Shadow profiles: What Facebook knows about you, even if you're not on Facebook

by Andrew Quodling / 16 April, 2018

Mark Zuckerberg prepares to testify before Congress for a second day. Photo / Getty Images

You might not be on Facebook, but the social media giant has data on you. Here's how that happens.

Facebook’s founder and chief executive Mark Zuckerberg faced two days of grilling before US politicians this week, following concerns over how his company deals with people’s data.

But the data Facebook has on people who are not signed up to the social media giant also came under scrutiny.

During Zuckerberg’s congressional testimony he claimed to be ignorant of what are known as “shadow profiles”.

Zuckerberg: I’m not — I’m not familiar with that.

That’s alarming, given that we have been discussing this element of Facebook’s non-user data collection for the past five years, ever since the practice was brought to light by researchers at Packet Storm Security.

Maybe it was just the phrase “shadow profiles” with which Zuckerberg was unfamiliar. It wasn’t clear, but others were not impressed by his answer.

Facebook’s proactive data-collection processes have been under scrutiny in previous years, especially as researchers and journalists have delved into the workings of Facebook’s “Download Your Information” and “People You May Know” tools to report on shadow profiles.

Shadow profiles

To explain shadow profiles simply, let’s imagine a simple social group of three people – Ashley, Blair and Carmen – who already know one another, and have each others’ email address and phone numbers in their phones.

If Ashley joins Facebook and uploads her phone contacts to Facebook’s servers, then Facebook can proactively suggest friends whom she might know, based on the information she uploaded.

For now, let’s imagine that Ashley is the first of her friends to join Facebook. The information she uploaded is used to create shadow profiles for both Blair and Carmen — so that if Blair or Carmen joins, they will be recommended Ashley as a friend.

Next, Blair joins Facebook, uploading his phone’s contacts too. Thanks to the shadow profile, he has a ready-made connection to Ashley in Facebook’s “People You May Know” feature.

At the same time, Facebook has learned more about Carmen’s social circle — in spite of the fact that Carmen has never used Facebook, and therefore has never agreed to its policies for data collection.

Despite the scary-sounding name, I don’t think there is necessarily any malice or ill will in Facebook’s creation and use of shadow profiles.

It seems like an earnestly designed feature in service of Facebooks’s goal of connecting people. It’s a goal that clearly also aligns with Facebook’s financial incentives for growth and garnering advertising attention.

But the practice brings to light some thorny issues around consent, data collection, and personally identifiable information.

What data?

Some of the questions Zuckerberg faced this week highlighted issues relating to the data that Facebook collects from users, and the consent and permissions that users give (or are unaware they give).

Facebook is often quite deliberate in its characterisations of “your data”, rejecting the notion that it “owns” user data.

That said, there are a lot of data on Facebook, and what exactly is “yours” or just simply “data related to you” isn’t always clear. “Your data” notionally includes your posts, photos, videos, comments, content, and so on. It’s anything that could be considered as copyright-able work or intellectual property (IP).

What’s less clear is the state of your rights relating to data that is “about you”, rather than supplied by you. This is data that is created by your presence or your social proximity to Facebook.

Examples of data “about you” might include your browsing history and data gleaned from cookies, tracking pixels, and the like button widget, as well as social graph data supplied whenever Facebook users supply the platform with access to their phone or email contact lists.

Like most internet platforms, Facebook rejects any claim to ownership of the IP that users post. To avoid falling foul of copyright issues in the provision of its services, Facebook demands (as part of its user agreements and Statement of Rights and Responsibilities) a:

…non-exclusive, transferable, sub-licensable, royalty-free, worldwide license to use any IP content that you post on or in connection with Facebook (IP License). This IP License ends when you delete your IP content or your account unless your content has been shared with others, and they have not deleted it.

Data scares

If you’re on Facebook then you’ve probably seen a post that keeps making the rounds every few years, saying:

In response to the new Facebook guidelines I hereby declare that my copyright is attached to all of my personal details…

Part of the reason we keep seeing data scares like this is that Facebook’s lacklustre messaging around user rights and data policies have contributed to confusion, uncertainty and doubt among its users.

It was a point that Republican Senator John Kennedy raised with Zuckerberg this week (see video).

 

After the grilling

Zuckerberg and Facebook should learn from this congressional grilling that they have struggled and occasionally failed in their responsibilities to users.

It’s important that Facebook now makes efforts to communicate more strongly with users about their rights and responsibilities on the platform, as well as the responsibilities that Facebook owes them.

This should go beyond a mere awareness-style PR campaign. It should seek to truly inform and educate Facebook’s users, and people who are not on Facebook, about their data, their rights, and how they can meaningfully safeguard their personal data and privacy.

Given the magnitude of Facebook as an internet platform and its importance to users across the world, the spectre of regulation will continue to raise its head.

Ideally, the company should look to broaden its governance horizons, by seeking to truly engage in consultation and reform with Facebook’s stakeholders – its users — as well as the civil society groups and regulatory bodies that seek to empower users in these spaces.

 

 

Andrew Quodling, PhD candidate researching governance of social media platforms, Queensland University of Technology

This article was originally published on The Conversation. Read the original article.

The Conversation

Latest

Fall from grace: Why some mistakes end celebrities' careers when others don't
89980 2018-04-26 00:00:00Z Social issues

Fall from grace: Why some mistakes end celebrities…

by Paul Thomas

In a world a-twitter, small infractions attract hysterical reactions, and abject confession is the only currency with which redemption can be bought.

Read more
Investing after the Global Financial Crisis
90010 2018-04-26 00:00:00Z Investment

Investing after the Global Financial Crisis

by Noted

Fixed interest markets have changed - managers can now pick from a wider range of investments, which is good news for the everyday investor.

Read more
The 3 types of cheating in sport
90100 2018-04-26 00:00:00Z Sport

The 3 types of cheating in sport

by Paul Thomas

When it comes to cheating, there are the rules – and then there are the alternative rules.

Read more
Win a double pass to An Evening with Hillary Rodham Clinton in Auckland
90019 2018-04-26 00:00:00Z Win

Win a double pass to An Evening with Hillary Rodha…

by Noted

An illuminating insight into Secretary Clinton's experience as a woman in politics, you could be seeing her live at Auckland's Spark Arena on May 7.

Read more
The Kiwi marine who didn't make it home from Vietnam
89575 2018-04-25 00:00:00Z History

The Kiwi marine who didn't make it home from Vietn…

by Ben Stanley

Jim Lott was one of two New Zealanders who died serving in the United States military in the Vietnam War.

Read more
How a giant chalk kiwi came to be carved into an English hill
89890 2018-04-25 00:00:00Z History

How a giant chalk kiwi came to be carved into an E…

by Russell Baillie

Now a source of pride, the Bulford Kiwi on Beacon Hill was originally hatched from a post-WWI mutiny.

Read more
Remembering and misremembering World War I
90016 2018-04-25 00:00:00Z History

Remembering and misremembering World War I

by Sam Finnemore

A soldier with miraculous recall and the story of the unknown Anzac bring home WWI’s reality.

Read more
The Guernsey Literary and Potato Peel Pie Society – movie review
89994 2018-04-25 00:00:00Z Movies

The Guernsey Literary and Potato Peel Pie Society …

by Russell Baillie

A tale of bookworms in occupied Guernsey makes for a safe film.

Read more