Hacker News Reader

Comment by crazygringo | Hacker News Reader

> Schrems had complained that Facebook had processed personal data including information about his sexual orientation to target him with online advertising, even though he had never disclosed on his account that he was gay. The only time he had publicly revealed this fact was during a panel discussion.

But processed what personal data? Where would Facebook even get reliable data on users' sexual orientation in bulk? It's not like you can buy that the way you can get credit scores or geographic locations. (Or can you? I've never heard of it.)

I'm very curious for the actual details here. And just because you get ads for products that seem to be marketed to the gay population, what leads the court to determine FB "identified" him as gay? My YouTube regularly has random ads in Spanish probably just because of some bug. Most ads seem to mistarget me, in fact.

View on HN

I'd guess that it's inferred from the content you interact with. If you spend a lot of time liking fireman calendar photoshoots and give no likes to women in swimsuits, there's a reasonable inference to be made.

I'd also guess that Facebook can do this pretty reliably for gender and age, martial status, parental status, and lots of other things.

What if the underlying algorithm simply matches "users who like X also like Y" without having concepts like sexual orientation baked in. And it just happened that it accidentally suggested certain things gay people generally like, because Max Schrems liked that "X" once.

This is where it gets murky. The algorithm could also recover a group without labeling anything — "Latent Group 7539".

Even then, how do you know the algorithm is recommending something "because" of the unlabeled sexual orientation class per se, and not because of some closely associated latent class?

But that's not how Facebook sells ads. It would be one thing to recommend more content like what you've engaged with already. It's another thing to let advertisers check boxes that let them say "sell my product to gay men between the ages of 25 and 35" and to satisfy that without ever having the user tell you their orientation or age. Facebook deliberately crunches the numbers and produces a clear signal from them that advertisers can filter on.

No, that really is how Facebook sells ads: https://www.facebook.com/business/help/164749007013531?id=40...

Creating a lookalike audience is literally just saying "create ad targeting that parallels the things that would target this other group of people". Just because you're not specifically choosing interests or behaviors and instead relying on automation to do the work doesn't mean that's not what's happening under the hood. "Show this ad to mothers" is effectively the same as "here's 100 mothers, show this ad to people like them".

This differs from betting shown recommendations because you're actively being targeted.

Hmm, not exactly. It’s more akin to “here’s 100 customers, show my ad to others who have similar interests/behaviors”. You don’t upload a list of 100 identical customers, nor would that be useful for lookalikes.

And to my point, in no way is this equivalent to "you liked this one thing, so here's another thing you might like". It's still targeting. Facebook isn't arbitrarily showing you ads. "People like this" is what advertisers set, whether that comes from the advertiser checking boxes or providing a sample of similar users is an unimportant distinction.

At no point is Facebook ever making the self directed decision to show an ad to someone that doesn't positively match some criteria that the advertiser specified. That would be wild, and as I said, that's not how Facebook sells ads.

No, it's not selected criteria. Your POV seems focused on an easily explainable classification style model. However, Ads (or any recommender) ML models have been using black box neural networks for a long while now. Lookalike audiences are most commonly used when the Advertiser does not know the criteria - instead hoping FB/Google can magically match their ads with users who are "similar" in web activity or whatever, and hopefully lead to conversions.

It's hard to explain a black box, but for eg, a Todo list SaaS company uploads a list of customers most likely having a diverse set of interests and behaviors. The NN matches more users that all seem like they'd be likely to buy such a SaaS because it figured they're in the market, or have disposable income, or maybe have searched for productivity solutions, or maybe have browsed some competitors, or have the same apriori but unrelated actions as someone who ended up doing the above or a combination of all of these.

> The NN matches more users that all seem like they'd be likely to buy such a SaaS because it figured they're in the market, or have disposable income, or maybe have searched for productivity solutions, or maybe have browsed some competitors

If the audience you provide has none of these attributes, there's no way for it to magically intuit that you want these things from your customers. The neutral net doesn't know what a to-do list is or who uses one. It doesn't know the price of your service. The only thing happening is it's determining which of the signals about the users in your source audience are the most impactful. By supplying the source audience, you're supplying criteria for who your ads should be shown to.

Whether you're explicitly setting those things or not, you're still supplying criteria. You can't swap this system for a recommendation system, they don't work the same way at all.

They do have a checkbox "Sell to gay men"?

Incidentally they removed the checkbox for LGBT targeting in 2022, but that doesn't mean you can't get the same results with other targeting options.

Is inferring something from data you legally obtained illegal or immoral?

Only in tech can you ask a question like this and have it be taken seriously. Which is ironic because we're the people who understand authz vs authn.

I'm sure from their ToS Facebook legally has claim to my firstborn but this is obviously flagrantly unethical. There's too much money to be made behaving unethically for any legal hurdles to exist. There is a reasonable expectation about what you are allowed to do with someone else's data that you're stewarding. And data-mining your users to discover information they haven't and wouldn't voluntarily disclosed you isn't one of them. Hell in most cases accessing that data at all not in service of a direct user request shouldn't be allowed.

There is no reason for Google to access files stored in my Google Drive except to serve them back to me when asked.

I say this as someone who at $dayjob is a steward of petabytes of extremely personal data about people. I/my company would be genuinely be betraying our users' trust if we pulled something like this. Because we could and it would even arguably be useful, but it would be a complete violation of their privacy.

Does end-running around privacy by saying, "well I technically didn't violate your privacy I just compared your semi-private data you gave us/we collected to millions of other people and now know a bunch of private information about you with high accuracy" feel like it would go over well with people?

The short answer to your question is it is obviously unethical unless it is specifically done for a relevant and lawful purpose and it can absolutely be illegal depending on the data protection regime you are operating under. Specifically in the UK and EU, sexual orientation is a highly-protected class of personal information known as "Special Category Data". The UK ICO has actually issued guidance on the legality of inference on this category of data[1]:

   If this is the case, then you are processing special category data regardless of how confident you are that the inference is correct.

   If you carry out any form of profiling which infers things like ethnicity, beliefs, politics, health status (condition or risks), sexual orientation or sex life, you will be processing special category data and must identify an Article 9 condition for processing.

The only article 9 conditions that suffice to make processing of special category data legal are "explicit consent", "not for profit bodies" (under certain conditions) and "substantial public interest" [2]

[1] https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re...

[2] https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re...

Both, as it turns out

> If you spend a lot of time liking fireman calendar photoshoots ...

That could be incorrect if (say) someone was researching fireman calenders for some non-sexual reason. ie boss assigned them the task of writing an article about fireman calenders through history

I'd have to wonder what other weird things such a person would be labelled with, given that they'd probably be researching a bunch of topics every week or so. ;)

>That could be incorrect if (say) someone was researching fireman calenders for some non-sexual reason. ie boss assigned them the task of writing an article about fireman calenders through history

That's fine. It doesn't have to be accurate for every single individual. As long as it's vaguely accurate to bring a targeting uplift, it'll be worthwhile to use.

To add one row of anecdata: I recently got an ad on Instagram (= Meta) for an "only for gay men" holiday resort. I'm straight. Took a screenshot of it because I thought it was funny and I'd never seen it (nor such a place) before.

Facebook (and others) don't just track you on their website. They do so on every website that includes their "like button", "analytics", "ads" and such

Reading your reply I just became aware that I haven't seen a single thumbs up button outside Facebook for maybe ten years. In 2011 they were everywhere and I remember that I implemented them on my personal website. I'm a hobby dev, so that was a big deal for me. How curious!

YouTube still uses thumbs up!

So, you claim that you're not interested in software development, but somehow according to this data we have here, you spend an hour a day reading Linux kernel mailing lists.

Curious.

That'd be explaining by someone trying to "fix the damn disconnection bug with this new usb $THING I bought a few weeks ago".

Stuff like that often ends up trawling through LKML posts trying to figure out wtf kernel might have a fix, potential things to try, and so on.

Probably also by people with zero interest in software development themselves.

You think that people with zero interest in programming are trawling the LKML to fix a low-level kernel issue with their USB device?

I've literally seen it happen, more than once, for all kinds of devices (not just usb). :)

Ah, you're in good company. I also keep an archive of saved gay porn videos due to my academic interest in homosexuality.

???

FB trackers that phone home on various websites, for one.

Why do you think you can't buy that? These companies have been building up profiles on millions (billions?) of people for many years now. It is not unreasonable to think they could infer stuff that they don't directly measure. Nor that these profiles would be shared/sold.

They can infer it from your friends who do publicise it. Same as political views, etc

The GDPR does not care about the specifics of tech.

The GDPR does not care if FB has a database column for “sexuality” or if FB never gathers that information directly. All it cares about is the fact that Facebook process personal data, and, using some of the data Facebook processes, sexuality can be inferred.

I think we in tech get hung up on technicalities, while the GDPR was specifically written to be as citizen-focussed and tech-agnostic as possible.

Regardless, this specific ruling seems a bit odd-it implies that FB took a fact he mentioned in a panel discussion (not on the platform), and used that information to serve him targeted ads based on his sexuality.

I have no idea of the mechanisms he supposes led to this.

Reply on news.ycombinator.com