18 ms·
Ask HN: How does Facebook know what I buy on Amazon or vice versa?
Following just happened: An hour before lunch I googled and visited websites that sell bicycles. I also visited Amazon during this research. I then bought a bike from one of the manufacturers' websites. A few hours later I browse facebook and see ads to this manufacturers' bikes in my newsfeed, via an Amazon sponsored ad.
I use one browser (Safari) for facebook exclusively, and browsed the bikes / Amazon / made the purchase on Chrome. I have different email addresses for facebook, amazon and, well, google.
- trjordan 9y agoSome data matching isn't done with straight cookies. You visited from the same computer, same IP. It may be a guess done by comparing IP + installed fonts. The other possibility is that your multiple email addresses have been matched as the same person. So even though you use different browsers and have different cookies, they're collapsed on Facebook's side.
- jdavis703 9y agoThese companies can also track you by IP address. I've had conversations with co-workers about them considering a specific large purchases, and then seen ads for what we talked about popping up. I'm assuming that if the CPM is low enough, many ad-retargeters will take the risk of targeting ads based on IP address alone.
- SpendBig 9y agoThey add tracking to the products you view/visit/buy for retargeting ads: https://m.facebook.com/business/help/651294705016616 https://m.facebook.com/business/help/651294705016616
- 2pointsomone 9y agoGoogle "Ad retargeting"
- dmerrick 9y agoYou can change this by going to your Amazon Advertising Preferences page[1] More info here[2] 1: https://www.amazon.com/adprefs?ref_=ya_advertising_preferences https://www.amazon.com/adprefs?ref_=ya_advertising_preferenc... 2: https://www.usatoday.com/story/tech/columnist/2017/02/12/how-stop-seeing-your-amazon-searches-everywhere/97764058/ https://www.usatoday.com/story/tech/columnist/2017/02/12/how...
- dtft 9y agoThree words......Facebook Tracking Pixel You go to Amazon, they tell Facebook what you are looking at, and then can dynamically create ads specifically for you.
- reustle 9y agoDoes Amazon really use the fb tracking pixel? I wouldn't think so
- jsjohnst 9y agoNo, they don't.
- netsharc 9y agoOp said he visited a website that sold bicycles. If this website has a "Like" button or such a tracking pixel or Facebook analytics (do they have that?), Facebook would then know that OP is interested in this bike. An effective ad network would know that OP already bought such a bike, so it's actually useless to try to sell him bikes... maybe accessories.
- dtft 9y agoLooks like they don't! Must be a different retargeting technique used by Amazon. FB Pixel could have also been on manufacturer's site.
- aresant 9y agoStraightforward: 1) Amazon tracked your research and likes to use " ad retargeting" if they see you leave before checking out to remind you to come back and purchase. 3) FB offers advertisers a variety of retargeting means + insanely advanced cross-device tracking. Like a building full of PhD's advanced. Maintaining privacy by logging in from different devices / accounts / etc is a thing of the past if you EVER cross-pollute between browsers / devices / etc the signal is picked up and then compared with browsing behavior etc to get a strong profile. (1) (1) https://www.facebook.com/business/a/performance-marketing-strategies https://www.facebook.com/business/a/performance-marketing-st...
- md224 9y agoBut... what about step 2? > Like a building full of PhD's advanced. On a more serious note, it's unfortunate that so many smart people use their intelligence to enable this kind of gross technology. It's all about "solving puzzles" rather than making the world a better place. There's gotta be more productive ways to advance your career.
- NumberCruncher 9y agoSelling stuff is a better business than making the world a better place: https://www.youtube.com/watch?v=JI8AMRbqY6w https://www.youtube.com/watch?v=JI8AMRbqY6w
- NTDF9 9y agoWhatever made you think that tech industry is a beacon symbolizing all the good things about humanity!
- deleted 9y ago[deleted]
- Razengan 9y ago> It's all about "solving puzzles" rather than making the world a better place. I'd figure it's more about getting paid. Making the world better usually doesn't make anyone money, or at least, costs too much before it starts making anyone money. Making the world truly better requires us to give up a lot of what gets ingrained into us since childhood. We've made money an ends instead of a means. I'm not making a political statement – this is true of every human society, culture and country today. We should collectively rethink what it means to be a successful human and have a fulfilling life (without abandoning technology and progress.) What's the end goal of civilization? Are we to just multiply and expand, ad infinitum?
- TekMol 9y agoI have had similar experiences. Others have already mentioned some cross-browser fingerprintig techniques. One of the worst that many people don't know about is that browsers hand over your local IP. Check this proof of concept: http://net.ipcalf.com/ http://net.ipcalf.com/ The media device IDs the browsers provide look even worse: https://jsfiddle.net/u4n4s296/ https://jsfiddle.net/u4n4s296/ I am not sure if these are unique to the device type (for example a certain soundcard model) or to the device itself. If it's the latter, then that is an indestructible cross-browser cookie right there. EDIT: As per icebraining's comment, in Firefox they are not not cross-domain, not cross-browser and get randomized when you delete your cookies.
- reaktivo 9y agoWhoa, for a moment I felt pretty sure you would be mistaken. Hadn't read about this particular vulnerability before.
- MichaelGG 9y agoWebRTC leaks have been known, and the WebRTC or Firefox people said they'd disable peer to peer data channels off if this technique became used for tracking. Because a permission prompt was too much. WebRTC folks couldn't even come up with a real use case for silent data channels.
- jfoutz 9y agoLove the comment. "In Chrome and Firefox your IP should display automatically, by the power of WebRTCskull."
- hood_syntax 9y agoHaha, wow. What is wrong with people nowadays, that they think this is reasonable behavior...
- anowlcalledjosh 9y agoInterestingly, this doesn't seem to work for me if I have uBlock Origin enabled. However, nothing is logged as blocked in uBO, so I can't tell what it's doing to break it.
- js7745 9y agoThey use the Facebook Pixel https://www.facebook.com/business/a/facebook-pixel https://www.facebook.com/business/a/facebook-pixel They segment users that visited each product on Facebook with a custom audience and then create ads for similar products that they show you. This is all done programmatically.
- icebraining 9y agoHow would that work across different browsers?
- nickphx 9y agoIf you're logged into facebook on the browser the pixel fires on then that event is associated with your facebook account and is used in further targeting.
- captainhcg 9y agoI am working at FB but not in ads or related team. But I had talked to a person who is directly working on it. Amazon is different to other AD buyers. Amazon does not want FB to know what customers are doing on its own site, so there is no FB tracker on Amazon at all. However, Amazon can choose what ad to deliver to you on FB backed up by its own team.
- rajathagasthya 9y agoOP says they have different email addresses for Amazon and FB. How would Amazon know which user to target ads on FB in this case?
- thisismine 9y agoCookie is a thing.
- ars 9y agoIt's not cookie, it happens across different browsers. It's IP based.
- dbbk 9y agoHow could IP-based possibly work for people at places like college campuses?
- Jasamba 9y agoThey take the number of people from the same IP into account. IPs are broken down into public IPs vs private IPs based on traffic/timing of usage etc. There are research papers on this sort of feature contruction using only IPs. Cross device especially uses it extensively to be able to probabilistically ascertain if the person from your house who is checking their phone is the same person who checked smth on the Desktop computer last night based on your online timing, IPs, behaviour over the day. They can figure out, for instance, your office vs home browsing timing, interests etc with the same methods.
- jayess 9y agoAnother reason to install ublock and add the social tracking filters.
- ars 9y agoThat would not help. Amazon knows what you looked at because you did it on their site. It's not Facebook tracking you, it's Amazon. It's also not Facebook giving you the ad, it's Amazon. So technically not a privacy violation.
- wu_tang_chris 9y agoshoutout to yesterday's post on Ad Nauseam (https://adnauseam.io/ https://adnauseam.io/). you know, incase you find this kind of thing reprehensible.
- molestrangler 9y agoIf you stay logged in on FaceBook and browse & search other sites they know. Only login when you need it the service, then logout and delete cookies.
- ars 9y agoThat doesn't make any difference. It tracks across browsers that are not connected in any way except IP.
- __abc 9y agoThis is all fairly straight forward however, what blows my mind is Facebook makes recommendations of friends that I've NEVER had any digital interaction with. For some reason it picked up the kid who stocks the craft beer at my local family run grocer. Literally only talked to the kid face-to-face. No phone number, no texting, no contact entry (not that I share those with Facebook anyways). That made the hair on the back of my neck stick up when that happened.
- eknkc 9y agoMaybe he searched and looked you up on Facebook and it's somehow enough signal to suggest him?
- yuvalmer 9y agoWouldn't it violate their promise that users cannot know who looked up their profile?
- mateo411 9y agoThere is some process that is running a spatial join. You were both logged into facebook at the same time, and were in close proximity. I had a similar situtation where Facebook recommended that I friend a coworker that sat next to me.
- beejiu 9y agoFacebook claimed a year ago that they did not use location data. https://www.theguardian.com/technology/2016/jun/29/how-does-facebook-suggest-potential-friends-not-location-data-not-now https://www.theguardian.com/technology/2016/jun/29/how-does-...
- Bjartr 9y ago"location data" and "factors that are location dependent" are not the same thing. e.g. SSID + MAC address of a wifi access point that two people used at the same time.
- ars 9y agoIt's by IP address. I know this because you can browse for something on Amazon on one machine, then find ads for that item on an entirely different machine - but one that's using the same WiFi. Good luck buying a surprise present for a Significant Other. If you try, they'll see ads for it on Facebook.
- calebcuster 9y agoIf you want to know what advertisers are retargeting you, you might want to check: http://whoisretargeting.me http://whoisretargeting.me It can be enlightening. You can also opt out of a lot of it here: https://www.facebook.com/help/568137493302217 https://www.facebook.com/help/568137493302217
- jszymborski 9y agoI don't seem to see too much specific to me, other than anything you can gleam from geolocation... Suspect NoScript/uBo/Self-destructing Cookies have mitigated a lot of it.
- hossbeast 9y agoDoes not work under Brave - which means I'm protected from retargeting, too?
- junkculture 9y agoInteresting. I whitelisted this site, and 2 of the 4 ads it displays on each refresh are from Facebook. I've never had an FB account and they seem to know it.
- b4ux1t3 9y agohttp://i.imgur.com/54JjaA3.png http://i.imgur.com/54JjaA3.png Well, I guess ad companies have no idea how much money I make.
- kostarelo 9y agoYet, FB doesn't know that you bought it. Just knows that you did the research. It would show you the ads regardless of if you bought it or not.
- nickphx 9y agoAll of those actions (searching, viewing, purchasing) sent signals to various tracking companies that all exchange data either directly or indirectly through third parties. While Amazon may not directly work with Facebook and exchange tracking data, Facebook may work with another third party that works with Amazon.
- exelius 9y agoDMPs. Amazon buys (and sells) data to/from DMPs. That data can (and often does) include a hash of your credit cards, all the e-mail addresses you go by, etc. Amazon can basically buy programmable ad inventory that says "I want to show this ad for chainsaws to kmonad" and the DMP resolves who 'kmonad' is through a variety of methods. Realistically, the opsec you would need to have to avoid this would be astronomically inconvenient. These DMPs work off statistics, so they don't need to know 100% that this browser session is probably kmonad, just 70%. Maybe you have the same IP, OS version, browser extensions, cookie sets...
- lxchase 9y agoThis is most likely. To take it one level further, since you bought something, it can be DLX data (or Oracle now) or some other purchase-based data (from Visa or Nielsen Catalina). Facebook can ingest these as custom segments to target. For instance, I can buy a data segment of past purchasers of Giant bicycles for $1 CPM that will be layered on whatever partner is integrated. With every "match" there will be drop off as one ID system needs to be matched with a separate ID system (i.e. FB <-> DLX, or Liveramp <-> Mobile App)
- exelius 9y agoRight; I think it would really creep people out to know what data is available to target for advertising purposes and how deeply it goes. Basically, there are a bunch of methods for tying your session back to your identity, and most DMPs will run through a good dozen or two. Most will fall back on geolocation patterns (which are surprisingly accurate themselves) but it's actually very hard to totally anonymize your internet activity. We are creatures of habit, but our patterns betray us. :)
- dx034 9y agoBut even with all that data, they still show irrelevant apps? In this case the user already bought the item and gets shown ads for it afterwards. That's very likely ineffective marketing. Is data mining this complex really worth it if the result is that bad?
- markgamache1 9y agoIt's called the internet. That's what it does. Do you ask why bacon is delicious?
- EADGBE 9y agoFWIW, Home Depot does this too.
- confounded 9y agoIt's just Amazon cookies. In short, you didn't see the ad because of what Facebook know about you (though they'll know a great deal more than Amazon), just that the two cut a deal to allow Amazon to read Amazon cookies from Amazon ads on Facebook.
- jlebrech 9y agoamazon serves their ads on facebook with scripts hosted on their domain, and the browser willinging gives amazon it's own cookie back, even if you're on fb and not amazon.
- dx034 9y agoIt's fascinating to see to what lengths advertisers go to identify users only to serve irrelevant ads. The bike ad after a purchase is completely useless and would've better been served to any other user.
- koolba 9y ago> It's fascinating to see to what lengths advertisers go to identify users only to serve irrelevant ads. The bike ad after a purchase is completely useless and would've better been served to any other user. On the contrary, I'd wager that a person who's purchased a bike is far more likely to buy another than a random other person. I'm not saying there's isn't someone more likely to buy one than the guy who just did. But he would be more likely than someone who has no recent bike related purchases or interest. It could be as simple as, "Hey this is a nice bike I bought. I bet my wife/sister/brother/friend would like one too. Hey Bike Co is having a sale!".
- BaptisteGreve 9y agoWould the same thing have happened if you were using the Brave browser (supposed to protect your privacy) - https://brave.com/ https://brave.com/?
- marvel_boy 9y agoNo. Using Brave they have no way to follow you (no cookies).
- alimoeeny 9y agoIt is enough for you to only once have used the same browser / profile with both accounts. There are cookies to keep track of who is who and then it is a matter of matching identifiers on one platform to the other. It is hard to believe you have been diligent enough to keep things absolutely 100% separate between Facebook and amazon.
- danilocesar 9y agoNot totally related to the post, but IMHO the following happen too often: I'm looking for a camera. So I opened a market place in my country that sells those cameras. Then I decided to buy one. Then, for a few days, I open facebook and I only see ads about cameras, from the same marketplace. That's useless as I'm sure (and they should know with some confidence) I'm not buying another camera. They should/could target me ads about SD cards, lens. But certainly not cameras. * Then it happened again when I bought the SDCards =/
- sumedh 9y agoMaybe the tracker did not track your purchase and still thinks you are looking to buy one.
- Grustaf 9y agoI read your question as being about how facebook found out from amazon what you bought. I don't know much about web technology but it seems to me they don't need to know, since the ads you mentioned came from Amazon, even if they're served inside facebook. So it's enough if facebook gives enough info to amazon so that the latter can infer who you are, then they know that you bought that bike. It's somewhat encouraging that the algorithms are still so stupid as to advertise precisely the things you are least likely, a large infrequent purchase that you just made!
- MichaelGG 9y agoAre they stupid? I've cancelled and bought a competing product more than once, though not via ads (adblocker), just searching or reconsidering.
- Grustaf 9y agoI think in general you are not very likely to buy a new bike (or phone in my case) the day after buying one, but there may be exceptions. Perhaps it's enough to be so crude as to not take timing into account. I mean it IS true that people who buy bikes online once are likely to do it again at dome point.
- poopoopoopoo 9y agoCookies & 3rd party re-targeting services.
- amrrs 9y agoThis is remarketing. It's based on Cookies (which sometimes could be both on Server and Client side). In this model, Facebook is the ad agency that doing this tracking and Amazon is just a customer of Fb.
- sunstone 9y agoIf you haven't disabled third party cookies in your browser then you're doomed from the start. After you've done that it's still a battle. Clear your cache and all that every time you close your browser (it's also a browser setting).
- mrhektor 9y agoOn a related note, I had a weird experience where I was talking about a trip to Vietnam with my friends. A few hours later, I saw an ad for air travel to Vietnam on my FB page. Now I'm 100% sure I hadn't googled or searched for Vietnam previously. At first, the conspiracy theorist inside said "they're listening!" through my phone microphone or whatever. But then, I thought, could they have been forming a pattern of my behaviour over the past several days, cross-referenced across several platforms (maybe I had searched for "Travel destinations" and also a friend had given a travel recommendation of Vietnam on chat)? Have the algorithms gotten that advanced?
- 0xcde4c3db 9y ago> Now I'm 100% sure I hadn't googled or searched for Vietnam previously. I'll bet your friends did.
- deleted 9y ago[deleted]
- sumedh 9y agoWhen you say talking do you mean you guys were physically close to each other then if your friends searched for Vietnam, FB will know that this group of people whose current GPS coordinates are the almost the same are interested in Vietnam.
- kristianc 9y agoAmazon has a Facebook retargeting pixel loaded which identifies you based on your (probably logged in but quite possibly not) Facebook account. Facebook has you IDed across browsers and across devices, getting around the single browser limitations cookies usually have. This links back to your FB account. Best practice would be for advertisers to also load a 'burn' pixel on a conversion page which lets them know you have purchased the product, but the tech doesn't always allow for this.
- tagawa 9y agoIt's worth noting that according to this study[1], Facebook has trackers on 25% of the top 1 million websites (Google is top with 75%). This doesn't immediately explain how they get around the use of separate browsers, but with device fingerprinting techniques, e.g. checking the list of installed fonts, screen size, IP address, etc., I'm sure they can reach a high probability of recognising a single user. [1] https://webtransparency.cs.princeton.edu/webcensus/ https://webtransparency.cs.princeton.edu/webcensus/
- kristianc 9y agoFacebook's trackers (predominantly) link back deterministically to a logged in Facebook account. Your account on Facebook is linked to a list of known devices/browsers that you use (verifiable as when you try to log in to a device or browser that you don't use regularly, Facebook will prompt you). Facebook and Google will make use of probabilistic device fingerprinting techniques etc, but to nowhere near the same extent that a company would that didn't have FB/Google's level of logged in data.
- BoorishBears 9y agoSome AdSense ads will let you mark an item as already purchased if you click on the information icon
- mikegerwitz 9y agoI recommend reading/skimming Networks of Control: http://crackedlabs.org/en/networksofcontrol http://crackedlabs.org/en/networksofcontrol
- theweirdone 9y agoAs others have pointed out, it's an advertising technique called retargeting. Here are some of the technical details of how exactly it is done(Facebook's implementation might differ somewhat from this, but overall concept is same) /* DSP - Demand side partner (Entity which works with someone who wants to show their ads) SSP - Supply side partner (Entity which works with some who have potential space on web to show ads) / 1. When you visited Amazon.com, one of the DSP associated with them drop a cookie on your system to uniquely identify you as a user. Let's call it cookiexyz. 2. When you end up on Facebook.com, their SSP also drops a cookie on you, let's call it cookieabc. 3. Now only thing remaining is to determine cookiexyz and cookieabc are same users. 4. To do that, SSP requests a bid from Amazon's DSP(among others). While doing that, it calls one of the DSP's url(bid tag) which sends cookiexyz in request headers and sends cookieabc in query params. This uniquely profiles the user which DSP stores in their system and next time user requests a bid again, they can serve them ads based on preferences based on cookiexyz. In other words, info that your looked at some shoes on Amazon.com / disclaimer: I work as a dev in one of the Advertising partner for Yahoo and Bing. */
- oelmekki 9y agoThing is, OP mentions using two different browsers, which is why it's surprising. I guess there's still the possibility that a cookie was added months before that and that "tainted" browsing was forgotten. But it's still worth wondering if some other identification mechanism could be at play.
- theweirdone 9y agoOr, facebook(https://www.facebook.com/business/learn/facebook-ads-reach-existing-customers https://www.facebook.com/business/learn/facebook-ads-reach-e...) matches this cookie to your fb account in their system. Then making this information available across the browsers is trivial. Now, to actually think of implementation, I can't even imagine the amount of data they need to store(and clear in LRU manner) to make this work.
- saluki 9y agoI'm sure they are tracking/matching by cookies, ip, FB logins, geolocation, etc . . . by combining those it's pretty easy to serve up the right ad, most of the time.
- eip 9y agoIf you are not blocking cookies and javascript then you are an intertoob noob.
- godot 9y agoAside from basic retargeting with cookies, there's definitely something more going on between Facebook and Google. (geoip/location might be a good guess) I have a habit of going into Incognito browsing often. Not for viewing any NSFW stuff, I just have this habit whenever I want to look up something that I know is very one-off and not related to my general interests. (habit started with Amazon and it showing me related products of stuff I wasn't interested in because I clicked on a link friends send over skype) A few days ago I was sitting at home, remembered about a specific couch-in-a-box company, wanted to check out how the couch looks again, so I opened up Incognito as I always do, and searched for Burrow. Later on that night, I saw Burrow facebook ads. Not only was I in incognito when I searched, and this time I was actually on a whole different laptop while on Facebook!