Facebook Privacy: Social Network Buys Data From Third-Party Brokers To Fill In User Profiles

It comes as no surprise to any Facebook user that the social network gathers a considerable amount of information based on their actions and interests. But according to a report from ProPublica, the world’s largest social network knows far more about its users than just what they do online.

What Facebook can’t glean from a user’s activity, it’s getting from third-party data brokers. ProPublica found the social network is purchasing additional information including personal income, where a person eats out and how many credit cards they keep.

That data all comes separate from the unique identifiers that Facebook generates for its users based on interests and online behavior. A separate investigation by ProPublica in which the publication asked users to report categories of interest Facebook assigned to them generated more than 52,000 attributes.

The data Facebook pays for from other brokers to round out user profiles isn’t disclosed by the company beyond a note that it gets information “from a few different sources.” Those sources, according to ProPublica, come from commercial data brokers who have access to information about people that isn’t linked directly to online behavior.

The social network doesn’t disclose those sources because the information isn’t collected by Facebook and is publicly available.

“Our approach to controls for third-party categories is somewhat different than our approach for Facebook-specific categories,” Steve Satterfield, a Facebook manager of privacy and public policy, told ProPublica. “This is because the data providers we work with generally make their categories available across many different ad platforms, not just on Facebook.”

Facebook does provide a page in its help center that details how to get removed from the lists held by third-party data brokers. However, the process isn’t particularly easy. In the case of the Oracle-owned Datalogix, users who want off the list have to send a written request and a copy of a government-issued identification in the mail to Oracle’s chief privacy officer.

Another data collecting service, Acxiom, requires users provide the last four digits of their social security number to see the information the company has gathered about them.

In a statement to IBTimes, a spokesperson for Facebook offered the following response:

"ProPublica’s piece neglects to mention the ways we provide transparency and control around the ads experience on Facebook and off. A person can click on the upper right corner of any ad on Facebook to learn why they’re seeing the ad. When they're seeing an ad because they're in a data provider's audience, we tell them that and link to the data provider's opt-out," the spokesperson said.

"Furthermore, we think when people choose not to see ads based on certain information, they don’t want to see those ads anywhere. When a person makes changes to her Ad Preferences (which apply to Facebook's ad categories), we do our best to apply those choices wherever we show ads to that person using Facebook data. We wanted controls for data provider categories to work similarly, so we required the data providers to provide opt-outs that work across all the services that use their data for ads."