Mark Zuckerberg Denies Knowledge of Non-Consensual Shadow Profiles Facebook Has Been Building of Non-Users For Years

It has been widely reported that Facebook builds profile of people even if they have never signed up for its services. However, in a hearing with the House Energy & Commerce Committee on Wednesday, when New Mexico Representative Ben Lujan asked Facebook CEO Mark Zuckerberg if he was aware of the so-called practice of building "shadow profiles", Zuckerberg denied knowledge of it. Here's the exchange: Lujan: Facebook has detailed profiles on people who have never signed up for Facebook, yes or no?
Zuckerberg: Congressman, in general we collect data on people who have not signed up for Facebook for security purposes to prevent the kind of scraping you were just referring to [reverse searches based on public info like phone numbers].
Lujan: So these are called shadow profiles, is that what they've been referred to by some?
Zuckerberg: Congressman, I'm not, I'm not familiar with that.
Lujan: I'll refer to them as shadow profiles for today's hearing. On average, how many data points does Facebook have on each Facebook user?
Zuckerberg: I do not know off the top of my head.
Lujan: Do you know how many points of data Facebook has on the average non-Facebook user?
Zuckerberg: Congressman, I do not know off the top of my head but I can have our team get back to you afterward.
Lujan: It's been admitted by Facebook that you do collect data points on non-[Facebook users]. My question is, can someone who does not have a Facebook account opt out of Facebook's involuntary data collection?
Zuckerberg: Anyone can turn off and opt out of any data collection for ads, whether they use our services or not but in order to prevent people from scraping public information ... we need to know when someone is repeatedly trying to access our services.

Comments

Non-consensual Facebooking

[sinij]

I don't understand why they left him off the hook so easily on this point. They could never collect consent from someone that didn't sign up for FB, so how is data collection could be legal?

Re:Non-consensual Facebooking

[OrangeTide]

I don't consent to political campaigns calling me up during election season. But there are public records and they've been doing this for decades. That you have some right to not have your public information accessed is some new right that currently does not exist in US legal code. Perhaps congress will write a new law, but until then it's a bit premature to get upset over something that we've tolerated for so long. (or at least spread your outrage out among the many marketing and political firms that have done similar things over the decades)

Re:Non-consensual Facebooking

[sinij]

Ted Stevens, is that you posting from beyond the grave? Because comparing digital tracking FB does to a publicly-listed PSTN number is rather flawed comparison.

A better comparison would be a third party wiretapping your phone, creating a list of everyone you calling to, then selling such list for profit.

Re:Non-consensual Facebooking

[sinij]

Your argument falls apart at "You can opt out". The issue with FB is that they not only track you when you visit www.facebook.com, but also across many, many other websites and they not only record your ip address and so on, but they also correlate that to private information they have on you.

Re:Non-consensual Facebooking

[Anonymous Coward]

Political campaigns don't get to look at the phone and email contacts of people on their lists. Facebook does precisely that. I must have missed the part about how that is public information.

Re:Non-consensual Facebooking

[Zmobie]

You're joking right? You just listed like 5 fairly technical things for a user to do before they can "opt out" of Facebook tracking most of their internet habits. Do you seriously expect everyone to be doing that? Even people that semi embraced tech don't understand how 90% of that works and usually have to have a techie friend or family member inform them/do it for them. So now anyone with a modicum of tech expertise has to be a steward to create a viable opt out option? That doesn't even mention the thousand other things they can do to circumvent someone doing all that (1x1 pixel trick anyone?).

Server logs in the sense of someone explicitly going to the domain is one thing, and even to a lesser degree accessing the API explicitly such as clicking the stupid like button on some website. Problem is they are harvesting information on other sites simply because the page loaded the like button. Real damn lovely word play there to say they are only looking at their own servers logs, but they are filling them with massive amounts of harvested information that people don't even realize they can get to unless they are tech savvy. Not to mention there is no explicit opt out option. Short of knowing before you even open the page that there is Facebook integration (and these days basically EVERYTHING has social media integration) users have no idea they are essentially auto consenting to this crap. So now I have to opt out of the internet? Sounds reasonable...

This doesn't even address the issue of other people giving them data about you knowingly or unknowingly. Picture uploads where they use facial recognition to build profiles of everyone in the photo whether they are on the site or not. Other people posting information about someone else and them harvesting it into the profile. Other people making fucking profiles of someone else (this one happened to me, only reason I have a Facebook account now is to control my own profile and protect friends and family from a false 'me' contacting them on there). Now I also have to opt out of having my picture taken, going into any store that might have some type of recording device, or going anywhere near anything that can recognize my face? Maybe I'll just wear a mask! Or better yet move to a cabin in the damn woods and live like a mountain man...

Ian Malcolm put it quite well, they were so focused on could they do it (and how much money they could make from doing it) that none of them ever asked if they should do it or, adding on to it, the right way to do it.

This company and others like them have absolutely no incentive to self-regulate to any real degree. They might pay lip service for PR purposes or to create an illusion of them 'protecting your information.' Most people don't understand half of what they are doing though and don't listen to those of us that do. I am not for tons of government intervention and regulation necessarily, but there is no other solution in my opinion. The free market doesn't solve this problem, laws, binding agreements, and enforcement does.

This should be the day of reckoning for them. I don't have a ton of faith that it will be because of some inept asshats representing the country's interests in Congress currently (pretty sure I saw an article about how over half the committees interviewing Zuckerburg received significant campaign contributions from Facebook), but it damn sure should hit them hard. Maybe I'll be wrong and the Republicans are so desperate to hit liberal Silicon Valley they will take the beating stick to them, but even that will be for the wrong reasons and likely will be targeted on a partisan basis. Every company needs to have privacy regulation imposed on them badly in my opinion. Personally, I'd be all for a US version of the GDPR getting passed, but maybe that is just me.

Re:Non-consensual Facebooking

[SeaFox]

They could never collect consent from someone that didn't sign up for FB, so how is data collection could be legal?

"Anyone can turn off and opt out of any data collection for ads, whether they use our services or not"

I'd like to know how one would go about opting out of data collection on Facebook if they don't use the service.
If it's a [shadow] profile they have no personal access to, how do you change preferences on it?

Nose Growing

[FerociousFerret]

Zuckerberg's nose is growing. Just sayin'

I'd love to understand

[argStyopa]

"Zuckerberg: Anyone can turn off and opt out of any data collection for ads, whether they use our services or not... " ...how, precisely do I turn off and opt out of FB data collection without signing up for FB?
I'm rather curious.

Facebook has done nothing illegal

[mi]

With all the hate suddenly piled up on the company, someone has to point out, that they've done nothing illegal. Not even unethical — certainly, not grossly so.

The information they keep about people was given to them voluntarily — either by users themselves, or by their friends and acquaintances. And what they now know, they are free to share — sell, give away, publicize, it is up to them.

Contrary to frequent assertions by the weaker-minded, there is no "right to be forgotten".

This whole "grilling" and questioning is quite extraordinary and barely constitutional, for it has most of the markings of a criminal prosecution without any crime.

That said, Zuckerberg does seem like a dork and an "accidental" billionaire, without the faculties, abilities, and guts normally necessary to achieve the power he wields.

Re:Facebook has done nothing illegal

[NichardRixon]

"The information they keep about people was given to them voluntarily — either by users themselves, or by their friends and acquaintances. And what they now know, they are free to share — sell, give away, publicize, it is up to them."

I disagree. Most of the people who provided the data to Facebook had no idea that it could be used in the way it is. Most Facebook users still don't know what's being done with their data, and that's exactly the way Facebook wants it. To say that these people willingly handed it over is like saying people scammed during the savings and loan scandals should have known better. When is the last time you read three or four pages of fine print legalese before signing up to use a website, or when applying for a mortgage? Even if you're determined to read it, you won't fully understand it unless you're a lawyer.

And when they scrape copies of every text message you sent with your cell phone, back when they could do it without asking; when they collected the names and phone numbers of all of your contacts; when they kept logs of who and when you call; when they keep logs of where you've been day after day out using location data from your phone--when they store all of this information, combined it with data from your Facebook profile, then put AI engines to work on it--I would say that those actions were all illegal invasions of privacy. Zuckerberg and friends should be tried for illegal eavesdropping.

And when that's done, they should start on Google and Microsoft . . .

Some people worry about what will happen when computers get smarter than people. They don't realize that it's already happened. AI can process huge volumes of data that humans could never hope to handle. The insights/information that can be derived from the kind of data that Facebook and Google keep boggles the mind. But don't believe me. Google it for yourself and you'll see. Maybe start with 'psycho-analytics'.

Zuckerberg knew his questioners lacked knowledge

[NichardRixon]

Zuckerberg took maximum advantage of the fact that the questions came from people mostly lacking the technical knowledge to judge his responses. For example, when asked if Facebook could track users across devices, he acted as though he didn't know. Is there anyone here who believes that? I wish we could ask him a few questions on Slashdot!

Zuckerberg also said that Facebook doesn't share user data, just uses it to predict which advertisements users are likely to respond to. In that case I'd really like to see what gets sent when someone uses Facebook to sign into a third party website.

I don't know what a "shadow profile" is

[chispito]

I don't know what a shadow profile is, but collecting data on anonymous visitors to your website is not a privacy violation, it's practicing security.

I'm surprised that the comprehension around here seems to be about on par with the congresscritters.

Re:I don't know what a "shadow profile" is

[chispito]

That's not it at all. Let's say that 10 different people have you listed as a contact in their phones, and that those 10 people are on Faceplant. Facebook will create a shadow profile for you that connects you to these 10 people. And of those 10 people start sending you text messages? Facebook has that as well.

Wait, so you mean when people give an app full access to their contacts, the developer of that app has full access to their contacts? Shocking. I'm not seeing the troubling part, other than how quick people are to provide full access to apps on their devices. I don't think Facebook really has to connect many dots to suggest contacts, based on the crazy volume of data people provide to them willingly.

Re:you can tell zuckerberg is lying

[SuperKendall]

What the hell is wrong with you Trump Haters??? This Facebook story is entirely unrelated to Trump.

You must get an orgasm every time you type his name, you post about him at the drop of a hat or even if someone is not wearing a hat.

You need professional help.

Re:Wow

[Anonymous Coward]

Of course. The data is valuable. Facebook wants it, and Facebook doesn't want screen-scrapers to get it.

It makes perfect sense.

Re:Mental gymnastics

[dgatwood]

No, no, you have that backwards. Facebook uses everyone. Everyone does not use Facebook.

Re:Mental gymnastics

[war4peace]

They're not supposed to do that!

I guess that phrase pretty much sums up the reason for this Congress hearing's existence :)

Re:Misleading title - he admits data is collected

[93 Escort Wagon]

He also is clearly not talking about shadow profiles here.

I think the term is "dissembling".

But, really, based on decades and decades of prior examples... he knows doesn't have to walk away smelling like a rose. He can walk away with the committee grumbling loudly, and they're still not going to do anything substantive to protect the hoi-polloi. Congress-critters generally are generally very reluctant to take steps which penalize billionaires to any significant degree.

Re:Zuckerberg knew his questioners lacked knowledg

[Zmobie]

Your first point is basically what they were banking on. Most of Congress lacks the technical expertise to verbally spar with him on most of these issues. He is employing the tactic every software engineer ever has when talking to non-tech executives. Plead ignorance to simple but damning questions and give overly complex answers to others such that management won't understand and doesn't want to look stupid. I really wish they would have pulled in some of his engineering leads that HAVE to be familiar with the product implementation so he couldn't plead ignorance so easily.

You second statement I think he was just abusing the double meaning. They aren't sharing data in the sense of a business deal where they get paid for the data, but they absolutely know they share a ton of information with developers and anyone plugging into the site to provide "enhancements" to their service.

Re:Misleading title - he admits data is collected

[mysidia]

Yes..... But in the Slashdot summary Zuck seemed to be conflating "Shadow profiles of Non-Users" with
"History of pages viewed by IP addresses visiting Facebook.com without logging in"

Implying that the "Shadow profile" was required for a security purpose is deliberately deceptive (IMO).... If you visit Facebook.com you're an "Anonymous Facebook user"

Whereas a "Shadow Profile" is not IP addresses/"knowledge when someone is repeatedly trying to access our services."
BUT Shadow profiles are Personal Information collected through 3rd party sources about real persons who have never created an account or personally provided the information directly on Facebook.com.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Mental gymnastics

[Ol Olsoc]

No, no, you have that backwards. Facebook uses everyone. Everyone does not use Facebook.

The first time I used a script blocker, years ago, on any of the "popular" sites, and especially news sites, there were many facebook tracking scripts. You didn't find out just how many there were until you started tracing them back to see who ran them.

So I am completely certain that Facebook collected the Users names of those who logged into the sites, collected data about everything they read, almost certainly collected their real names, and distributed that data directly to..... who knows?

Oh....... wait......... we do know now exactly who they were selling or giving almost everyone's data to. And no doubt there are plenty of others.

Seriously, if that festering asshole in charge of running the worlds largest weaponized data collection center isn't aware of the fact that they collected and weaponized data against everyone, and people believe him - well I have some some oceanfront property to sell them in Colorado.