How to Force Facebook into Handing Over their Secret Tracking Data

http://europe-v-facebook.org/EN/Get_your_Data_/get_your_data_.html

by stfu • 15 years ago

411 105 15 years ago

europe-v-facebook.org

phreeza• 15 years ago

I wonder if anyone has tried to do this with google?

click170• 15 years ago

Google already provides a pretty good interface for exporting your data..

http://www.dataliberation.org/

Or, from your Google+ page, click on your picture in the top right corner, then Account Settings, then on the new page click on Data Liberation on the left hand side.

Loic2• 15 years ago

You cannot get all your logins, session time, IP address, etc. This is what you have a right to get out of a EU based company. Yes, this means that as a business, it is pretty hard to comply with the law.

jannes• 15 years ago

They claim that they anonymize your data. For example Google Analytics data should be anonymized (i.e. they don't link the traffic to your Google account name or some cookie ID, but they do store your IP). If this is true, it means that they can't send anything like logs of your visited sites to you, because they can't link your identity to the correct IP addresses.

gburt• 15 years ago

There doesn't appear to be any non-facebook.com data in the example PDFs -- i.e., no "you commented on TechCrunch" or "you visited TechCrunch which has our widgets".

I would suspect this means Facebook just simply did not provide it?

kragen• 15 years ago

It's surprising that the PDF I looked at (the first one) doesn't contain any access-log data at all. Shouldn't it contain the time, date, and IP address of every time she's viewed a page on Facebook, at least as far back as they keep HTTP access logs? Or do they not log the user ID when they log HTTP accesses? Someone (in Europe, therefore not me) should ask the Irish Data Protection Commissioner to get an answer to these questions.

nl2• 15 years ago

I doubt they HTTP access logs are tied directly to the user id.

It might be possible to derive this information by linking on the IP address, but that isn't the same thing as a direct link at all.

dbbo2• 15 years ago

Is there a similar law in the United States? If so, I've never heard of it.

_delirium5• 15 years ago

No, there's no general right-to-data law. There are general right-to-government-data laws, so you can e.g. request your own FBI record. But private businesses don't normally have to disclose what data they collect on you. There are a few exceptions for specific areas; for example, the credit-ratings agencies have to provide you with a copy of your credit report, and in some cases an employer may be required to provide you with a copy of certain personnel records. But they apply to fairly limited situations.

skcin7• 15 years ago

So for those of us that live in the US, is it not possible for us to request to have the data that Facebook stores about us???

Related (well, maybe): You can easily download a copy of your Facebook data no matter where you are located, by logging in and clicking "Account Settings" > "Download a copy of your Facebook data". This will include all things like messages, pictures, etc., but I am positive that it isn't nearly as in depth as what is outlined in that article.

cdh• 15 years ago

Does anyone know if requests made by Americans are honored? I'm guessing we don't have the same privacy protections here in the US, but maybe I've assumed incorrectly?

techiferous• 15 years ago

So let's say I launch TrackMyEatingHabits.com. If a user that happens to live in the UK signs up, they can send me a request for all of their data and I have to comply, right?

So this means that when I design the software for TrackMyEatingHabits.com, I should also be mindful to have a process (and data model) that makes it easy to locate this user data quickly, right?

Also, I should have in place processes to verify the identify of the requester too, right?

Or alternatively, I can just limit my market to the U.S.

Loic2• 15 years ago

If you are a US company operating a US website, you are not bound to the EU law in that regard. But if you launch trackwhatever.[EU top level domain] to better target these markets, you may need a EU address to get the domain. In that case, you may need to comply with the EU law.

justincormack• 15 years ago

Its not mainly about TLDs, it is about whether you have an EU operating company, like Facebook does, or if you store any personal data in the EU.

gradschool• 15 years ago

Yes, please do that (limiting your market to the U.S.).

pestaa2• 15 years ago

Excuse me, there are a couple of entire continents getting tired of that! Or should I assume you talked out of the same frustration?

rmc4• 15 years ago

No, probably not. Usually you only have to abide by a countries laws if your server are based there, or you have a company incorporated there. If you have a US company with servers hosted in the US, acbd an EU citizen uses it, and claims you are breaking their laws, then there its nothing the courts in that country can do to make you abide them.

To put it another way, are you worried if your US company breaks Chinese censorship laws? That's illegal in China. Are you worried if your company denies that the Holocaust happened? That's illegal in Germany.

You only need to abide by laws in the country you are in. Unless you have a EU server you don't have to abide by EU laws.

zatara• 15 years ago

Does this apply to patents as well?

tonfa2• 15 years ago

Like most legal matter it's a bit more complex than that. As far as I know, you can be targeted by foreign laws with a .com domain, and servers physically in the US.

If you specifically target/advertize (e.g. with translated interfaces) your services to EU citizens, a judge might decide that EU laws apply to you.

lawnchair_larry• 15 years ago

Unless it is a US law. You better believe that those apply globally. They can and will shut you down and/or throw you in prison.

ma2rten2• 15 years ago

I work for a european social network. I helped make a self service page, where users can view their info. However, we only some basic the information that is easily accessible for us in our databases.

So far no one send request for all their access log data, but that would mean, that we would have to go though billions of entries.

Actually not a lot of people request their information anyway. It's sill better then the software patent situtation in the use.

sschueller• 15 years ago

Facebook's legal headquarters are in Ireland for tax reasons (12.5%) so they have to comply with EU law. (http://www.facebook.com/press/releases.php?p=59042)

gilted• 15 years ago

Thanks to the Google employee ring for voting this one up too, I found that the 5 breathless Facebook articles already on the front page weren't sufficiently satisfying my intellectual curiosity. Now you may proceed to transition into downvote mode.

I really hope one day pg changes it so that all votes on articles and comments are publicly available, so that we can run our own analysis' using it. It would be interesting to see how much of the content on HN has become dominated by these employee rings over time.

mattmanser• 15 years ago

Woah, less of the crazy conspiracy theories.

If you're so out of the loop that you didn't know about f8 and 'frictionless sharing' then read up about those things and viola, you'll realize why these stories are all popping up the rankings.

FB is creepy and keeps getting creepier.

Keep your tinfoil hat on though if you want.

spooneybarger• 15 years ago

Some of the other recent posts about facebook have similar comments from low karma accounts. I'm just writing it off as some facebook employee ring.

buro9• 15 years ago

I voted it up and have nothing to do with Google; not being employed there, never being employed there, and holding no shares.

I also have only a passing curiosity of a desire to work for Google, no more or less than Facebook, Apple, Microsoft or any other large tech company.

However, I find it disconcerting how ALL companies seem to be edging towards creating and storing a mass of data about individuals without disclosing the entire purpose, what is held, or how to access it.

With that in mind, this is a great article/link. The Data Protection laws in Europe are wonderful, and they're there for a good reason (remember that Europe has been host to things like the Stasi).

We value our privacy, and we value our right to know what data companies hold about us.

So please step down from your soap box and ask yourself: Is there a real problem that resonates here? Is there a reason X stories are all on the front page at once?

It's nothing to do with employees waging a PR war or anything as petty... it's because even amongst very technical people there is a lot of concern about the direction things are going in, and Facebook (and sometimes Apple recently, though Google might trump them soon with Google Wallet) seem to be at the very front line of it.

sek3• 15 years ago

Unbelievable: http://europe-v-facebook.org/EN/Data_Pool/data_pool.html

They delete sh*t, if you delete your posts they don't remove them from their databases.

This makes me really angry, there is a reason why i delete this stuff. I can't believe this, they have a responsibility.

Edit: WTF http://europe-v-facebook.org/EN/Data_Pool/data_pool.html#Mac...

This is maybe the most frightening: http://europe-v-facebook.org/EN/Data_Pool/data_pool.html#Mes...

nak3d2• 15 years ago

Best advice I ever heard (and it came from an ex-Facebook employee), "treat communication ("private" & "public") on all services, including Gmail, Facebook, and Tumblr, like a million people are listening."

X-Istence• 15 years ago

Or better yet start using OTR on these services and verify the "key" on each end before continuing to talk about private matters.

WettowelReactor• 15 years ago

That does not really cover it as all FUTURE people are listening as well. Time has a funny way of obliterating context.

parallel• 15 years ago

Similar advice that was given to me during a messy legal fight'; Assume that anything you put in an email might one day be read out to you in court.

robrenaud• 15 years ago

I think my life would be considerably worse if I had been treating all e-communication with my girlfriend as though it was public.

It has yet to hurt me.

jojopotato• 15 years ago

I'm pretty sure that in Gmail, delete actually means delete.

FuzzyDunlop4• 15 years ago

You may be surprised that many (at a guess, maybe most?) companies/websites actually consider a delete function to be changing a 'deleted' flag to 1 in a database. The data persists, but is no longer shown.

I would also make a very big assumption that the only companies who wouldn't do this are those run by developers or other people who have had experience implementing that sort of system.

There's nothing bosses love more than storing whatever data they can get their hands on, no matter how relevant it is, and how reluctant they are to actually delete it. Or secure it properly. Hell, it's just data, who gives a shit right?

mattm• 15 years ago

This is how I usually implement delete. Deleting a record can have many cascading effects and there is no possibility for undoing it if it was an error. I think this is a pretty standard way of doing it.

chc• 15 years ago

I think you're close, but missing something: The companies who wouldn't do this are run by developers or other people who don't interact much with the actual users. Irreversible actions are horrible UX, and any irreversible action in a commonly used area of the app will make a large number of people steaming mad on a daily basis — guaranteed.

People who will blithely click "Delete" — and then click "Yes" even though they don't mean it on the confirmation dialog that comes up — vastly outnumber people who care that an invisible copy of their content might be buried in some Facebook database somewhere. Next to the unintentional deleters, the second group looks like a rounding error. And that's not even counting people who get their accounts hijacked.

So I would say people who know users are more likely to go with the delete flag, since that leaves you an avenue to help the user who emails support with "I got really drunk last night at the wake and thought it might be funny to delete everything on my Facebook and now all my photos of my dead Nanna are gone."

zipdog• 15 years ago

This is almost certainly not true for a lot of medical data (in Canada and Australia at least, don't know about the US).

There was a rather interesting example in Queensland ~two years ago when govt. health sector payroll data (from an outgoing system) was deleted due to privacy concerns, and then the replacement system mis-functioned (never really worked) and the entire state's health payroll information was lost. $200 million and counting to fix the lost data.

jakejake• 15 years ago

unless I was dealing with a security based application where data needed to be wiped - I would never delete, but just flag as deleted. I don't see it as evil from a development perspective. Losing data is about the worst thing that can happen - all other errors can be fixed.

I have many times ran into a situation where having that deleted data either saved us from losing a customer or was used to show that our app was not mysteriously "deleting" their data.

gus_massa• 15 years ago

There are also some technical problems with deletion. For example: What to do if the post has subposts from other user? What happens is someone steals your account and erases all your posts?

And, when you click on the delete, should they erase the information:

* From the cache

* From the database (not only mark it for deletion)

* From the weekly/monthly/yearly backup

* From the old backup system that is not longer in use, and was connected to the old backend that is not longer in use.

And remember the man that gets his Flirk account erased by mistake. Luckily they got a secret mode to restore it. http://bindermichi.posterous.com/how-to-subdue-a-major-inter...

sek3• 15 years ago

Well i don't expect them to do it instantly, but just "never" deleting anything is what bugs me.

There is no necessity to change backups, just to remove it from the current database and when the last backup is outdated it is gone.

You can't come up with a realistic example that cannot be solved by 6 months old backups.

bgarbiak• 15 years ago

What to do if the post has subposts from other user?

My solution: mark the record with a 'deleted' flag, leave all the logical/structural data (user id, post id, etc.) untouched, overwrite/wipe out the post's content, on the webpage display "Post deleted" message. If you want to have an ability to 'unerase' things: mark as deleted, delay the purge.

Cache should be purged as well, though not necessarily in real-time. Backups issue is a complicated one - but is there any use of yearly backups in Facebook case?

nextparadigms• 15 years ago

"Note: According to facebook’s privacy policy, messages on facebook can not be deleted anymore. If you click on ‘delete’ the messages will only be invisible to you. US law enforcement agencies can access this information at there own liking, without judicial review."

That last one is scary indeed. People were arguing a while ago whether these companies should keep data only for 6 months, or for a year, or 18 months - but Facebook is simply keeping it forever. Even 10 years from now law enforcement could verify your Facebook data.

Facebook Timeline should give them a nice UI, too, in case you don't delete anything. But they would still want to dig deep. I wonder if Facebook built a special Timeline product for law enforcement to see everything about everyone. Remember when they admitted a while ago that they provide law enforcement a special software for the data? I wonder if the idea of Timeline for users comes from that.

Julian Assange was dead-on that Facebook is the biggest spying machine.

_delirium5• 15 years ago

It also seems to indicate a deliberate quasi-law-enforcement role being played by Facebook. If Facebook handed over data when presented with warrants, the "without judicial review" wouldn't be true. That can only be true if they're purposely partnering with law enforcement, to voluntarily offer them data that courts haven't requested.

Reduces any qualms I might have about calls for Facebook to be regulated as a public utility, if it's actively choosing to act as an arm of the government anyway. Public utilities are actually, despite being much more entangled with the state in some ways, more separated from the state when it comes to law-enforcement. For example, the phone company can't just choose to record all your calls and give them to the police without a warrant.

nak3d2• 15 years ago

Heads up: Google does this with Gmail, too. http://news.cnet.com/2100-1047_3-6050295.html - "Judge grants subpoena and orders that all e-mail messages, including deleted ones, be divulged."

jonknee• 15 years ago

You can be asked for anything, that doesn't mean you have it. As the article you linked states, Google's privacy policy notes deleted information may live on in backups. This is common sense, otherwise they would have to touch every backup on a delete, which besides being very risky (one bug away from disaster), would mean having to go through offline tape archives of everyone's mail. If that were the case it would be prohibitively expensive to allow anyone to delete.

The question is if they have the ability/requirement to go sifting through the old backups for requested data.

http://gmailblog.blogspot.com/2011/02/gmail-back-soon-for-ev...

ldd-2• 15 years ago

I have a dual citizenship . . . U.S./France. While I live in the U.S., I may try this with my French passport.

kiiski• 15 years ago

Facebook TOS says:

"If you are a resident of or have your principal place of business in the US or Canada, this Statement is an agreement between you and Facebook, Inc. Otherwise, this Statement is an agreement between you and Facebook Ireland Limited."

So if you're living in USA it seems like they don't need to comply with your requests.

ldd-2• 15 years ago

Thanks for the head's up on the TOS. Actually, there WAS a period of time when I was on FB when I was living in Germany. In fact, when I signed up for FB, I was living in Germany (not in the military), so still probably worth a shot.

alastairpat• 15 years ago

I'm dual Australian/UK and just tried it with my British passport (and Australian address).

Almost immediately I got an email saying that "Unfortunately, we won’t be able to respond to your email directly, as this form is only applicable in certain jurisdictions." Might try again when I'm back over Christmas.

Edit: On inspection of the Facebook T&C page, it says I'm contracted to Facebook Ireland, so I'm not sure what the email's about.

avar• 15 years ago

Facebook knows too much about us, let's all send them a scanned copy of our passport!

FuzzyDunlop4• 15 years ago

Whether they do it now or not, but a few years ago they actually demanded that info (or some other form of valid ID such as your driving license) if you wanted to start a page and add music to it.

I was in a band back then. Set up the page, tried to add my own band's music, and was told I had to provide valid ID first.

tripzilch2• 15 years ago

You're allowed to (and should) black out your photograph and your social security number, they don't need those for ID. Only your government, your employer and a list of government-sanctioned organisations can require social security numbers for ID purposes. the rules for photo ID are even more strict.

Additionally you should write in big letters over the scan "Request to access Facebook Data <date>", so that nobody else can use the scan of your ID-card for anything else.

The rest of the data, Facebook already knows (name, date of birth) or is useless (passport/ID document number).

Source: https://pim.bof.nl/gebruikers/geef-niet-meer-dan-nodig/ (Dutch)

abcd_f2• 15 years ago

> Additionally you should write in big letters over the scan "Request to access Facebook Data <date>", so that nobody else can use the scan of your ID-card for anything else.

This serves no purpose as it is trivial to 'shop these big letters out of the image.

0x12• 15 years ago

This is the sort of thing that causes governments to enact legislation. Either you self-regulate and do a good job of it or sooner or later you get a bunch of rules forced upon you that may be far more impractical and expensive to implement.

driverdan• 15 years ago

The missing data is what's interesting. The data they provided isn't surprising or shocking at all, it's exactly what I'd expect to get from this type of request.

toadstone3• 15 years ago

I don't understand this community. I thought you were wolves, but here you are taking the part of the sheep. Instead of being outraged, you should be trying to get your own piece of the data pie. Every single web startup is doing exactly that.

Helianthus• 15 years ago

I don't think you understand communities. People acting in a group will act similarly and be derided by you as 'sheep.' It it is the type of thing that motivates group action that determines whether you think group members are 'wolves.'

Wolves move in packs, too.

toadstone3• 15 years ago

It was a predator/prey metaphor, not a individual/group metaphor.

forensic3• 15 years ago

Most computer scientists want to help the world. Including those who believe in the free market.

bretthellman• 15 years ago

Wouldn't that be giving FB more data? You need to send either a driver license, national ID, passport.

lunchbox• 15 years ago

Facebook also tracks what profiles I view. Looks like that data isn't released here.

danielrhodes• 15 years ago

I don't find any of this surprising. All of the data Facebook has on me I have given to them. Just like anywhere else on the internet or not, if you don't want somebody to know about something then don't share or keep a record of it. Privacy is not absolute, it is contextual.

mituljain• 15 years ago

what bothers me - or has me in awe even (to some extent) is how early on in the process facebook started storing all this information! I've had status updates from years ago show up in my "this day in 2009" pop-up on the sidebar. And clearly from the content of these files on the above website - they have stuff on you that goes way -way back. It seems almost sinister - as if they knew all along that they would aggregate so much information - althought on the face of it - it was just another social networking site. Which I would assume like any other website or web-app would delete unneccesary stuff in order to save space / efficiency etc (atleast before they got huge and had their own server farms). At the same time - one cant help but wonder if having all this data (and probably a lot lot more that we dont see from an outsider's perspective) - is really what is responsible for facebook making the "right" moves every now and then with regards to really delivering features that its users will use and growing at unbelievable rates? Might be food for thought - after all - the more you know about your users - the better you can serve them!

barbazfoobuzz• 15 years ago

ha. this is smart by fb. if they follow the yahoo model, access to that data is sold to the agencies that want it. they don't get access for free. so fb has an interest in having a nice store of data on offer. it's a nice business unit on its own in addition to their ad selling pursuits.

ubuntufreak• 15 years ago

why they keep those data in their data base. If i deleted a content, i meant it to be deleted forever. and knowing the fact "Note: According to facebook’s privacy policy, messages on facebook can not be deleted anymore. If you click on ‘delete’ the messages will only be invisible to you. US law enforcement agencies can access this information at there own liking, without judicial review."

by @nextparadigms I'm thinking of quitting facebook

dafarian• 15 years ago

I wonder if there's a way to do this in the US. I will look into this.

How to Force Facebook into Handing Over their Secret Tracking Data

Related Stories