How is “they sent facebook a list with my name on it, and facebook showed me their records showing I was on their list” compatible with the statement “this is NOT data being sent to FB”?!?
> Advertisers may get information from you (like your email address) when you interact with them outside of Facebook, like if you make a purchase in their store or create an account for a rewards program. They can create a hashed list with that information and upload it to Facebook. We can match users using the list to help the advertiser reach people who may be interested in their business and without Facebook learning any new identifying information about you.
I’m not sure what else Facebook does with that information. I wouldn’t be surprised if they use it and send me ads for shoes from other companies.
When you use the custom audience tool they very explicitly don't let you upload any data unnecessary to find matches.
Is that supposed to be reassuring in some way? I don't understand how that really makes the practice OK.
So in FB's documentation, they make it clear that they take the hash of your chosen identifier information (email, ID, etc) and just return the number of hashes that get matched. https://www.facebook.com/business/help/112061095610075?id=24...
They don't tell you who gets matched, and they don't give you a way of providing any other data because they don't trust it.
... Oh, like the data brokers stole the data from me? sigh I hate adtech.
It doesn't matter if they took your name, hashed it and then facebook reversed the hash via a lookup table. Presumably, the fact that they're doing the hash stuff is to give themselves plausible deniability when you tell them to delete all your personal information, and they decide not to.
Here's a sketch of the argument:
- We got a request to delete your info, so we deleted your name and email address and everything with the hash, including the fact that the hash doesn't want to be tracked.
- 10 ms later, data brokers started pumping information about the hashes back into our system, but there was nothing we could do to block it (we forgot the hash)
- We rebuilt your profile to high fidelity within a few minutes, and linked it to all your devices within a day
- The next week a shady app developer sold us info to link your real-world identity to the hashes, but we had to assume this was a new user that hadn't opted out, since we deleted your info.