Facebook now tracking and showing ads to people who don’t use Facebook

library
crime | hacking | security

Accusations that Facebook tracks non-users as they browse around the web have dogged it for years.

Well, now we can stop calling them accusations thanks to an announcement on 26 May 2016 from the Social Network itself:

Today, we’re expanding Audience Network so publishers and developers can show better ads to everyone – including those who don’t use or aren’t connected to Facebook.

Audience Network is Facebook’s ad network for mobile apps. It uses the same data and targeting that powers ads inside Facebook to deliver ads “beyond Facebook and into mobile apps.”

When it was launched two years ago Audience Network would only show ads to people who had a Facebook account. Despite that it has grown to be the second biggest mobile ad network after Google’s.

That limitation has now been lifted and all of us, including people like me who’ve never had a Facebook account, will be fair game for ads that use Facebook’s targeted advertising algorithms.

It’s pretty obvious that users within the walled garden of Facebook’s, er, news-wall-stream-thing (or whatever it’s called now) have their every move hoovered up and analysed but how, you might ask, will it know what to show to un-hoovered non-users?

Ever since it launched it’s Like button in early 2009 Facebook has been installing windows on the web.

Every time you see a Like button on a website your browser is talking to Facebook; telling it what page you’re looking at and what kind of browser you’re using and, thanks to the magic of cookies, extending an invisible thread that links this page to the other pages with embedded Like buttons you’ve seen.

And that all happens even if you don’t click on it.

To put things in perspective, all of us share all of the same information with all the web pages we visit, and all of the third party sharing or analytics widgets that are embedded in that page.

That we send all of this information to Facebook is a quirk of the way the web works and that Facebook records it for users of its services is neither in dispute nor unusual (Twitter does it too for example.)

What has been matter of dispute and innuendo until now is whether or not Facebook records and acts upon the information it receives from non-users.

Last year it denied claims made in a report commissioned by the Belgian Privacy Commission that it was tracking non-users, claiming that the report was “based on assumptions.”

Following that report a Belgian court gave Facebook 48 hours to stop tracking non-users and as a consequence Belgians without a Facebook account are now unable to view any Belgian Facebook pages, even public profiles.

In February the French data protection agency CNIL gave Facebook three months to stop tracking non-users in France.

But even those actions didn’t clear things up entirely because, to my reading at least, both the accusations and the response from Facebook seem to deal with nothing more than we already knew; that Facebook sets cookies.

Doubters will say there’s nothing new in this announcement, that Facebook has been tracking all of us all along. Perhaps they’re right – perhaps this announcement is simply a big organisation that’s already tracking us all just bringing itself into line with EU regulations.

If they are right though they’ve never managed to prove it.

Now, at last, everything is out in the open.

In tracking non-users like this Facebook isn’t doing anything unusual, there are other ad networks that work in the same way and there are social media companies that use their third party widgets for similar purposes (and worse.) If you’re open to web and mobile advertising this might even be good news for you because you should see better ads.

What makes this announcement significant for the rest of us is Facebook’s size and reputation. Facebook isn’t just another ad network in exactly the same way that Microsoft isn’t just another software company.

Facebook is in our lives and (literally) in our faces. If you’ve decided not to be a Facebook or Instagram user you already have to contend with the fact that your friends and family are likely throwing mentions, photographs and tags of you into the great data hoover.

If you want to keep your browsing habits out of it too and you’re in North America or Europe you could follow Facebook’s vague advice and opt out via the marketing industry’s most relevant self-regulatory body:

Signing up should stop all of the participating networks from tracking you, not just Facebook, but you do have to trust the fox to guard the hen house.

If you want to put yourself in the driving seat then start using your browser in private browsing or incognito mode, uninstall Flash, use add-ons that help you control which cookies you accept or scripts you run, and install an ad-blocker.

At Naked Security we’re not generally in the habit of endorsing third party software but we hear a lot of good things about NoScript, Privacy Badger and the Tor Browser.