HN Explorer

Ask HN: Does Facebook not delete your personal data along with the account?

38 points by zwaps ↗ HN
See https://www.commerce.senate.gov/public/_cache/files/9d8e069d-2670-4530-bcdc-d3a63a8831c4/7C8DE61421D13E86FC6855CC2EA7AEA7.senate-commerce-committee-combined-qfrs-06.11.2018.pdf

Note the answer to the question 11:

"Mr. Zuckerberg, how does Facebook determine whether and for how long to store user data or delete user data?"

Answer: "In general, when a user deletes their account, we delete things they have posted, such as their photos and status updates, and they won’t be able to recover that information later (Information that others have shared about them isn’t part of their account and won’t be deleted.) "

What an interesting way to phrase this. Why "what they posted", instead of "personal data"? This seems like a lawyerized answer telling us that facebook will delete what you posted, but they will not delete your profile, your tracking information (including all mouse cursor movements and ad engagements), your contacts and network, your e-mail?

Also, the answer to question 3 on page 21 confirms that you can opt out of ad-usage of your data, but you can not opt-out of collection of any data...

Finally, question 5 in the same section all but confirms that "Download your data" doesn't actually download all ad-relevant data.

19 comments

[ 2.8 ms ] story [ 49.9 ms ] thread
wmf
If you never sign up for Facebook they create a shadow profile about you. It sort of makes sense that if you delete your account it reverts back to the shadow profile.
zwaps
I am not so sure about that.

Almost any answer in that report is vague or circling the issue. Facebook does state, however, that they do NOT create profiles for non-users, nor track their history.

The vagueness implies that they do not want to lie to the senat. Yet, they state rather clearly that there are no shadow profiles.

Therefore, it seems there actually may be none.

itchyjunk
What is a `profile` though? If they create an entry on a different database not linked to face book profiles, does that count?

My thought is this: as big as facebook is, they are probably curious about the people who don't have facebook accounts. "we know this person exists because of the activity we see on the internet but we can't link them to any facebook profile." Maybe this is too out there but if i was a company trying to get every user on the internet to have a face book account, the ones without would be as interesting as the ones with.

AstralStorm
That is exactly a profile, constructed by collating metadata and protected by GDPR. Crosslinking and collating personal data such as your name is processing it.
netsharc
The embedded like buttons can be used to track a user across the web, similar to ad agencies' tracking pixels. FB is an advertising company, it would've been very stupid of them if they didn't notice they could do this. And we know they don't carw about ethics...

Someone asked Zuck directly about tracking non-users, he said he'll have his team answer the question, and continued with a bullshit "I know about cookies.".. yeah thanks Mr. Boy Wizard, you know about cookies..

[deleted]
(comment deleted)
featdd
Not a big surprise... I had a Facebook profile years ago and had to create a fake profile some years later. Needed to add my phone number for access tokens etc. and somehow the moment I saved my number all my old friends and family members showing up as friend suggestions

I think that even careful people on the internet would be disgusted when they could having an unfiltered look in the "real" data Facebook tracked about them

zwaps
Many have similar experiences, but let me quote facebook directly

"When the person visiting a webs ite featuring Facebook’s tools i s not a registered Facebook user, Facebook does not have information identifying t hat individual, and it does not create profiles for this individual. "

So, I wonder: Is facebook triangulating you based on contact information from other users, or are they deceiving the senators in this response?

netsharc
Is "profile" defined at the beginning of this document? Sounds like a lawyer worked on the document and said "A profile is defined as bla bla bla" (e.g. a description of the person accessible by other public users). And someone's ad profile is... something else.

FB probably would just have a classification of this person, e.g. where they stand on the left-right spectrum, how much they like particular things (e.g. cars, fashion, travel), their income level..

[deleted]
(comment deleted)
newscracker
> Needed to add my phone number for access tokens etc. and somehow the moment I saved my number all my old friends and family members showing up as friend suggestions

This could also be because one or more of your contacts (likely more) provided permission for the FB app to access their contacts/address book (and never revoked that permission, allowing Facebook to always have a current social graph) or were using pre-6.0 (Marshmallow) Android that didn't even have granular permissions requested at runtime (so apps could be installed only if the user accepted to provide all permissions that apps wanted, which for Facebook included contacts, photos, SMS and more).

TACIXAT
Your friends and family members shared their contacts. So they had friend -> your number. Then when you enter your number it can back step that to your friend. With just a few connections like that they can suggest all those friends' mutual friends.
[dead] lerie82
this has been mentioned here many times before
[deleted]
(comment deleted)
pmontra
It might also be a technical problem, because there are a zillion foreign keys pointing to that user record in the database. It's a problem common to every application, worse at Facebook scale. All technical problems have solutions, one is to replace customer data with fake ones. Still, some patterns could give away personal information. Example: a spike in the number of posts on a timeline gives away the birthday date. And when I delete my account, should everybody's else posts on my timeline be deleted as well (maybe evidence about why I deleted my account and I'm suing some of my FB's friends for harassment), or my shares on other timelines, with their comments. Should they deleted the events I created, which other people joined and commented to?
AstralStorm
Why would you even be able to retrieve the number of posts of a deleted account, much less other metadata? It seems like that is the most trivial to hide. The posts of a deleted account should be replaced with some sort of deleted marker and impossible to index from old profile or account. Technically trivial to implement even at Google or Facebook scale of replicated world since they do have a unique account ID. The contents would only survive if directly quoted. In case backups are restored, it would be scrubbed again from a blacklist of removed anonymous ids, and that would expire after a reasonable time when the backups should be gone completely.

Hiding behind "too hard" is a dumb cop out. Regulatory agencies should not buy it ever.

chatmasta
I think GP was referring to counting the number of OTHER people (I.e. still active users) who wrote a post on the deleted person’s wall. Still, there is no way I know of to get posts an active account made on an inactive wall, and you would need to get those posts for a significant number of the inactive user’s friends.

Probably a bit of a convoluted example but I see the point GP is making.

smilesnd
They make money off you personal data why would they delete their money? Have you ever try to delete your account on something you use on the regular? I had to lie to amazon and tell them my email address was hacked for them to delete my amazon account but they still keep all that data. With vultr a vps provider I had to do the same thing to get my account deleted. This isn't just a facebook issue this is a massive issue where data is worth more then gold.