17 ms·
Facebook will reveal who uploaded your contact info for ad targeting
- busterarm 8y agoThat just means that uploaders will scrub their data through an intermediary, if they aren't already.
- thr0awaz 8y ago'Your information was purchased by Totally Not the NSA, Inc.'
- galapago 8y agoFlowers By Irene (https://i.kym-cdn.com/photos/images/newsfeed/000/183/841/0c5.jpg https://i.kym-cdn.com/photos/images/newsfeed/000/183/841/0c5...)
- justinclift 8y agoCanadian International Airlines ;)
- llukas 8y agoI don't think it would help much in EU. :) Would GDPR allow to withdraw consent for the intermediary? What if I disallow intermediary to handle my data but some other third party I gave permission to process data uses this intermediary?
- floatrock 8y agoThe California Consumer Privacy Act (coming into effect in 2020) definitely does. From https://privacylaw.proskauer.com/2018/07/articles/data-privacy-laws/the-california-consumer-privacy-act-of-2018/ https://privacylaw.proskauer.com/2018/07/articles/data-priva..., the California Consumer Privacy Act specifies: > 1. the right to know, through a general privacy policy and with more specifics available upon request, what personal information a business has collected about them, where it was sourced from, what it is being used for, whether it is being disclosed or sold, and to whom it is being disclosed or sold; > 2. the right to “opt out” of allowing a business to sell their personal information to third parties (or, for consumers who are under 16 years old, the right not to have their personal information sold absent their, or their parent’s, opt-in); > 3. the right to have a business delete their personal information, with some exceptions; In fact, this entire facebook announcement looks like it's just compliance for #1. Good for them for not waiting until the month before like GDPR, but don't be fooled that they're showing this information out of the goodness of their hearts.
- tyfon 8y agoThe data controller, in this case the "original" company is responsible for collecting an informed concent to use your data for that specific use unless the use is a requirement to do business (i.e. invoicing, not advertising). It does not carry over to another company by shifting this to the processor. The intermediary is just a data processor, and while they also have to follow gdpr it's the data controller who is responsible that the intermediary actually follows the laws. As far as I can tell facebook will just tell you who is uploading your data but then you can pursue them if you do not believe they have your concent to do so.
- rubyfan 8y agoIt’s reason enough to leave my Facebook account open. I’ve just stopped using it anymore and that’s fine. It’s been months and I don’t miss the constant barrage of political rants from my friends on both sides of the political spectrum.
- iscrewyou 8y agoThat’s why I have a separate Firefox profile. It’s the only site that gets used on there. I am a lot more productive at home and save so much more time.
- Groxx 8y agoin case you hadn't seen them: have you tried container tabs instead of separate profiles?
- iscrewyou 8y agoI have. But I haven’t read the spec and don’t really know if they truly isolate Facebook and all it’s way of associating with my computer/Firefox profile to my account. With how shady Facebook is, I don’t believe it for a second they haven’t found a work around to identify my profile through Container Tabs. It’s paranoia maybe? But it’s warranted I think. So for a good measure, I just use a separate profile.
- Groxx 8y agoyea, that's a pretty good reason :) afaik the list of what containers separate is here, if you're interested: https://wiki.mozilla.org/Security/Contextual_Identity_Project/Containers#What_is_.28and_isn.27t.29_separated_between_Containers https://wiki.mozilla.org/Security/Contextual_Identity_Projec... (I can't speak to its up-to-date-ness tho, I'm not familiar with how well maintained the moz wiki is) there are definitely some leaks, and there is a "facebook container" extension which plugs some (all?) of those... but yea. if you want maximum separation, you want maximum separation, profiles are probably always going to be the safest bet.
- deleted 8y ago[deleted]
- deleted 8y ago[deleted]
- ppeetteerr 8y agoThis is a step in the right direction. I would like to see more regulation around who can upload ads to Facebook as well.
- the_cat_kittles 8y agoif you think facebook is doing this because they are "on your side" you are a complete sucker
- mturmon 8y agoThis seems like a way to offload the blame onto the uploader, rather than the system that continually asks for contacts.
- floatrock 8y agoYou're right, but the reason they're doing this is less conspiratorial than you suggest... it's just compliance for the California Consumer Privacy Act coming into effect in 2020. From https://privacylaw.proskauer.com/2018/07/articles/data-privacy-laws/the-california-consumer-privacy-act-of-2018/ https://privacylaw.proskauer.com/2018/07/articles/data-priva..., the first major provision is: > 1. the right to know, through a general privacy policy and with more specifics available upon request, what personal information a business has collected about them, where it was sourced from, what it is being used for, whether it is being disclosed or sold, and to whom it is being disclosed or sold; The UI mocks in the article are literally a checklist of each of these items.
- o10449366 8y agoAre they assigning blame to a single individual? Because I'm pretty sure 95% of my Facebook and Instagram friends have "connected their contacts" at some point. I've had this huge banner on my Instagram profile page for over a year now. It takes up over 50% of the screen and shows up every time I press the button to go to my page: https://i.imgur.com/PLvohTH.jpg https://i.imgur.com/PLvohTH.jpg I've never clicked it and never will, but I don't doubt that many of my friends have just to get it to go away. That's why I only give out my Google Voice number to people and only use my real phone number when it's strictly necessary.
- randomacct3847 8y agoA person adding their contact list isn’t “ad targeting.” Some companies literally upload email contact lists to Facebook and pay for ads that will be shown to anyone on that list that also has a Facebook account.
- marsRoverDev 8y agoIt's worth noting that they hash their email lists and upload those. They are never given access to a list of the list of people on facebook who share those addresses.
- eigenvector 8y agoThere should be an App Store rule that you can only ask for a permission once, if the user declines you can't keep pestering for it unless they've actually invoked an action that requires the permission.
- simongr3dal 8y agoOn iOS, apps can only activate the system dialog for permissions once for each individual permission (camera, microphone, contacts, etc.) So the strategy to do is to say yes for the app to ask permission and when the system dialog shows up you can decline. If you ignore or say no to the app dialog they can keep pestering you, but once you have declined on the system dialog there's not much the app can do. The apps have to instruct you to go into the app settings if you want to activate permissions, not a lot of apps are doing this since it's quite an involved process.
- randomacct3847 8y agoI went to a growth meetup last year and sat through a presentation by a Pinterest engineer who walked through how they upload emails from churned Pinterest users to Facebook to try to reactivate them as the primary use case for their FB ad spend. Honestly didn’t even realize it was “ok” for companies to share emails with third parties as I thought that is even considered PII.
- ssvss 8y agoI think they upload the hashes of emails they have, and facebook matches it with the hashes of the emails it has.
- deleted 8y ago[deleted]
- omeid2 8y agoIn some jurisdictions, that is still, rightly so, considered PII.
- shostack 8y agoCan you share a link with info on some of those specific jurisdictions?
- omeid2 8y agoEuro/GDPR: https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly. The keyword here is indirectly. Australia: https://www.legislation.gov.au/Details/C2019C00025 https://www.legislation.gov.au/Details/C2019C00025 personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable. (a) whether the information or opinion is true or not; and (b) whether the information or opinion is recorded in a material form or not. The keyword here "reasonably identifiable". So if the purpose of an email hash is to identify me for ads targeting, then it is by definition reasonably identifying me, even if indirectly.
- aussieguy1234 8y agoCould be good for competitive intelligence - discover your competitors ad targeting strategy
- senectus1 8y agoI'm not sure why anyone would trust this information. there is a plethora of ways they could omit information or order information or over provide information to make this work in their favour.
- bigiain 8y agoI wonder how much Facebook are charging "preferred advertisers" to be left out of this?
- deleted 8y ago[deleted]
- reilly3000 8y agoAs a recovering media buyer I think this is one of the most concrete forward steps Facebook has made since their struggles began. “Custom Audiences” are great for CRM matching campaigns but so very easily abused. There used to be a 20 row min on lists. There was an article or reddit post I remember that showed how a kid trolled his roommate with ads targeted exclusively at the roommate and 19 fake people. They subsequently increased the list size minimum to 500, but I still cannot fathom that they left such a huge abuse vector open for so long. It’s like they didn’t care as long as the clicks kept coming.
- reilly3000 8y agoHere it is: http://ghostinfluence.com/the-ultimate-retaliation-pranking-my-roommate-with-targeted-facebook-ads/ http://ghostinfluence.com/the-ultimate-retaliation-pranking-... TIL even the 20 user mine wasn’t required and today the min is only 100. I know for a fact that Trump 2016 used this technique with voter rolls to discourage turnout for likely Hillary voters based on a talk I watched by their media team.
- smudgymcscmudge 8y agoHow did they do that? Target them with ads that said “don’t bother voting she’s got it under control”?
- mehrdadn 8y agoI think parent is referring to a 60 Minutes interview with Brad Parscale, if you want to look it up.
- reilly3000 8y agoThe talk I was referring to was from Molly Schweickert, Vice President Global Media from Cambridge Analytica on "How digital advertising worked for the US 2016 presidential campaign" https://youtu.be/bB2BJjMNXpA?t=897 https://youtu.be/bB2BJjMNXpA?t=897 Its really a fascinating watch, and a perfect case study for why GDPR is needed. After reviewing it I don't see any mention of specific techniques used to discourage turnout, but those techniques are well-documented elsewhere: https://www.theatlantic.com/politics/archive/2016/10/trumps-black-voter-dilemma/505586/ https://www.theatlantic.com/politics/archive/2016/10/trumps-...
- chrsstrm 8y agoI just counted and Facebook tells me that 1,147 advertisers have uploaded a contact list that contained my info, specifically found on https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen https://www.facebook.com/ads/preferences/?entry_product=ad_s... : These advertisers are running ads using a contact list they or their partner uploaded that includes info about you. This info was collected by the advertiser or their partner. Typically this information is your email address or phone number. Want to know what's funny? The email address I use for Facebook was created only for Facebook. I have never given it out to anyone else, ever. The inbox for that account only contains emails from Facebook. I have never given Facebook my phone number. I have never clicked on an ad in Facebook. I have never connected an app with my Facebook account. _Facebook_ itself is the only entity which has ever had my contact info associated with my account. So tell me, how did 1,147 other businesses and groups get their hands on my info if I've never given it out? I can't wait to see what the explanation is when this feature launches end of the month.
- arrty88 8y agoHow? Is it public on your profile page? Have you ever used facebook apps or oauth/single sign on?
- chrsstrm 8y agoNope, contact info is hidden. Never authed with another app or service. The idea of super cookies doesn't play either, I only use Facebook in a separate browser that doesn't get used for anything else, and these days it only gets used in Firefox using the Facebook container. I've always treated Facebook like the plague and never let it come close to my normal activities. I went to great lengths to not let them figure out who I was, other than the graph info they have on my friends.
- spc476 8y agoYou were probably tracked via IP address. Even without a static IP address, it probably doesn't change that much. With so many Facebook "like" icons everywhere, it doesn't really matter what browser you use, or if you are logged in or not.
- starpucks 8y agoHow is any of this surprising? At this point pretty much anything you are doing is monitored including clicks and typing within iPhone apps
- gnicholas 8y agoI can’t tell if this change affects how lookalike audiences are described. Does anyone know how they are currently described? “You are seeing this ad because BigCo wants to target people who like things similar to people whose email addresses they uploaded” or something?
- tjpnz 8y agoWould've been nice for them to go a step further including the name of the person handling your information.
- trumped 8y agoWhen I created my Facebook account, I used a unique email address that I completely disabled after the signup process was over (because I wanted to avoid Facebook's email spam) and I never gave them my phone number and never used the Facebook apps on my phone... yet a bunch of companies uploaded that contact info? very strange.
- jahewson 8y agoFacebook does not tell you exactly what contact information was uploaded. Does your Facebook profile include your name? Birthday? Location? That’s what it’s gonna be. Not so strange.
- trumped 8y agoFacebook should at least give you access to your shadow profile so that you know what they have. I didn't give them my real birth date or home address but they still could have them, I guess (some people wished me happy birthday on Facebook, for example)
- austinhutch 8y agoOf my list, which I'm still parsing, I'm seeing a TON of local car dealerships and realtors. What I really wish is I could see the supplier that's selling my data to these folks who are 100% not running their own Facebook ad campaigns. Actually - I might reach out to the car dealerships and try to figure out what agencies they are using.
- fru2013 8y agoSame for me with the car dealerships. I've never owned a car or even ever contacted a dealership before. My guess is maybe car rental companies are selling the data to dealerships, since they would be gathering email + phone and car-renters would be targets for car-sellers.
- shostack 8y agoTons of out of state real estate agents on mine. That's just poor targeting.
- ACow_Adonis 8y agoI had a total of 4 advertisers remaining on mine (if anything I'm doing better than most). Audi, a local real estate group, a betting agency, and an airline/frequent-flyer account. Obviously I don't want and didn't volunteer my details used for use by any of these for advertising or tracking purposes. The frequent flyer group have just taken it from my membership details. I don't bet, but I've worked as a statistician, so there's probably some connection there with past probability and modelling work or getting odds from these sites. The real estate group I'm guessing is from contact details given while looking for houses that they've used without my explicit permission. Audi is interesting because I've never had a car in my name, and haven't had one in my household for several years. Haven't so much as stepped in a car dealership. I'm guessing they must have bought(stole?) it from a rental or car-share company database...or a marketing list somewhere, but its certainly not from anything I've done first hand.
- 0xCMP 8y agoI clicked "Show more" via the console until it stopped and then "clicked" every button and waited. It's not a real solution, but at least I've voiced my intention to not be tracked by these advertisers. I wish deleting my Facebook was a valid option here, but as we all know they keep profiles on you anyways.
- grogenaut 8y agoSo I guess keep the facebook account because it's hopeless anyway? Way to be principled. How bout delete it and feed them less and stop being an ecosystem effect. My friends from college for years were planning yearly meetups. 2 years ago enough of us dropped off FB that we started planning with email and MMS again. Quite a few more dropped as well last year and this. So it does work eventually
- deleted 8y ago[deleted]
- rochak 8y agoI haven't checked mine, but couldn't you have written a simple JS to automate this?
- 0xCMP 8y agoYea, that's what I meant. I just selected the show more link and clicked in a loop and then selected all the "X" buttons and clicked them and waited until the network requests finished.
- knaik94 8y agoI got department of homeland security... https://i.imgur.com/qlsKmNH.png https://i.imgur.com/qlsKmNH.png
- jmspring 8y agoHow about FB just allows a simple click of "ignore everything about me and provide phsyical proof that such is happening".
- sahin-boydas 8y agoI just counted and Facebook tells me that 713 advertisers have uploaded a contact list that contained my info. The super funny thing is that i saw my old girl friend create a page and upload my info and target me. ;)) (a good idea to create jealousy i guess)
- rblion 8y agoThis is going to be very interesting year for a lot of industries and movements. It's only February.
- Raed667 8y agoMost of the ones I have got are from apps I use (Netflix, Uber, Airbnb, etc...) They already have me as a user, do they really feel the need to push it?
- dbg31415 8y agoAnd, is your Facebook-powered social media leaking your data? The answer may not surprise you. It’s ‘yes, it’s Facebook.’
- plorg 8y agoThe Do Not Call Registry obviously isn't 100% effective, but one possible regulatory move would be to create a similar service for email and phone numbers used in marketing lists, such that possessing a list with the PII of a person who had opted out would subject you to monetary penalties. Then make it incumbent on the company to prove that the person affirmatively consented to sharing their PII. An attempt at such a concept appears to exist as implemented by a non-governmental group here [1], although that group is voluntary rather than compulsary, and probably doesn't have anything to do with the shadier data brokers. [1] https://dmachoice.thedma.org/ https://dmachoice.thedma.org/
- mdekkers 8y agoIMHO this would require a "I did not provide consent" button to keep the ad publishers (i.e. Facebook's paying customers) honest. There will obviously be many people clicking this "incorrectly" but much like your spamfilter, FB should eventually learn this user x really doesn't want to hear about this company anymore. Not that this is likely to ever happen, given the we are the product, not the user.
- chillacy 8y agoYou can get to "Hide all ads from <advertiser>" in a few clicks. I mean that makes sense since if you really don't want to hear from a company, the company can better spend their money elsewhere.
- echofavor 8y agoThanks for sharing. You can also share your ideas for free on www.echofavor.com
- lucb1e 8y agoOh, I thought this was about my friends, so I could mention to my friends that I wasn't happy they uploaded my PII through their usage of Facebook.
- a_imho 8y agoOtoh Techcrunch (I mean Oath Family) will not reveal this article if you are European and don't agree to their tracking. It presents a complex and captcha ridden interface where it is impossible to give/deny informed consent.
- werid 8y agoI looked at the advertisers who uploaded a contact list with me in it... * Motley Denim * TV2 Sumo * Bandcamp * NBA I am a bit surprised it was only four, and a bit disappointed bandcamp was one of them.
- aembleton 8y agoIf you make a POST request to https://www.facebook.com/ads/profile/advertisers/ https://www.facebook.com/ads/profile/advertisers/ with your facebook cookies then you get the JSON back with all of your advertisers. Looks like I have well over a thousand of them.
- bluetidepro 8y agoCan you explain how to do this specifically?
- mxuribe 8y agoYeah, i'm interested myself. (Either my curl wrangling is wrong, or FB not playing nice now.) Would love to know how you're doing this.
- renholder 8y ago>Starting February 28th, Facebook’s “Why am I seeing this?” button in the drop-down menu of feed posts will reveal more than the brand that paid for the ad, some biographical details they targeted and if they’d uploaded your contact info. Facebook will start to show when your contact info was uploaded, if it was by the brand or one of their agency/developer partners and when access was shared between partners. A Facebook spokesperson tells me the goal is to keep giving people a better understanding of how advertisers use their information. This is great and all but what about the people who don't have a Facebook account, which Facebook is still keep tracking of (e.g.: Facebook Pixel)?
- makecheck 8y agoNot sure this can really help; information changes hands quickly. Once an agent misheard my name when setting up electricity and I received bills addressed to a similar-sounding name from them. For years I would receive mail from all kinds of random things they clearly sold me to, with the exact same mistake.