Yes, Senator, Facebook Does Have A Profile On You

Facebook’s chief executive, Mark Zuckerberg, finally goes before Congress today and tomorrow to discuss the Cambridge Analytica scandal and how the company protects user privacy, and he’s expected to face more questions from lawmakers still unsatisfied from their last public encounter with the company. At those hearings in October, which were focused on social media propaganda, there was one face-off that may have left lawmakers, and anyone familiar with the basics of the company’s business, especially puzzled.

“Gentlemen, I am very proud that the three companies you represent are American companies, and I think you do enormous good,” Republican Senator John Kennedy from Louisiana told officials from Google, Twitter, and Facebook during his turn for questions. “But your power sometimes scares me.”

That power–held especially by Facebook but also by giants like Google and Amazon–is to know a lot about people and how to influence them. That power can help advertisers target users who aren’t logged in to their accounts or who aren’t carrying their phones, and it can even help advertisers target non-users, people who don’t even have accounts on their platforms. In racing to build their ad businesses, meanwhile, these companies have allowed an unknown army of entities to pay to use all that user data, or in some cases, scrape it en masse.

During his allotted five minutes, Kennedy took aim at Facebook. As he put it to the company’s vice president and general counsel, Colin Stretch:

Sen. Kennedy: If I came to you…. And said, “look, I want to buy an ad that everyone sees on Facebook.” That’s going to be cost-prohibitive, can we agree on that?

Colin Stretch of Facebook: That’s likely the case.

Kennedy: So I’ve got to narrow it down. You can help me narrow it down. Because that’s your business model. You collect data, and lease it out to companies who use that data to sell people products, services, and candidates. Isn’t that basically your business model?

Strech: Senator, we do provide targeted advertising. We don’t actually share the data of individuals with advertisers.

Facebook doesn’t technically share users’ data with advertisers. But it does let advertisers use targeted advertising tools that rely on that data. Kennedy continued, with a simple but critical question, one that led to a baffling answer from Stretch.

Sen. Kennedy: Do you have a profile on me?

Strech: Senator, if you’re a Facebook user, we would permit you to be targeted with an advertisement based on your characteristics and your likes along with other people who share similar characteristics and likes…

Sen. Kennedy: Well, let’s do another one. Let’s suppose your CEO came to you, or not you, somebody who could do it in your company, maybe you could, and said, “I want to know everything we can know about Senator Graham. I want to know the movies he likes. I want to know the bars he goes to. I want to know who his friends are. I want to know what schools he went to.” You could do that, can’t you?

Stretch: So, I want to be—it is a very good question—the answer is absolutely not. We have limitations in place on our ability to view the person’s—

Sen. Kennedy: I’m not asking about your rules. I’m saying, you have the ability to do that, don’t you?

Stretch: Again, Senator, the answer is no. We’re not able—

Sen. Kennedy: You can’t put a name to a face to a piece of data? You’re telling me that?

Stretch: So we have designed our systems to prevent exactly that, to protect the privacy of our users.

Sen. Kennedy: I understand, but you can get around that to find that identity, can’t you?

Stretch: No senator, I cannot.

Sen. Kennedy: That’s your testimony under oath?

Stretch: Yes, it is.

[Watch a clip of the full hearing; Kennedy’s exchange with Stretch begins at 1 hour and 14 minutes; see a clip here.]

“Facebook evades questions from Senator Kennedy about its ability to produce personal profiles on users,” read the headline on a Fast Company story the following day. Siva Vaidhyanathan, a professor of Media Studies at the University of Virginia, who is writing a book about Facebook, responded to the story on Twitter. “Not just evaded,” he wrote. “FB misled.” Matt Stoller, a fellow at the Open Markets Institute, wrote on Twitter that Stretch’s “statements on targeting and surveillance smelled like perjury.”

David Carroll, a professor at the New School who is pursuing a lawsuit against Cambridge Analytica to better understand what data it has collected on him, was impressed by both Sen. Kennedy’s questioning and Stretch’s elusive response. “That was the most significant, most heated exchange I saw,” he said in a Twitter direct message. “The [Facebook] lawyer was exceptionally good at dodging it.”

In terms of producing a “profile” on a user, a particular engineer at Facebook—or an executive like Stretch himself—may be constrained by company policy and technological safeguards. A spokesperson for the company, which has announced new privacy features in recent weeks, did not respond to an emailed request for clarification about these internal safeguards by time of publication. But Kennedy’s general point is: If you use Facebook, the company has a “file” on you, built on your likes, habits, purchases and other data. According to a 2016 ProPublica report, Facebook collects over 29,000 different criteria for each individual user. Facebook can also track you even if you don’t have a Facebook account, relying on cookies, “like” buttons, and other plug-ins embedded on third-party sites; in many cases, it may be tracking your locations and your offline purchases. And it is using all that data to help its advertisers, whoever they may be, change your mind.

Facebook isn’t alone of course; thanks to a decades-long head start, many large American conglomerates have extensive data on consumers, and with the help of a thriving data brokerage industry, virtually any company can access mountains of individuals’ data too.

But Facebook has an unusually large and extensive set of information on users and many ways of reaching them with messages. To target users more precisely than what it knows about you, it allows brands to upload their own piles of data through a tool called Custom Audiences. The brand may already have you on their mailing list, but if they upload that list to Facebook or Instagram, they can follow you around those platforms and, thanks to the Facebook Audience Network, the rest of the web too. In fact, as Sen. Diane Feinstein noted, Russian trolls did just that, “retargeting” certain Americans on Facebook and elsewhere using data they had gathered from a network of fraudulent websites.

Under new restrictions it announced in recent weeks, Facebook will require brands to take responsibility for the Custom Audiences data they use and certify that it was gathered and used ethically–for instance, not to target users along racial and ethnic lines. But, as Cambridge Analytica showed, there are obvious questions about Facebook’s ability to certify the legal and ethical use of even its own piles of data.

This week, it is the chief executive and not a company lawyer who will take Congressional questions, befitting his promise to take responsibility for what happens on his 2-billion-user-strong social network. And this time, lawmakers like Kennedy are demanding more action, not just words—but they still want words, and truthful ones. “I’m hoping that Mr. Zuckerberg won’t just, I don’t know, pull things out of his orifices,” was how Kennedy put it to CNBC’s “Power Lunch” this week. “That he’ll talk frankly about what Facebook can and cannot do.”

Kennedy and other lawmakers want to understand if and how Facebook is policing its platform for other foreign trolls and Cambridge Analyticas. They want to understand how these platforms are addressing the complicated problem of “fake news,” and bringing more transparency to “dark” election ads.

But as his question last October highlighted, Kennedy has also called for something more basic: transparency around the data. Simply, who owns it, what it says, and can users ever really delete it? In its settings, Facebook allows users to see all the data they’ve shared and uploaded, but that is still just the tip of the iceberg of all the data the social network has on users. Meanwhile, “the service agreement with Facebook–it’s written in Swahili,” Kennedy complained during another appearance on CBS’s “Face the Nation” on Sunday. “Nobody understands it.”

As Mark Zuckerberg eventually realized after the 2016 elections, it’s not “pretty crazy” to think that that fundamental devil’s bargain of the internet–I get your service, you get my data–may have an impact how people vote, not least because many of Silicon Valley’s billions are premised on its very ability to influence people through their screens. The stakes may seem more tangible and proximate now than they were even a few years ago, when Edward Snowden revealed the NSA’s vast data dragnet. The tools that Russian trolls used to spread political and issues-based messages well before and well after last year’s vote–like the tools that Cambridge Analytica used to harvest millions of user profiles–are the same kind of tools that brands use all the time to influence purchasing decisions. in an industry that will spend $579 billion on digital ads this year. These are the tools that the U.S. defense department helped to build, and the tools that have helped make Google and Facebook into the kind of U.S. giants that even Sen. Kennedy can be proud of.

Facebook’s answers to the senator’s questions may have been frustrating, but they still exposed the problem: there isn’t enough clarity or transparency about the files of data that companies have on us, and what they do with them. Whatever answers or changes arise out of Facebook’s showing on Capitol Hill this week, being upfront about how data is used shouldn’t be so hard for companies like Facebook. It’s ironic, perhaps, given all that they know about us, that these companies have seemed to know precious little about the activities of the people who are using that data to influence people in unseen and unjust ways. Another irony, perhaps, is that while Facebook and many other companies have a file on you–a file that you helped write–you aren’t allowed to know all that it says or how it’s used.