There has been a lot of confusion in the last week over how Facebook gets its data. To clear some of that up, I created a Facebook Ads account and looked at the sorts of data Facebook uses to target users.

Matt Brockman

Apr 16, 2018·6 min read

Overview:

• Facebook obtains data on users from third party services including Oracle Data Cloud and Epsilon, and indirectly from Shopper’s Voice.
• Facebook Pixel appears to store user web activity for at least 180 days.
• Facebook acquires offline data from Facebook Business users in addition to the third party data services listed above, which they appear to store for at least 2 years.

Why Facebook Data Matters:

Last week, committees in both chambers of Congress held hearings with Facebook’s CEO Mark Zuckerberg. A whistle-blower who had worked for a data-analysis company, Cambridge Analytica, claimed that Cambridge Analytica had quietly acquired data on millions of Facebook users. Cambridge Analytica had acquired the data from an academic researcher who had created an app for a personality quiz; the app requested access to users’ data and to their friends’ data, ultimately acquiring and selling the data from 90 million Facebook users.

During the hearings, Zuckerberg attempted to explain what sort of data Facebook collects and how users control the use of their own data. Confusing issues during the hearings involved how Facebook gets data from third parties, tracks web histories, and acquires users’ offline activities. This sort of data was likely not acquired by third parties as it is only used internally for ad targeting; however, it’s still a privacy issue and users do not realize that Facebook is collecting this data. To clear up the confusion, I went through the process that advertisers go through to target audiences based on user data.

Setting Up Facebook Ads:

From my Facebook homepage, I selected the down-arrow menu (top right) and selected ‘Create Ads.’

Facebook requires a marketing objective before Facebook will let an advertiser see the audience choices; here I selected the “Traffic”objective under ‘Consideration’ arbitrarily. This allows me to select “Audience” under Ad Set (top left).

In the new screen that opens, I scrolled down to “Detailed Targeting” and selected “Browse.” This opens up a window containing “Demographics,” “Interests,” “Behaviors” and “More Categories.”

Findings

I started clicking through the different sub-menus. Looking at the details that Facebook provides for each attribute, it appears that Facebook gets data from several sources included user provided content and data brokers.

Some demographic information is acquired through user content. For example, Facebook determines if someone is a ‘College grad’ based on the user provided information.

Other demographic information combines third-party sources with the user content. For instance, users fitting the ‘Soccer moms’ demographic are determined based on data from Oracle Data Cloud. This includes information on “how where consumers shop, how they shop, what products and brands they purchase, their demographic and psychographic attributes.”

Facebook also gets financial information. For instance, they use Epsilon data based on Shoppers Voice survey data to determine if users belong to a credit union.

I didn’t know much about Shopper’s Voice, so I went to the website and checked it out. On their privacy page, they state:
“Shopper’s Voice is dedicated to ensuring that your information is managed responsibly with respect for your personal privacy.”

They seem to be sharing quite a bit of information with Facebook though. Later down, Shopper’s Voice clarifies:
“We may transfer your personal information to our third party service providers to assist us with: providing you with our or our partner companies product offers; deploying email, postal, and online campaigns; data processing, data warehousing, data verification and supplementation; market research, fulfillment, and technical support. By providing your information, you agree to this transfer, storing and processing.”

Looking back at some of the other demographic options, Facebook also can determine user charitable donations based on other Epsilon data, although here they don’t provide the specific source.

Using Facebook Pixel to Track User Web Activity

Back in the Facebook Ads window, I clicked the menu next to “Ads Manager”, then clicked on “Audiences” under “Assets”. Facebook Pixel is a dot that appears on a website. Whenever that dot loads along with the rest of the images on the website, it sends the data about the person viewing the website back to Facebook.

Clicking on “Create a Custom Audience” gives the options to target people off of a “Customer File”, “Website Traffic”, “App Activity”, “Offline Activity”, and “Engagement”. I selected “Website Traffic”, which lets me set up my Facebook Pixel.

You can select how long after they’re logged by your Pixel you want the user to be targeted. However, scrolling over the information ‘i’ gives the following information: You can target users up to 180 days after they load the pixel, meaning Facebook keeps this data on file at least 180 days.

So what about that option for “Offline Activity” that was available? Well, you need a Facebook Business account for that. So I created one.

Businesses Also Upload Offline User Activity

After creating the Facebook Business, I clicked on the “Business Settings” menu and selected “Offline Events”

This page shows an overview of how businesses can upload their customer data from the brick-and-mortar store to facebook. So I clicked ‘Get Started’

I selected “view examples” on the resulting screen, showing what sort of data stores can upload to Facebook. Here, we see that it uploads some identifying information on the customer, as well what the customer bought and how much it cost.

Mousing over “Event Time” shows that Facebook appears to allow the storage of offline purchases for up to 2 years.

This Data is not Available to Users

None of the information from the third party sites, Facebook Pixel, or Offline Event data appears to be available to users through the “Download Your Information” tool. This is problematic because the data appears to be available in Facebook Ads for at least 180 days for Facebook Pixel and 2 years for Offline Events.

Facebook is not unique in the world of online tracking. After all, the data brokers that Facebook acquires user information from are collecting individual data through more traditional means such as surveys and credit card receipts. Other online companies such as Google, Amazon, and many media companies also track users for advertising purposes as well. The ecosystem for user information is vast, and it is understandable why Congress was confused last week about what Facebook does. That being said, setting up a Facebook Ads account was quick and simple; if the members of Congress had done their research they might have been able to ask better questions.