There’s no escape from Facebook, even if you don’t use it

Megan Borovicka joined Facebook in 2013 and then forgot she even had an account. But Facebook never forgot about her.

The 42-year-old Oakland, Calif., lawyer never picked any “friends,” posted any status updates, liked any photos or even opened the Facebook app on her phone. Yet over the last decade, Facebook has used an invisible data vacuum to suction up very specific details about her life - from her brand of underwear to where she received her paycheck.

“It’s a strange feeling,” Borovicka told me, after I showed her what Facebook knew about her. She paused looking at a string of shopping data from one Christmas when she was stuck with a sick kid while her husband went to Macy’s. “Why do they need to know that?” she said. “I thought if I’m not using Facebook, I wouldn’t be in its orbit.”

Facebook has become too big to escape. We’re rightly becoming more skeptical of Big Tech monopolies, and that should include the sheer volume of data they collect.

Earlier this month, the Federal Trade Commission filed an updated antitrust lawsuit against Facebook, arguing the company needs to be broken up. Some 69 percent of American adults now have Facebook accounts, according to Pew Research. The next most popular social network, Instagram, is also owned by Facebook. So are messaging services WhatsApp and Messenger.

[How to block Facebook from snooping on you]

How does Facebook’s bigness hurt you and me? As Borovicka and I learned, Facebook takes a toll on your privacy - but perhaps not in the way you expect. It isn’t just the Facebook app that’s gobbling up your information. Facebook is so big, it has convinced millions of other businesses, apps and websites to also snoop on its behalf. Even when you’re not actively using Facebook. Even when you’re not online. Even, perhaps, if you’ve never had a Facebook account.

Here’s how it works: Facebook provides its business partners tracking software they embed in apps, websites and loyalty programs. Any business or group that needs to do digital advertising has little choice but to feed your activities into Facebook’s vacuum: your grocer, politicians and, yes, even the paywall page for this newspaper’s website. Behind the scenes, Facebook takes in this data and tries to match it up to your account. It sits under your name in a part of your profile your friends can’t see, but Facebook uses to shape your experience online.

Among the 100 most popular smartphone apps, you can find Facebook software in 61 of them, app research firm Sensor Tower told me. Facebook also has trackers in about 25 percent of websites, according to privacy software maker Ghostery.

I tried my own version of Borovicka’s experience by cutting Facebook and Instagram out of my life for two weeks and then tallying who sent it my data. But unlike her, I left its apps on my phone - untouched for a while, but present. (Below I’ll show you how I unearthed what Facebook knows, and how you can see it for yourself.)

While I was gone, Facebook got a notice when I opened Hulu to watch TV. Facebook knew when I went shopping for paint, a rocking chair and fancy beans. Facebook learned I read the websites What To Expect, Lullaby Trust and Happiest Baby. There’s no surprising Facebook when you’re expecting a baby.

Over two weeks, Facebook tracked me on at least 95 different apps, websites and businesses, and those are just the ones I know about. It was as if Facebook had hired a private eye to prepare a dossier about my life.

Why does Facebook think that’s okay? The company emailed me answers about how its tracking technology works, but declined my requests to interview its chief privacy officer or other executives about its alleged monopoly.

In an emailed statement, Facebook spokesman Emiliano Vazquez said: “Our use of data from other apps and websites to inform advertising was commonplace in the industry when we introduced it. We’ve also provided more transparency and control to help people manage their data over the years - including a tool that lets people manage and view a summary of information Facebook receives about their activity on other apps and websites. We’re committed to further strengthening our privacy program, but privacy concerns are not antitrust concerns.”

Yet our inability to escape Facebook’s personal data vacuum suggests its bigness is part of the problem. Yes, technology giant Google also engages in an appalling amount of tracking - I’ve called its Chrome web browser spy software. But who in their right mind thought they were signing up for this much surveillance back when they first joined Facebook?

Facebook may be free, but you pay for it with your privacy. And Facebook keeps raising the price.

The making of a monopoly

How did Facebook get too big to escape?

Facebook has had so many different privacy screw-ups, you can be forgiven for not remembering which ones were happening a decade ago. Starting around 2010, researchers noticed Facebook was placing software on websites that weren’t Facebook.com. Back then, sites were including widgets that let you “like” or share content to Facebook without ever leaving. Privacy advocates were worried Facebook was using data it collected to track everything we do online.

In response, Facebook said in very clear terms that it wasn’t using the Web data to track people. It said it only used the data for advertising purposes when you actively clicked on a widget to share some content with friends. That was enough of a promise to keep many, including me, from jumping ship to some other up-and-coming social network, like Google+ or Orkut.

But in 2014, Facebook reversed course. It announced it would begin allowing its advertisers to target us based on the websites we visit. Facebook was giving itself permission to track everything we do beyond its happy blue walls. (“Facebook is following you” I warned in a technology column I wrote at the time.)

Our shift to using mobile phone apps increased Facebook’s reach. Its form of tracking also broke new ground: While many companies were using browser cookies, which could be easily cleared or blocked, Facebook tied what it learned to real identities - the names on our Facebook profiles.

Today, Facebook says it uses the data it gets from other companies to target its members with ads and make recommendations for things like groups and events. It forbids businesses from passing along what it considers “sensitive” information about our lives. But that hardly stops its giant data vacuum.

Legal scholar Dina Srinivasan, whose ideas about privacy shaped the government lawsuit against Facebook, tells me the 2014 switcheroo was the moment it became clear the social network had monopoly power over consumers.

“It’s a farce that consumers are happy with surveillance in return for a free product,” says Srinivasan, a former advertising executive. Everyone has different expectations about privacy, but in democracies people tend to agree broad surveillance is bad.

So then how does Facebook get away with doing it? Because we don’t have a choice. As the FTC wrote in its lawsuit: “Without meaningful competition, Facebook has been able to provide lower levels of service quality on privacy and data protection than it would have to provide in a competitive market.”

By the time Facebook switched on external tracking in 2014, Facebook owned onetime rival Instagram, and arch-nemesis Google had killed off its alternative social network Orkut. Facebook knew it could raise its price - making a grab for a lot more data.

Lawmakers have typically been concerned about the ways monopolies harm consumers, such as unilaterally raising prices. But just because Facebook is free to us doesn’t mean it can’t act like a monopoly. Srinivasan says we should think of Facebook’s cost as our data, and scrutinize the power it has to set its own price.

One way to measure it: In 2013, the average American’s data was worth about $19 per year in advertising sales to Facebook, according to its financial statements. In 2020, your data was worth $164 per year.

And what about Facebook’s assertion this isn’t a monopoly problem? “Monopoly has always been concerned with price and quality. Facebook knows that,” says Srinivasan.

How high is your privacy price?

If you’ve got an active Facebook account, you can see some of what it knows in a special section Facebook added to its website and app in 2020 called “off-Facebook activity.” (You can click here to access yours if you’re logged in.) It introduced this after that awkward visit CEO Mark Zuckerberg paid to Congress where he told lawmakers you’re “in control” of your data 45 times and, rightly so, nobody believed him.

Your off-Facebook activity screen will only cover the last two years worth of surveillance. But it showed Borovicka and me that Facebook is an equal-opportunity spy - it collects data on hibernating users and Instagram addicts alike. It also doesn’t matter if, like Borovicka, you had joined Facebook at a time when it had a different privacy policy.

This invisible surveillance system doesn’t require you to click “like” or use a “login with Facebook” button. You don’t necessarily have to be logged in to the Facebook app or website on your phone - companies can report other identifying information to Facebook like your email to help it figure out who you are. (That said, the more devices where you’re using Facebook, the more opportunities you give the social network to match up your activity with your identity.)

For example, during my experiment, Facebook got multiple notices from the meal delivery app DoorDash, indicating I opened the app at 11:09, 11:11 and 11:15 on different mornings. I guess I’m a creature of habit - and that’s the exactly the point: Now Facebook knows exactly the best time to advertise lunch to me.

If you’ve only got an Instagram account, Facebook also tracks you - but the photo-sharing app offers no mechanism to download this data.

Borovicka even tried using the force of law to access the data about her 13-year-old daughter, who only has an account with Instagram. The California Consumer Privacy Act, which went into effect in 2020, gives any resident the right to access and delete their personal data. Borovicka sent Instagram a legal request on behalf of her daughter. The company never sent her the data.

And what if you’ve never had a Facebook account at all? It may still be watching.

Borovicka tried to use that same California privacy law, known as CCPA, to view the data about her 11-year-old son, who has never had an account on Facebook or on Instagram.

Facebook replied it wouldn’t comply with the access request because her son doesn’t have an account it could use to verify his identity. But if he had an account, he’d be giving Facebook the right to collect his data. “It feels like you’re trapped in some kind of logic circle,” said Borovicka.

In its emailed reply, Facebook acknowledged it could still be collecting the boy’s personal information. It said: “When a person visits a site or app that uses one or more of these Facebook services, these sites and apps may send us information regardless of whether the person has a Facebook profile.”

Facebook told me it does not use this nonmember data to “create profiles” of people or target ads at them. But it doesn’t claim to delete the data - or preclude other uses for it.

“What are the harms I’m not realizing?” Borovicka asked me. Facebook makes it sound so low stakes - like all this data is just about making ads for pants more interesting.

My answer: Ever get the feeling your phone is listening in on your conversations? This is what’s really going on.

Think about data as power. I, for one, don’t like giving businesses a leg up on my dreams and fears to hyper-target their sales pitches. Facebook can also use your life to nudge you into groups that shape your thinking on politics or even the coronavirus vaccine. It can use your life to train its artificial intelligence, analyze web and mobile app use, or whatever new purpose it might dream up in a decade.

At stake in all that personal information is the ability to manipulate our economy, our society and even our democracy.

Just try to hide

So what can you do to stop Facebook from following you? The whole problem with monopolies is that they leave consumers with few good choices.

The off-Facebook-activity disclosure does give you the option to “disconnect” some of this data from your account. That term, which only a lawyer’s mother could love, does not mean that Facebook deletes your data - it means Facebook just no longer uses it to target you with ads all over the Internet. (And, of course, this only works if you have an account.)

There’s little you can do to stop Facebook from collecting your information in the first place.

You can try to make changes to your computer and phone to block some of Facebook’s tracking altogether, (see this list of technical steps I take on my own devices) but that takes commitment and expertise because the tactics keep changing.

At the moment, the most effective pushback against the privacy price of Facebook is coming from technology giants Apple and Google, which have their own monopoly powers over smartphone operating systems and web browsers. Earlier this year, Apple began giving iPhone owners the ability to tell apps not to track them, cutting back on some of Facebook’s ability to get data from apps that don’t also know your email address or phone number. Google has promised a similar setting for Android phones, but both of these are a partial solution, at best.

In response to these sorts of moves, Facebook recently announced it is exploring what it calls “privacy-enhancing technologies” to target ads using less personally identifiable information. But so far, those remain experiments.

So what about Borovicka?

“My instinct is to get completely off Facebook,” she told me when I asked what she was going to do next. “But I feel torn because it’s one thing to make these choices for myself, but another for my teenagers.”

The truth remains, no other online services come close to matching Facebook and Instagram’s ability to connect you with people you know, or might want to know.

For the vast majority of Americans, quitting Facebook is no more likely to happen in 2021 than it was a decade ago. We’re just stuck with its ever-higher price.