Slashdot Mirror
Facebook Is Giving Advertisers Access To Your Shadow Contact Information (gizmodo.com)
Kashmir Hill, reporting for Gizmodo: Last week, I ran an ad on Facebook targeted at a computer science professor named Alan Mislove. Mislove studies how privacy works on social networks and had a theory that Facebook is letting advertisers reach users with contact information collected in surprising ways. I was helping him test the theory by targeting him in a way Facebook had previously told me wouldn't work. I directed the ad to display to a Facebook account connected to the landline number for Alan Mislove's office, a number Mislove has never provided to Facebook. He saw the ad within hours.
One of the many ways that ads get in front of your eyeballs on Facebook and Instagram is that the social networking giant lets an advertiser upload a list of phone numbers or email addresses it has on file; it will then put an ad in front of accounts associated with that contact information. A clothing retailer can put an ad for a dress in the Instagram feeds of women who have purchased from them before, a politician can place Facebook ads in front of anyone on his mailing list, or a casino can offer deals to the email addresses of people suspected of having a gambling addiction. Facebook calls this a "custom audience." You might assume that you could go to your Facebook profile and look at your "contact and basic info" page to see what email addresses and phone numbers are associated with your account, and thus what advertisers can use to target you. But as is so often the case with this highly efficient data-miner posing as a way to keep in contact with your friends, it's going about it in a less transparent and more invasive way.
[...] Giridhari Venkatadri, Piotr Sapiezynski, and Alan Mislove of Northeastern University, along with Elena Lucherini of Princeton University, did a series of tests that involved handing contact information over to Facebook for a group of test accounts in different ways and then seeing whether that information could be used by an advertiser. They came up with a novel way to detect whether that information became available to advertisers by looking at the stats provided by Facebook about the size of an audience after contact information is uploaded. They go into this in greater length and technical detail in their paper [PDF]. They found that when a user gives Facebook a phone number for two-factor authentication or in order to receive alerts about new log-ins to a user's account, that phone number became targetable by an advertiser within a couple of weeks. Officially, Facebook denies the existence of shadow profiles. In a hearing with the House Energy & Commerce Committee earlier this year, when New Mexico Representative Ben Lujan asked Facebook CEO Mark Zuckerberg if he was aware of the so-called practice of building "shadow profiles", Zuckerberg denied knowledge of it.
One of the many ways that ads get in front of your eyeballs on Facebook and Instagram is that the social networking giant lets an advertiser upload a list of phone numbers or email addresses it has on file; it will then put an ad in front of accounts associated with that contact information. A clothing retailer can put an ad for a dress in the Instagram feeds of women who have purchased from them before, a politician can place Facebook ads in front of anyone on his mailing list, or a casino can offer deals to the email addresses of people suspected of having a gambling addiction. Facebook calls this a "custom audience." You might assume that you could go to your Facebook profile and look at your "contact and basic info" page to see what email addresses and phone numbers are associated with your account, and thus what advertisers can use to target you. But as is so often the case with this highly efficient data-miner posing as a way to keep in contact with your friends, it's going about it in a less transparent and more invasive way.
[...] Giridhari Venkatadri, Piotr Sapiezynski, and Alan Mislove of Northeastern University, along with Elena Lucherini of Princeton University, did a series of tests that involved handing contact information over to Facebook for a group of test accounts in different ways and then seeing whether that information could be used by an advertiser. They came up with a novel way to detect whether that information became available to advertisers by looking at the stats provided by Facebook about the size of an audience after contact information is uploaded. They go into this in greater length and technical detail in their paper [PDF]. They found that when a user gives Facebook a phone number for two-factor authentication or in order to receive alerts about new log-ins to a user's account, that phone number became targetable by an advertiser within a couple of weeks. Officially, Facebook denies the existence of shadow profiles. In a hearing with the House Energy & Commerce Committee earlier this year, when New Mexico Representative Ben Lujan asked Facebook CEO Mark Zuckerberg if he was aware of the so-called practice of building "shadow profiles", Zuckerberg denied knowledge of it.
Republicans are such disgusting fucking pedophiles and rapists that they nominated a rapist to degrade America from the supreme court.
Lock him up!
Lock up all the republican rapists and pedos!
tickle my intestines where the sun dont shine
Don't give Facebook your phone number. It's not required. Every few months they ask, "Do you want to give us your phone number to help us secure your account?" and I answer, "Fuck off, Facebook", as I click the "No" button and move on.
You are welcome on my lawn.
Even though they stated they have removed the ability to target people based on race, age, income, sex, etc, they still do. You just have to take a list of known people you do want to target, upload that and then "target similar people" or something like that.
So if you only want to target rich, white, males to exclude other demographics it is still relatively easy to do. They have not really changed anything. They have not stopped collecting this "shadow" information, nor have they removed it. It's way to damn valuable to them.
Come on, people, it's time to delete yourself from Facebook, wean your actual friends off it, and set your adblockers and NoScript to prevent Facebook from tracking you even if you aren't on Facebook anymore. Do yourself a favor, do it today.
Read the Fscking Green Link Text
I haven't had a Facebook account for years... this morning after reading the story about the Founder of WhatsApp, and a few days ago reading the articles from the founders of Instagram, I decided to delete my Instagram and WhatsApp accounts as well. The thing that disturbed me was that Instagram kept prompting me to follow users, claiming they were in my contacts list... but I had NEVER given Instagram permission to my contact list... so how did they know? Too creepy for me. I'm out. Instagram was a giant time suck anyway.
Which has more power: the hammer, or the anvil?
Friends don't let friends facebook.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
The answer to this is Mark Zuckerberg is a greedy, lying sack of shit, who has now apparently lied to Congressional comittees.
This is precisely why my ad blockers block everything related to Facebook, and any other ad/analytics company I can.
I don't trust their "privacy policies", so I have my own .. which boils down to "most third party stuff on any webpage is shit that I block, and don't feel even slightly bad about".
Umm... FB didn't give the "advertiser" the number or access to it. The advertiser said "target this phone number". Wonder what would happen if you were to do similar for all of the area code combos (other than toll/toll free numbers) and 867-5309 ?
Heck, almost wish I didn't have to worry about money just so I could do it, and run an ad asking for Jenny...
Don't blame me, I voted for Kodos
I really want Google, Facebook, Amazon, Microsoft and Apple to completely fall. We need something new. These companies have become just a giant suck on innovation, and they are just sort of there by default because there's nothing better.
...a number Mislove has never provided to Facebook...
The article explains how Facebook got the phone number indirectly because another company had the phone number.
The advertiser said, "Target this phone number," which Facebook claims not to have if you didn't give it to them.
They targetted the right guy on Facebook. That's way creepy and contradicts Zuck's congressional testimony.
That Mark Zuckerberg wouldn't claim to "know" about the concept, notion, or actual presence of shadow profiles is absolute bullshit and, if he were under oath at the time, would clearly be guilty of lying under oath. We knew about shadow profiles when MySpace was still a thing. It's time to start targeting some of these guys with prison time.
FTFA:
The researchers also found that if User A, whom we’ll call Anna, shares her contacts with Facebook, including a previously unknown phone number for User B, whom we’ll call Ben, advertisers will be able to target Ben with an ad using that phone number, which I call “shadow contact information,” about a month later. Ben can’t access his shadow contact information, because that would violate Anna’s privacy, according to Facebook, so he can’t see it or delete it, and he can’t keep advertisers from using it either.
The lead author on the paper, Giridhari Venkatadri, said this was the most surprising finding, that Facebook was targeted ads using information “that was not directly provided by the user, or even revealed to the user.”
So informing me that someone else has revealed a piece of my personal information to Facebook (and particularly one that I've not revealed to Facebook myself) is somehow a violation of the other person's privacy?
Give me a break.
Just means that he does not know what the fuck is going on in his "own" company.
Who would have ever thought Faceberg, of all companies, would let advertisers access things it has figured out about you without your consent! What craziness!
And a bit of a nit to pick with the headline: I doubt Faceberg is giving it to them.
That isn't a shadow profile. What they are describing is an existing Facebook account which has a phone number tied to it that the user never provided to Facebook but was presumably attached by other sources. It seems amazing to me that people think that Facebook (and other companies) aren't attaching tons of data about you from multiple data sources and partners. There are entire companies devoted to building profiles of you and have been for many decades.
That giant social media doesn't already know exactly who you are, who you associate with and what your habits are... I have a lovely bridge for sale.
Even if you don't have an account, your friends do, your spouse does, your organization/company does. They may not necessarily know your name definitively, but you can be damn sure they have, thru data scraping and aggregation (including combing thru other users uploaded contact lists, their posts, their pictures, their location history, etc...), have compiled a profile of you. I don't care what you call it, "shadow account" or otherwise, it absolutely exists (to think otherwise is to be naive in the big data world). When these social media giants ask you to enter a phone number or other data all it does is verify the data they already had about you is indeed accurate. They use your responses to more effectively tune their algorithms and data sources to increase overall accuracy because ultimately the more data that have on their users and the more accurate that data is the more they can charge for targeted advertisement.
JUST SAY NO to social media.
Granted I don't know the number called, but the Facebook system may have just asked Google and parsed the results, nothing shadow about it..
I mean I asked Google and one of the many pages I received was https://www.ccis.northeastern.edu/people/alan-mislove/ which contains a phone number...
They aren't sharing your info, if you don't have an account. Delete Facebook.
The way most people use social media (and search), it should be a standard internet protocol implemented at the ISP level. ISPs should then be given common carrier status, that would solve most our problems with privacy.
It was scraped from Kashmir Hill's phone. HE had the number in his contacts. It was probably typed in as Alan Mislove. By default, contacts autosync to Facebook. Since Hill's FB app was on his phone and so was that contact, FB could assume it's a legit name and number. So Hill posts the same name and number into FB ads and the app just goes, "oh you want to talk to that dude on your phone". I don't know if any of that is legal or not but FB knows who is in your contacts list, even if you don't allow it access. It just pretends it doesn't know.
Have you not made a fake trolling profile and told it not one damned thing about you nor added friends but within about 2 weeks it knows where you live, where you work, and just happens to suggest every person your real FB profile knows? Go ahead and try it. Try to be super stupid paranoid about it too. Keep your android permissions set to deny, turn off GPS, don't add a single friend, etc. You might make it a few more weeks than I have managed, but some way, some how, your phone/the app will "have a technical difficulty" and it'll scrape every bit of info off the phone.
This is my strongest (but not only) objection to 2 factor authentication as it is frequently used. The 2nd factor is usually a phone, and nothing seems to keep the company from selling that very valuable information.
The claims about security are largely bogus as the many social hacks around 2 factor authentication have shown.
Prior to the existence of the facebook "Messenger" mobile app which we should assume steals the users' contact list, there was (and may still be) a practice by facebook of asking for the user's email address and password - and this was requested overtly to scan through the messages and build up a list of contacts.
I'm sure a large fraction of the "shadow profile" comes from this source: damned idiotic friends with zero comprehension of privacy issues who nonetheless use technology.
All the big internet companies operate illegally. Facebook keeps lying to us, Slashdot keeps harassing me for "consent" to monetise my data, everybody is in on it, everybody does it. I nearly prefer the sites that just do not give you access if they cannot set cookies, or you have an ad blocker. At least that is honest (or I am too optimistic there, too?).
Just imagine someone using this for spearphishing or stalking someone; sending them targeted ads that are designed to trick or offend. This could also be used to target politicos by phone number...
On the less creepy side, someone could use it as a strange marriage proposal hint or high school promposal (except kids don't use Facebook now). But edge-cases for weird good uses don't make the practice good in general.