6 ms·

I have actually written to facebook (without having an account) and requested my personal data, worked fine. I believe the adress I used was support@facebook.co

I have actually written to facebook (without having an account) and requested my personal data, worked fine. I believe the adress I used was support@facebook.com. They replied that they do not have any data on me. They requested a copy of my ID though, if I remember correctly.

paulie_a 8y ago
I have no doubt they straight up lied to you.
- simsla 8y ago
  Don't see how the gain from that would be worth the risk.
  - hedora 8y ago
    They certainly did lie. When I created a new (my only) facebook account a few years back, it was clear they already knew that about 90% of my friends knew me. They probably interpreted “what information do you have” as “give me a copy of my account”. If they still do this, someone in a GPDR country (but without a FB account) should go through this exercise, then report the violation.
  - paulie_a 8y ago
    There is zero risk and they get money.
ernesth 8y ago
> They replied that they do not have any data on me. How could they transmit that info? They at least have stored your mail address.
poizan42 8y ago
"The only personal data we have been able to identify related to you is the ID you just sent us. Have a good day."
a_imho 8y ago
They requested a copy of my ID though I saw this practice in the wild, however I don't quite agree with supplying of any more information. Emails and phone numbers are most often used for identification on the web. What can they even do with an ID? Surely most sites don't store ID numbers.
- toxicFork 8y ago
  They still need to defend against malicious requests; for example how do you know that it's not someone's potential enemy requesting for that information?
  - Rjevski 8y ago
    But unless they had your ID before, how can they tell it’s the ID of the account owner and not a homonym? Also how would they defend against fake IDs? If the purpose is to prevent malicious access then they better expect that attackers will try and use fakes.
  - a_imho 8y ago
    They need to resort to the mechanism agreed upfront to prove identity. Usernames, emails, numbers + passwords, keys etc. At this point I see this practice mostly as deterrance with a little cya mixed in, possibly with a pinch of data fishing in some rare cases. However in the future I'm all for providing IDs as a requirement to use webservices if that makes people more conscious about what data they share.

paulie_a 8y ago

I have no doubt they straight up lied to you.

simsla 8y ago
Don't see how the gain from that would be worth the risk.
- hedora 8y ago
  They certainly did lie. When I created a new (my only) facebook account a few years back, it was clear they already knew that about 90% of my friends knew me. They probably interpreted “what information do you have” as “give me a copy of my account”. If they still do this, someone in a GPDR country (but without a FB account) should go through this exercise, then report the violation.
- paulie_a 8y ago
  There is zero risk and they get money.

ernesth 8y ago

> They replied that they do not have any data on me. How could they transmit that info? They at least have stored your mail address.

poizan42 8y ago

"The only personal data we have been able to identify related to you is the ID you just sent us. Have a good day."

a_imho 8y ago

They requested a copy of my ID though I saw this practice in the wild, however I don't quite agree with supplying of any more information. Emails and phone numbers are most often used for identification on the web. What can they even do with an ID? Surely most sites don't store ID numbers.

toxicFork 8y ago
They still need to defend against malicious requests; for example how do you know that it's not someone's potential enemy requesting for that information?
- Rjevski 8y ago
  But unless they had your ID before, how can they tell it’s the ID of the account owner and not a homonym? Also how would they defend against fake IDs? If the purpose is to prevent malicious access then they better expect that attackers will try and use fakes.
- a_imho 8y ago
  They need to resort to the mechanism agreed upfront to prove identity. Usernames, emails, numbers + passwords, keys etc. At this point I see this practice mostly as deterrance with a little cya mixed in, possibly with a pinch of data fishing in some rare cases. However in the future I'm all for providing IDs as a requirement to use webservices if that makes people more conscious about what data they share.