杏吧原创

Facebook knows more about you than you might think. A study has for the first time revealed the scale of its data gathering, suggesting the social media company has deduced sensitive information about nearly three-quarters of all Facebook users based in the European Union, totalling 40 per cent of all EU citizens 鈥� around 200 million people. By looking at the pages you like and the things you click, Facebook can infer your sexual orientation, religion and political leanings, then uses this information to target you with adverts.

We鈥檝e long known that Facebook profiles its users in this way, but the process is hidden away in the background. Now 脕ngel Cuevas Rum铆n, at Charles III University of Madrid, Spain, and his colleagues have听shed some light on the practice.

That matters, because the EU is increasingly cracking down on profiling. In September, for targeting adverts based on sensitive information, including 鈥渋deology鈥�, 鈥渟ex鈥� and 鈥渞eligious beliefs鈥�, without obtaining explicit consent first. New EU-wide legislation, called the General Data Protection Regulation (GDPR), comes into force in May and clarifies that users must be specifically asked before companies collect and use their sensitive information or profile users on the basis of sensitive data.

Before starting the project, Cuevas was browsing Facebook when he found an ad that said: 鈥淐onnect with the gay community & rent affordable places from people like you. Book Now.鈥�

After some digging, he found that Facebook had categorised him as interested in homosexuality. 鈥淚 have never given Facebook information about my sexual orientation, nor given them permission to use this to target me with adverts,鈥� says Cuevas.

听Targeting belief

To show how easy it is to target people on the basis of sensitive information, the team purchased three Facebook ad campaigns, one targeting users interested in 鈥淚slam鈥�, 鈥淛udaism鈥�, 鈥淐hristianity鈥� or 鈥淏uddhism鈥�, another targeting people based on political opinions, such as 鈥渞adical feminism鈥� or 鈥渟ocialism鈥�, and the third targeting people registered as interested in 鈥渢ranssexualism鈥� or 鈥渉omosexuality鈥�. For 鈧�35, they reached more than 25,000 people with interests across the three groups.

However, Facebook says that interests and sensitive information are not the same. For example, just because you like a page about homosexuality doesn鈥檛 mean you are gay. 鈥淭his report is not accurate,鈥� a Facebook spokesperson told New 杏吧原创. 鈥�Like other internet companies, Facebook shows ads based on topics we think people might be interested in, but without using sensitive personal data. Our advertising is fully compliant with current Irish Data Protection law and we are actively preparing for the GDPR to ensure we are compliant when it comes into force in May.鈥� Facebook鈥檚 European operations are based in Ireland.

All of the independent data protection experts contacted by New 杏吧原创 expressed concerns about personal information being used in this way, because it likely doesn鈥檛 match people鈥檚 expectations.

For example, many people would consider clicking on an advert for a sexually transmitted infection clinic personal information. 鈥淐ontext matters and it鈥檚 not black and white, but Facebook are wrong in my view,鈥� says Pat Walshe, a data protection and privacy consultant.

While it is true that a person can be interested in homosexuality without being gay, and vice versa, it is clear that there is a large crossover between these two categories. By selling ads based on the first category, Facebook allows advertisers to target a large number of people in the second.

鈥淎lthough there may be a semantic difference between profiling one鈥檚 interests and profiling their personal aspects, the effect is the same: an individual becomes affiliated with a class or type of identity in a manner that might permit discrimination or abuse of power,鈥� says Carly Nyst, an independent consultant on technology policy. 鈥淚n an era in which the US government expresses a desire to establish a 鈥楳uslim registry鈥�, for example, a trove of data that links individuals to Islam is an incredibly powerful and sensitive thing.鈥�

Behind the scenes

Advertisers on Facebook can choose from hundreds of thousands of options to target their adverts, including location, demographics, behaviours and interests. The vast majority would not be considered sensitive information. For example, some interests are as simple as Facebook thinking you enjoy New 杏吧原创 because you鈥檝e liked the New 杏吧原创 Facebook page. Others are inferred from the way you act online. Exactly how Facebook does this is kept secret, although it is possible to see which interests Facebook has assigned to you using their 鈥淎d Preferences鈥� tool.

To work out how often sensitive interests are used to target adverts on Facebook, Cuevas and his colleagues created an internet browser extension people can use that gives you a real-time estimate of how much money you generate for the site by analysing how you interact with adverts. It also records why a specific advert was shown to an individual.

Between October 2016 and October 2017, more than 3000 people from EU countries used the tool, corresponding to 5.5 million adverts. The team extracted in excess of 2000 reasons Facebook gave for showing someone an advert that related to sensitive interests, including politics, religion, health, sexuality and ethnicity. In total, about 90 per cent of the people who used the extension were targeted with ads based on these categories.

By comparing the demographics of the people who used the browser extension and the demographics of EU citizens, the team came up with an estimate of how many people may have been targeted using sensitive interests 鈥� about 40 per cent of all EU citizens, or around 200 million people.

Covering tracks

Cuevas and his colleagues are now adapting their tool so that it can automatically delete inferences about you related to sensitive information on your Facebook account. Users can already do this manually via the 鈥淢anage your ad preferences鈥� settings in Facebook, but it is unclear how many people choose to.

鈥淭his just shows why we need laws to govern this. Often, we don鈥檛 know whether things going on in the background are ethical, so there need to be boundaries to protect individuals,鈥� says at the Oxford Internet Institute.

at the University of East Anglia, UK says that the company鈥檚 profiling makes a 鈥渕ockery of data protection鈥�, and that even if the GDPR seems to make the practice illegal, it may not be enforced or interpreted that way. 鈥淪adly, I am not optimistic that they will be brave enough to take this bull by the horns.鈥�

Europeans are worried about their personal data. , 63 per cent of EU citizens do not trust online businesses, and more than half do not like providing personal information in return for free services. But they often have little choice.

鈥淐ompanies like Facebook and Google have a monopoly. They offer services nobody else is offering, so your only options are to either take it or leave it,鈥� says Cuevas.

Article reference: