Facebook Ads Could 'Out' Gay Users

itwbennett writes "Researchers at Microsoft Research India and the Max Planck Institute for Software Systems in Germany have written a paper showing that a users may be inadvertently revealing their sexual preference to advertisers. 'One example was an advertisement for a nursing program at a medical college in Florida, which was only shown to gay men. The researchers said that persons seeing the ad would not know that it had been exclusively aimed at them solely based on their sexuality, nor would they realize that clicking on the ad would reveal to the advertiser, by implication, their sexual preference in addition to other information they might expect to be sent, such as their IP (Internet Protocol) address.' For its part, Facebook 'downplayed the study, saying that the site does not pass any personally identifiable information back to an advertiser.'"

Comments

Rule number 1

[Capt.DrumkenBum]

Never put anything on Facebook that you would not tell your parents and your boss.

Re:Rule number 1

[Anonymous Coward]

Rule number 2: Clicking an ad sends information you didn't know was on your facebook to your parents and your boss.

Re:Rule number 1

[rainmouse]

Never put anything on Facebook that you would not tell your parents and your boss.

Being fired for content on my facebook account about my private life is just a labour saving service. It saves me the hassle of having of having to research if I'm working for snooping, big brother dickheads and then quitting.

Re:Rule number 1

[Dunbal]

Clicking an ad turns you gay, according to TFA.

Re:Rule number 1

[Anonymous Coward]

Never put anything on Facebook that you would not tell your parents and your boss.

Being fired for content on my facebook account about my private life is just a labour saving service. It saves me the hassle of having of having to research if I'm working for snooping, big brother dickheads and then quitting.

So do you work for a place that drug tests? Because drug tests are not like a breathalyzer. A breathalyzer tests whether you are drunk right now and therefore would be completely appropriate for a workplace. It does not test whether you've had alcohol in the last 1-4 weeks without distinguishing whether you did so on your own time or your employer's time.

Drug tests, on the other hand, make no attempt to distinguish your employer's paid time from your own private time away from work. The employer's only legitimate concern is whether you are sober while you're on the job. What you do in your private time is between yourself and the state. Yet it lets them be snooping, big brother dickheads and monitor your private time too. Like Facebook, it's a way for them to find out "oh no, you did something we don't approve of, so now we're going to punish you for that." They stupidly do this no matter how productive you are as a worker and even though you, as a professional, maintain a clear separation between your private life and your working life.

Employment is becoming more and more like running for public office. It is increasingly ruling out all except for two classes of people: the goody two-shoes who never broke a rule in their life because they worship authority with no regard for its legitimacy, and the dangerously deceptive who are very good at living double lives and covering up their tracks. This is not good for society. Some of the wisest and best among us made mistakes and did things they were not proud of before they saw the error of their ways and became better people. The trend now is for every little thing, including victimless crimes, to become a permanent stigma that forever closes doors in your life.

One other related topic. Why is there even such a thing as an arrest record? I can understand a conviction record, but an arrest record? Really? What kind of fascist wet dream is that? Fascists just love thought processes like "well, he must have been doing SOMETHING wrong even though the state with its overwhelming resources couldn't come up with evidence of that" as though the police are omniscient and never make mistakes, as though false accusations are never made. Really fascists love any reason to turn someone else into a second-class citizen, especially if that person has done them no harm and has no ill intent.

What REALLY amuses me is the sheer irony of those who would enforce their Puritannical beliefs on others at every opportunity because the person did something that offends their "Christian values" while forgetting that anyone who has ever actually read the words of Christ knows that Jesus's main teachings were forgiveness and non-judgement. It's not only Christians who do this, of course. There are many secular fascists. It's just extra ironic when people who call themselves Christian display such hypocrisy to cover up their authoritarian eagerness to condemn.

Which part of this is "inadvertent"?

[bhartman34]

The ads were served to males who declared themselves to be interested in other males, and females who declared themselves to be interested in other females.

Exactly where is the problem here? The users are outing themselves. Shouldn't this be filed under, "...and water is wet"?

Re:Which part of this is "inadvertent"?

[bhartman34]

I think you're misunderstanding something. You can make sexual preference private, or not. Hell, you don't even have to disclose your preference, if you don't want to. Now, if advertisers are somehow getting around people's privacy preferences, and accessing that information without it being public, that's certainly a Facebook problem, but I don't see anywhere in TFA where it says that.

The only problem I see in the article is that advertisers aren't supposed to be using sensitive demographic information (sex, gender, presumably sexual preference) to do the targeting. But that's already a violation of Facebook's policies. Facebook should deal with that, I suppose, but even if they do nothing, users can still control what advertisers see. If sexual preference is the kind of information you consider to be only your (or your friends') business, you should configure your profile appropriately. At best, the researchers are causing a tempest in a teapot. There's a fairly easy fix that anyone can implement, without Facebook having to do anything.

Re:Which part of this is "inadvertent"?

[causality]

but I can definitely see paranoid people not liking this (and I'm not saying they are wrong in feeling this way, just that I'm not quite as paranoid).

I really don't know what has happened in the last several years. The desire that people not know information that is none of their business is suddenly described as "paranoid", a term for a medical disorder. This is absolutely bass-ackwards. In fact, it's downright pathological and a great example of Newspeak. It so clearly serves those who wish to deny privacy that it's bordering on the miraculous that most people don't notice. Really, only large masses of people could be so stupid/blind/oblivious/whatever you want to call it.

I say we turn the tables. Let's stop using words like "paranoid" to describe people who want random strangers to leave them alone. Instead, let's choose a word that's the inverse of "paranoid" to describe the asshats who intrude into the lives of others and then claim that data as their own to use as they please. I tentatively suggest "Orwellian" but am open to suggestion. Maybe Panopticonians would work, except that fewer than six syllables would be a plus.

Re:Which part of this is "inadvertent"?

[Runaway1956]

"Just because it's on your Facebook status, doesn't mean you want the whole world to know." Wait. (looks ^ at address bar) It says yro.slahsdot.org up there. Damn, I thought maybe it was portal.twilight.zone or some such. DAMMIT man! Have you been paying attention, or not? EVERYTHING ON FACEBOOK is accessibly by anyone with the will to snoop. It doesn't even require much skill - just the will to snoop. One more time: if it's on the intartubez, it ain't private. Go to the blackboard, and write that one thousand times for the class, please.

If they didn't know

[Dayofswords]

[...]such as their IP (Internet Protocol) address.

If you don't know what IP stands for in 'IP address' then you're on the wrong site.

Re:soooo.....

[Anonymous Coward]

No, you don't understand. Facebook has a policy saying they won't disclose personal info, like what age you are.

Now, suppose an advertiser says "target this ad at people born in October of 1978" ... Facebook says "OK". So all of these people's birth months are revealed to the advertiser, in violation of the policy. Thru essentially costless micro-targeting, advertisers (or any attacker with $) can dig out whatever info they want. There's a simple and obvious way for an attacker to get a list of people based on a piece of information Facebook has said they're keeping private.

There is a big difference between someone clicking on an ad for, say, a gay-dating site -- when you click on an ad, you know you are implicitly signaling some level of interest in its content to the advertiser -- and clicking on an ad (*any* ad, it could be for a car or for dog food ... the content of the ad could have *nothing* to do with the audience targeting) that happens to be targeted based on a specific database query.

If a piece of information is promised to be kept private, private should not equal "disclosed to third parties who pay us."

Reminds me of Project Gaydar

[Khopesh]

A year ago, some MIT undergrads wrote up a short piece called Project Gaydar which showcased how they were able to successfully identify gay men who were still in the closet.

Facebook might not expose this information directly (via the "sexual preferences" profile information), but your friends list is enough to extrapolate it. Since there's money in that kind of data and it is easily fetched via the Facebook API, it's being done.

Re:OK...

[zerocool^]

According to several of my (very out) gay friends, putting your sexuality on facebook tends to lend its self to a lot of random messages from people who want to meet up at truck stops.

No joke.

Does not pass any personally identifiable info...

[Anonymous Showered]

Facebook DOES pass personally identifiable information, albeit inadvertently.

As a Facebook Ads user, I have tracked down people who have clicked my ads EASILY.

How?

Your unique Facebook user ID is passed through the refer string each and every time you click on an ad.

Simply copy down this ID and paste it in the USERID variable below.

http://www.facebook.com/profile.php?id=USERID

Tada.

Lesson learned from a previous incident

[microbee]

I sometimes hang out on a web forum, and they have a special forum where you could post anonymously - it's not really anonymous, as you still need to login and post, but the postings do not show your user id or IP addresses, so it appears totally anonymous, except to the web admins. So people post a lot of random crazy stuff there which would embarrass themselves if it had not been anonymous.

Then one day the forum upgraded their software, and due to a bug, all posts inside that anonymous forum suddenly showed all user IDs - including the old ones. That quickly turned into a sh*tstorm as people ran around screaming in panic with their underwear.

The lesson: do not post anything if you don't want others to find out it's you.

Re:Wait, what?

[guyminuslife]

Yeah, exactly. This is why we have a national shortage of nurses. It's because straight men don't want to go into a profession where their job title is the same as the word for "have a baby suck milk form your boobs." On the other hand, there's no shortage of male "paramedics."