What Zuckerberg Forgot To Mention… Profiling

This is why we need real data protection — not just better privacy settings.

Like many Facebook users around the world, we at Privacy International have been wondering whether any of our own data was sold to Cambridge Analytica. Today, we finally found out: at least one of our staff member’s data was sold. Even though they had never logged into an app called “This Is Your Digital Life” and even though they never agreed or consented to the company’s terms and conditions, our staff member’s data was likely sold to a company that worked on influencing elections around the world. The only reason they are in this dataset, is not because of anything they have done, but because years ago, one of their Facebook friends logged into an app.

All of this is pretty outrageous in and of itself, but it also raises more serious questions about the way that Facebook thinks about privacy on a much more fundamental level. Facebook likes to talk about privacy settings, and people’s control over the content they put on the platform. But Facebook doesn’t like to talk about how exactly this data can be used to profile and target people.

In both hearings before the Senate, Zuckerberg only mentioned two kinds of data: the information that people decide to share on the platform, and the data that is automatically collected about people’s behaviour. But there’s a third kind of data: data that is derived, inferred, or predicted from the data that people share and that is recorded about their behaviour.

This third type of data can reveal shockingly invasive insights. In contrast to the information that users (more or less) willingly share, the vast majority of users have no idea that such data even exists.

There is no specific field on Facebook that prompts you to type your personality profile, or other psychometric data, yet Cambridge Analytica claims to have possessed such information on millions of people.

Yet, such insights can be generated when data on millions of people are analysed. This is exactly the kind of data that Facebook doesn’t like to mention — and that is also strikingly absent from the user notification we received.