4 ms·

I don't understand: where are users entering sensitive information, and how is that related to facebook? If I click an ad on facebook and land on some website w

I don't understand: where are users entering sensitive information, and how is that related to facebook? If I click an ad on facebook and land on some website where I can fill in sensitive information, surely that's beyond facebooks' control? Were people entering information somehow IN the ad, while still on facebook's page?

Moru 4y ago
One way would be to place the facebook pixel on the site so if you buy sensitive meds from the drugstore, facebook knows what you bought and can sell that information to your insurance company. Not sure if they shut down the facebook pixel yet but I'm sure there is something similar around instead if they did.
- jollybean 4y ago
  I don't think that's it. FB doesn't 'sell' data, rather, they allow advertisers to 'target' people. The targetting dimensions are right there for everyone to see, I'm doubtful that you're going to find the ability to target people on 'recently purchase meds'. I think this is a case of companies asking users to provide information on in-app sign ups.
jollybean 4y ago
Neither do I, once again, frustratingly bad reporting. My guess is that the 'ad' is has a 'sign up' where people can input information, which can be sensitive, that is capture for the advertiser. I could be anything i.e. contests, emails, whatever. The advertiser can get the data in a spreadsheet later. If the company doing the ad is 'fake' then you have a CA like scandal possibly, where the fake company can sell that harvested data, some of it sensitive. I think there are legit concerns here, but I mean, the companies could just as easily direct them to their own url and ask users to 'sign up', which would likely be beyond Facebooks purview to control.
Ma8ee 4y ago
No, people went to an online pharmacy, unrelated to Facebook. That pharmacy sent the information to Facebook, including information about what kind of medication that was purchased. Of course, the main fault was with the pharmacy, but that is another, related, story. The main point here is that Facebook had promised to filter and not store sensitive information, but that filter apparently didn't work, possibly because that filter didn't handle information in Swedish. So, even if you never ever had been even close to Facebook, Facebook could have the information that you just ordered some Emergency Contraceptives.
- alkonaut 4y ago
  I understand. It feels almost like magic that a script could figure out that kind of thing from any site? I guess it’s mostly just blindly uploading things from forms? This is a massive GDPR breach of the site in question though. I really don’t fault Facebook much. Anyone who ever includes any FB script is reaponsible for exactly what it does.
  - amelius 4y ago
    > I really don’t fault Facebook much. Anyone who ever includes any FB script is responsible for exactly what it does. Many people don't understand the implications of using FB scripts, whereas FB does.
    - alkonaut 4y ago
      Sure. There is perhaps a moral/ethical responsibility. But there are laws against sharing sensitive info and I don't think "I didn't know FB scripts did that" helps. FB's entire business is gobbling up user data. And pharmacies business is to know who they share sensitive data with. I don't think it's too much to ask to require siteowners to understand what the scripts they use are actually doing, at least if they deal with sensitive data. For example, I don't think pharmacies should do any kind of advertising on FB, or do any kind of campaign tracking/conversion measuring etc on the same site they accept user data. As will all GDPR violations, if just a few large pharmacies were fined out of existence, I bet the rest would quickly fall in line.
TazeTSchnitzel 4y ago
They weren't on Facebook's website at all. They were using an online pharmacy's website, and Facebook gets sent information about this because the site embeds Facebook's tracking scripts. This is one of the insidious things about adtech: they track you all over the internet, not just on the adtech companies' own sites.
- _joel 4y ago
  Thank god for Firefox containers and ublock origin et al.

Moru 4y ago

One way would be to place the facebook pixel on the site so if you buy sensitive meds from the drugstore, facebook knows what you bought and can sell that information to your insurance company. Not sure if they shut down the facebook pixel yet but I'm sure there is something similar around instead if they did.

jollybean 4y ago
I don't think that's it. FB doesn't 'sell' data, rather, they allow advertisers to 'target' people. The targetting dimensions are right there for everyone to see, I'm doubtful that you're going to find the ability to target people on 'recently purchase meds'. I think this is a case of companies asking users to provide information on in-app sign ups.

jollybean 4y ago

Neither do I, once again, frustratingly bad reporting. My guess is that the 'ad' is has a 'sign up' where people can input information, which can be sensitive, that is capture for the advertiser. I could be anything i.e. contests, emails, whatever. The advertiser can get the data in a spreadsheet later. If the company doing the ad is 'fake' then you have a CA like scandal possibly, where the fake company can sell that harvested data, some of it sensitive. I think there are legit concerns here, but I mean, the companies could just as easily direct them to their own url and ask users to 'sign up', which would likely be beyond Facebooks purview to control.

Ma8ee 4y ago

No, people went to an online pharmacy, unrelated to Facebook. That pharmacy sent the information to Facebook, including information about what kind of medication that was purchased. Of course, the main fault was with the pharmacy, but that is another, related, story. The main point here is that Facebook had promised to filter and not store sensitive information, but that filter apparently didn't work, possibly because that filter didn't handle information in Swedish. So, even if you never ever had been even close to Facebook, Facebook could have the information that you just ordered some Emergency Contraceptives.

alkonaut 4y ago
I understand. It feels almost like magic that a script could figure out that kind of thing from any site? I guess it’s mostly just blindly uploading things from forms? This is a massive GDPR breach of the site in question though. I really don’t fault Facebook much. Anyone who ever includes any FB script is reaponsible for exactly what it does.
- amelius 4y ago
  > I really don’t fault Facebook much. Anyone who ever includes any FB script is responsible for exactly what it does. Many people don't understand the implications of using FB scripts, whereas FB does.
  - alkonaut 4y ago
    Sure. There is perhaps a moral/ethical responsibility. But there are laws against sharing sensitive info and I don't think "I didn't know FB scripts did that" helps. FB's entire business is gobbling up user data. And pharmacies business is to know who they share sensitive data with. I don't think it's too much to ask to require siteowners to understand what the scripts they use are actually doing, at least if they deal with sensitive data. For example, I don't think pharmacies should do any kind of advertising on FB, or do any kind of campaign tracking/conversion measuring etc on the same site they accept user data. As will all GDPR violations, if just a few large pharmacies were fined out of existence, I bet the rest would quickly fall in line.

TazeTSchnitzel 4y ago

They weren't on Facebook's website at all. They were using an online pharmacy's website, and Facebook gets sent information about this because the site embeds Facebook's tracking scripts. This is one of the insidious things about adtech: they track you all over the internet, not just on the adtech companies' own sites.

_joel 4y ago
Thank god for Firefox containers and ublock origin et al.