What Facebook Knows

Ever since the Cambridge Analytica scandal revealed that a data analytics firm in the UK was able to obtain the personal information on 87 million Americans from Facebook to target them for political ads in the 2016 presidential election, Americans have looked at the ubiquitous social media giant askance. That this particular event broke through the national consciousness in a way that privacy advocates’ years-long warnings have not may have as much to do with an unprecedented partisan divide as anything else.

Since then, news of the extent of personal exposure of Facebook users has grown worse by orders of magnitude. Facebook has admitted that it allowed 60 different device manufacturers, including Apple, Samsung, and Huawei, to mine users’ data without their knowledge or consent. In April 2018, Facebook further confessed that personal information on over two billion people—in other words, virtually all users—had been “scraped” from Facebook by bad actors. That Facebook has now disabled the feature that allowed that scraping is an egregious example of closing the barn door longggg after the horse bolted.

If you are a Facebook user, and the preceding paragraphs are making you wonder uneasily what info they have on you and what it means, then read on. You’ll learn how to see at least part of your data profile, hear from digital cognoscenti what they found in their own Facebook data, and see what I saw in mine. You’ll also hear about the unknown quantity of information that FB admits it has collected about you, but refused to discuss when asked about it…information that is conspicuous in its absence from the data-set on users they do acknowledge and share.


Log on to your Facebook account.

Click on the down arrow at the top right of the page and scroll go down to Settings, just above Log Out.

After you click on Settings, you are on the General Account Settings page, and your first option is go to your personal info. You can choose to access the information without downloading it or download a copy.

If you choose to download a copy, on the download page, click the Create File button and then stand by. The longer you’ve been on Facebook and the more active you have been, the longer this will take, but Facebook will notify you when the download is ready.

Facebook has already greatly expanded the information it makes available to users on how the corporation tracks activity across the web in just the last few months, and has announced it will make even more information available in coming months.

The first time I downloaded my info from Facebook, about four months ago, this was the list of files it produced:

Facebook files April

As of July 2018, that list of files had grown to:

Facebook files July

Comparing the two data sets, the most recent download process was easier to navigate, and clearly Facebook is providing much more information as well. Significantly, there was no search history, location history, or calls and messaging history in the data set available to users just a few months ago.

Now, before you start digging into your info, take a DEEP breath.

This will help you not become nauseated in a few minutes when you start to realize the amount of information Facebook has on you—information, it is worth recalling, it has shared, both by design and accidentally, with an undetermined and unknowable quantity of individuals and organizations whose ultimate intentions are opaque. (One thing we do know for sure is that information scraped from Facebook makes users far more vulnerable to targeted spear-phishing emails, because cybercrooks can use data about personal interests to uniquely appeal to their targets.)

Tim Brown, owner of the Hook Agency in Minneapolis, who regularly uses Facebook to advertise, was less than pleased when he started looking at his personal data. “What I found wasn’t shocking, but definitely left a bit of a lump in my stomach, as some things were accessible that I don’t feel like reflect well on me professionally. I started deleting old images and videos after some examination, as well as deleting 25-plus app and business integrations that I don’t use anymore or didn’t know existed. I’d strongly suggest people take a look at what’s available about them out there—if not to just do a little house-cleaning.”

Alec Sears, a communication specialist with Frontier Communications had a similar reaction. “As a marketer, I understand the importance of data, I really do…I thought I favored privacy over convenience until I got a look at my Facebook data. I suddenly became painfully aware of how often I clicked Log in with Facebook so that I wouldn’t have to create a new login and password. Apparently, 67 times. Convenient? Yes. More risky? Absolutely.

“The amount of people who have me in their advertising list was shocking. Based off of clicks that I don’t remember, Facebook is intimately familiar with my Batman obsession, my pop culture inclinations, and my political leanings.

“On another note, the number of videos I’ve watched on Facebook is frankly disturbing. I thought I was scrolling Facebook to get caught up on the lives of my friends and family. Turns out I’m actually scrolling Facebook for several hours a month in search of mildly entertaining video clips.”

So Many Advertisers
As you peruse your data, you will likely find some the biggest surprises under the “ads” data, including a list, “Advertisers that uploaded a contact list with your info.” These are companies that have already obtained some information about you and are looking to find whether you are on Facebook to reach you there.

You will almost certainly be baffled at the number of them. Just as strange will another list, “Advertisers you’ve interacted with.” According to Facebook, “These advertisers are running ads using a contact list they uploaded that includes your contact info. This info was collected by the advertiser, typically after you shared your email address with them or another business they’ve partnered with.” Except when you look at those advertisers, you may see what I did: you intentionally “interacted” with less than one in ten of them, which only deepens the mystery of how they got your information.

Standup comedian Dan Nainan, a former Intel engineer, was appalled at the number of advertisers with his info. “I downloaded my information and I was truly shocked at all of the advertisers who had my information! If I didn’t need to be on Facebook for my profession, I would get off of it in a second.” Nainan was kind enough to share that list, which made his reaction quite understandable. 620 individuals, companies, or organizations had uploaded a contact list to Facebook with Nainan’s name on it.

Even more surprised about the number of advertisers with his personal data was Logan Abbot, president of Wirefly. “The amount of data that advertisers have collected about me on their websites…was mindbogglingly long. I am talking nearly 800 entities had uploaded contact information to Facebook that they had collected about me on their site.”


iStock.com / ROUDRR, 4JXDJN, RA5IOO

We asked Digital marketing consultant Brad Bauer of Bauer Heavy Industries, who has made more than a million dollars in Facebook ad-buys for clients, how companies may decide to target you through Facebook ads. Bauer speculated, “They may be doing something called fingerprinting, which is essentially the practice of assuming an identity based on a number of factors. Different sites capture information that your browser is sending out about what sorts of technologies you’re using. And I’m purposely being obtuse about saying what sorts of technologies you’re using for a reason, because it could be your phone, it could be your iPad, it could be your desktop or laptop. Each one of those devices sends out a different set of information. You would be shocked at the amount of information that your browser is happy to publish about your computer, for example. They can understand what plugins you have installed in your browser, how fast your CPU is, your screen resolution, a wide variety of things besides just your IP address, even what kind of wi-fi you’re using.

“It’s a collection of data points essentially that create a unique footprint around you as a user. And these fingerprints can be matched to know information about you so they can say with a fairly surprising degree of certainty, ‘This is Art, or Brad.’”

Pete Zaborsky, founder and owner of BestVPN.com, opined on how I might have wound up on the contact lists of several out-of-state conservative politicians, given that I’m a registered independent, and have never donated a dime to any politician. (I reached out to 10 of them asking where they’d gotten the contact list info that I appeared on which they shared with FB, and none responded.) “Let’s just say for example, like maybe Cambridge Analytica generally realizes that people who like DIY tend to be right-leaning, and then they just buy a list of people who are into DIY, and then they just assume since you like DIY, you are right-leaning as well.”

Compared to Abbot’s 800 advertisers with his data and Nainan’s 620, the mere 120 entities with my contact info on it seemed paltry by comparison. This leads me to believe that some of my efforts to wrest back my privacy online are actually working. Of course, I hardly go on Facebook anymore except to research shady Facebook practices and share articles on the same. When I do, I try to foil Facebook’s data harvesting by maximizing privacy settings, minimizing sharing settings, never clicking on ads or sponsored content, never accessing the site via a mobile device, and working to confuse Facebook’s facial recognition algorithms by making my main profile photo a picture of a Taliban gentlemen photographed in southern Afghanistan.

In addition to the above measures, Facebook and its advertiser pals may be having a hard time pinning me down, as I use Mozilla Firefox browser with privacy windows to surf the Internet, and on top of that, I use the Electronic Frontier Foundation’s Privacy Badger plugin, which prevents Facebook and other data harvesters from tracking me. Even using all those tricks, 120 potential advertisers still had my information.


Taliban member who doubles as the author’s Facebook avatar

Will Facebook Finally, Really, Truly Delete?
Others who delved into their Facebook data were not upset by ad-related issues, but by old wounds raised by a social media giant that never forgets anything it knows about you, even when you ask it to. Jessica Scherlag, a social media manager at real-estate company Compass, saw reminders she could have done without. “Some of it was inaccurate—Facebook thinks I like strained yogurt and heavy metal—neither of which are particularly true. Some of it was unpleasant—conversations with exes or people I am no longer friends with—messages I’d deleted and had aimed to never see again.”

And Scherlag’s request to Facebook to delete painful conversations, and Facebook pretending to, when in fact they only hid it from Scherlag’s page when she tried to delete it, may seem like a small issue, but it is central to whether Facebook is actually turning over a new leaf and giving users real control of their data and privacy.

Up to now, it has not, or Scherlag would not still be able to see deleted messages in her downloaded data. But according to the Facebook spokesperson we contacted for this story, that is all changed now. “First, you control your information on Facebook and can delete anything you share. When you delete a post or photo, we remove it from our site. If you want to permanently delete your account, you can download a copy of your information and take it with you. It may take up to 90 days to delete all of your account information from our backup systems.”

Which is a significant improvement, if true…but two crucial follow-up questions we emailed to the Facebook spokesperson were ignored: “Is Facebook providing to the user all the info Facebook has on that user, derived from all sources? By all sources, this includes information purchased or otherwise obtained from data aggregators of any kind, and Facebook cookies or other tracking modalities that follow user activity when the user is not on Facebook. If Facebook is not providing all the information about a user it has obtained, regardless of source, how can Facebook claim users control their own information?”

Facebook has admitted that it gets data on users from credit agencies and data brokers Acxiom, Epsilon, Experian, Oracle Data Cloud, TransUnion, and WPP. And because FB will not share any of that info, or get rid of it upon request, it remains completely beyond a Facebook user’s control.

Nor do non-Facebook users (still the majority of people on the planet) who have never agreed to allow Facebook to collect one iota of personal information have any way to learn what Facebook has on them or what it does with that data. The last time Facebook’s creation of so-called shadow profiles of non-Facebook users came up, Facebook said it refused to delete such profiles because doing so, “violates free speech.” [See The Technoskeptic article “In the Shadow of Surveillance” from January, 2017]

If after reviewing your data-set, you are feeling like Facebook is less a social-media platform and more of a way to present you as chum before a ravening mass of advertisers, there is a way to push back, not just against Facebook, but against the credit unions and data brokers Facebook has been conspiring with to profile you. It should also, happily, result in you getting fewer spam emails, sales calls, and junk mail.

Under the Ads section, go to Independent Data Providers. You will find the names of every data provider Facebook has been working with, and a link to take you to each of their websites to opt out of their data collection and sharing.

At the end of the day, this opting-out may be your only recourse to regain some degree of control over your personal info, if, like digital marketer Brad Bauer, you remain skeptical Facebook is going to permanently delete user info upon request.

“I don’t believe that, that they’re going to be scrubbing some piece of information from their systems. I really don’t believe that.” Bauer explains, “As long as their primary revenue stream is advertising, their spots are not going to change. They may rearrange them a little bit to obfuscate, but they’re certainly not going to make big changes in service of making it easier for consumers to have faith in [Facebook], because there’s zero chance that won’t weaken their position in the advertising world.”