The Facebook Trials: It’s Not “Our” Data

Facebook, Google and other tech companies are accused of stealing our data or at least of using it without our permission to become extraordinarily rich. Now is the time, say the critics, to stand up and take back our data. Ours, ours, ours.

In this way of thinking, our data is like our lawnmower and Facebook is a pushy neighbor who saw that our garage door was open, took our lawnmower, made a quick buck mowing people’s lawns, and now refuses to give our lawnmower back. Take back our lawnmower!

The reality is far different.

What could be more ours than our friends? Yet I have hundreds of friends on Facebook, most of whom I don’t know well and have never met. But my Facebook friends are friends. We share common interests and, most of the time, I’m happy to see what they are thinking and doing and I’m pleased when they show interest in what I’m up to. If, before Facebook existed, I had been asked to list “my friends,” I would have had a hard time naming ten friends, let alone hundreds. My Facebook friends didn’t exist before Facebook. My Facebook friendships are not simply my data—they are a unique co-creation of myself, my friends, and, yes, Facebook.

Some of my Facebook friends are family, but even here the relationships are not simply mine but a product of myself and Facebook. My cousin who lives in Dubai, for example, is my cousin whether Facebook exists or not, but I haven’t seen him in over twenty years, have never written him a letter, have never in that time shared a phone call. Nevertheless, I can tell you about the bike accident, the broken arm, the X-ray with more than a dozen screws—I know about all of this only because of Facebook. The relationship with my cousin, therefore, isn’t simply mine, it’s a joint creation of myself, my cousin and Facebook.

Facebook hasn’t taken our data—they have created it.

Facebook and Google have made billions in profits, but it’s utterly false to think that we, the users, have not been compensated. Have you checked the price of a Facebook post or a Google search recently? More than 2 billion people use Facebook every month, none are charged. Google performs more than 3.5 billion searches every day, all for free. The total surplus created by Facebook and Google far exceeds their profits.

Moreover, it’s the prospect of profits that has led Facebook and Google to invest in the technology and tools that have created “our data.” The more difficult it is to profit from data, the less data there will be. Proposals to require data to be “portable” miss this important point. Try making your Facebook graph portable before joining Facebook.

None of this means that we should not be concerned with how data, ours, theirs, or otherwise, is used. I don’t worry too much about what Facebook and Google know about me. Mostly the tech companies want to figure out what I want to buy. Not such a bad deal even if the way that ads follow me around the world is at times a bit disconcerting. I do worry that they have not adequately enforced contractual restrictions on third-party users of our data. Ironically, it was letting non-profits use Facebook’s data that caused problems.

I also worry about big brother’s use of big data. Sooner or later, what Facebook and Google know, the government will know. That alone is good reason to think carefully about how much information we allow the tech companies to know and to store. But let’s get over the idea that it’s “our data.” Not only isn’t it our data, it never was.


Where does this end? With the car dealership running facial recognition at the front door, the salesperson greeting me by name, and knowing both my ability to pay and my purchase history?

Or, with a lag to run my "credit history" are we there already?

If it wasn't my data, there is no privacy.

Easy!! Make the law reflect what the HIPAA laws says. Essentially that ALL information about us belongs to "US" and cannot be captured, used or even viewed without our explicit permission. Put into place major penalties for intentionally or unintentionally breaking that law. Problem solved.

We certainly can pass more or better privacy laws.

I don't see a good argument that privacy slows progress or restricts commerce.

Facebook's shareholders probably disagree.

Why, because they've been oversold on the idea that you have to know exactly who the customer is? If they know I camp, that is enough to sell me gear. They don't need to know which campground I go to, or with whom.

Why? Because they need time to make use of the greater fool theory to ensure their profit.

Ⲏi! Ӏ simply աish to give you ɑ hugᥱ thumbs uρ for the great info
you have got right heгe on thiѕ post. I am сoming bɑck to
yⲟur website fօr more soon.

Magnificent beat ! I would ⅼike to apprentice at
the sɑme tіmе as ʏou amend your website, hoԝ can i subscribe
fօr a blog site? Τhe account aided me a aρpropriate deal.

I wегe tiny ƅit acquainted օf tɦis your broadcast offered vivid transparent idea

whoah thіѕ weblog іs great i love reading үour posts.
Stay ᥙp the ɡood ѡork! You recognize, many people
ɑre hunting round for thiѕ іnformation, ʏou couⅼd aid thᥱm

Tɦese aгe truly impressive ideas іn on tһᥱ topic of blogging.
Ⲩou hаve touched ѕome good things here. Any waу keеp
uρ wrinting.

But you gave explicit permission for Facebook to use the data when you got an account, and especially when you gave it to them. You post information to Facebook's server. They allow you to do that for free. Obviously, they need to get something out of the deal.

HIPPA is a weak analogy. No one is forced to use Facebook, but you are forced to get medical care. Medical information is potentially embarrassing and unavoidable; Facebook posts are embarrassing only if you let them be, and they are entirely avoidable.

Facebook gives you a free platform to express yourself. You cannot then deny them the right to use those expressions. If I were Zuckerberg, I would offer a paid version of Facebook with greater privacy assurances.

I was not aware that "it was letting non-profits use Facebook’s data that caused problems." How so? Is there an article or something else like a blog post out there explaining this? Interesting tidbit of information.

The "personality" profile was academic research using Facebook data mining crossed with survey.

Academic is not-for-profit except in the 80s free lunch economists argued such research would be free if academics owned their results, not the public, so "private" "profits" would pay for "public" research.

What is really at issue is who pays and how workers get paid. Tax payers paying for materials engineering for NASA and DoD, or can "profits" from selling soda in aluminum cans pay for R&D? Or from selling flu shots pay for eliminating eggs from manufacturing vaccines?

Circa 1980, a push started to eliminate putting all government funded R&D results in the public domain, with universities patenting, etc, results to sell them to fund future R&D at higher levels with no more tax funding.

Academics then objected. But today's academics often look to public funding to fund their private startup. Paid by a university, a researcher asks a corporation to donate in kind to support their research. Software, data, old equipment, expert advice, etc.

Universities have since encouraged creating separate corporations with the researcher getting some, most, all the rewards.

Note, this same idea has taken hold in college sports with taxpayer paid university coaches getting paid millions as their share of profits from big time sports funding part of university budgets by way of separate corporate entities. In this case, the star workers, students, do not get paid because education is not-for-profit.

In this case Facebook made charitable donation of data, software, and expert advice to an academic not-for-profit research project. Virtue! Probably got listed as a donation in tax filings and securities filings and press releases.

Alex has formed a new group:
Libertarians Against Privacy.

So, he is a barking LAP dog?

LOL. No true Libertarian would *ever* join Facebook!

"Sooner or later, what Facebook and Google know, the government will know."
That time is now, the Snowden revelations have taught us as much.

And it is a major reason that American firms are losing (legal) access to data on EU citizens unless they can guarantee that it is not being shared with the NSA et al.

Makes sense. Europe has its terrorism problem completely under control.

Somehow it's almost like it's absurdly obvious that it's not about terrorism.

But hey, since people respond to fear, let's out-Stasi the Stasi.

(P.S.: It is wrong to do things with the specific intent to cause terror in civilian populations, for example for a political purpose. However, when actual risk is out of proportion with the fearmongering, might the people who fan the flames of fear be more guilty under the CIA definition of terrorism the proximate actors of the violent acts?)

Clockwork, Show me the link which supports your claim that American firms are losing legal access to data on EU citizens unless they can show that it is not being shared with the NSA.
Do you think the NSA would ask for permission.? I doubt it.

Maybe you should read up about the EU GDPR privacy regulations a bit. They go into effect on May 25th.

"Do you think the NSA would ask for permission.? I doubt it."

That's kind of the point. Since no one would believe the NSA would refrain from hoovering up any and every thing if there was some plausible way to do so, the EU is extremely reasonable to assume that housing or transmitting data in/via the US is liable to pose risks to the ability of the EU to assure both individual and collective security of Europeans.

Not only is there a possibility of malicious actors within the NSA, but there is this particularly American way of viewing the world (not that everyone thinks like this, and there are also gradations which do not have such extremely black/white thinking on the matter) that involves basically zero valuation of anything not American. For example, its being acceptable (to some people) to nuke somewhere (maybe any non-US place) to save a single American life.

Oh, c'mon. Do you think that the NSA is unable to examine foreign systems in foreign countries. And, the term, malicious actors within the NSA: are you a Russian troll? You do use the name: Troll Me.

Go do some research on EU privacy regulations and skip the speculation.

Because there's literally a front door on my house, therefore I should self-install cameras in every room and forward them directly to foreign government SIGINT agencies?

The theoretical ability to spy on allies does not imply that allies should forward substantial information on all citizens, by default. To even suggest that everyone else should be OK with that is hostile.

Does the rescinding of the EU Safe Harbor provisions count? - 'A "bombshell" ruling from the highest court in the European Union branded a key EU-U.S. data-sharing agreement illegal – and threatened to plunge Internet companies into a legal limbo.

The ruling "pulled the rug under the feet of thousands of companies" that have been relying on safe harbor, said Monika Kuschewsky, special counsel at Covington & Burling LLP in Brussels. "All these companies are now forced to find an alternative mechanism for their data transfers to the U.S. And, this, basically overnight."

Here's what has happened, and why: What is Safe Harbor?

Safe Harbor was adopted by the European Commission in 2000 and recognizes a set of privacy principles by the U.S. Department of Commerce "as providing adequate protection for the purposes of personal data transfers from the EU," according to the EU executive body. It has become a key trans-Atlantic data transfer mechanism, with more than 4,000 U.S. companies self-certified under it.'

Or would this case count? 'On Thursday, the Irish High Court referred a case triggered by Austrian privacy campaigner Max Schrems against Facebook's international branch in Ireland to the European Court of Justice in Luxembourg.

The case stems back to US mass surveillance as disclosed by former NSA operative, Edward Snowden.

"The question in this case does not seem to be if Facebook can win it, but to what extent the Court of Justice will prohibit Facebook's EU-US data transfers," Schrems said in a statement.'

Or maybe this German court case, as already noted in another MR Facebook post? 'Facebook’s default privacy settings and use of personal data are against German consumer law, according to a judgement handed down by a Berlin regional court.

The court found that Facebook collects and uses personal data without providing enough information to its members for them to render meaningful consent. The federation of German consumer organisations (VZBV), which brought the suit, argued that Facebook opted users in to features which it should not have.


The court also ruled eight clauses in Facebook’s terms of service to be invalid, including terms that allow Facebook to transmit data to the US and use personal data for commercial purposes. The company’s “authentic name” policy – a revision of a rule that once required users to use their “real names” on the site, but which now allows them to use any names they are widely known by – was also ruled unlawful.'

Whether this has had any impact on Facebook till now is open to question, of course.

This doesn't support your earlier claim, and in fact, supports mine: that EU data privacy regulations are the limiting factor in US corporations transferring data to the US without compliance with EU regulations.

But, I am glad that you did some reading on this subject after not finding support for the NSA claim.

The post certainly articulates the corporate view -- where the person is nothing but an input to the profit function. The reality is that is someone did in actual action what occurs in the virtual world there is no doubt they are be called stalkers. The standard is in place and we do have a right to quite enjoyment of pursuing our happiness even in public spaces without someone monitoring every action and choice we make.

Yes, marketer should be allowed to collect data. Yes targeted marketing has value. This can be accomplished without putting any person private -- what is legally called Non-public Personally Identifying Information--at risk.

That is not information FB has create. It's information it has failed to protect.

Alex Vs Facebook terms and conditions from Jan 30, 2015(

"Statement of Rights and Responsibilities

2. Sharing Your Content and Information

You own all of the content and information you post on Facebook, and you can control how it is shared through your privacy and application settings. "

Without looking, I can guarantee that the very next part is about you giving Facebook a license that is transferable/permanent/assignable to do whatever they want with it.

Every commercial site with UGC does this.

Which is a bit confusing and contradictory (though also probably covered in some legalese about how each clause stands on its own regardless of the validity of some other clause). Seemed to be part of what was brought up in the grilling/hearing.

I do think it's worth pushing the "caveat emptor" is not a good structure or standard for healthy markets or corporate law.

The confusing in these terms boarders (in my view complete crosses and has left the line far distant in the rear view mirror) invalidating any meeting of the minds for a valid contract.

We all need to do better here and none should be defended as if they have it right. In terms of online privacy and the protection and respect there of we live in a cesspool.

I think we need both some regulation of the giants as well as people being more picky about these bargains they do for "free" services.

First, I don't use Facebook and have never had an account with a real profile. Groups and organizations my children belonged to required a Facebook account, so I created a fake identity. It probably gave me a false sense of privacy, but I don't like Facebook.

Google, of course, knows more about my activities than my mother.

My question for Professor Tabarrok is if Facebook and Google were in a more competitive environment what would be the value of my "private" information?

Nationalization of data seems like a worse option. Claiming that personal data is a public good that the government should control and monitor sounds like a worse path. The idea that government regulation will be less abusive than private corporate control seems contrary to historical lessons.

In my ideal world, we would have more competition and the creation of something like Underwriters Laboratories. A private company that would monitor the security practices of data companies to protect against abuse. Only data companies that followed methods recommended by this private concern would get their certification.

If data companies competed as aggressively with providing privacy as they do with providing information to advertisers, I think it would be an improvement.


Does the grocery you shop at value your paycheck? If you stopped getting paid, would the grocery change how it values you as a consumer? Paying cash vs food stamps and dumpster diving in back of grocery.

SWAG from various easy public reports is every US Facebook user pays for $60 in wages and benefits to workers:
FB operations workers, including ad sales and marketing workers
FB customer service workers
FB computer server operators
Workers making FB data centers and equipment
FB engineers and coders

FB users pay by consuming GDP from business that pay a bit of your spending to FB workers as the cost of finding the FB user as customer.

In an efficient market/economy, all cost/value would be the wages paid to workers, with no profit. FB, et al, would be the labor cost of the economy finding the point of maximal and optimal paying of workers by workers consuming optimal and maximal product.

Businesses have been paying big bucks to print, etc, lots going to deliver boys for the print, and now FB gets the money previously for the delivery boys, without paying as much in labor cost. Thus high profits.

The economic scarce resource is your attention. You toss lots of mail delivered by the USPS delivery boy. To get you to look at email, Google discards email for you based on your past actions discarding email so you will actually read the email using gmail, instead of reading almost nothing.

FB a year ago flooded it's users with too much junk and FB users stopped reading anything in significant numbers, so FB has focused on cutting down the quantity fed you.

What if the USPS printed ads for customers based on demographics and packages delivered to you? DHL, the German post office, has a print and delivery arm tied to its mail delivery arm. Doesn't use package delivery data yet, as far as I know.

With all due respect Mulp, I have no idea what you are talking about.

It is very expensive for firms to acquire and maintain customers. Loyal customers are an "intangible asset" that can actually increase the stock price of a company.

The following article just offers one take on the issue.
Is there a rational reason that stock prices in some industries greatly exceed book values? The answer may lie in
the idea that customers are capital.

Palantir (a/k/a Stanford Analytica), the data mining firm founded by Peter Thiel, already snoops on people on behalf of government and business. I half-jokingly (but only half) refer to Thiel as the Grand Dragon of the Libertarian-Authoritarian Axis. Tabarrok is willing to strike a Faustian bargain with Facebook and Google ("free" service in return for his personal information). Are you? As I've stated before, most users of Facebook and Google are willing to strike a Faustian bargain because they place such a low value on their personal information.

"most users of Facebook and Google are willing to strike a Faustian bargain because they place such a low value on their personal information."

Or, they consider the price of lost privacy to be worth the gain in social capital, which is hard to get these days. You know, bowling alone and all ...

Good points, and I will just add two more:

1. People use a free service, and then dictate to that service how it should work!
Imagine if Facebook presents two types of accounts to its users. One: you pay $10 per month and you will see ZERO ads, and your data will NEVER be shared with any third party. Two: you use Facebook for free, and you will see contextual ads and your data will be shared with third parties and advertisers.

Which option do you think most Americans would choose?

2. China is having the last laugh.

This is one reason why China banned Facebook way back in 2009. Such a huge treasure trove of data (and by now China would've had the largest no.of Facebook users in the world), all in the hands of a western private company? Unthinkable.

Sooner or later, what Facebook and Google know, the government will know.

The government already knows. It ALREADY has access to all Facebook and Google data - via the NSA. According to the Snowden revelations about PRISM and other surveillance programs, the NSA has backdoor access to the servers of Facebook, Google, Amazon, Microsoft and a host of other private US companies. And these companies cannot talk about it due to gag orders imposed on them.

This means that an analyst at the NSA can access ALL your data stored on any of the services/products mentioned above, without a judge even looking at that request. And remember, there is no such thing as a deletion. Even after your delete a photo or some information, it always remains on their servers.

(And these backdoors are often easily exploited by hackers. For example, in 2010, Chinese hackers discovered a backdoor in Gmail that Google had left at the behest of the NSA. And they exploited it. When Google discovered this, they promptly announced that Gmail had been "hacked" by attacks originating from China, but kept mum about the backdoor. And this incident then lead to Google's departure from China. Google refused to agree to China's local data storage and censorship laws, but happily acceded to America's own unconstitutional surveillance activities.)

Now imagine if you are a Chinese citizen. Would you rather your private data be in the hands of your own government, or a private US company and the US government? Every single Chinese internet user knows that there is no privacy in the Chinese system. The government never hides it. On the other hand, the US government hides the true extent of its surveillance (James Clapper even lied under oath to Congress about this), and then prevents these companies from talking about it by imposing gag orders. And all the while presenting a saintly face of human rights and internet freedom to the world.

All this is justified of course, since America is an exceptional nation. After all, as one definition of American Exceptionalism goes: America can commit the crimes that it condemns others for committing.

Re your option #1, I think TC made exactly the same point a few weeks ago, almost with the same language. The reason is most Americans are in the 99%, not the 1% like me. Actually the 0.01% that I know don't even have a PC, don't use the internet at all, pace guys like P. Thiel.

As for AlexT's FB "friends", I almost feel sorry for him. Who needs such shallow friends? Put another way, if I was banned from this site, would I care much? Not really. And neither should you, reader. So the value of the internet as a social network is, for me, about zero. And arguably it should be for most people. That's one reason psychologists say the internet is, on balance, actually net harmful. Get a life, there's no reason why you should be interested in the broken arm of your long-lost cousin in Dubai.

Bonus trivia: once I saw a rather close relative of mine, that I never met, and who we don't communicate with, on the BBC, in a non-notorious way (it was a feel good story). And I had no idea the guy had so much money, much more than we do (he's probably in the 0.1%). Dang the Lopez family does well.

The US Constitution is exceptional, but the people have all the biases of humans everywhere.

The particular bias exploited by FB, Google et al is the power of free. We are predictably irrational.

One thing to remember - if you aren't paying for the service you are not the customer, you are the product.

We have the Constitution because nothing of value is free, and asking people to donate enough was not working.

Washington and his business manager Hamilton called for the convention to find way way to pay for everything.

The number one enumerated power was tax to pay for spending.
The number two power was that the first would pay for past spending to ensure borrowing was possible in the future.

All the other stuff was stuff added to get votes in agreement for the power to tax. Ie, pork.

If the revolution and future independence were free, there would have been no Constitution.

'The reality is far different.'

Not in the EU, where you own your data - and that ownership is not lost merely by sharing it with someone else. Merely giving data to Facebook in the EU does not mean that Facebook somehow becomes its owner. You are the owner, and you have the legal right in the EU to force Facebook to delete your data at any time now or in the future.

'they have created it'

No, they did not create it.

'Ironically, it was letting non-profits use Facebook’s data that caused problems.'

I guess it is not a surprise that someone simply glosses over something like this non-third party manipulation - 'Facebook let researchers adjust its users' news feeds to manipulate their emotions – and has suggested that such experimentation is routine, which is seemingly how the idea got past the advertising firm's ethics committees.

In 2012, researchers led by the company's data scientist Adam Kramer, manipulated which posts from their friends the sample of nearly 700,000 users could see in their “News feed”, suppressing either positive or negative posts, to see whether either cheerful or downer posts seemed to be emotionally contagious.'

'But let’s get over the idea that it’s “our data.” Not only isn’t it our data, it never was.'

No, let us not ever believe that my data belongs to someone else on their say so.

Some comments and the post itself seem to imply that the government having access to our data is worse than private third-parties (facebook, google, whomever) having access to it.

Why so?

The former is certainly more accountable to citizens and I find it hard to find something the government could do to me than Facebook could not, or that it couldn't do before having access to all my data.

"Why so?"

Because they're the ones with the armed police, judges, prisons, tax and regulatory authorities -- and they have proven they will abuse their power to go after critics and political opponents -- from Lois Lerner on down to off-the-chain local sheriffs:

Or Customs and Border Control:

I can choose not to do business with Facebook (in fact, I have always chosen not to do business with Facebook). With a bit of trouble I could drop Google as well (there are other email providers and search engines after all). But I can never switch to a different 'government provider' (not without emigrating anyway). And your faith in the accountability of government to my personal concerns? That's adorable. One tiny vote adrift in a sea of hundreds of millions of others.

What's the worst thing Facebook or Google could do with my data? Try to use it to target advertising at me? Big deal -- don't really care. Advertising is easy to ignore. But no -- the worst thing they could do with my data is provide it to the government. With no ability to refuse or even notify me that they've provided that data. That, I do care about.

"I find it hard to find something the government could do to me than Facebook could not"

What!!!!!????? Seriously? Ever heard of Walter Scott? You do realize the guy who shot him dead was part of the government, right? When was the last time a Facebook employee on official company business shot somebody in the course of their duties?

Interesting points! I can definitely see where your fear from the government comes from, and empathise with some of your ideas.

TL;DR of my response: I think you are grossly underestimating the capacity of private companies to do real damage and overestimating what harm governments in XXI century western democracies are willing to inflict upon their own citizens.

Also, I have to disclose I am playing devil’s advocate here since my personal opinion is that any accumulation of power, either by governments or corporations, is bad.

### Longer response

**1) Private companies have been as damaging as governments**
Private companies, throughout history, have engaged in all sorts of illicit activities that have cause real damage. Just to cite a few, corporations have:
- exploited workers in, both, developing and developed countries. An activity that has resulted in the deaths of countless.
- Denied climate change that will have all sorts of devastating consequences to several million people around the globe.
- effectively financed drug cartels that, needless to say, kill people.
- actively engaged in warfare.

It seems to me you are downplaying how consequential a big corporation like Facebook or Apple can be for the lives of millions.

**2) You cannot, effectively, opt out of private companies**
There’s this common argument that you can always choose not to use [insert random company/service name here]. I think this is true only at the margin.

If we assume that holding of your private data by third parties poses an intrinsic risk to your safety, you should be prepared to go back to the cave because private companies operate with your data in virtually every aspect of your life you care about. I don’t doubt you can leave FB and Google (albeit with some troubles, as you said), but could you also opt out of your health insurance/education/internet/cable-tv providers (to name some common ones), all at the same time?

All of these companies have bits of your private data and there’s no good reason to think they wouldn’t use it without your consent for illicit activities in the interest of profit, other than the threat of being caught by law enforcement or the prospect of losing market share… which brings me to my second point.

The suggestion that there would always be a morally “good” alternative to every “evil” provider presupposes perfect competition in a completely open market (which is laughable in the case of Facebook’s and Google’s sectors) and downplays the role of important external factors like network effects or the costs of switching providers. Market share is not a force for accountability in a situation of effective monopoly.

The reality is that in many sectors, and I would say social networks is definitely one of them, there are no “clean” alternatives: someone, somehow, is gonna have some of your private data, unless you are switching off the world.

**3) Actually, I do not think government accountability is that good either**!
You are right! Governments aren’t, by a long stretch, as accountable as I would like them to be, I simply said they are more accountable than private companies.

The facebook / Cambridge Analytica scandal is actually a pretty good example to make my point. After all that has happened… what are the consequences for FB? A pretty inoffensive “#deleteFacebook” campaign, some public spanking in the media and… what else? It still makes billions, it still has 3 of the top 5 social apps in the App Store and the most consequential changes it will be forced to make will be due to the new European GDPR regulations.

Again, I’m not saying governments are amazing at accountability either. After all that was disclosed by Snowden, no one at the time was even close to suggest Obama’s impeachment but, guess what, he was forced out nevertheless!

I agree with you that the current American electoral system currently gives too much power to a small number of electoral colleges, rendering the vote of millions worthless. However this does not suggest the situation cannot be changed. Look at Switzerland or Norway for some good examples of more direct/accountable democracies.

At least two reasons:
1) Google/FB can't make me do anything / I can opt to use a non-evil Google/FB competitor
2) Government as provider is a conflict-of-interest with government as judge/policeman.

3) Innovation and competition, in the long run, can break the power of private firms. Governments almost never relinquish monopoly power without a revolution.

"The former is certainly more accountable to citizens " That's a stretch.

Also, I can quit facebook, or no sign up. No so with the government.

It is well known by now that Facebook collects data on people who are not "yet" users. It is called a shadow account.

I can't say I'd be fond of that, but is it all public information?

Do you mean is it for sale? If there is a buyer, why not. Data is data and business is business.

Yes technically you can quit Facebook.

But increasingly you cannot avoid it. Many other web-based functions and activities are using FB logins as their authentication, and many businesses and agencies use FB as their communication medium.

I've succeeded in avoiding it, as have a number of acquaintances. I've yet to encounter a business I could not get information about or buy from for lack of an FB account.

See the new estimate of massive consumer surplus generated by Facebook:

"Using Massive Online Choice Experiments to Measure Changes in Well-being"
By Erik Brynjolfsson, Felix Eggers, and Avinash Gannamaneni
NBER Working Paper No. 24514
April 2018
JEL No. E01,E16,O0,O4
"GDP and derived metrics (e.g., productivity) have been central to understanding economic progress and well-being. In principle, the change in consumer surplus (compensating expenditure) provides a superior, and more direct, measure of the change in well-being, especially for digital goods, but in practice, it has been difficult to measure. We explore the potential of massive online choice experiments to measure consumers’ willingness to accept compensation for losing access to various digital goods and thereby estimate the consumer surplus generated from these goods. We test the robustness of the approach and benchmark it against established methods, including incentive compatible choice experiments that require participants to give up Facebook for a certain period in exchange for compensation. The proposed choice experiments show convergent validity and are massively scalable. Our results indicate that digital goods have created large gains in well-being that are missed by conventional measures of GDP and productivity. By periodically querying a large, representative sample of goods and services, including those which are not priced in existing markets, changes in consumer surplus and other new measures of well-being derived from these online choice experiments have the potential for providing cost-effective supplements to existing national income and product accounts."

Link to gated access to full paper at NBER:

Disclosure: I don't have a Facebook page, because I prefer a) more privacy, b) using my online time to follow social-science blogs and livestreams of pro cycling races, and c) focussing on old-school friends, few as they are. Perhaps I don't know what I'm missing!

As always, my problem with Facebook is not the data that is created from my freely chosen interactions with the world. My problem is with the data Facebook assembles without my knowledge or consent via my friends.

I really dislike the idea of letting the lowest data preference in a social network set the data sharing limits for everyone else. I do have to worry about the odd psychotic patient so it makes sense for me to limit my phone number, address, and family relations from being easily accessible. My friends and social contacts do not have to live with this, so they will happily allow random aps to scour whatever data they come across.

So how do I fully opt out? How do I decide that Facebook, which I am not nor ever have been on, is totally not worth it and then have my wishes respected? How do I establish that I have been harmed by some data collection to which I did not consent? How do I determine if Facebook or some other entity is liable from a situation involving their data?

The current setup is that in order to limit Facebook's use of data about me I have to ... sign up for Facebook.

The inherent assumption of the market is that parties freely contract with known terms of contract. Does anyone actually know the terms of Facebook's contract? Can anyone know them? Can anyone validate if they have been broken without a small army of lawyers?

A well functioning, free market this is not.

Ever heard of Acxiom Corporation? Ever agree to giving them all the information they have had on you for more than two decades?

Circa 2000 they touted to clients they had a hundred characters of data for every 6 billion people on the planet. At that point, a terabyte of data in one place in computer accessible form was still a global quest of business and government. But everything was in place, except the funding.

The funding came from Darpa and DOE on government side, and search on private side, ...

...and Amazon as a side effect of its logistics needs. What was managing and then predicting future sales and package delivery next Christmas ended up being a major engine of growth.

Amazon is weird in knowing about your interests and then paying Google, Facebook to insert Amazon ads it selects for you into your view. But it does not give google and Facebook much info on you, just that it wants to put an ad for something in front of you.

Google and Facebook both collect data on non-users based on code embedded in a large number of websites that seem to have nothing to do with Google or Facebook but have an ad banner and a "Share" button. For example, this blog comment page is bugged by Facebook but not Google

If you use the uMatrix plug in for Firefox, you just might be surprised to see what google is doing here.

What a Straussian article.

Prof. you are wrong! PII or PHI belongs to individuals, not corporations even they store the data. I hope you understand the concepts of Data Subject, Data Controller, Data Processor, all of which are independent concepts. As someone who has been in information management for more than 20 years, I can tell you the Europeans got this right in GDPR (albeit not perfect). But someone has to start from somewhere. The US shows no leadership in this space and many are shockingly ignorant.

Facebook's role as co-creator does not make it less our data. If I hire a home inspector to help me understand what is going on in my home, it's not crazy to think I might want control over where the information gets disseminated. If I send my DNA to 23andMe, we are co-creating my genetic data, but I could reasonably ask for privacy. When I get a blood test, the lab is co-creating the data with me, and I have a very reasonable expectation of privacy.

All these things are unique co-creations of me and some firm. They are all also much more personal to me than they are to the firm, and I am bearing all the risk of these data being widely disseminated.

I think your description of the situation misses the point. When I co-create some kind of database based upon my personal information with a third party, there is no obvious default state of privacy or lack of privacy. Instead, there is typically a shared understanding of what will be disseminated to whom.

This is presumably buried in some 50-page user license that I have clicked on and agreed to, but given that nobody ever reads these, what matters is whether Facebook is acting in a way that its users expected them to, or is acting in a way that makes its users feel that their privacy has been violated. The answer appears to be the latter, but that the violations are not serious enough for people to depart facebook en masse.

However, the notion that we shouldn't be upset by privacy violations because facebook helped create some of this data -- this is not a good argument.

You pay for a home inspector, DNA service, blood test with money. You pay for Facebook and Google by letting them use your data. If you don't like this, you'll need to find a different service and pay actual money for it.

Does the maker of your hammer own part of your deck project? Does Ford own part of your drive in the country? Does Apple own part of your phone calls? The technology may be very enabling, but the vendor of the platform does NOT own any piece of your data. You and your friends created your network. Your work, your creativity, and perhaps your passion and love created the data. Facebook did not. Facebook sold the data you created to someone else and got compensated for providing their platform. They have absolutely no ownership of your data.

"Does the maker of your hammer own part of your deck project? Does Ford own part of your drive in the country? Does Apple own part of your phone calls? "

Smith and Wesson seems to participate in the use of their products. Or are they special?

You pay for a hammer, car, and phone using money. You pay for Facebook and Google by letting them use your data. If you don't like this, you'll need to find a different service and pay actual money for it.

There's no doubt the connectivity provided by facebook for family and social interaction has been transformative. For that reason its user base, for now, is unchanged despite all the recent scandals.
But to say that their practice of tracking and storing all the personal data coming across their servers is normal and to be expected is a bit of a stretch. Can you imagine if Ma Bell had had three roofing contractors show up at your door if you happened to mention over the phone to an acquaintance that you had storm damage? Or a researcher with a clip board in hand just showed up at your doorstep looking for the outcome of a conversation you shared with your mother four years earlier about concerns of potentially autistic behavior in your child. We used telephones to communicate but the service provider was not allowed to use and record the information- to make money off it.
So for facebook users to be taken aback that this new form of communication has by-passed traditional norms of respectful privacy shouldn't be surprising.

And we pay a fee for a telephone service. If we a want a social media and search service to exist, they have to make money some how. Either they make money by running ads based on the information we give them, or we'll have to start paying money for it.

Ok- how about an employer sets up microphones all over their cafeteria on a remote corporate campus. When employees chat about marital concerns they get sent counseling suggestions, or after expressing excitement of the prospect of a new car they get calls from local dealers. After all the employer provides the lunchroom for free and has participated in creating the environment where the conversations occur- why don't (haven't) they taken advantage of such a wonderful revenue source?
Or let's say at the public park, gardeners record conversations of mom's watching their kids and then sell the information too formula manufacturers, daycare providers and lactation specialists. It seems like a no brainer to fund public infrastructure where the objective is to bring community members together so they can interact and get to know one another!

Facebook and Google know a lot more about you than what you post on their services. They have ad networks extending beyond your voluntary interactions with them, and it's data they can, and will, keep. Remember how the phone company knows everyone you ever called? Google knows a very high percentage of the pages you ever visited, separated by device. Facebook can have quite the profile on you even when you have never signed up for their services at all.

In the movement to the 2016 election, some companies with access to way too much data had great models for the possible election results, all without asking for a single poll response. I saw models in advance that had every state right but PA... Better than any pollster, and better, I am told, than the best the campaign has. It just happens that selling those predictions was seen as a PR nightmare.

The curve of how much utility can one get out of data that was not willingly provided by individuals, as a factor of the data size, is something few people get, and it's depressing

Facebook is more like that creepy neighbor who takes things out of your trash and builds wierd little altars out of it in his house.

Excellent post Alex. The theater over the last year, and the last few weeks in particular have been hard to swallow.

I agree. A really good article, perhaps one of the best on this blog ever.

Facebook "stole no one's data": fine and dandy.

Facebook PROTECTED NO ONE'S DATA, in spite of its professed agreement with the particulars of the 2011 FTC data protection consent decree.

Facebook FAILED and continues to fail.

Very much agree with the sentiment expressed in this post. From my point of view, Facebook is a terrific bargain. Ditto Gmail and the other google apps I use occasionally; mainly Sheets when I want to share an Excel spreadsheet publicly.

I do think it behooves Facebook to put some effort into policing content, and I think their filters should include "fake news". Also blocking bot accounts, to whatever extent that's possible. But it seems they're doing of those things. An argument could be made they should put more effort into it, but that's more a discussion of "degree".

Ok, everything you post on Facebook to your friends isn’t “our” data.

What about 3rd party tracking cookies, browsing history, GPS locations, contacts, photographs, VPN collection, and shadow profiles for non-Facebook users. Who owns that data?

The Facebook you describe is not the Facebook it has become.

In some ways, your complaint is with your browser provider. And with the websites that embed the tracking cookies, etc.

>But let’s get over the idea that it’s “our data.”

Meh. Semantic whining.

Similar to when someone uses the phrase "my wife" and is someone else retorts SHE IS NOT YOURS, SHE IS HER OWN HUMAN SELF, NOT YOUR PROPERTY and (worse) thinks they have made an insightful point.

Let's get over the idea that this is an insightful point, and focus on the only relevant point, which you got to at the end. Who gets the data and how can they use it.

The lawnmower analogy is incomplete -- it's as if your neighbor left his or her garage open, let you borrow a lawnmower, but then proceeded to hide in the bushes and follow you about, tracking your lawnmowing and gardening habits, and sell the information to the local garden store. All this being done under the guise of "bringing the community together".

Certainly not illegal, and yes a favor was done, but not very neighborly, and depending on the specificity of the recommendations, slightly creepy.

This is the type of post and position that makes it embarrassing to be a libertarian.

Just an addendum, randomly flipping through SMBC brought this up...

Yes, caveat emptor, but there's gotta be a limit, no?

Submit to the algorithm.

A Zuckerberg-shaped you is a better you.

If mere Russian bots can change your voting decisions, think of how much the world will be improved and what a better person you will be by giving munificient software titans all the personal information they would like. It is a civic responsibility.

My 401k owns part of my retirement nest egg?

A couple points related to the persistent rumor that Facebook sells personal user data:

1. I've never heard of anyone who decided to test this idea by running ads themselves. Wouldn't it be a great story to show what personal data you can get your hands on by being a Facebook advertiser?

2. Has any real advertiser revealed that they obtained personal data from Facebook? Anyone?

3. Selling personal data would be stupid business model because all an advertiser would have to do is buy their identities and contact them directly. Facebook is a middle man and it works very well.

The advertisers can't contact directly, except by email spam.

They need to pay sites, like Facebook, to run the ads. FB selling user data to its advertisers make their own product more valuable.

So FB sells information about its users but not identities, rather like how the NY Times can say "If you advertise with us, you'll reach __ people with __ demographics"?

What is the exact concern about this data in the first place? I mean, are we saying that the government / corporations can actually impact your life by using the data we share online??? How exactly?

This discussion sounds more like some theoretical argument that anything else. I really don't mind who owns my online trail. As long as there is no clear case that this data can be used against me, I am fine. And yes, I don't think seeing specific ads online really influences me in any important way.

Maybe one day you'll express disagreement with something that someone in the NSA (or someone with money who knows corrupt people in the NSA) holds dear.

Then all that data will be mined and re-mined to screw with your life and head in any imaginable way.

So in this apocalyptic scenario, the NSA has no better data source than Facebook??? Really???
Again, I think there's a lot of concern based in principle but very little in actual risks for users here. My facebook profile says nothing about my real private data (bank accounts, passwords, etc.) and a lot of that data is already known by the government anyway...

The following two things are not similar: a) the ability of single, multiple and/or numerous individuals to do bad things, and b) the sun exploding or a nuclear apocalypse.

Also, the existence of a second or third source of information does not make the first one irrelevant.

To use the old cliche, knowledge is power. The ability to manipulate information is power. Facebook and others spend a great deal of time trying to understand how they can shape information to get you to act in a certain way. It goes beyond the collection of data to the manipulation of data to achieve goals. The fear of potential for abuse by a gatekeeper is genuine.

I think over time that the US will follow EU data privacy regulations. Facebook will not die in Europe from them, nor would they die in the US from similar regulations.

As for the subject of "free", there are degrees of "free" goods which are given in exchange. Will there be less "free" offerings in the EU by Facebook in the face of EU privacy regulations. I doubt it. So, if Facebook offers the same "free" service in exchange for a more moderated or protected exchange of information, then perhaps the EU will have demonstrated that you can have a free product and privacy protections at the same time.

I am careful about what I put on my FaceBook page and I accept that my deal with FaceBook is that they have that data. I am concerned that they have made it possible for me to consent to third parties scraping my friends' data. I did not expect that. And I did not expect that consenting to a third party looking at my FaceBook page included consent for them to scrape my Messenger history - which I did expect would stay private.

Privacy is eroding so fast that we have no hope of preserving it. We either can or almost can read your thoughts directly from your brain. Cool right? No more need for torture! But privacy is done. We’re already filming just about everything in public space. Will we soon be recording everyone’s every thought?

My benefit-cost ratio is much lower. I have abstained from the Facebook, Instagram, MySpace, Snapchat, Twitter matrix. I don't use third party apps or answer questionnaires that require data. I use Ghostery and Duck Duck Go. I have always understood that my interactions are under surveillance and have adapted my use accordingly. I have essentially curbed my freedom of expression and speech.

My largest complaints are the manipulative and exploitive implications that accompany a greater online presence. Will my boss fire me over a post? Will a retailer overcharge me based on my traffic? Are the friends I have truly friends or vultures? The psychology of online communities have perverse incentives. I am rewarded for likes and friends. How does this alter my interactions in my real life? The philosophical implications are equally perverse. What is real and what is fake?

As a woman, I must safeguard myself from predators. Zuckerberg cannot. Congress cannot. So I must. I have done the analysis and I am unwilling to take the risk. Go forth, with purpose.

I go to a public garden to attend a meet up, and get a call from my friends. Seems they all create the data with me, and want to use it ? Then I'll have nowhere to go.

Comments for this post are closed