Facebook uses information that the user does not share for advertisements
US researchers show how Facebook uses ‘shadow contact information’ to target ads. This concerns data that users have not provided to Facebook themselves and telephone numbers for security.
Users cannot see their own shadow contact information because they have not given it to Facebook themselves. Facebook also refuses to provide this data if European users invoke the right to access their data. According to European privacy legislation, the General Data Protection Regulation, Facebook should disclose all data it has about a user. Facebook does not do that because it states that the data comes from another person’s address book and is therefore private data of that person. Facebook may be in violation of the GDPR.
With the research, the scientists show that Facebook links phone numbers to people, even if people have not given that number to the social network themselves. This happens, for example, if person A shares his contacts with Facebook, including a phone number of person B, who has a Facebook account, but has never shared his number. Facebook links the phone number to the account and if advertisers want to target advertising, they can use that number.
Targeted advertising with telephone numbers works if companies have their own list of telephone numbers. They don’t get to see the numbers from Facebook, but they can supply their list themselves and if there are matches, those people are presented with the ad.
According to the research, this “shadow contact information” is available to advertisers about a month after the contacts are shared. The researchers discovered this by mimicking such situations themselves and purchasing targeted advertisements from Facebook.
Facebook also appears to use telephone numbers that users provide for two-step authentication for targeted advertisements. The researchers created an account where only a phone number was provided for the security method. A targeted ad on that phone number was then shown to the account. A Facebook spokesperson confirms to Gizmodo that the social network is doing this. Users who don’t like that can use another method of two-factor authentication without a phone number, Facebook said.
Facebook does not go against the findings of the researchers, but hides behind its conditions and states that users can adjust their advertising preferences themselves via settings on the site.