Facebook users monitored by thousands of companies

The scale of surveillance of internet users is massive, and a mind-boggling amount of data travels to Facebook’s ad platform daily, a new study claims.

Research conducted by Consumer Reports, an American nonprofit consumer organization, has found that users generally have their data collected and sent to Facebook’s ad platform by around 2,230 companies on average.

Obviously, no one today is surprised to see ads on Facebook for items they’ve previously searched for. Plus, we usually quickly click through these little boxes where we’re asked if our data can be shared with “partners.”

Well, it turns out that there are quite a lot of partners. Consumer Reports has collected data from Facebook users who volunteered to share their archives, analyzed it, and concluded that thousands of companies have sent each participant’s data to Facebook.

Importantly, participants in the study downloaded an archive of the three previous years of their data from their Facebook setting and provided it to Consumer Reports.

This way, researchers were able to examine a form of tracking that’s normally hidden – the so-called server-to-server tracking in which personal data goes from a company’s servers straight to Meta’s servers. Meta is the parent company of Facebook, Instagram, and WhatsApp.

The data in the study comes from two types of collection: events and custom audiences, Consumer Reports said. Both categories include information about what people do outside of Meta’s platforms.

Custom audiences allow advertisers to upload customer lists to Meta, often including identifiers like email addresses and mobile advertising IDs. These customers, and so-called look-alike audiences made up of similar people, can then be targeted with ads on Meta’s platforms.

The other category of data collection, “events,” describes interactions that the user had with a brand, which can occur outside of Meta’s apps and in the real world. Events can include going to a page on a company’s website, leveling up in a game, going to a physical store, or purchasing a product.

"Users don’t expect Meta to know what stores they walk into or what news article they’re reading or every site they visit online."

Caitriona Fitzgerald.

One company appeared in 96 percent of participants’ data: LiveRamp, a data broker based in San Francisco. However, the companies sharing users’ online activity to Facebook aren’t just little-known data brokers. Retailers like Home Depot, Macy’s, and Walmart were all in the top 100 most frequently seen companies in the study – as were Amazon, Etsy, and PayPal.

“This type of tracking, which occurs entirely outside of the user’s view, is just so far outside of what people expect when they use the internet,” said Caitriona Fitzgerald, deputy director of the Electronic Privacy Information Center.

“While users are likely aware that Meta knows what they are doing while they are on Facebook and Instagram, they don’t expect Meta to know what stores they walk into or what news article they’re reading or every site they visit online.”

Another form of tracking, in which Meta tracking pixels are placed on company websites, is visible to users’ browsers. Meta Pixel has been used to surveil people as they dial suicide hotlines, buy groceries, take their exams, or file their taxes.

Another study carried out by cybersecurity firm Surfshark recently showed that Facebook and Instagram were the least privacy-sensitive social media apps. Of the 32 data points collected about their users, Facebook and Instagram used seven for tracking, including name, physical address, and phone number.