Analysis

You can control what you share on Facebook — but not what Facebook collects

The deceivingly simple toggle between public and private sharing obscures the full extent of what data Facebook collects, writes Matthew Braga.

Mark Zuckerberg told Congress that users control their privacy, but how much control do they have?

Facebook CEO and co-founder Mark Zuckerberg faced two days of questions in U.S. Congress on a wide range of issues, including the social media site's data collection.

One thing Mark Zuckerberg wants you to know is that on Facebook, you're in control.

Having spent the last two days before U.S. Congress, the Facebook co-founder and CEO answered an onslaught of questions about the types of user data Facebook collects — and whether Facebook has been upfront with its users about the collection it does.

But for the most part, Zuckerberg attempted to keep the spotlight on users and the choices they have, rather than on what Facebook itself chooses to do.

When asked by Republican Senator Chuck Grassley why Facebook doesn't disclose all the ways user data might be collected and used by Facebook — and its responsibility to inform users of those possibilities — here's how Zuckerberg replied:

"I believe it's important to tell people exactly how the information that they share on Facebook is going to be used. That's why, every single time you go to share something on Facebook — whether it's a photo in Facebook, or a message in Messenger or WhatsApp — every single time, there's a control right there about who you're going to be sharing it with, whether it's your friends or public or a specific group. And you can change that and control that in-line."

For much of his marathon five-hour testimony on Tuesday, this is how Zuckerberg framed many of his responses to questions about privacy on Facebook — around the choices users have when they choose to share information about themselves.

But it seems like both a dodge and a clever misdirection. The broader issue isn't whether users have enough control over who can see their Facebook posts, but whether users have a reasonable understanding of what else Facebook collects about them in the process.

User control

The deceivingly simple toggle between what's public and private obfuscates the extent of what Facebook also gathers from its users when they use the company's apps or websites. It's information that, if plainly laid out, might make some people think twice about how much they're willing to let Facebook track their actions on the site.

Facebook recently sent a poll to select users asking whether they thought the website is 'good for the world.' (Marcio Jose Sanchez/Associated Press)

Facebook explains some of what it tracks — information it vaguely refers to as your "activity on Facebook apps and services." There's the obvious stuff: the pages you like, the information on your profile, the links you share and the physical locations you visit. And it lets users opt out of having Facebook track their browsing habits across the internet.

It's hard to believe, however, that this is a fulsome view of what Facebook can track on the platform itself. The subtext to many of the senators' questions was a nagging feeling of, "What else is going on?"

It's telling, for example, that until recently, Facebook's page for privacy settings primarily included options relating to how much of your information others could see.

Everything related to behavioural advertising and interest-based tracking was stored under a separate advertising settings page. This suggests that Facebook considers the information we choose to share on the site as separate from the records of our actions and habits — the metadata — that Facebook itself collects.

Tracking your habits

But therein lies the problem with framing privacy on Facebook as primarily an issue of what controls users have.

Zuckerberg has been held to greater account in recent weeks after a whistleblower at Cambridge Analytica revealed that the firm had improperly used data from more than 87 million Facebook users. (Stephen Lam/Reuters)

Put plainly, the audience controls that determine what's public, private or only seen by a specific subset of your friends or their friends — the controls that Zuckerberg repeatedly highlighted — don't apply to what advertisers, developers and even Facebook itself has access to.

Framing the narrative around what's private or public on Facebook obscures the transaction that is really taking place when you choose to click a link, upload a photo or like a page.

Zuckerberg presumably knows all this. But when asked, again and again, whether Facebook users had been given enough control over the information collected about them, Zuckerberg was quick to reassure. "If you want to have an experience where your ads aren't targeted using all the information that we have available, you can turn off third-party information," he explained.

Of course, that does little to limit what Facebook can track and measure about your habits on the platform itself — the extent of which remains opaque. Zuckerberg said repeatedly that Facebook users are in control. But over what — that's still up to Facebook to decide.

About the Author

Matthew Braga

Senior Technology Reporter

Matthew Braga is the senior technology reporter for CBC News, where he covers about how data is collected, used, and shared. If you have a tip, you can contact this reporter securely using Signal or WhatsApp at +1 416 316 4872, or via email at matthew.braga@cbc.ca. For particularly sensitive messages or documents, consider using Secure Drop, an anonymous, confidential system for sharing encrypted information with CBC News.