10 ms·

>Foremost among these tools is enforcement action against companies that fail to honor their privacy promises This is the crux of the issue. The problem is tha

>Foremost among these tools is enforcement action against companies that fail to honor their privacy promises This is the crux of the issue. The problem is that when Facebook asks for "location information", the consequences of this are not being conveyed to the user. The user might think, "ah they want my location for the weather recommendations and event suggestions in my neighbourhood". They do not realise how something so "innocuous" as location information could be weaponised against them. I used location data as an example because you could infer almost everything about a person just from that. You could know their social circle, their approximate tax bracket, which banks they use, who is their lawyer, their accountant and their wealth manager, their familiar situation, how healthy they eat, how healthy they are, whether they are chronically ill, and what type of chronic diseases they might have, what activities they engage in, what are their political leanings, I could go on, I do not think this is anywhere near an exhaustive list... The user does not know that Facebook it going to tip off the insurance provider about the user's unhealthy eating habits or his chronic medical condition. Or maybe tip off his bank that he has substantial wealth elsewhere.

mtgx 9y ago
Indeed. Collecting a "type of data" tells you almost nothing about what the company collecting it could do or is going to do with that data. I think regulation around this idea may be most effective. Companies should have limits on what they can do with the data by default. If they want to use it for more, then they should not only offer a much greater degree of transparency but they should have to abide by much higher standards, too, similarly to how medical companies have to abide by much higher standards when collecting your information. So if a company asks for location data just to use it for weather information, that could be obtained with a single click from the user. If the company intends to use that location data to allow advertisers to target you, then it should be made very clear to the user that this is what the purpose of collecting the data is. And they should need to do more than just click once on a button. If the same company intends to give the data to electoral campaigns, then higher standards still should be imposed on that company. The point is we need to start regulation the use of data, and not just what type of data can be collected.
- thu0nt345tnu 9y ago
  I don't believe that telling the user what use will be made of their data will be in any way effective. Many companies are very honest and up front about it. The problem is that the information is just too technical for a user to understand, so they ignore. They have no choice because there's no way for them to understand it anyway. Even if all companies were required to and did comply with a law like that and fully disclosed the information, the collected data would just be laundered through a third party in some way so that the terms of service were technically correct, but they could still get away with business as usual. I think these companies just need to be barred from using data in this way period. It's the only way to ensure users are protected in my opinion.
  - Moru 9y ago
    In the end it just doesn't matter if the user understands or not. Most people just don't care either way until it hits them personally. When the violent ex boyfriend manages to track you down even though you have a secret identity just because a mutual friend visited and unknowingly got your location on some social app.
r00fus 9y ago
And who knows if the analysis that is derivable from this private data leads to a bunch of false-positives (that are conveniently not known by the person affected)? You could be "doing nothing wrong" and still get screwed by right people thinking the wrong things about your data. 1984 or Brazil - it doesn't matter they're both dystopias that revolve around totalitarian constructs - neither of them work without this kind of comprehensive information. [edit: clarity]
- steve_b 9y ago
  There's a really good Econtalk podcast called Weapons of Math Destruction about this: http://www.econtalk.org/archives/2016/10/cathy_oneil_on_1.html http://www.econtalk.org/archives/2016/10/cathy_oneil_on_1.ht...
fortythirteen 9y ago
If I had a nickel for every time someone called me paranoid or a conspiracy theorist for mentioning this before last week, I'd have a ton of nickels. I should feel better now that people of aware of the nefariousness of this type of data collection, but I feel worse. The general public is being fed this as "Russia" and "Trump", and not getting the real, horrifying, surveillance state truth of what's going on. I'm less worried that the Trump campaign used CA (and that the Clinton campaign used CTR), than I am by Obama saying "it's just metadata".
- debt 9y ago
  "I'm less worried that the Trump campaign used CA" But, and maybe someone can clarify, every single intelligence agency has come out and said that there was some interaction between Russia and Trump and, more specifically, between Facebook and Russia. And it's been proven Facebook is directly implicated in both the Trump campaign and Russian election meddling. We hold the ability to vote in free elections as pretty a basic fundamental right in a democracy, so why wouldn't this be the thing we should all be worried about?
  - vkou 9y ago
    How much interaction is there, during, prior, or after election time, between the political or intelligence arms of the USA, and the politicians of any country in which the USA chooses to meddle in? If we were so worried about the integrity of democracy, we wouldn't have our fingers in so many other ones. You've just described soft power.
    - debt 9y ago
      "How much interaction is there, during, prior, or after election time, between the political or intelligence arms of the USA" Great question. We don't know, because either we don't get caught or doesn't happen to begin with. We can make up all sorts of conspiracies, but Russia got caught so the conversation starts there.
      - 9y ago
kevin_thibedeau 9y ago
The consequences of using a store loyalty card are not known to the general public either. Yet all transactional information is sold off to third party data brokers and aggregated into profiles where they keep track of you in minute detail. It isn't exactly fair that Facebook is going to be punished while the rest of the industry hides behind its fine print.
- CaptSpify 9y ago
  I agree with you, but FB has been pretty blatant about how they misuse their user's data. If you are the biggest and most obvious, then you will probably be the first one targeted.
  - icantdrive55 9y ago
    I imagine Google is much worse. I was hoping they would be caught, by the SEC, looking at certain peoples data, and do what privileged boys do best; trade stocks/bonds well. But, I guess, they are making enough on advertising.
- pelario 9y ago
  Yes indeed, and maybe this is an opportunity to do something about this too...
- notyourday 9y ago
  Ioseb Jughashvili has a thing for sales, I hear.
- rjsw 9y ago
  This story [1] is fairly widely known. [1] http://www.businessinsider.com/the-incredible-story-of-how-target-exposed-a-teen-girls-pregnancy-2012-2?IR=T http://www.businessinsider.com/the-incredible-story-of-how-t...
- bobthepanda 9y ago
  Whataboutism - corporation edition?
- deleted 9y ago
hanspeter 9y ago
Interesting that you choose location information. I believe location privacy issues on Facebook pale in comparison to Apple and Google who share your exact location information with 3rd party app developers.
- titzer 9y ago
  Well, there is a permissions model for 3rd party apps. What about the system software...
herpderp3dtwerp 9y ago
You can get all of this information from a phone number too. https://www.twilio.com/marketplace/add-ons/nextcaller-advanced-caller-id https://www.twilio.com/marketplace/add-ons/nextcaller-advanc... Give it a try with your phone number. It'll provide your address (current and former), income bracket, relatives, siblings, children, etc, etc. Guess what Facebook asks you to provide when initially setting up!?
- kemitche 9y ago
  You can't get someone's bank from that. You can likely figure out someone's bank if you monitor their location over time, though.
- jstarfish 9y ago
  > Guess what Facebook asks you to provide when initially setting up!? Amusingly enough, so does Fetlife (NSFW). It's not outside the realm of possibility that even your specific kinks could be appended to that list.
- thinkingemote 9y ago
  600+ Million records: "Name, Address, Email, Carrier, Line Type, Secondary Phone, Age, Gender, Household Income, Marital Status, Presence of Children, Home Owner Status, Home Market Value, Length of Residence, High Net Worth, Occupation, Education Level, Twitter Handle & Followers, Facebook Profile & Followers, LinkedIn Profile"
  - sgroppino 9y ago
    Don't forget number of steps per day, resting heartbeat rate...
    - brlewis 9y ago
      No, that's not included. Read the link. I do not speak for Fitbit, but I work for Fitbit, and I do not appreciate my employer being baselessly lumped in with violators of privacy.
faramarz 9y ago
you could build a simple app that illustrates your points.
LifeLiverTransp 9y ago
How about a diffrent form of punnishment for privacy violating companys? Just insert NN generated Noise into there databases. Instant devaluation of there most treasured asset. That has to hurt.
- kirillseva 9y ago
  The biggest names in AI technology are the very same advertisement companies. General public can't win in this arms race
joering2 9y ago
That's a good example, +1. But I have bigger issue with their cookie abuse. Initially cookie was designed to help website track you around THEIR website; it wasn't design to track you around the WHOLE internet. While it may be in Facebook spirit of "hacking things" and "breaking things", I'm surprised EU and US have not come up with strict rules and regulations on how cookies can be utilized. I remember in EU Facebook tried to argue that they track you around web for your safety and security but I'm unsure how much water it hold.
gnode 9y ago
Does anybody know what the legal situation (in US or under the GDPR) is for data derived from inferences? E.g.: if he visits this nightclub he's gay, or if she goes to this clinic she's having an abortion. As the subject never told you, but rather you speculated it, it could be argued you don't know, and you don't have to record it in explicit terms. It also raises significant concerns about the accuracy, and whether the subject can even correct, let alone expunge such data, which could be sold on to credit rating agencies or whomever else.
- olympus 9y ago
  It's not illegal to record whether you think someone is gay. It's probably immoral if you hand that data over to a country that will prosecute someone for being gay (Russia). I'm not aware of any US protections unless they came along with recently passed legislation, but the GDPR had some recourse for European citizens. They are now guaranteed a right to explanation and a right to correct the data. So if a person is given a higher health insurance premium, they are allowed to ask for an explanation. If the answer is "Google thinks you're gay, so we're raising your premium," the person is allowed to correct the information, basically saying, "I'm not gay, so please lower my premiums to what they were."
  - philipwhiuk 9y ago
    (and then in the UK you sue for discrimination based on sexuality).
    - olympus 9y ago
      Right, but that is only if they discriminate based on what they had recorded about you. A company recording whether they think you are gay based on your location information isn't doing anything illegal until they discriminate against you with that information. There are things that a company can do (like advertising) that doesn't meet the bar of discrimination that they can still legally do with their inference about your sexual preference (or whatever else they infer about you from your data). Advertising "gay" products to you based on the fact that your cell phone spends a lot of time in close proximity to a gay bar probably doesn't meet the bar for a discrimination lawsuit.
deepGem 9y ago
Isn't this primarily on Android ? Am quite certain no app can monitor your location in the background on iOS. Regardless What pisses me off is FB not providing evidence to the contrary, that they don't harvest data in the bqckground. Not providing this evidence makes it quite clear that they do harvest this data. The issue isn't about permissions. 'Sir, may I come inside your house, is fine, but ransacking the house once you get is is douchebaggery.
- reaperducer 9y ago
  If Facebook does a background news feed update on your iPhone and notices that your iPhone wifi is on the same IP address as another phone (Android or otherwise) with location enabled, then it can record a correlation. There's probably even better ways of doing it.
  - JetSpiegel 9y ago
    Straight up GeoIP is good enough, particularly on WiFi. On mobile networks I believe the carries will gladly sell the tower-IMEI mapping. They already have to collect that for law enforcement purposes anyway.
    - reaperducer 9y ago
      In my experience GeoIP is unreliable. Right now GeoIP identifies my desktop computer as being in northern Nevada. I'm 400 miles away. Right GeoIP identifies my laptop as being in Atlanta. I'm 2,300 miles from Atlanta. Right now GeoIP identifies my wireless hotspot as being in Los Angeles. I'm more than 400 miles from Los Angeles. Three devices, inches away from each other in reality. But GeoIP thinks they're on opposite ends of the country. GeoIP has certainly improved in the last few years, but I would never rely on it for anything important.
- JimDabell 9y ago
  > Am quite certain no app can monitor your location in the background on iOS. Any application can do this on iOS, with a few caveats: - iOS prompts you to grant permission when the application requests it for the first time. If you refuse, the application cannot keep prompting you. - After a few days, it reminds you that the application has been accessing your location in the background and asks you if you want to keep allowing it or revoke access. - There is an indicator in the status bar to let you know when an application is tracking your location. - You can see which applications have access and which applications have used that access recently by going to Settings > Privacy > Location Services. - You can revoke access at any time in the same place or by going to Settings > App Name. - You can also only grant applications access to your location while you are using the application, as long as the application supports that. - If an application doesn't intrinsically need location services to function and the developer tries to force users to grant permission by disabling functionality, the application is unlikely to be allowed in the App Store. As others have mentioned, there are also other ways in which applications may be able to infer your location indirectly.
downandout 9y ago
The user does not know that Facebook it going to tip off the insurance provider about the user's unhealthy eating habits or his chronic medical condition. Or maybe tip off his bank that he has substantial wealth elsewhere. Are you aware of any instance in which this has actually happened? AFAIK Facebook has not been selling location data to anyone, and this would be a direct violation of their privacy policy. Further, if I worked for an insurance company or bank, I’d have customers install my mobile app that has lots of convenience features, and have that app request location permissions so that I could get GPS data directly from their mobile device. Then I’d use that location data, that I obtained directly and in accordance with all applicable privacy policies, in all of the scary ways you mention and then some. Going to Facebook is not the most efficient way to violate the privacy of most individuals. Most people will happily trade their privacy for a small discount or to be able to save a few seconds interacting with a service they use. This is where any legislation in this area should focus - not on punishing a specific company because the “wrong” candidate happened to win an election.
- dredmorbius 9y ago
  Location data, both user and friends, are part of Extended Profile Properties: https://stratechery.com/2018/the-facebook-brand/ https://stratechery.com/2018/the-facebook-brand/ https://stratechery.com/wp-content/uploads/2018/03/Screen-Shot-2018-03-19-at-10.08.09-PM-e1521474474970.png https://stratechery.com/wp-content/uploads/2018/03/Screen-Sh... https://web.archive.org/web/20130911191323/https://developers.facebook.com/docs/reference/login/extended-profile-properties/ https://web.archive.org/web/20130911191323/https://developer...
  - downandout 9y ago
    Right, but those are directly authorized. That's not the same as going to Facebook and buying location data, nor does it apply to friends' locations.
feelin_googley 9y ago
http://webcache.googleusercontent.com/search?q=cache:https://www.ftc.gov/opa/reporter/privacy/privacypromises.shtml http://webcache.googleusercontent.com/search?q=cache:https:/... http://web.archive.org/web/20180124044328/https://www.ftc.gov/news-events/media-resources/protecting-consumer-privacy/enforcing-privacy-promises http://web.archive.org/web/20180124044328/https://www.ftc.go...
dm319 9y ago
You also know where they live, where they work, when they are on holiday, when they are out taking a stroll in the woods... Even if you trust 'Facebook' with that data, do you trust a facebook employee?

mtgx 9y ago

Indeed. Collecting a "type of data" tells you almost nothing about what the company collecting it could do or is going to do with that data. I think regulation around this idea may be most effective. Companies should have limits on what they can do with the data by default. If they want to use it for more, then they should not only offer a much greater degree of transparency but they should have to abide by much higher standards, too, similarly to how medical companies have to abide by much higher standards when collecting your information. So if a company asks for location data just to use it for weather information, that could be obtained with a single click from the user. If the company intends to use that location data to allow advertisers to target you, then it should be made very clear to the user that this is what the purpose of collecting the data is. And they should need to do more than just click once on a button. If the same company intends to give the data to electoral campaigns, then higher standards still should be imposed on that company. The point is we need to start regulation the use of data, and not just what type of data can be collected.

thu0nt345tnu 9y ago
I don't believe that telling the user what use will be made of their data will be in any way effective. Many companies are very honest and up front about it. The problem is that the information is just too technical for a user to understand, so they ignore. They have no choice because there's no way for them to understand it anyway. Even if all companies were required to and did comply with a law like that and fully disclosed the information, the collected data would just be laundered through a third party in some way so that the terms of service were technically correct, but they could still get away with business as usual. I think these companies just need to be barred from using data in this way period. It's the only way to ensure users are protected in my opinion.
- Moru 9y ago
  In the end it just doesn't matter if the user understands or not. Most people just don't care either way until it hits them personally. When the violent ex boyfriend manages to track you down even though you have a secret identity just because a mutual friend visited and unknowingly got your location on some social app.

r00fus 9y ago

And who knows if the analysis that is derivable from this private data leads to a bunch of false-positives (that are conveniently not known by the person affected)? You could be "doing nothing wrong" and still get screwed by right people thinking the wrong things about your data. 1984 or Brazil - it doesn't matter they're both dystopias that revolve around totalitarian constructs - neither of them work without this kind of comprehensive information. [edit: clarity]

steve_b 9y ago
There's a really good Econtalk podcast called Weapons of Math Destruction about this: http://www.econtalk.org/archives/2016/10/cathy_oneil_on_1.html http://www.econtalk.org/archives/2016/10/cathy_oneil_on_1.ht...

fortythirteen 9y ago

If I had a nickel for every time someone called me paranoid or a conspiracy theorist for mentioning this before last week, I'd have a ton of nickels. I should feel better now that people of aware of the nefariousness of this type of data collection, but I feel worse. The general public is being fed this as "Russia" and "Trump", and not getting the real, horrifying, surveillance state truth of what's going on. I'm less worried that the Trump campaign used CA (and that the Clinton campaign used CTR), than I am by Obama saying "it's just metadata".

debt 9y ago
"I'm less worried that the Trump campaign used CA" But, and maybe someone can clarify, every single intelligence agency has come out and said that there was some interaction between Russia and Trump and, more specifically, between Facebook and Russia. And it's been proven Facebook is directly implicated in both the Trump campaign and Russian election meddling. We hold the ability to vote in free elections as pretty a basic fundamental right in a democracy, so why wouldn't this be the thing we should all be worried about?
- vkou 9y ago
  How much interaction is there, during, prior, or after election time, between the political or intelligence arms of the USA, and the politicians of any country in which the USA chooses to meddle in? If we were so worried about the integrity of democracy, we wouldn't have our fingers in so many other ones. You've just described soft power.
  - debt 9y ago
    "How much interaction is there, during, prior, or after election time, between the political or intelligence arms of the USA" Great question. We don't know, because either we don't get caught or doesn't happen to begin with. We can make up all sorts of conspiracies, but Russia got caught so the conversation starts there.
    - 9y ago

kevin_thibedeau 9y ago

The consequences of using a store loyalty card are not known to the general public either. Yet all transactional information is sold off to third party data brokers and aggregated into profiles where they keep track of you in minute detail. It isn't exactly fair that Facebook is going to be punished while the rest of the industry hides behind its fine print.

CaptSpify 9y ago
I agree with you, but FB has been pretty blatant about how they misuse their user's data. If you are the biggest and most obvious, then you will probably be the first one targeted.
- icantdrive55 9y ago
  I imagine Google is much worse. I was hoping they would be caught, by the SEC, looking at certain peoples data, and do what privileged boys do best; trade stocks/bonds well. But, I guess, they are making enough on advertising.
pelario 9y ago
Yes indeed, and maybe this is an opportunity to do something about this too...
notyourday 9y ago
Ioseb Jughashvili has a thing for sales, I hear.
rjsw 9y ago
This story [1] is fairly widely known. [1] http://www.businessinsider.com/the-incredible-story-of-how-target-exposed-a-teen-girls-pregnancy-2012-2?IR=T http://www.businessinsider.com/the-incredible-story-of-how-t...
bobthepanda 9y ago
Whataboutism - corporation edition?
deleted 9y ago

hanspeter 9y ago

Interesting that you choose location information. I believe location privacy issues on Facebook pale in comparison to Apple and Google who share your exact location information with 3rd party app developers.

titzer 9y ago
Well, there is a permissions model for 3rd party apps. What about the system software...

herpderp3dtwerp 9y ago

You can get all of this information from a phone number too. https://www.twilio.com/marketplace/add-ons/nextcaller-advanced-caller-id https://www.twilio.com/marketplace/add-ons/nextcaller-advanc... Give it a try with your phone number. It'll provide your address (current and former), income bracket, relatives, siblings, children, etc, etc. Guess what Facebook asks you to provide when initially setting up!?

kemitche 9y ago
You can't get someone's bank from that. You can likely figure out someone's bank if you monitor their location over time, though.
jstarfish 9y ago
> Guess what Facebook asks you to provide when initially setting up!? Amusingly enough, so does Fetlife (NSFW). It's not outside the realm of possibility that even your specific kinks could be appended to that list.
thinkingemote 9y ago
600+ Million records: "Name, Address, Email, Carrier, Line Type, Secondary Phone, Age, Gender, Household Income, Marital Status, Presence of Children, Home Owner Status, Home Market Value, Length of Residence, High Net Worth, Occupation, Education Level, Twitter Handle & Followers, Facebook Profile & Followers, LinkedIn Profile"
- sgroppino 9y ago
  Don't forget number of steps per day, resting heartbeat rate...
  - brlewis 9y ago
    No, that's not included. Read the link. I do not speak for Fitbit, but I work for Fitbit, and I do not appreciate my employer being baselessly lumped in with violators of privacy.

faramarz 9y ago

you could build a simple app that illustrates your points.

LifeLiverTransp 9y ago

How about a diffrent form of punnishment for privacy violating companys? Just insert NN generated Noise into there databases. Instant devaluation of there most treasured asset. That has to hurt.

kirillseva 9y ago
The biggest names in AI technology are the very same advertisement companies. General public can't win in this arms race

joering2 9y ago

That's a good example, +1. But I have bigger issue with their cookie abuse. Initially cookie was designed to help website track you around THEIR website; it wasn't design to track you around the WHOLE internet. While it may be in Facebook spirit of "hacking things" and "breaking things", I'm surprised EU and US have not come up with strict rules and regulations on how cookies can be utilized. I remember in EU Facebook tried to argue that they track you around web for your safety and security but I'm unsure how much water it hold.

gnode 9y ago

Does anybody know what the legal situation (in US or under the GDPR) is for data derived from inferences? E.g.: if he visits this nightclub he's gay, or if she goes to this clinic she's having an abortion. As the subject never told you, but rather you speculated it, it could be argued you don't know, and you don't have to record it in explicit terms. It also raises significant concerns about the accuracy, and whether the subject can even correct, let alone expunge such data, which could be sold on to credit rating agencies or whomever else.

olympus 9y ago
It's not illegal to record whether you think someone is gay. It's probably immoral if you hand that data over to a country that will prosecute someone for being gay (Russia). I'm not aware of any US protections unless they came along with recently passed legislation, but the GDPR had some recourse for European citizens. They are now guaranteed a right to explanation and a right to correct the data. So if a person is given a higher health insurance premium, they are allowed to ask for an explanation. If the answer is "Google thinks you're gay, so we're raising your premium," the person is allowed to correct the information, basically saying, "I'm not gay, so please lower my premiums to what they were."
- philipwhiuk 9y ago
  (and then in the UK you sue for discrimination based on sexuality).
  - olympus 9y ago
    Right, but that is only if they discriminate based on what they had recorded about you. A company recording whether they think you are gay based on your location information isn't doing anything illegal until they discriminate against you with that information. There are things that a company can do (like advertising) that doesn't meet the bar of discrimination that they can still legally do with their inference about your sexual preference (or whatever else they infer about you from your data). Advertising "gay" products to you based on the fact that your cell phone spends a lot of time in close proximity to a gay bar probably doesn't meet the bar for a discrimination lawsuit.

deepGem 9y ago

Isn't this primarily on Android ? Am quite certain no app can monitor your location in the background on iOS. Regardless What pisses me off is FB not providing evidence to the contrary, that they don't harvest data in the bqckground. Not providing this evidence makes it quite clear that they do harvest this data. The issue isn't about permissions. 'Sir, may I come inside your house, is fine, but ransacking the house once you get is is douchebaggery.

reaperducer 9y ago
If Facebook does a background news feed update on your iPhone and notices that your iPhone wifi is on the same IP address as another phone (Android or otherwise) with location enabled, then it can record a correlation. There's probably even better ways of doing it.
- JetSpiegel 9y ago
  Straight up GeoIP is good enough, particularly on WiFi. On mobile networks I believe the carries will gladly sell the tower-IMEI mapping. They already have to collect that for law enforcement purposes anyway.
  - reaperducer 9y ago
    In my experience GeoIP is unreliable. Right now GeoIP identifies my desktop computer as being in northern Nevada. I'm 400 miles away. Right GeoIP identifies my laptop as being in Atlanta. I'm 2,300 miles from Atlanta. Right now GeoIP identifies my wireless hotspot as being in Los Angeles. I'm more than 400 miles from Los Angeles. Three devices, inches away from each other in reality. But GeoIP thinks they're on opposite ends of the country. GeoIP has certainly improved in the last few years, but I would never rely on it for anything important.
JimDabell 9y ago
> Am quite certain no app can monitor your location in the background on iOS. Any application can do this on iOS, with a few caveats: - iOS prompts you to grant permission when the application requests it for the first time. If you refuse, the application cannot keep prompting you. - After a few days, it reminds you that the application has been accessing your location in the background and asks you if you want to keep allowing it or revoke access. - There is an indicator in the status bar to let you know when an application is tracking your location. - You can see which applications have access and which applications have used that access recently by going to Settings > Privacy > Location Services. - You can revoke access at any time in the same place or by going to Settings > App Name. - You can also only grant applications access to your location while you are using the application, as long as the application supports that. - If an application doesn't intrinsically need location services to function and the developer tries to force users to grant permission by disabling functionality, the application is unlikely to be allowed in the App Store. As others have mentioned, there are also other ways in which applications may be able to infer your location indirectly.

downandout 9y ago

The user does not know that Facebook it going to tip off the insurance provider about the user's unhealthy eating habits or his chronic medical condition. Or maybe tip off his bank that he has substantial wealth elsewhere. Are you aware of any instance in which this has actually happened? AFAIK Facebook has not been selling location data to anyone, and this would be a direct violation of their privacy policy. Further, if I worked for an insurance company or bank, I’d have customers install my mobile app that has lots of convenience features, and have that app request location permissions so that I could get GPS data directly from their mobile device. Then I’d use that location data, that I obtained directly and in accordance with all applicable privacy policies, in all of the scary ways you mention and then some. Going to Facebook is not the most efficient way to violate the privacy of most individuals. Most people will happily trade their privacy for a small discount or to be able to save a few seconds interacting with a service they use. This is where any legislation in this area should focus - not on punishing a specific company because the “wrong” candidate happened to win an election.

dredmorbius 9y ago
Location data, both user and friends, are part of Extended Profile Properties: https://stratechery.com/2018/the-facebook-brand/ https://stratechery.com/2018/the-facebook-brand/ https://stratechery.com/wp-content/uploads/2018/03/Screen-Shot-2018-03-19-at-10.08.09-PM-e1521474474970.png https://stratechery.com/wp-content/uploads/2018/03/Screen-Sh... https://web.archive.org/web/20130911191323/https://developers.facebook.com/docs/reference/login/extended-profile-properties/ https://web.archive.org/web/20130911191323/https://developer...
- downandout 9y ago
  Right, but those are directly authorized. That's not the same as going to Facebook and buying location data, nor does it apply to friends' locations.

feelin_googley 9y ago

http://webcache.googleusercontent.com/search?q=cache:https://www.ftc.gov/opa/reporter/privacy/privacypromises.shtml http://webcache.googleusercontent.com/search?q=cache:https:/... http://web.archive.org/web/20180124044328/https://www.ftc.gov/news-events/media-resources/protecting-consumer-privacy/enforcing-privacy-promises http://web.archive.org/web/20180124044328/https://www.ftc.go...

dm319 9y ago

You also know where they live, where they work, when they are on holiday, when they are out taking a stroll in the woods... Even if you trust 'Facebook' with that data, do you trust a facebook employee?