a feature after it's been used. That's particularly important given this industry's history of opting in for you.

The problem is that language is ambiguous and it’s important to be accurate. I do believe that intent wise, it answers the question the way you would prefer. Let me explain.

In the case you describe, Facebook no longer creates a Face Template, that is some kind of ML model of your face that could be used to recognize it or identify that you are the same person appearing across new pictures.

But I can’t say Facebook no longer has a record of your face. It still has some pictures, uploaded by your friends, where you appear. It won’t know that it's you OR and if your friends upload two pictures where you appear, it won't know that the same person is in both unless they tag you manually (which they can only do if you are user and authorize them - but that's a different setting).

Thanks for taking time to reply to comments here.

If I understand correctly, when facebook detects faces, it does something like...

    compare face to all Face Templates
    if match
        associate picture and face with matched user
        (maybe also update Face Template of matched user)
    else
        discard data structures created during compare
        (maybe mark face as "already compared")

If the data is truly discarded, great! I'm glad if my earlier speculation is not what happens.

question: how can I ask facebook to disable facerec for me, as an ex user who disabled his facebook account ?

https://news.ycombinator.com/item?id=20901808

You have deeply questionable morals

What happens to unknown faces in photographs, you just discard them? What if I have 1000s of photo of aunt Emma, but aunt Emma is not on Facebook. When she eventually joins, and turns Face recognition on, will you rescan all my old photos to identify her? Or will Face recognition only work for new photos?

We don't discard anything because we don't specifically identify or recognize these faces in the first place.

I don't think we go back to old photos, I suspect it would not be practical. But I am not positive on this one.

What do you mean by not specifically identifying or recognizing these faces?

When a face -- which is unknown to Facebook -- is found in a photo, is that face used for graph building? Is a anonymous representation of it kept?

No: https://news.ycombinator.com/item?id=20903110

Don't you have to try to identify a face first, before you can decide you don't want to identify it? I don't see how it can work if you don't try to identify every face.

You identify that there is a face yes, that's face detection, https://en.wikipedia.org/wiki/Face_detection, which is not the same as face recognition and doesn't need a model per person.

No I mean you have to try to recognize the face. Otherwise you can not decide whether the face is from a person who wants to be identified or not.

I don't see how it could work any other way.

There are gaps in your use of language here which is exactly what the parent is talking about. Facebook could turn around later and say "we never said anything about a Face Stencil".

Can you elaborate on the "gaps"? See my other answers. I am trying to be as precise as one can be.

But on each picture you automatically recognize when there is some face. And you need to be able to learn new faces. So doesn't it make necessary for somewhere in the system to be your face model in order for system to decide to ignore it? Not my field so I'm clueless but I would assume that without such hidden model it would be more likely to match the next most similar person? (I'm guessing social network is also taken into account to make such mistakes less likely?)

The point is your algorithm will still need to detect "a" person in order to confirm it's not a person who has opted in and should be scanned

Exactly. You still need to detect which person is in the photograph in order to determine that it is a person who has opted-out. This feature is an incredibly half-assed PR attempt.

This is getting tiring. I have to submit a form to tell Facebook to delete data about my face. Submit a form to opt out of binding arbitration for each credit card. Submit a form to avoid being tracked. This whole mess puts a huge onus on the average internet user, and acts like it's the user's own fault if they're every movement and action is being tracked by a hundred entities at once.

Yeah, i get that there might be some people who only want to delete a few particular things, but there should be blanket options for entire categories of data, and any tracking/marketing data about you that you yourself did not provide to them.

I've never had, and intend to never have, an account with Facebook or any of their services.

Can we please have sane legal defaults like Facebook ONLY having data profiles for those who have agreed to the creation of such profiles?

Sane legal defaults are great and necessary, but not enough. Google has iffy GDPR compliance to begin with and has now been caught circumventing it.

Nothing will be effective short of jailtime for the execs responsible for flouting laws and public trust (not for making a mistake, but actually engineering workarounds).

Thing about that, Facebook is known to construct "shadow profiles" of people who don't have normal profiles, just to correlate all of the data they happen to gather on you from having their tendrils on half the sites on the internet. It might be better off to create a profile with your info just to turn off as many things as you can, and not interact with anybody on it.

...yeah but how will you ever get them to delete all the forms you've submitted?

It’s forms all the way down!

You’re absolutely right - it should all be opt-in. The issue it would seem is that it would no longer be profitable for these companies. I’m also tired of company profits over citizens privacy.

It should be societies preference to create the individual property rights for the individual. If a company is profiting off peoples likeness then peoples likenesses are a personal property. Blows my mind that a capitalist society doesn’t get this instinctively and demand it.

And then at the end, they don’t even really abide by those forms anyway. It’s like getting Shell to stop selling oil or Merck to stop selling drugs: Facebook isn’t going to stop doing what its entire raison d’être is until we use the iron force of law to make it so.

The feature is now opt-in. It is turned off for all new users and for those who only had the "tag suggestion" setting on.

Disclaimer: I work at Facebook and this feature is managed by my team.

More correctly, that's a 'Disclosure', not a 'Disclaimer'.

Thanks. 20 years in the states and still not getting it right at times ;-)

How do I do this if I’ve already deleted my Facebook profile? I know Facebook is still holding some data on me because the “that account doesn’t exist” page it shows when I type in my former account email is subtly different than the page when I type in an email I know doesn’t exist.

I am in the same boat.

Exactly my problem too. It almost feels like I have to have a Facebook account just to opt out of Facebook's tracking. Furthermore, and as others have stated, what about all the time my face may appear in other's photos?

If you are not or no longer are a Facebook user or you do not have the Face Recognition on, we will not create or store a face template to recognize you.

Source/Disclaimer: I work at FB and this feature is managed by my team.

I deleted my FB account a few days ago, and reactivated it today (within the 30-day permanent deletion cancel period) to see if I could delete FB's record of my face data. Like some others in this thread, I couldn't see any option to do so.

Do I need to wait for this option to be rolled out to my account (and how long will that take)? Can I delete my account anyway without this option having shown up? (While ensuring FB doesn't have records of my face?)

Does this count for backups, too?

Is this feature related to the face verification Facebook sometimes does on new or old accounts? (where they ask you to submit a picture of your face to verify your account is real)

Recently I created a new account after not having one for a while and failed the face verification thing. I wonder how that can even be possible if not that they have an idea what my face looks like already and it wasn’t the same as the one I gave.

What about having a disabled account (the option where you can continue to use Messenger)? With a disabled account you can't log-in to check the settings because Facebook will automatically enable the account again.

But will you delete a face template when a user deactivates his/her account ?

Of course I can. The question is - will they actually delete it everywhere inside their data storages or will they just send me a 200 response code.

And what exactly does "delete" mean? It's removed from production, or it's also scoured from backups?

After I give them the data required to prove I'm authorized to delete the template, what happens to that data?

Trusting Facebook... rather jump down a well.

It is deleted, then added to a list of deleted faces.

Just so they can be sure not to re-add it later.

Yeah. That's it! And they're sticking with that story.

Sensing another Zuckerberg promise "to do better" in the works already.

At Amazon new products have a press release written during the spec phase (to help frame the pitch internally); I presume, at this point, fb writes an apology during spec phase...

Has he already apologized for the recent release of a half billion phone numbers?

Hey, we have just gotten a enormous phone directory for free! Why are you complaining?

Unless you want it restored in which case they'll undelete it for you. It's good design to provide an undo option after all.

Undo options are user friendly! And what if you really actually want them to use your face data, but hit it by accident? Maybe it's best if they just ignore the request all together. That way you can both feel good about things, users think they got what they wanted, and Facebook actually gets what it wants. Everyone wins. Except the user, who loses.

It's a face backup. In case you lose the original.

One has to wonder if they'll make a model of deleted faces.

Their definition of "delete" is to dissociate your identity from the data pieces. There's no true way to splice out a person from their database otherwise

Allowing regulators to look at systems, data and source code is the inevitable conclusion of this madness where software companies say one thing and do something completely different.

What could possibly go wrong with that...

Yeah this is all starting to feel a lot like what the NSA's definition of observing data is.

My guess: delete flag set in db, data remains but is ignored.

Is it even feasible to scour all their backups? And I don't mean the hot backups, I mean the annual data dumps stored on tapes in a data archive built in a cold war nuclear bunker somewhere in the Rockies.

Are they really using the word "delete"? I know this is pretty much forbidden in Google world.

yeah and what about future images, will they be associated with a shadow profile?

Is it deleted from the models? Clearly they aren't doing that. Do they fine tune their models so they can no longer identify you from your photo? I'd also doubt that. More clarification on deletion is needed.

Most often this is solved because the model is retrained only on the current data every N days.

Probably not. Because I imagine they aren't retaining off the original data but rather doing an online method. This means the network retains information about those images.

Yeah, if it's already been shared with commercial partners, or especially, if it's already been shared with government agencies, the cat is out of the bag. Not really sure what can be done to regain control of that data?

But, hey, at least FB will "delete" it!

So, yeah, I guess there's that? :(

*202 never to be executed

I can't find the setting to disable this. The EFF says they "have questions" about how Facebook is implementing this.

"Throughout Facebook’s deliberately vague announcement, it takes great pains to note that the change applies only to new Facebook users and people who currently have the “tag suggestions” setting. However, Facebook migrated many, if not most, existing users from “tag suggestions” to “face recognition” in December 2017 (see here for Facebook’s explanation of the difference between tag suggestions and face recognition). That means this safeguard does not apply to the billions of current Facebook users who have already been moved."

https://www.eff.org/deeplinks/2019/09/facebook-changing-its-...

The URL when I found it was: https://www.facebook.com/settings?tab=facerec

If that URL doesn't work I went to Settings and there's a tab for "Facial Recognition" on the left rail. Between "Language and Regions" and "Notifications"

I really appreciate you posting this.

Just to confirm my experience: when I click on that link, I see "General Account Settings" (like name, username, contact... Everything that's available from the first left-hand menu choice.) And no where in that left-hand menu is there any choice about Face Recognition.

I do have a left-hand menu choice about "Timeline and Tagging" -- but there's still nothing there about face recognition.

Here's what my left hand menu looks like: https://imgur.com/a/dFPibMc

I'd guess that it's a feature that's being gradually rolled out to all accounts.

I originally posted it because I was frustrated that I didn't see a link to the setting in the article, but I guess I understand why there was no link.

My left-hand menu looks exactly like yours -- but without the "Face Recognition" choice. (After "Language and Region" my next choice is "Notifications", with nothing in between.)

Thanks for posting the screenshot.

I just noticed the last line of Facebook's (Tuesday) announcement.

"These changes will be effective globally starting today."

Can't figure out why I'm not seeing them.

I don't know if this is supposed to be new, I found it and it was already set to "no". I think I turned it off on one of my privacy kicks a year or two ago, not sure exactly.

This is misleading to the point it's almost propaganda. From Facebooks announcement [1]

> ... if you’re in a photo and are part of the audience for that post, we’ll notify you, even if you haven’t been tagged. You’re in control of your image on Facebook and can make choices such as whether to tag yourself, leave yourself untagged, or reach out to the person who posted the photo if you have concerns about it.

[1] https://newsroom.fb.com/news/2017/12/managing-your-identity-...

What the even what. This is double speak.

"We've got all the data we need, you may now opt out" ¯\(°_o)/¯

Shouldn't it be that I have to tell Facebook what they are allowed to keep?

Especially since I have never had and never will have a FB account.

That's what you think. Your shadow profile is probably there, waiting for you should you ever claim it.

More info: https://newsroom.fb.com/news/2019/09/update-face-recognition...

The feature is now opt-in. It is turned off for all new users and for those who only had the "tag suggestion" setting on.

Disclaimer: I work at Facebook and this feature is managed by my team.

I deleted my facebook account years ago — how do I delete myself?

If you are not a Facebook user or you do not have the Face Recognition on, we will not create or store a face template to recognize you.

Is that the truth or will a court later fine your company for lying?

When you ask hypotheticals like this, it comes across as an attack. When you attack people, they stop showing up to share their unique knowledge and experience.

Facebook's chronic underhanded tactics requires one to ask for confirmation. The onus is on the dishonest party not the victims.

Good that he asked... we all should more.

When are you going to fix the 2FA account issue I noted last year? I'm beyond responsible disclosure times, y'all have been totally silent (which has had the consequence of me being unable to access my account for a year) and I think I'd like to be going public with it really soon.

I appreciate you coming here and commenting.

One question, do you construct "templates" for faces that are unmatched by existing templates that are correlated?

This would allow a shadow face recognition profile to be generated that could be later matched to a known image.

I've had face recognition turned off anyway, and I'm not particularly concerned about it, I'm interested though in how internally FB manages "unknown" images, shadow profiles etc.

No we don't. I answered in more details here: https://news.ycombinator.com/item?id=20903110.

What do I have to do to get facebook to delete this after I already deleted my account 3 years ago?

Seconded, I'm in the same boat. I realize attempting to wipe my data from all the various sources it may be in across the web is futile but I'd still like to try.

Until Facebook states they won't store/analyze faces they can't recognize then everyone who has never had an account or deleted their account are at a disadvantage.

I've always wondered if COPPA could be used against Facebook with regard to this. Theoretical situation: I'm a parent and I find an image of my child (under 13 years of age). Facebook never notified me of they were storing my child's image. Facebook would argue they didn't know. But Facebook already scanned the image and likely guessed the child's age - and knew they were under 13. In that situation Facebook should be required to remove the image based on the fact they cannot notify the guardian. I realize this would have severe repercussions to their operational model, but that's also the point. Or... If I find an image Facebook didn't notify me about - then I'll take that $42,000 per image.

Seems fair.

>When you opt out of facial recognition on Facebook, the company will delete your template, meaning it will have no original reference point for your face and therefore cannot find your face at all.

The details are pretty sparse. It would be nice if they clarified how they manage black-listing your template ID somewhere but still disconnect it from your profile. If you opt-ed back in at some point, they need to know to remove you from that black-list, which might imply there's still some sort of connection from your profile to a template ID or maybe the generic template still exists but they're disallowed to associate it to a profile and it's in some shadow table?

Plus, just as another layer of "I don't trust this". I have to re-unsubscribe from AT&T's job search newsletter every few months because of what I assume is a new wave of recruitment emails being sent from an older mailing list. Doesn't matter how many times I unsubscribe, that backup will always have my information on it and that service only refers to that backup.

My only assumption is that Facebook is too big to properly manage that piece of specific knowledge and will delete it, but I'll still be there somewhere. Or I'll magically opt back in because of something like Messenger or whatever. Considering the news about Google circumventing their own GDPR restrictions, I just assume these companies aren't following through with any of their promises.

> I have to re-unsubscribe from AT&T's job search newsletter every few months because of what I assume is a new wave of recruitment emails being sent from an older mailing list. Doesn't matter how many times I unsubscribe, that backup will always have my information on it and that service only refers to that backup.

That sounds like a violation of the CAN-SPAM act, and you could consider suing them.

Yes, but the hassle of deleting their email once every few months isn't enough to make suing them worth it. Plus, that doesn't really resolve the issue that requesting to be take off things doesn't actually remove me (the original concern of these comments)

You might be able to get some money out of them, though

You seem to be ignoring the rest of the issue entirely.

This is great for the new users it appears to apply to. But what about people like me? I haven't had a Facebook account in seven years. Yet, I'm not delusional to believe they don't still have my data (yes, I "deleted" it) along with my picture. So every time my wife posts a picture with me in it to Facebook, they know where I am.

I still can't use it and won't be able to, probably forever.

I'm not on Facebook and I don't have plans to become part of that thing for the next two centuries or so, but a lot of people I happen to share the same geographical coordinates do. They take and upload photos at events thinking everyone wants to appear in their videos. Now imagine -as someone who strives every single day to stay away from that platform and all associated things- playing an instrument at a dinner and realizing there are no less than half the people there pointing a cellphone at you. How in the Universe can I ask people I don't ever recall the name not to shoot videos of me, or at least not put them on Facebook because once they do I can't ask Facebook to delete them because I don't have a Facebook account?

The real problem here is that I am already somewhere on Facebook since forever although I firmly refuse to be part of it, and I have no way of telling them to delete all my data, short of making an account, which would negate everything I am struggling for. This is crazy.

A while ago I proposed somewhere (probably here, can't recall for sure) a barcode which if shown (worn?) tells the system used to shoot the video that the associated human doesn't want to appear, so that the whole person is deleted from the scene. Now that the random-faces technology has progressed, I would add some AI that swaps that person with a fake one so that the photo won't be ruined by an empty area.

In the meantime we could create human readable symbols telling if and how we want our image to be used and instruct people how to use them, then one day hopefully if someone posts a photo of me while wearing a patch/shirt/whatever with a crossed camera, I can force that person to delete the photo or sue the platform that keeps it online. Of course there should be exceptions for well known public figures and/or public officers during service (read: the heck I'm not uploading a photo of say police abuse even if the cop wears a 5 meters wide photo of a crossed camera!).

What infuriates me is when parents do this to other people's children without asking. It's now just a given you'll be uploaded onto some giant corporations systems from birth to death.

Can anyone figure out how to actually turn this off? After bouncing around in Facebook's help docs I found the steps[1] but don't see the option.

Click the down arrow at the top right, then Settings. There _should_ be a "Face Recognition" item in the left but not for me.

This is so frustrating and part of me thinks they just disable this for a bit so 90% of people forget.

[1] https://www.facebook.com/help/187272841323203

I checked it in the Android app, and I was able to find it and it was already deactivated. I remember doing this a while ago. But it was burried in Facebooks settings. Here is how you can do it on Android.

1. Click on the menu icon (three horizontal lines) in the top toolbar. 2. Scroll down, expand "Settings & Privacy" if not expanded, and click "Settings". Don't fall for those privacy shortcuts. Facebook will hide a lot of settings from you. 3. Scroll down and you should see the " Face Recognition" entry in the Privacy category.

Hope this helps.

PS: I personally find it lame, that Facebook needs to make it as much confusing as possible to find those settings.

>It’s an assurance that Facebook isn’t actually retaining data that it could use again someday to recognize your face.

Given fb's history of lying, it's only an assurance that they won't overtly use such data. No guarantee that they're not still storing it on a server somewhere, and good luck proving as much.

Also, what does this mean for people without accounts that are being tracked? I wonder if facial data is collected on them too, after being labeled by friends.

Where has Facebook been caught lying?

They've surely done many things you don't like, but they've not lied about doing those things.

For starters:

techcrunch.com/2018/06/27/study-calls-out-dark-patterns-in-facebook-and-google-that-push-users-towards-less-privacy/

www.cnet.com/google-amp/news/facebook-accused-of-misleading-advertisers-then-trying-to-hide-it/

theguardian.com/commentisfree/2018/dec/20/facebook-violating-privacy-mark-zuckerberg

FB's entire business model is fundamentally in conflict with any semblance of privacy. Why anyone believes anything that comes out of Zuckerberg's mouth is beyond me. FB is built around exploitation of user ignorance, apathy, and unwarranted trust.

Make no mistake, no matter how much these dangerously charismatic CEOs speak about positive changes to society, modern large tech companies are 100% self serving and always engaged in carefully prepared corporate doublespeak. They don't give any kind of a shit about your privacy when it is directly tied to the bulk of their revenue. What motivation does fb actually have to delete facial recognition data like they claim, as opposed to just quietly storing it somewhere on the back end? There's no legal requirement and if they get caught, the only people who would care are the kind who by and large have already moved off FB. Meanwhile the upside is huge for future facial recognition applications - this is a massive goldmine of very sensitive personal data.

From stallman.org: Facebook made deals for phone and computer manufacturers including Apple, Amazon, Microsoft, and Samsung to access data about its useds and their friends as well. These deals seem to still be operative. [1]

When Zuckerberg testified to Congress, he said Facebook had stopped doing this years ago [2]. Apparently he lied.

1: https://www.nytimes.com/interactive/2018/06/03/technology/fa...

2: https://www.commondreams.org/news/2018/06/04/sure-looks-zuck...

I've had this setting disabled for I want to say over a year now. Was I part of some early pilot or something? I followed the instructions here (https://www.facebook.com/help/www/187272841323203) and it was already set to "No". What the heck?

FB is known to build profiles of pretty much everyone it encounters, even vicariously, ostensibly to be able to populate a new account with engaging info once they actually join.

Can I tell them to delete the records of my face that they keep even though I don't have an account?

And, of course, in all instances. will they actually expunge it from all locations in their data-universe?

How does a person without a facebook account accomplish this though? Even without an account it’s likely that fb has several dozens of photos of me via other people’s posts.

It'll be extremely difficult for the face-identification algorithm to not run on your face without remembering what your face looks like. Their algorithm is probably a two-step process: find where all the faces are in the photograph, and then attempt to match the found faces to user profiles. It's extremely probable that every failure-to-match gets logged somewhere, and probably annotated with extra data. Will Facebook wind up deleting your facial recognition data only to recreate it without the tie to your profile? It seems extremely likely, unless they keep some list of "deleted faces" and tell the match-to-profile algorithm to discard any results from that list. And that seems very different from actually deleting your face record.

Sorry, but... So I don't have to go hunting for it (and get stuck in facebook land reading updates!) can some one provide a link to the place where this setting resides? Thank you!

Yes please. I hate articles like this that tell you what Facebook will now allow you to do... but don't give you the actual link where you could do it yourself _right now_. Makes me think these articles are actually Facebook PR which wants to control the narrative on the feature and deliberately not make it easy to find where to do it.

Can I opt out if I'm not a Facebook user? i.e. opt out of having them store records of my face?

PS don't tell me they don't have records of my face

This help page[1] claims you can go to Settings > Facial Recognition, but I don't have that option under Settings...

[1] https://www.facebook.com/help/www/187272841323203

Okay, but how will they know if the face they found is yours, and thus should not be found?

This is actually an exception that GDPR makes for storing data - companies can keep around some sort of record to "tombstone" users.

Sort of. GDPR is so woefully under-specified in some places, and general in others, it's really entirely up to the will of the regulators what would count as a violation.

I wonder about this too. They say they delete the template (the statistical model they know is your face). Ok.

So now I register a new fb profile, using a picture of you, opting in to facial recognition. Now what?

They can't match the picture against your profile, because they've deleted the template?

And they totally will from most of their archives wink wink. Who is really capable of verifying this actually happens that doesn't also have a vested interest in Facebook?

I shouldn’t have to tell Facebook to delete something it should never have had to begin with. How are we going to force Facebook to stop doing terrible things forever?

The article makes it sound like an ominous surveillance feature with not justifiable product reasons, so I should point out that this powers beneficial features like face recognition for image accessibility. Thanks to face recognition, blind people can know who's in a photo.

https://www.facebook.com/accessibility/videos/new-face-face-...

Remove yourself if you want to, but people should be aware there's also a useful side of this.

That there exists useful product reasons is beside the point. The point is that people who don't want their data to be involved should not have their data be involved.

Yes, it's good that you can opt out now. But I think articles like this are doing a disservice by glossing over the negative effects of opting out.

People choosing to remove their data from this should be aware that if they have visually impaired friends on facebook (or even friends of friends, depending on sharing settings) you will be degrading accessibility features that they probably use.

And it's great to let people make their own choice about whether they're OK with Facebook having face recognition of them, but encouraging people to disable it without at least mentioning that image tags are an accessibility feature is a dick move.

It's framed as just "this will remove features that you might not care about," but blind people need the image tags more than you do.

So, just to be clear.. when a person signs up for.. wait for it... Facebook... they shouldn’t expect that Facebook has an image of their... face?

Surely after their AI neural net thingamybob has absorbed your face, FB doesn't care about deleting your face, as their model has already benefited from it?

In other words, they've trained their models enough that they can now be ethical about this one particular piece of data.

Is this for the people who haven't already legally prevented FB from using your face? I fixed this years ago by copypasting a legal message on my FB account refusing FB this permission. They have no right to use my photo for any means whatsoever without my express written permission.

Give me physical opt-out. A "robots.txt"/do-not-track for computer surveillance spiders. Let me wear a necklace or QR code on my shoulder, and any commercial face tracking software, is required to create a big black blindspot where my facial micro-expressions used to be.

The implication that everyone is forced to do something, forever, in order to not have their privacy violated, is a little silly. Explicit opt-ins should be the only legal method.

And then the minute it even isn't slightly visible, Facebook et al will likely take that as you consenting.

Despite the headline I don’t see anything about deleting data. Just that it won’t try to recognize you.

That being said, I went on my profile to check and it was already set to No (don’t do facial recognition). Is this the default? Or is this actually an old thing that I disabled a long time ago.

So how do I do this if I'm not a facebook user? you can't even contact facebook by email to tell them to stop sending spam because they've allowed another user to sign up using your email address - they have no outward facing public email address

I read this as "You can now 100% confirm to Facebook that, indeed, that is your face".

...and Facebook will tell you it's deleted. But why should anyone believe them?

How do you do this if you no longer have a Facebook account? I am sure they have my data but I deleted my account several years ago and I don't plan to reactivate it.

Interestingly, I just went into my account and I was already opted-out. Is this the case for everybody? If so, that's a very surprising move coming from FB.

I can "tell" them. What a farce.

Until the title reads "New Law Criminalizes Sale of Private Data Without Consent", this crazy train will never stop.

How can I, someone without a Facebook profile, ask Facebook to delete my internal profile?

I deleted my Facebook account months ago. Does that mean all of the other records were deleted?

Of course they don’t delete it, which is why they know not to automatically tag you.

okay....so how do you opt-out?

You can now tell the Queen of England to make you a Knight!

Didn’t this happen over a year ago? (in the EU at least)

https://www.wired.co.uk/article/facebook-facial-recognition-...

I mean you could always tell Facebook to do whatever.

"You can now tell Facebook to " $*

Slowly, with me, now:

Hah. Hah. Hah.

uh oh...here comes the facial data leak

yeah? Zuckerberg promised? suuure

What do they mean by "delete" ? Is this only FB? What about its 279387429 other connectors

Reply on news.ycombinator.com