I have no more illusions about my online privacy. It’s no longer a private-until-proven-not-private world. We must actively fight to defend our privacy—big tech companies assume we have no real right to it.

That point was underlined on Tuesday, when Facebook launched a feature—first promised by CEO Mark Zuckerberg in the wake of the Cambridge Analytica scandal—called Off-Facebook Activity. Located in the service’s privacy settings, it lets you see all the websites and apps that reported data back to Facebook about your visits and activities. Looking at my summary page was an eye-opener.

A word of explanation: After quitting Facebook in November 2017, I (sort of) rejoined it just shy of four months ago under an assumed name. I use my new account only when my work as a reporter requires it. Even in that small space of time, 309 apps and websites dutifully reported my visits, purchases, and other actions back to Big Brother Facebook. Most of them reported data back more than once, many of them four or five times, and a few more than 50 times. That’s despite the fact that I’ve never clicked on any ads or added a single friend. They don’t care—it’s all automated.

And, Facebook advises, the summary page may not even list all the data the company collected from those sites and apps. For example, it may not include data collected from apps or sites while I was not logged in to Facebook. And during the four months or so I’ve been back on Facebook, I’ve probably only been logged in for about an hour in total. So Facebook may have a lot more data about me than I know.

Some of the sites that reported my actions to Facebook are personal in nature, such as my pharmacy and medical group. (Facebook says that its policies forbid sites from reporting back sensitive data such as health information, but they classify sites by type, and allow them to state that you made a purchase.)

In order for apps—such as the ones installed on my phone—to transmit data back to Facebook, I would have to have logged in to them using Facebook Login. Websites don’t require such a proactive decision on my part. Facebook says that sites are required to inform me that they intend to report back to Facebook on my visits, purchases, and other activities. I don’t recall ever having seen such an advisory, and when I asked, Facebook provided no further information on the subject.

For me, Facebook’s data harvesting was always a bit nebulous.

The Off-Facebook browsing data is used to show you “relevant” ads you might click on Facebook as well as on sites on its advertising network. For instance, if you’ve been visiting sites about travel destinations, you may see an ad next to your Facebook feed about hotel deals at those places. Facebook would not say whether or not the Off-Facebook data was also used to determine what content is included in your feed.