What’s Not Included in Facebook’s “Download Your Data”

[JumpCrisscross]

"But 'Download Your Data' hardly tells you everything Facebook knows about you. Among the information not included:

- information Facebook collects about your browsing history;

- information Facebook collects about the apps you visit and your activity within those apps;

- the advertisers who uploaded your contact information to Facebook more than two months earlier;

- ads that you interacted with more than two months prior.

Download Your Data is particularly spotty when it comes to the information Facebook taps to display ads."

---

TL; DR When you get too close to their business model, Facebook clams up.

[textmode]

- the data that Facebook collected about you from various other sources, e.g., data brokers

Mr. Zuckerberg and other Facebook staff assert: "We do not sell data."

Does Facebook acquire/purchase data about people from other sources, e.g., data brokers, and then combine it with (a) the highly personal data people voluntarily submit to Facebook and (b) the highly personal behavioural data people consent to allow Facebook to collect from their use of the Facebook website, Facebook app, and websites hosting Facebook anchors.

Is Facebook allowing users to download all the data Facebook has on them?

[richardfeynman]

PSA: Facebook looks at what websites you visit in an incognito window, provided that the incognito window is open the same time as a regular browser.

[mtremsal]

Thought experiment: if after 5/25, I download my data, then revoke consent and delete my account, then a while later reactivate my account and log back in -- if any of my previous personal data is tied to my "new" account, have I proven that my personal data wasn't entirely deleted since Facebook could still uniquely identify me?

[fredley]

Yes. I'm waiting to delete my account until after the 25th because:

* There's slightly more of a chance they'll actually delete my data

* If they don't, I'll be entitled to be a part of any class-action.

[GuB-42]

If you delete your account, only your data is erased, not your "ghost profile".

I don't know if it is the official term but your ghost is all the data Facebook has about you that doesn't come from you. For example, friends can talk about you and even tag you even if you never touched Facebook. It means that if you are the only one within your group of friends not using Facebook, they already know pretty much everything they need to know.

If you delete your account, unless all your friends do the same, your ghost won't disappear, and it can be easily reconnected if you create a new account.

[aukiman]

I'd say that assumption would be correct. Otherwise they have access to some serious non-facebook metadata repository! But then again how would they assume it was you without a trace of the former data.

[bogomipz]

>"Thought experiment: if after 5/25, I download my data, then revoke consent and delete my account, then a while later reactivate my account and log back in ..."

If you actually delete your account you won't be able to reactivate it. There is an option to deactivate it but then all of your personal data is preserved anyway.

[whyever]

I'm surprised this article does not mention Max Schrems, who requested all data Facebook had on him in 2011:

> He later made a request under the European "right to access" provision for the company's records on him and received a CD containing over 1,200 pages of data, which he published at europe-v-facebook.org with personal information redacted.

(See https://en.wikipedia.org/wiki/Max_Schrems.)

[vageli]

Just a heads up, your Wikipedia link doesn't work.

[randomsearch]

Not covered here: it does not really export your social graph. Just a list of names. No way to easily import that into contacts etc. This is making quitting Facebook time-consuming, but I'm getting there.

Similarly with birthdays, although it's quite easy to work around that via their calendar link.

[Lionsion]

> No way to easily import that into contacts etc. This is making quitting Facebook time-consuming, but I'm getting there.

Also, IIRC, all the photos are resized smaller and recompressed, while the full-res versions are still accessible through the Facebook website. This also makes it harder to quit if 1) you don't have the original photos and 2) don't want to live with the unnecessary sacrifice of quality.

Facebook really ought to include the best versions it has of the data you've uploaded, even if it makes the archive size enormous. The option to shrink things should be a non-default option only, since the download might be a prelude to an irreversible account deletion.

[lamename]

This 'Download Your Data' tool is highlighted every few years when ire toward facebook is renewed, but while appealing it's never seemed more than table scraps to me looking at the data.

Even without looking, the idea that a data broker would just willingly give us all the information it has is unbelievable. The scale is so large, how would you even know?

[cromulen]

They don't have a choice under GDPR.

[SubiculumCode]

One thing is clear. If they delete my data upon my request, they do not,for obvious reasons, delete it's contribution to any ML that was trained with it. Also, when deleting data, I wonder whether they delete any derived scores based on my data.

[alex_hitchins]

This is a very good point and one that I've been wondering but not seen much discussion of.

[amelius]

An important omission is the data that Facebook collected on you using browser fingerprinting.

Since a fingerprint is like a hash, it is theoretically impossible for Facebook to determine if the data really belongs to you, or to someone else who happened to have the same browser fingerprint.

This means that if Facebook is legally obliged to offer a complete user data download, then the practice of fingerprinting is illegal.

[Spivak]

I don't think fingerprinting in the interesting target here -- it's whether anything derived from somoene's data is part of their data and if so where the boundaries are.

* Can I use differential privacy? Can a user request a correction to such a dataset?

* If I train a ML model on some user data what responsibility do I have with acquisition or deletion?

* Can I anonymize my data-sets?

* How do I handle aggregate statistics?

[dvfjsdhgfv]

Do they really have to use browser fingerprinting? With everyone giving them everything they want hey have no reason to use more complex tehchniques.

[rock_hard]

That assumes that they collect such finger prints

[thisisit]

In case, anyone is wondering how to get to the "Your Categories" option on Facebook. Go to Settings -> Ads and the tab will appear.

I have always been paranoid about sharing information on social media. So, this section has only Facebook access information - 4G, Ipad etc. Couple of categories are even incorrect.

[macintux]

Despite never enabling location services, Facebook once (briefly) gave me a weather forecast when I was traveling. Spooked me quite a bit.

The best I could figure is that I temporarily enabled access to my camera roll so I could post a few photos (ordinarily I just copy/paste them to keep Facebook out of my photos), and either it scanned the photos' exif data during upload or directly from the roll once I enabled it.

I wasn't remotely surprised to find that particular piece of location data wasn't part of the data download.

[k_lander]

Makes me wonder how many "features" considered internally at FB, Google, etc are being scrapped only because it would not be worth the risk of potential backlash by spooked out users even though they have in their possession all the necessary data.

[Peyphour]

Could just be IP geolocation

[gregsadetsky]

in addition to that, wouldn't it have access to the MAC addresses of the wifi networks around you, and more importantly, be able to do a geo-ip check?

[NietTim]

Funny that the website is entirely unusable for me unless I turn off ghostery.

[spraak]

Well, not very surprising

[AnnoyingSwede]

The irony to see the "Would you like to login using facebook"-popup on the wired article..

[notimetorelax]

I’m thinking, GDPR is not live yet. They might expand the type of data they export in a month.

[Silhouette]

In theory, GDPR doesn't change very much in this area. Data subjects already had similar rights to access personal data about them under existing law in much of the EU. The potential fines for non-compliance may be much bigger, though. There is also some expansion in what constitutes personal data under the GDPR, which might be relevant if we're talking about areas where you could have tried to argue they didn't count before but they're going to be explicitly covered in the new scheme.

[mxuribe]

I'm not familiar with FB's APIs...do they allow for programmatic download of your data with the same set as via the manual download tool? Because if they do, then a neat little script - leveraging their API - could be used periodically to download one's data to at least address the issue with 2-month expiration on the ad data.

[bengale]

Not long now ... https://www.linkedin.com/pulse/nightmare-letter-subject-acce...

[not_that_noob]

There is a potentially disastrous blow to FB's business model in the GDPR that relates to this sort of profiling. It is forbidden under GDPR, unless the user grants explicit consent (opt-in). See [1].

Without this, FB's targeting abilities for ads just evaporates. It is going to be interesting to see how this pans out.

[1] https://ico.org.uk/for-organisations/guide-to-the-general-da...

[ikeboy]

In my experience it doesn't have your comments, posts, etc in groups.

[andrewshadura]

The zip file Facebook provides doesn't include full resolution photos I uploaded, only heavily compressed low-resolution low-quality previews. Useless.

[fortythirteen]

> Wikileaks, Julian Assange, and alt-right provocateurs recommend giving it a whirl.

Classic guilt-by-association propaganda technique.

[908087]

I really can't even figure out what posessed the writer to put that line in there. It has absolutely nothing to do with the story, and kind of comes out of nowhere.

[kdot]

How complete is this data? Does it include content like comments?

It'd be nice to download my data and import it into a competing social network.