The #DeleteFacebook movement has been riding high ever since the Facebook/Cambridge Analytica scandal got rolling, with high-profile figures like Elon Musk publicly declaring their intention to purge their good names from Facebook’s ledgers (only not really doing it, in Musk’s case).

But, by Facebook’s own admission, it still has ways of tracking ex-users and non-users alike.

For context: Facebook’s inability to keep its user data private was the crux of the Cambridge Analytica case, and its prompted a number of users to delete their Pages and profiles in protest.

While testifying before Congress last week, Facebook CEO Mark Zuckerberg tried to deflect questions about whether the social network collected data on non-users. However, when pressed, he admitted the network collects data on people who haven’t signed up for or consented to its terms “for security purposes.”

How it works: In a blog post following Zuckerberg’s testimony, Facebook expanded on exactly what the data is and where it comes from. Its main source of information on non-users is websites or apps which use Facebook services:

When you visit a site or app that uses our services, we receive information even if you’re logged out or don’t have a Facebook account. This is because other apps and sites don’t know who is using Facebook.

This means, if you’ve visited a site that uses a Like button, it’s likely sent information about your visit back to Facebook.

Also, if you have friends who use the site, they might have uploaded your contact information from their phone in order to connect with you without having to type out your name — and they share the information regardless of whether or not you actually have a profile.

Why it matters: The #DeleteFacebook movement is a righteous gesture, but Facebook’s reach means it might also be a futile one.

This is how Facebook collects data on you even if you don’t have an account on Recode

Read next: Apple's recycling robot disassembles 200 iPhones an hour