A Guided Tour Of The Data Facebook Uses To Target Ads

by Bennett Cyphers
Originally published by Electronic Frontier Foundation
Reprinted under Creative Commons 3.0 License

Last week, Pew released the results of a survey investigating how users understand Facebook's data collection practices and how they react when shown what the platform thinks it knows about them. The upshot is that 74% of users weren't aware that Facebook assembles lists of their interests and traits. 88% of respondents were assigned "categories" for advertising, which could include racial or ethnic "affinities" and political leanings. 58% of those users were "not comfortable" with the company compiling that information.

Essentially, this means that more than half of Facebook's users are unhappy with the major thrust of the company's business model--surveillance-based advertising--even after they've learned more about the info that the company has gotten from surveilling them. This is unsurprising: just knowing how you're being tracked doesn't necessarily make the tracking or the targeted ads less creepy. And while Facebook gives you some control over what data it uses to show you ads, it does not give you any way to stop the data from being collected in the first place.

We don't know what goes into determining your "categories," but it is likely grounded in the more concrete data the company knows about you: what you "like," what third-party websites and apps you use, and the physical location of your smartphone and your computer. Facebook allows advertisers to target you based on any one of these categories of data, as well as by more nebulous metrics like "similarity" to other users. Though you might not know it, much of this data is visible to average users in the Ad Preferences page. In this post, we'll go through each category of data to explain where it comes from and what it means.

What do they know?

There are four main ways Facebook collects data about you.

The first is through actions you take on Facebook platforms, like Instagram, Whatsapp, and Facebook itself, including Liking posts and clicking on ads. You can see a summary of what it knows about you this way under the "Your Interests" tab. Every time you take an action in a Facebook product, it contributes to the profile shown here. Some of the items in this list are specific companies or pages you've interacted with, and others are interests that it's attributed to you indirectly based on your actions.

Further down, under "Your Information -> Your Categories," you can see more ways Facebook classifies you for advertisers. According to Pew, a majority (60%) of users are placed into 10 or more categories by Facebook, and these categories can include political and ethnic "affinities." About half of users are assigned to a political category, and 21% are assigned a "multicultural affinity" by the company.

Second, Facebook allows businesses to upload lists of people they want to reach directly with contact information. For example, if a big box store collects email addresses as part of a rewards program, it can tell Facebook to target ads at everyone it has an email for. This also allows advertisers to target people using other sources of data, like publicly-available voter records or lists of names purchased from data brokers. Facebook often processes these data in a hashed or obfuscated form, and maintains that it does not save or use them for any purpose other than this direct targeting. You can see which companies and groups have targeted you in this way under "Advertisers -> Who used a contact list added to Facebook."

The companies here have targeted me with ads using their own lists of contact information, potentially including my name, email, or phone number. Facebook lets companies link any of these identifiers to a Facebook profile to serve ads.

Third, Facebook tracks your activity on the rest of the internet. Thanks to tech like pixel tracking and Facebook's third-party ad network, Facebook can track a great deal of your activity on other websites and in different apps on your phone. According to our own research, Facebook has pixels or other cookie-sharing code on about 30% of the top 10,000 sites on the web. And according to its own marketing literature, the company's tracking tech is used in 32% of the top 500 android apps and reaches 1 billion people per month. Under "Whose website or app you've visited," you can see a list of the advertisers Facebook believes you've interacted with in this way. The data recorded here may include activity from any device or browser you've used to log in to Facebook in the past, so some of it might not actually be yours.

Finally, Facebook can collect location data through its apps (including Instagram and Messenger), by asking to "know your location" in your browser, and by logging where you connect to the Internet. It uses that data to serve location-targeted ads as well as to determine when specific people are visiting specific brick-and-mortar stores, part of its efforts to link digital ad impressions to purchases in meatspace. Even with a good understanding of how it works, researchers have found it incredibly difficult to turn off location-based ad targeting on Facebook.

Knowledge, not power

Facebook shows you a bit of what they know about your activity, plus a limited window into who can target you with certain kinds of ads. But it doesn't give you any control over how it collects or uses your data.

Under Ad Settings, you have the option to "opt out" of seeing targeted ads in a couple of ways: you can turn off targeted ads served on Facebook using data collected off Facebook (e.g. with pixels), and you can turn off ads you see around the web that are targeted using your activity on Facebook. Both of these may help you if you're tired of the same electric toothbrush ad stalking you across cyberspace, but they do nothing to stop the collection of your data in the first place.

You can also opt out of seeing ads from individual advertisers by clicking on the little "X" in the top-right corner of each icon -- one at a time. There's no way to turn off ads from a single source in bulk. And if you want to stop advertisers from targeting you based on your location or your contact information in the future, you're out of luck.

So what good is all this? Well, we do applaud Facebook's strides towards transparency. This window into its targeted ad ecosystem is more straightforward and more granular than many of its competitors, most of whom perform the same kinds of tracking. But without meaningful ways to act on this data, the page mostly serves as a creepy reminder that Facebook follows you just about everywhere.

Luckily, you can take matters into your own hands. You can uninstall or disable Facebook's mobile apps to stop most of the company's location tracking. And you can install Privacy Badger to stop third-party tracking around the web, including through Facebook's pixels and Like buttons. The more users learn what Facebook is doing, the more they can make informed decisions about their privacy, including putting pressure on lawmakers and companies to do better.