5 ms·

PSA: Some Major News Outlets Are Also Sending Data Directly to Facebook

81 points by jmsflknr 8y ago

donohoe 8y ago
I think its safe to say "Almost All Major News Outlets Are Also Sending Data Directly to Facebook".
- Bartweiss 8y ago
  Particularly horrible/funny, though, that the Verge article about Android apps doing this is also doing it.
stunt 8y ago
Apparently 10% (I just made this number) of people working in tech industry are working to collect, store, and process personal data. It is shocking to see how few of these 10% speak up. We put Hackers into jail for stealing personal data. Not comparing them together, but from moral perspective they seem equal to me.
- magduf 8y ago
  They're not stealing personal data: users are willingly giving them this data. There is a solution to this, and that's to have stronger privacy laws like the EU does, but American voters have flatly rejected anything like that and don't want such laws.
  - kevin_thibedeau 8y ago
    American politicians won't enact laws that impair the data broker industry which has been around for decades. Voters are kept largely in the dark by a press that doesn't want to expose how the sausage is made since they have a seat at the table.
    - magduf 8y ago
      I don't buy this stuff about "the press" at all. The press in America was firmly behind Hillary in the 2016 election, and look what happened. The voters do have a will of their own and they're not just doing what the press tells them. (This isn't to say the voters made the right choice: the way the voters have voted is why we don't have strong data-protection laws, along with a lot of other things the Europeans have such as a better-functioning healthcare system, better public transit, etc.)
- tbrownaw 8y ago
  It is shocking to see how few of these 10% speak up. So maybe it's actually not 10%, or maybe just working with "personal data" isn't as automatically objectionable as you seem to think. For example I know that whoever does IT for the local doctor's office, or dispatch for the plumbing company, is working with personal data. I don't think I'd consider either of those a problem. Not comparing them together, but from moral perspective they seem equal to me. Not sure how that's supposed to work exactly.
  - mc32 8y ago
    That IT person presumably is working under something like an NDA (and HIPAA, etc., where applicable), so there is recourse we’re they to violate their duties and misuse data.
- dragonwriter 8y ago
  > Apparently 10% (I just made this number) of people working in tech industry are working to collect, store, and process personal data It's probably closer to 100% than 10%; at any rate it's a lot more than 10%. > It is shocking to see how few of these 10% speak up. About...what? I mean, I pretty much am the overseer of changes to some specialized public sector medical billing systems that handle on the order of single-digit billions of dollars in annual claim volume and on the order of a million annual individuals. So connecting, storing, and processing personal information is a central part of what those systems do. But what are you supposing I ought to be speaking up about just because I work on such a system?
- soared 8y ago
  I spend 100% of my time at a digital advertising agency working on and placing google/facebook/trade desk/etc pixels. I spent most my time trying to scrape and store information on what products you viewed, how much money you spent, etc. What do you want to know?
  - Bartweiss 8y ago
    Hey, I'm interested to see someone who's actually in this specific line of programming comment! I'm pretty sympathetic to the general argument that interactions with websites aren't private because they're two-party interactions with the site, but there are a few things that trouble me that I'd be interested to ask. First, I guess: do you think that users are broadly aware of how much they're tracked and ok with it, or do you think the tracking is alright independent of that? (This question is more relevant if you're on the "tracking browser resizes" side of things than "recording products in a cart".) Second: do you have any worries about data that's tame in isolation or on average causing problems as it's gathered and shared - deanonymizing aggregate data, revealing pregnancies by shopping history, etc? Third: do you worry about keeping identifiable data in existence more generally? Assuming you trust yourself and your partners, there's still the concern that maintaining data troves like these increases the attack surface for everything from hacking to government demands.
    - soared 8y ago
      1) I don't do any browser fingerprinting or things like that, but we definitely pay vendors to do it for us (crosswise, owned by oracle does a lot). Users know as much about tracking as they do about how a website works - none. If you tried to get an average person to learn about http, html, javascript, cms, dns, cdn, caches, cookies, etc it would be impossible.. tracking is equally as complicated. 2) I only support data in aggregate. Anything personally identifiable should be illegal IMO. As long as target finds 10,000 people who are pregnant due to their shopping habits, I think thats fine. If the system is set up correctly with one company collecting and aggregating data, then another company buying access to that data it is safe. Its a misconception that facebook sells data, they just sell access to it. So most data you can't actually de-anonymize. 3) I definitely support legislation around data storage and yeah I think thats a huge problem right now. Its super easy to collect a ton of data, even when you have no idea how to store it or even use it. Its literally 2 minutes of effort for me to grab every single name of someone who purchased something on ~50 ecom sites, but I know nothing about how to securely store that. As far as the justification for where I work - Ads fuel the internet and create more benefit than they do harm. Millions of people run websites, create content, make free apps. That simply would not occur without ads to monetize them since people are unwillingly to pay for content. Microtransactions for content would be awesome but they haven't worked yet. We're also on year <30 of widespread internet use. Its the wild west right now but we will fix it.
tbrownaw 8y ago
Yes, I know, analytics (especially outsourced analytics) are fundamentally evil. Just like paywalls are evil. And just like ads are evil. But, I'm not exactly clear on how these things are supposed to all fit together.
- i_am_nomad 8y ago
  I don’t like paywalls, but in what way are they evil? To be specific, a paywall in front of privately funded content is annoying but fair. Elsevier-style paywalls are another matter.
data_spy 8y ago
Can't speak to this specifically but many news publishers use FB for ads. Yes, Facebook does ads outside of their platform.
h3ckr 8y ago
Why is Google never brought up in these? Isn’t Facebook pixel similar to Google Analytics?
- h3ckr 8y ago
  While at it, should we put Segment, Mixpanel, Optimizely, etc. on the list? I’m not saying they’re good or bad in terms of data tracking, I’m just saying they should be in the same bucket. Tech companies harvest data to improve their businesses...
  - gorkemcetin 8y ago
    Well, while we (Countly) are direct competitor to Mixpanel, we cannot talk about this as there is no evidence and all of them are clear about what they do with your data. Speaking of product analytics, the best way is to keep your own data on your premises (shameless plug here).
CharlesColeman 8y ago
> I check every time some tech outlet posts the usual, dumb, silly FB post about how presumably FB leaks or ingests your data...and they're always leaking your data to FB, among other, far sketchier players. Newflash: the developers that make technology choices for the website and the journalists writing the articles for it are in entirely different organizations. It's usually dysfunctional when business users have the power to dictate technology choices to the tech team.
soared 8y ago
>SOME MAJOR TECH JOURNALS ARE STILL SENDING DATA DIRECTLY TO FACEBOOK Sound the alarms? Pretty much every site you visit has facebook, google, and 20 other adtech pixels on it. Go download ghostery and check for yourself. Any business that wants to make money is using these pixels.. advertising would be nearly useless without them. How else would you know who visits your site? How would you know if someone who made a purchase had seen one of your ads? If they were a new customer or old customer? If they might be interested in complementary products? The go to answer is 'check the logs'. Good luck telling your 19 year marketing intern to check the logs. Or your director of marketing. Or your CMO. Or your agency.
- Bartweiss 8y ago
  Yes, there's a pretty major difference between this and the story it's referencing about in-app Facebook tracking. (https://news.ycombinator.com/item?id=19319215 https://news.ycombinator.com/item?id=19319215) Sites running tracking pixels are consciously tracking their users and feeding info to advertising players for their own benefit. I suspect many people would be surprised that this happens even when you're not signed into the relevant service and don't see anything like a "share this on Facebook" icon, but the basic concept of browser tracking isn't that weird. That pixel on The Verge didn't end up their by accident. On the other hand, the Facebook SDK fires an event every time you open an app using it - by default, even if you aren't signed into Facebook, even if the app's creator never intended that behavior and gets no benefit from it. And, of course, auditing or controlling app behavior and data exchange is way harder than doing the same for browsers. The average person who runs uBlock or Privacy Badger still isn't emulating every app they download to study its behavior.

81 points by jmsflknr 8y ago

donohoe 8y ago

I think its safe to say "Almost All Major News Outlets Are Also Sending Data Directly to Facebook".

Bartweiss 8y ago
Particularly horrible/funny, though, that the Verge article about Android apps doing this is also doing it.

stunt 8y ago

Apparently 10% (I just made this number) of people working in tech industry are working to collect, store, and process personal data. It is shocking to see how few of these 10% speak up. We put Hackers into jail for stealing personal data. Not comparing them together, but from moral perspective they seem equal to me.

magduf 8y ago
They're not stealing personal data: users are willingly giving them this data. There is a solution to this, and that's to have stronger privacy laws like the EU does, but American voters have flatly rejected anything like that and don't want such laws.
- kevin_thibedeau 8y ago
  American politicians won't enact laws that impair the data broker industry which has been around for decades. Voters are kept largely in the dark by a press that doesn't want to expose how the sausage is made since they have a seat at the table.
  - magduf 8y ago
    I don't buy this stuff about "the press" at all. The press in America was firmly behind Hillary in the 2016 election, and look what happened. The voters do have a will of their own and they're not just doing what the press tells them. (This isn't to say the voters made the right choice: the way the voters have voted is why we don't have strong data-protection laws, along with a lot of other things the Europeans have such as a better-functioning healthcare system, better public transit, etc.)
tbrownaw 8y ago
It is shocking to see how few of these 10% speak up. So maybe it's actually not 10%, or maybe just working with "personal data" isn't as automatically objectionable as you seem to think. For example I know that whoever does IT for the local doctor's office, or dispatch for the plumbing company, is working with personal data. I don't think I'd consider either of those a problem. Not comparing them together, but from moral perspective they seem equal to me. Not sure how that's supposed to work exactly.
- mc32 8y ago
  That IT person presumably is working under something like an NDA (and HIPAA, etc., where applicable), so there is recourse we’re they to violate their duties and misuse data.
dragonwriter 8y ago
> Apparently 10% (I just made this number) of people working in tech industry are working to collect, store, and process personal data It's probably closer to 100% than 10%; at any rate it's a lot more than 10%. > It is shocking to see how few of these 10% speak up. About...what? I mean, I pretty much am the overseer of changes to some specialized public sector medical billing systems that handle on the order of single-digit billions of dollars in annual claim volume and on the order of a million annual individuals. So connecting, storing, and processing personal information is a central part of what those systems do. But what are you supposing I ought to be speaking up about just because I work on such a system?
soared 8y ago
I spend 100% of my time at a digital advertising agency working on and placing google/facebook/trade desk/etc pixels. I spent most my time trying to scrape and store information on what products you viewed, how much money you spent, etc. What do you want to know?
- Bartweiss 8y ago
  Hey, I'm interested to see someone who's actually in this specific line of programming comment! I'm pretty sympathetic to the general argument that interactions with websites aren't private because they're two-party interactions with the site, but there are a few things that trouble me that I'd be interested to ask. First, I guess: do you think that users are broadly aware of how much they're tracked and ok with it, or do you think the tracking is alright independent of that? (This question is more relevant if you're on the "tracking browser resizes" side of things than "recording products in a cart".) Second: do you have any worries about data that's tame in isolation or on average causing problems as it's gathered and shared - deanonymizing aggregate data, revealing pregnancies by shopping history, etc? Third: do you worry about keeping identifiable data in existence more generally? Assuming you trust yourself and your partners, there's still the concern that maintaining data troves like these increases the attack surface for everything from hacking to government demands.
  - soared 8y ago
    1) I don't do any browser fingerprinting or things like that, but we definitely pay vendors to do it for us (crosswise, owned by oracle does a lot). Users know as much about tracking as they do about how a website works - none. If you tried to get an average person to learn about http, html, javascript, cms, dns, cdn, caches, cookies, etc it would be impossible.. tracking is equally as complicated. 2) I only support data in aggregate. Anything personally identifiable should be illegal IMO. As long as target finds 10,000 people who are pregnant due to their shopping habits, I think thats fine. If the system is set up correctly with one company collecting and aggregating data, then another company buying access to that data it is safe. Its a misconception that facebook sells data, they just sell access to it. So most data you can't actually de-anonymize. 3) I definitely support legislation around data storage and yeah I think thats a huge problem right now. Its super easy to collect a ton of data, even when you have no idea how to store it or even use it. Its literally 2 minutes of effort for me to grab every single name of someone who purchased something on ~50 ecom sites, but I know nothing about how to securely store that. As far as the justification for where I work - Ads fuel the internet and create more benefit than they do harm. Millions of people run websites, create content, make free apps. That simply would not occur without ads to monetize them since people are unwillingly to pay for content. Microtransactions for content would be awesome but they haven't worked yet. We're also on year <30 of widespread internet use. Its the wild west right now but we will fix it.

tbrownaw 8y ago

Yes, I know, analytics (especially outsourced analytics) are fundamentally evil. Just like paywalls are evil. And just like ads are evil. But, I'm not exactly clear on how these things are supposed to all fit together.

i_am_nomad 8y ago
I don’t like paywalls, but in what way are they evil? To be specific, a paywall in front of privately funded content is annoying but fair. Elsevier-style paywalls are another matter.

data_spy 8y ago

Can't speak to this specifically but many news publishers use FB for ads. Yes, Facebook does ads outside of their platform.

h3ckr 8y ago

Why is Google never brought up in these? Isn’t Facebook pixel similar to Google Analytics?

h3ckr 8y ago
While at it, should we put Segment, Mixpanel, Optimizely, etc. on the list? I’m not saying they’re good or bad in terms of data tracking, I’m just saying they should be in the same bucket. Tech companies harvest data to improve their businesses...
- gorkemcetin 8y ago
  Well, while we (Countly) are direct competitor to Mixpanel, we cannot talk about this as there is no evidence and all of them are clear about what they do with your data. Speaking of product analytics, the best way is to keep your own data on your premises (shameless plug here).

CharlesColeman 8y ago

> I check every time some tech outlet posts the usual, dumb, silly FB post about how presumably FB leaks or ingests your data...and they're always leaking your data to FB, among other, far sketchier players. Newflash: the developers that make technology choices for the website and the journalists writing the articles for it are in entirely different organizations. It's usually dysfunctional when business users have the power to dictate technology choices to the tech team.

soared 8y ago

>SOME MAJOR TECH JOURNALS ARE STILL SENDING DATA DIRECTLY TO FACEBOOK Sound the alarms? Pretty much every site you visit has facebook, google, and 20 other adtech pixels on it. Go download ghostery and check for yourself. Any business that wants to make money is using these pixels.. advertising would be nearly useless without them. How else would you know who visits your site? How would you know if someone who made a purchase had seen one of your ads? If they were a new customer or old customer? If they might be interested in complementary products? The go to answer is 'check the logs'. Good luck telling your 19 year marketing intern to check the logs. Or your director of marketing. Or your CMO. Or your agency.

Bartweiss 8y ago
Yes, there's a pretty major difference between this and the story it's referencing about in-app Facebook tracking. (https://news.ycombinator.com/item?id=19319215 https://news.ycombinator.com/item?id=19319215) Sites running tracking pixels are consciously tracking their users and feeding info to advertising players for their own benefit. I suspect many people would be surprised that this happens even when you're not signed into the relevant service and don't see anything like a "share this on Facebook" icon, but the basic concept of browser tracking isn't that weird. That pixel on The Verge didn't end up their by accident. On the other hand, the Facebook SDK fires an event every time you open an app using it - by default, even if you aren't signed into Facebook, even if the app's creator never intended that behavior and gets no benefit from it. And, of course, auditing or controlling app behavior and data exchange is way harder than doing the same for browsers. The average person who runs uBlock or Privacy Badger still isn't emulating every app they download to study its behavior.