Facebook Frownies

Shadow profiles: Facebook knows about you, even if you’re not on Facebook

During his congressional testimony, Mark Zuckerberg claimed not to know what ‘shadow profiles’ mean.

Facebook’s founder and chief executive Mark Zuckerberg faced two days of grilling before US politicians this week, following concerns over how his company deals with people’s data.

But the data Facebook has on people who are not signed up to the social media giant also came under scrutiny.

During Zuckerberg’s congressional testimony he claimed to be ignorant of what are known as “shadow profiles”.

Zuckerberg: I’m not – I’m not familiar with that.

That’s alarming, given that we have been discussing this element of Facebook’s non-user data collection for the past five years, ever since the practice was brought to light by researchers at Packet Storm Security.

Maybe it was just the phrase “shadow profiles” with which Zuckerberg was unfamiliar. It wasn’t clear, but others were not impressed by his answer.

Facebook’s proactive data-collection processes have been under scrutiny in previous years, especially as researchers and journalists have delved into the workings of Facebook’s “Download Your Information” and “People You May Know” tools to report on shadow profiles.

Shadow profiles

To explain shadow profiles simply, let’s imagine a simple social group of three people – Ashley, Blair and Carmen – who already know one another, and have each others’ email address and phone numbers in their phones.

If Ashley joins Facebook and uploads her phone contacts to Facebook’s servers, then Facebook can proactively suggest friends whom she might know, based on the information she uploaded.

For now, let’s imagine that Ashley is the first of her friends to join Facebook. The information she uploaded is used to create shadow profiles for both Blair and Carmen – so that if Blair or Carmen joins, they will be recommended Ashley as a friend.

Next, Blair joins Facebook, uploading his phone’s contacts too. Thanks to the shadow profile, he has a ready-made connection to Ashley in Facebook’s “People You May Know” feature.

At the same time, Facebook has learned more about Carmen’s social circle – in spite of the fact that Carmen has never used Facebook, and therefore has never agreed to its policies for data collection.

Despite the scary-sounding name, I don’t think there is necessarily any malice or ill will in Facebook’s creation and use of shadow profiles.

It seems like a earnestly designed feature in service of Facebooks’s goal of connecting people. It’s a goal that clearly also aligns with Facebook’s financial incentives for growth and garnering advertising attention.

But the practice brings to light some thorny issues around consent, data collection, and personally identifiable information.

What data?

Some of the questions Zuckerberg faced this week highlighted issues relating to the data that Facebook collects from users, and the consent and permissions that users give (or are unaware they give).

Facebook is often quite deliberate in its characterisations of “your data”, rejecting the notion that it “owns” user data.

That said, there are a lot of data on Facebook, and what exactly is “yours” or just simply “data related to you” isn’t always clear. “Your data” notionally includes your posts, photos, videos, comments, content, and so on. It’s anything that could be considered as copyright-able work or intellectual property.

What’s less clear is the state of your rights relating to data that is “about you”, rather than supplied by you. This is data that is created by your presence or your social proximity to Facebook.

Examples of data “about you” might include your browsing history and data gleaned from cookies, tracking pixels, and the like button widget, as well as social graph data supplied whenever Facebook users supply the platform with access to their phone or email contact lists.

Like most internet platforms, Facebook rejects any claim to ownership of the IP that users post. To avoid falling foul of copyright issues in the provision of its services, Facebook demands (as part of its user agreements and Statement of Rights and Responsibilites) a:

“...non-exclusive, transferable, sub-licensable, royalty-free, worldwide license to use any IP content that you post on or in connection with Facebook (IP License). This IP License ends when you delete your IP content or your account unless your content has been shared with others, and they have not deleted it.”

Data scares

If you’re on Facebook then you’ve probably seen a post that keeps making the rounds every few years, saying: “In response to the new Facebook guidelines I hereby declare that my copyright is attached to all of my personal details...”

Part of the reason we keep seeing data scares like this is that Facebook’s lacklustre messaging around user rights and data policies have contributed to confusion, uncertainty and doubt among its users.

It was a point that Republican Senator John Kennedy raised with Zuckerberg this week (see video).

Play
Senator John Kennedy’s exclamation is a strong, but fair assessment of the failings of Facebook’s policy messaging.s

After the grilling

Zuckerberg and Facebook should learn from this congressional grilling that they have struggled and occasionally failed in their responsibilities to users.

It’s important that Facebook now makes efforts to communicate more strongly with users about their rights and responsibilities on the platform, as well as the responsibilities that Facebook owes them.

This should go beyond a mere awareness-style PR campaign. It should seek to truly inform and educate Facebook’s users, and people who are not on Facebook, about their data, their rights, and how they can meaningfully safeguard their personal data and privacy.

Given the magnitude of Facebook as an internet platform, and its importance to users across the world, the spectre of regulation will continue to raise its head.

Ideally, the company should look to broaden its governance horizons, by seeking to truly engage in consultation and reform with Facebook’s stakeholders – its users – as well as the civil society groups and regulatory bodies that seek to empower users in these spaces.

Andrew Quodling, PhD candidate researching governance of social media platforms, Queensland University of Technology.

This article first appeared on The Conversation.

Support our journalism by subscribing to Scroll+ here. We welcome your comments at letters@scroll.in.
Sponsored Content BY 

What is it about Tom Clancy’s characters?

In the mammoth Jack Ryan series, Tom Clancy creates a compelling protagonist who is as cerebral as he is action-oriented.

Jack Ryan (Ph.D., CPA, KCVO) has had an eventful life. He’s served as a marine, made a fortune worth millions after retirement from the military, earned a doctorate degree in history and beaten up a lot of bad guys along the way. He is a unique action hero, in that he has also been a US Marine, an investment broker, a history teacher, a CIA analyst rising to Deputy Director, National Security Advisor, vice president and eventually the President of the United States of America! This multipotentialite is the protagonist of Tom Clancy’s ‘Ryanverse’ - the term used to refer to the fictional universe he built over 10 books.

Jack Ryan is a complex hero. Before he was beating up bad guys Hollywood-style, he also took a year to learn to walk again and battled painkiller addiction. Before he became the POTUS, jet-setting around the world on official matters, he nursed a crushing phobia of flying. A reluctant president, he nonetheless campaigns for a second term and even has foreign policy named after him - the ‘Ryan Doctrine’- in the tradition of some past US presidents.

Other prominent characters in Ryanverse have equally rollercoaster-like story arcs. John Clark/Kelly - Ryan’s bodyguard - is tragedy’s favourite child, having lost his parents in childhood and later wife. After a whirlwind adventure involving two gunshots and 16 murders, John Kelly ended up having to change his identity to John Clark. He, unlike Ryan, has an unusually strong aversion to drugs.

In the later books, Tom Clancy also devotes space to Jack Ryan Jr, who takes after his father more ways than one. An intelligence analyst by profession, Jack Jr, too, is adept in firearms, close-quarter combat, surveillance and espionage. Jack Jr has a tumultuous relationship with his girlfriend, a CIA operative herself, with whom he parts after she’s revealed to be an indirect intelligence asset.

Ryanverse is replete with scores of characters of all shades - spies, soldiers, terrorists, politicians and criminals - that set in motion events that threaten the course of world order. Clancy’s varied interests and love for research culminates in an action series which also explores history, politics, international relations and the human condition, especially when it comes to loss and grief. All his prominent characters are fighting some personal demons even as they chase down enemies that are equally complex.

Ryanverse’s charismatic leading man has also been the focus of five Hollywood films. Actors Alec Baldwin, Harrison Ford, Ben Affleck and Chris Pine have all portrayed the iconic character at various stages of his career. Now, John Krasinski takes up the role in Tom Clancy’s Jack Ryan, playing a gifted-analyst-turned-reluctant-action-hero thrown into a global terrorism conspiracy. Watch the trailer of Tom Clancy’s Jack Ryan below.

Play

Jack Ryan is now streaming on Amazon Prime Video. You can watch it here.

This article was produced by the Scroll marketing team on behalf of Amazon Prime Video and not by the Scroll editorial team.