Does Facebook Know Too Much?

Whenever Phoebe Companion-Racicot, 15, downloads an app on her phone and sees the option to log in with Facebook, she does it. After all, it’s easier than creating a whole new account for the app. But it does make Phoebe a little suspicious.

“It worries me that someone is getting a hold of my information and I don’t know what they are doing with it,” says the 11th-grader at Colchester High School in Vermont.

She’s not alone. Earlier this year, it was revealed that the detailed personal information of up to 87 million Facebook users wound up in the hands of a voter-profiling firm called Cambridge Analytica. The company obtained the data when users logged into a quiz app with their Facebook accounts. The information—including location data, private messages, and lists of every Facebook page users had ever liked—was later used to build profiles of potential voters for Donald Trump’s 2016 presidential campaign.

Whenever Phoebe Companion-Racicot, 15, downloads an app on her phone and sees the option to log in with Facebook, she does it. After all, it’s easier than creating a whole new account for the app. But it does make Phoebe a little suspicious.

“It worries me that someone is getting a hold of my information and I don’t know what they are doing with it,” says the 11th-grader at Colchester High School in Vermont.

She’s not alone. Earlier this year, it was revealed that the detailed personal information of up to 87 million Facebook users wound up in the hands of a voter-profiling firm called Cambridge Analytica. The company obtained the data when users logged into a quiz app with their Facebook accounts. The information included location data and private messages. It also had lists of every Facebook page users had ever liked. The data was later used to build profiles of potential voters for Donald Trump’s 2016 presidential campaign.

The revelation that so much private Facebook data had been harvested without users’ knowledge or consent sparked outrage and led many to question whether big tech companies know too much about us. Some lawmakers are now calling for regulations that would require companies to be more transparent about how much of our data they’re collecting, who that information could be shared with, and for what purposes it could be used.

“Facebook can learn almost anything about you by using artificial intelligence to analyze your behavior,” says Peter Eckersley, the chief computer scientist for the Electronic Frontier Foundation, a digital rights group. “That knowledge turns out to be perfect both for advertising and propaganda.”

The revelation that so much private Facebook data had been harvested without users’ knowledge or consent sparked outrage. It also led many to question whether big tech companies know too much about us. Some lawmakers are now calling for regulations that would require companies to be more transparent about how much of our data they’re collecting, who that information could be shared with, and for what purposes it could be used.

“Facebook can learn almost anything about you by using artificial intelligence to analyze your behavior,” says Peter Eckersley, the chief computer scientist for the Electronic Frontier Foundation, a digital rights group. “That knowledge turns out to be perfect both for advertising and propaganda.”

Practically everything you do online can be tracked, and much of it is. Facebook, as well as Instagram, which Facebook acquired in 2012, monitors users’ every action on the sites: everything they like and post, their conversations, locations, and much more (see “What Facebook Knows About Me,” below). In fact, the company is so adept at gathering users’ information that it can pinpoint when they’re feeling “stressed,” “overwhelmed,” “anxious,” and like “a failure.”

Google, with its range of products including Gmail, Maps, Chrome, YouTube, and the Android operating system, is able to gather even more user information on people—everything from your entire search history on the web and where you live to the destination of your last vacation. Google Home, the smart speaker and voice assistant, has recordings of everything you’ve ever said to it, including all the times you’ve asked it to turn on or off your lights and how many times you’ve asked to listen to Rihanna’s newest track (as does Amazon’s Alexa).

Collecting this data is a big part of how Google, Facebook, and other big tech companies make money. Though Facebook and Google don’t sell your data, they do sell access to you. Companies pay Facebook and Google to place ads on those sites, using the data that’s been gathered to target consumers who may be interested in their products. For example, a company that sells athletic gear may post an ad on Facebook that gets shown to people whose interests include sports. Last year, Facebook generated $40 billion in online ad revenue—second only to Google’s $95 billion.

Practically everything you do online can be tracked, and much of it is. Facebook, as well as Instagram, which Facebook acquired in 2012, monitors users’ every action on the sites. That includes everything they like and post, their conversations, locations, and much more. The company is very adept at gathering users’ information (see “What Facebook Knows About Me,” below). In fact, it can pinpoint when they’re feeling “stressed,” “overwhelmed,” “anxious,” and like “a failure.”

Google has a range of products, including Gmail, Maps, Chrome, YouTube, and the Android operating system. As a result, the company is able to gather even more information on users. That includes everything from your entire search history on the web and where you live to the destination of your last vacation. Google Home, the smart speaker and voice assistant, has recordings of everything you’ve ever said to it. That includes all the times you’ve asked it to turn on or off your lights. And it also knows how many times you’ve asked to listen to Rihanna’s newest track (as does Amazon’s Alexa).

Collecting this data is a big part of how Google, Facebook, and other big tech companies make money. Though Facebook and Google don’t sell your data, they do sell access to you. Companies pay Facebook and Google to place ads on those sites. They use the data that’s been gathered to target consumers who may be interested in their products. For example, a company that sells athletic gear may post an ad on Facebook that gets shown to people whose interests include sports. Last year, Facebook generated $40 billion in online ad revenue (second only to Google’s $95 billion).

Countless more companies use web cookies and other trackers that load in people’s web browsers to collect information about their browsing activities. That’s why you might see an advertisement show up on websites for the exact product you had just been searching for online.

“It’s not just companies like Facebook and Google,” says Jamie Winterton, a cybersecurity expert at Arizona State University. “There’s a whole other slew of trackers and data crunchers that also sit in the back of the room, so to speak, and watch everything that’s going on and build these data profiles not only of individuals but of populations of people.”

Facebook, for its part, notes that when users sign up for an account, they must agree to the company’s data policy. Still, many of Facebook’s 2.2 billion users have no idea how much data it and other companies collect about them and how these companies use or share that data. Media watchdog groups say the information is typically buried in the terms and conditions, which people often accept without reading.

Countless more companies use web cookies and other trackers that load in people’s web browsers to collect information about their browsing activities. That’s why you might see an advertisement show up on websites for the exact product you had just been searching for online.

“It’s not just companies like Facebook and Google,” says Jamie Winterton, a cybersecurity expert at Arizona State University. “There’s a whole other slew of trackers and data crunchers that also sit in the back of the room, so to speak, and watch everything that’s going on and build these data profiles not only of individuals but of populations of people.”

Facebook, for its part, notes that when users sign up for an account, they must agree to the company’s data policy. Still, many of Facebook’s 2.2 billion users have no idea how much data it and other companies collect about them and how these companies use or share that data. Media watchdog groups say the information is typically buried in the terms and conditions, which people often accept without reading.

In April, Senators Amy Klobuchar, a Democrat from Minnesota, and John Kennedy, a Republican from Louisiana, introduced a bill that would help address this issue. It would require websites to provide users a copy of the data that’s being collected on them, as well as a list of who has had access to their data.

Two other senators, Richard Blumenthal of Connecticut and Edward Markey of Massachusetts, both Democrats, introduced a separate bill that would force companies to get consent to share or sell personal data.

In Europe, strict regulations already went into effect in May. The European Union passed new laws that require companies to explain in simple language how they plan to use and share people’s personal information. And tech companies must ask for users’ consent for their data.

While some U.S. lawmakers have cautioned against moving too quickly to adopt regulations before understanding how they would affect American tech companies, many privacy experts say such regulations are necessary to keep internet users’ privacy secure. They argue that the Cambridge Analytica scandal makes it clear that if people’s data ends up in certain hands, it could be used not just for targeting ads but also for more questionable purposes, such as trying to sway an election. 

“The Cambridge Analytica story is an example of why it can matter,” says Jay Stanley, a senior policy analyst at the American Civil Liberties Union. “This data can be used to manipulate us, it can be used in a discriminatory fashion, it can be abused if it’s very personal information.”

Of course, political campaigns, government agencies such as the Census Bureau, and advertisers have always tried to gather data on people. But the information they were previously able to collect was in broad statistical categories—things like age, sex, and race. Using Facebook, Cambridge Analytica was able to gain a far deeper understanding of individuals through what’s called psychographic data, which includes interests, hobbies, and even people’s opinions. And experts say companies will only get better at analyzing all of this data in the future.

“There’s no question that political campaigns and a lot of other people want to gather as much information as they can and want to track us,” says Stanley, “but now they increasingly have the ability.”

In April, Senators Amy Klobuchar, a Democrat from Minnesota, and John Kennedy, a Republican from Louisiana, introduced a bill that would help address this issue. It would require websites to provide users a copy of the data that’s being collected on them, as well as a list of who has had access to their data.

Two other senators, Richard Blumenthal of Connecticut and Edward Markey of Massachusetts, both Democrats, introduced a separate bill. It would force companies to get consent to share or sell personal data. 

In Europe, strict regulations already went into effect in May. The European Union passed new laws that require companies to explain in simple language how they plan to use and share people’s personal information. And tech companies must ask for users’ consent for their data.

Some U.S. lawmakers have cautioned against moving too quickly to adopt regulations before understanding how they would affect American tech companies. But many privacy experts say such regulations are necessary to keep internet users’ privacy secure. They argue that the Cambridge Analytica scandal makes it clear that if people’s data ends up in certain hands, it could be used not just for targeting ads but also for more questionable purposes, such as trying to sway an election. 

“The Cambridge Analytica story is an example of why it can matter,” says Jay Stanley, a senior policy analyst at the American Civil Liberties Union. “This data can be used to manipulate us. It can be used in a discriminatory fashion. It can be abused if it’s very personal information.”

Of course, political campaigns, government agencies such as the Census Bureau, and advertisers have always tried to gather data on people. But the information they were previously able to collect was in broad statistical categories, like age, sex, and race. Using Facebook, Cambridge Analytica was able to gain a far deeper understanding of individuals through what’s called psychographic data. This data includes interests, hobbies, and even people’s opinions. And experts say companies will only get better at analyzing all of this data in the future. 

“There’s no question that political campaigns and a lot of other people want to gather as much information as they can and want to track us,” says Stanley, “but now they increasingly have the ability.”

All that tracking can provide benefits to consumers. For example, it allows Instagram to suggest memes and videos users might be interested in, based on photos they’ve liked. It enables sites like Facebook and Snapchat to be free to use, since they’re able to make money from ads. Plus, advertisers argue, wouldn’t you prefer to see an ad for something you’re interested in rather than for a totally random product?

“The data that people give is extremely helpful in order for you to get more-relevant offers, deals, opportunities that you potentially want,” says Ben LeDonni, CEO of the digital marketing agency Creative Multimedia Solutions. But he adds that “with power comes great responsibility, and data is power.”

All that tracking can provide benefits to consumers. For example, it allows Instagram to suggest memes and videos users might find interesting, based on photos they’ve liked. It enables sites like Facebook and Snapchat to be free to use, since they’re able to make money from ads. Plus, advertisers argue, wouldn’t you prefer to see an ad for something you’re interested in rather than for a totally random product?

“The data that people give is extremely helpful in order for you to get more-relevant offers, deals, opportunities that you potentially want,” says Ben LeDonni, CEO of the digital marketing agency Creative Multimedia Solutions. But he adds that “with power comes great responsibility, and data is power.”

In testimony before Congress in April, Facebook CEO Mark Zuckerberg said it’s “inevitable” that there will be some regulations and agreed that the company needs to “step up and do more” to protect people’s information. And Facebook has taken measures to do this. It’s banning apps from accessing personal information, like a user’s religious or political views. And it’s launching a new “privacy dashboard” to give users more control over their privacy settings.

Regardless of what steps companies and lawmakers take to safeguard information, experts say, everyone should gain a better understanding of how they can control their privacy settings (see “Taking Control of Your Data,” below).

“People have a right to privacy,” says Winterton, the cybersecurity expert, “and people have a right to decide what that means for them.”

In testimony before Congress in April, Facebook CEO Mark Zuckerberg said it’s “inevitable” that there will be some regulations. He agreed that the company needs to “step up and do more” to protect people’s information. And Facebook has taken measures to do this. It’s banning apps from accessing personal information, like a user’s religious or political views. And it’s launching a new “privacy dashboard” to give users more control over their privacy settings.

Regardless of what steps companies and lawmakers take to safeguard information, experts say, everyone should gain a better understanding of how they can control their privacy settings (see “Taking Control of Your Data,” below).

“People have a right to privacy,” says Winterton, the cybersecurity expert, “and people have a right to decide what that means for them.”

With reporting by Natasha Singer of The New York Times.

With reporting by Natasha Singer of The New York Times.