5 ms·

I disagree with the premise. The accusation only holds if your definition of "selling data" includes any transaction where data is leaked as part of a transact

I disagree with the premise. The accusation only holds if your definition of "selling data" includes any transaction where data is leaked as part of a transaction. Importantly, in the ad model the information leakage is an unintended (but unavoidable) side effect. If Facebook could sell ad slots without revealing information about you they would. In fact over the years they've tightened their constraints around targetting to ensure that individuals cannot be targetted and data about individuals can't be derived by targetting hacks. If you asked an average person what "selling data" means, they would describe a much more straightforward exchange: you pay me, and I tell you the names of woman interested in skiing. Consider a real world comparison. You run a ski class for woman. I pay you $100 to distribute vouchers for a range of ski equipment at my store. If a customer shows up with a voucher then I know that they're taking your lessons. I can infer their skill level and that they can afford to pay for private lessons. Was that an instance of you selling your customer's data?

andybak 8y ago
I am no Facebook fan but I have to agree. Can anyone clarify if there still exists a way for 3rd parties to get data out of Facebook for users that haven't clicked on the 3rd party ad?
- cerved 8y ago
  Facebook has a large network of adtech partners who integrate with Facebooks advertising APIs. This used to be FBX, then they replaced it custom audiences. I used to work at one of these firms and AFAIK, I worked in sales, Facebook didn't exchange any data with us. I believe with FBX was implemented using tokens but this changed with custom audiences. What we could do was match email addresses from our clients, think newsletter list, and get custom audience segment to advertise towards on Facebook. I seem to recall that we needed at least 1000 emails and we could see how many of them matched a Facebook user. A possible covert channel of confidentiality breach could be that you feed it 999 bogus emails and one target email to find out if a particular email matched a Facebook user. But then I don't think you would've been able to target ads to that small of an audience. If there is a possibility to get data, my guess is that it would be through inference using this kind of covert channel.
Arnt 8y ago
You're entirely right and I quite agree. Except that I'm not sure I do, now that computers are involved and can pick up every scrap of maybe-data and correlate sets of maybes into probable identities. Twenty years ago walking into a shop with a voucher wasn't an identifying action, now it may be. Twenty years ago what the shop owner got from the voucher distributor wasn't a list of names, now it may be. If the shop owner gets a list of names at the end of the day, then arguably that list is what Facebook sold. Maybe Facebook sold it with plausible deniability, maybe Facebook would prefer not to sell it, but the shop owner paid money and got something in return.
- ironSkillet 8y ago
  Companies exist solely to gather and de-anonimize this data to the fullest extent possible. As an example of what you can do, in Google Adwords, you can download multiple aggregated click/cost reports across many dimensions (age range, zip code etc), set up and solve a mixed integer linear programming problem, and get detailed information about every click. Not sure if Google ever caught on or cared enough to fuzz the data.
  - zonethundery 8y ago
    Would you mind naming some players in this space?
- bertil 8y ago
  You can’t get a list of names from Facebook unless each customer individually allows the company to access it. Happy to upload the modal when that happens.
  - Arnt 8y ago
    Yes, but can I also not get any individual cookies that I could then collate with data from other sources?
dhimes 8y ago
Would you say that then gives you the right to get the fingerprints off of the voucher and examine it for traces of other molecules, such as perfumes, cigarette brands, or sexual activity? There are certain lines that people assume others won't cross. What we're finding is that people do cross those lines. Your example honors those lines. The problem, however, lies in what the companies that don't honor those lines are willing to do. In the case of tech, most people have no idea how to even articulate what crossing those lines would mean in terms of the data they give up. If someone has a medical procedure, most of us assume that sharing that information is a line that shouldn't be crossed. We have laws that even prevent directly sharing the directly acquired information, and those laws make sense to people. But when you say that the same information can be obtained in other, more roundabout ways, it's hard for them to conceptualize the risk. Companies can't back down because they have no compelling reason to argue against making that next dollar other than "it feels immoral." That's why we need strong regulations. Strong regulations actually protect the honorable businesses by giving compelling reasons to not cross those lines.
- whatshisface 8y ago
  I'm not sure how you are going to get strong regulations passed (or even written) in an environment where "most people have no idea how to even articulate what crossing those lines would mean." The reason theft, libel and feeding poison directly to restaurant-goers are not options for companies are because the effects are immediate and everyone understands why they are bad. Slowly polluting the water supply, unlike feeding fast-acting poison directly to everyone, is not off-limits in practice because it is slow-acting and not everyone understands what is happening.
  - dhimes 8y ago
    Agreed. Eventually, hopefully, people become educated. Unfortunately it seems to take knowing someone who knows someone who suffers directly to change these minds. But in the early stages it's freaking impossible. Even when someone on the 'inside' suggests changing things, such as Warren Buffet saying we need to increase taxes on the rich, it is very hard to convince people that there's a real problem.
snek 8y ago
> If Facebook could sell ad slots without revealing information about you they would. Google literally does this with adsense. It is definitely possible.
- randaouser 8y ago
  How is adsense able to complete this? I assume Google is the broker and thus completes on the match on their servers.
learnstats2 8y ago
>Importantly, in the ad model the information leakage is an unintended (but unavoidable) side effect. This is quite a spin! The leakage is unavoidable because it is an essential part of the sale. >Was that an instance of you selling your customer's data? Yes. The reason you distribute targeted vouchers is to use the data to help identify qualifying customers.
PhasmaFelis 8y ago
> I disagree with the premise. The accusation only holds if your definition of "selling data" includes any transaction where data is leaked as part of a transaction. This seems equivalent to arguing that poachers don't actually "kill" elephants, it's just an unintended side effect of shooting them and ripping their tusks out.
jakelazaroff 8y ago
> The accusation only holds if your definition of "selling data" includes any transaction where data is leaked as part of a transaction. Importantly, in the ad model the information leakage is an unintended (but unavoidable) side effect. So, if leaking data isn't their primary intent, it's cool if it happens — even if Facebook knows there's a causal relationship between their advertising model and data leakage? Why should a company not be liable for known externalities of their business?
- SpicyLemonZest 8y ago
  Should a clothing store be held liable because some people wear its clothes as gang signs? It’s simply not a workable standard to demand that companies make it impossible in principle for third parties to do shady things with their stuff.
  - deleted 8y ago
    [deleted]
stvswn 8y ago
I agree, and I think your point can be even more generalized -- businesses can collect information about their customers, there's nothing wrong with it. The key difference is that, while a website may know from your ad click that you were targeted by a campaign looking for college-aged men or whatever, it doesn't necessarily know who you are. That's the difference between personally identifiable information and simply targeted information. There needs to be safeguards to avoid abuse. For example, if the targeting dimensions of an ad campaign are so narrow that the few people fall into it, it shouldn't be targeted (a good example would be geographic targeting of devices that are inside of your house -- too granular). But, I don't care if a website knows that I am likely male or my coarse age or whatever, because i don't have to tell the website who I am in the real world if I don't want to. "Selling your data" is commonly understood by the public to mean something like this -- people suspect that facebook just gives lists of their users to third parties and asks them who they want to send ads to, which is the accusation that Facebook is denying. If I end up making a purchase w/ a website, then sure, they'll know some things about me from the FB ad click referral and the underlying ad campaign they ran. I feel fine with that, I'm entering a relationship with the business where they know quite a bit about me anyway -- like my name, my address, what I'm buying, etc. I don't buy things from places if I can't trust them.
adrianmonk 8y ago
I've become convinced that people were already looking for a concrete reason to dislike Facebook. They resent the presence of social media in their lives and the influence it has, not to mention the annoyance and over-saturation. But they see some usefulness too and/or don't want to be out of the loop, so they're not ready to totally walk away. So they remain in a situation they don't like, and there's been a lot of simmering frustration. Then this data collection thing came along, and it became a way of venting some of that frustration. So it became a myth that a lot of people believe in. A myth because, while Facebook definitely isn't perfect, people believe it is doing certain bad things it really isn't. To me this suggests that, like a couple who has a big argument over some trivial non-issue, there is probably some other real issue that needs to be sorted out.

andybak 8y ago

I am no Facebook fan but I have to agree. Can anyone clarify if there still exists a way for 3rd parties to get data out of Facebook for users that haven't clicked on the 3rd party ad?

cerved 8y ago
Facebook has a large network of adtech partners who integrate with Facebooks advertising APIs. This used to be FBX, then they replaced it custom audiences. I used to work at one of these firms and AFAIK, I worked in sales, Facebook didn't exchange any data with us. I believe with FBX was implemented using tokens but this changed with custom audiences. What we could do was match email addresses from our clients, think newsletter list, and get custom audience segment to advertise towards on Facebook. I seem to recall that we needed at least 1000 emails and we could see how many of them matched a Facebook user. A possible covert channel of confidentiality breach could be that you feed it 999 bogus emails and one target email to find out if a particular email matched a Facebook user. But then I don't think you would've been able to target ads to that small of an audience. If there is a possibility to get data, my guess is that it would be through inference using this kind of covert channel.

Arnt 8y ago

You're entirely right and I quite agree. Except that I'm not sure I do, now that computers are involved and can pick up every scrap of maybe-data and correlate sets of maybes into probable identities. Twenty years ago walking into a shop with a voucher wasn't an identifying action, now it may be. Twenty years ago what the shop owner got from the voucher distributor wasn't a list of names, now it may be. If the shop owner gets a list of names at the end of the day, then arguably that list is what Facebook sold. Maybe Facebook sold it with plausible deniability, maybe Facebook would prefer not to sell it, but the shop owner paid money and got something in return.

ironSkillet 8y ago
Companies exist solely to gather and de-anonimize this data to the fullest extent possible. As an example of what you can do, in Google Adwords, you can download multiple aggregated click/cost reports across many dimensions (age range, zip code etc), set up and solve a mixed integer linear programming problem, and get detailed information about every click. Not sure if Google ever caught on or cared enough to fuzz the data.
- zonethundery 8y ago
  Would you mind naming some players in this space?
bertil 8y ago
You can’t get a list of names from Facebook unless each customer individually allows the company to access it. Happy to upload the modal when that happens.
- Arnt 8y ago
  Yes, but can I also not get any individual cookies that I could then collate with data from other sources?

dhimes 8y ago

Would you say that then gives you the right to get the fingerprints off of the voucher and examine it for traces of other molecules, such as perfumes, cigarette brands, or sexual activity? There are certain lines that people assume others won't cross. What we're finding is that people do cross those lines. Your example honors those lines. The problem, however, lies in what the companies that don't honor those lines are willing to do. In the case of tech, most people have no idea how to even articulate what crossing those lines would mean in terms of the data they give up. If someone has a medical procedure, most of us assume that sharing that information is a line that shouldn't be crossed. We have laws that even prevent directly sharing the directly acquired information, and those laws make sense to people. But when you say that the same information can be obtained in other, more roundabout ways, it's hard for them to conceptualize the risk. Companies can't back down because they have no compelling reason to argue against making that next dollar other than "it feels immoral." That's why we need strong regulations. Strong regulations actually protect the honorable businesses by giving compelling reasons to not cross those lines.

whatshisface 8y ago
I'm not sure how you are going to get strong regulations passed (or even written) in an environment where "most people have no idea how to even articulate what crossing those lines would mean." The reason theft, libel and feeding poison directly to restaurant-goers are not options for companies are because the effects are immediate and everyone understands why they are bad. Slowly polluting the water supply, unlike feeding fast-acting poison directly to everyone, is not off-limits in practice because it is slow-acting and not everyone understands what is happening.
- dhimes 8y ago
  Agreed. Eventually, hopefully, people become educated. Unfortunately it seems to take knowing someone who knows someone who suffers directly to change these minds. But in the early stages it's freaking impossible. Even when someone on the 'inside' suggests changing things, such as Warren Buffet saying we need to increase taxes on the rich, it is very hard to convince people that there's a real problem.

snek 8y ago

> If Facebook could sell ad slots without revealing information about you they would. Google literally does this with adsense. It is definitely possible.

randaouser 8y ago
How is adsense able to complete this? I assume Google is the broker and thus completes on the match on their servers.

learnstats2 8y ago

>Importantly, in the ad model the information leakage is an unintended (but unavoidable) side effect. This is quite a spin! The leakage is unavoidable because it is an essential part of the sale. >Was that an instance of you selling your customer's data? Yes. The reason you distribute targeted vouchers is to use the data to help identify qualifying customers.

PhasmaFelis 8y ago

> I disagree with the premise. The accusation only holds if your definition of "selling data" includes any transaction where data is leaked as part of a transaction. This seems equivalent to arguing that poachers don't actually "kill" elephants, it's just an unintended side effect of shooting them and ripping their tusks out.

jakelazaroff 8y ago

> The accusation only holds if your definition of "selling data" includes any transaction where data is leaked as part of a transaction. Importantly, in the ad model the information leakage is an unintended (but unavoidable) side effect. So, if leaking data isn't their primary intent, it's cool if it happens — even if Facebook knows there's a causal relationship between their advertising model and data leakage? Why should a company not be liable for known externalities of their business?

SpicyLemonZest 8y ago
Should a clothing store be held liable because some people wear its clothes as gang signs? It’s simply not a workable standard to demand that companies make it impossible in principle for third parties to do shady things with their stuff.
- deleted 8y ago
  [deleted]

stvswn 8y ago

I agree, and I think your point can be even more generalized -- businesses can collect information about their customers, there's nothing wrong with it. The key difference is that, while a website may know from your ad click that you were targeted by a campaign looking for college-aged men or whatever, it doesn't necessarily know who you are. That's the difference between personally identifiable information and simply targeted information. There needs to be safeguards to avoid abuse. For example, if the targeting dimensions of an ad campaign are so narrow that the few people fall into it, it shouldn't be targeted (a good example would be geographic targeting of devices that are inside of your house -- too granular). But, I don't care if a website knows that I am likely male or my coarse age or whatever, because i don't have to tell the website who I am in the real world if I don't want to. "Selling your data" is commonly understood by the public to mean something like this -- people suspect that facebook just gives lists of their users to third parties and asks them who they want to send ads to, which is the accusation that Facebook is denying. If I end up making a purchase w/ a website, then sure, they'll know some things about me from the FB ad click referral and the underlying ad campaign they ran. I feel fine with that, I'm entering a relationship with the business where they know quite a bit about me anyway -- like my name, my address, what I'm buying, etc. I don't buy things from places if I can't trust them.

adrianmonk 8y ago

I've become convinced that people were already looking for a concrete reason to dislike Facebook. They resent the presence of social media in their lives and the influence it has, not to mention the annoyance and over-saturation. But they see some usefulness too and/or don't want to be out of the loop, so they're not ready to totally walk away. So they remain in a situation they don't like, and there's been a lot of simmering frustration. Then this data collection thing came along, and it became a way of venting some of that frustration. So it became a myth that a lot of people believe in. A myth because, while Facebook definitely isn't perfect, people believe it is doing certain bad things it really isn't. To me this suggests that, like a couple who has a big argument over some trivial non-issue, there is probably some other real issue that needs to be sorted out.