Why Facebook Still Seems to Spy on You

Facebook Inc. FB +0.53% has spent the better part of a year telling its users, Congress and the readers of this paper that we’re in charge of our personal data and the ads we see. The network has streamlined its privacy settings, shared more details about how data is used and highlighted how its ad controls work.

If we take advantage of all these privacy controls, it shouldn’t still feel as if Facebook is spying on us, right? We shouldn’t see so many ads that seem so closely tied to our activity on our phones, on the internet or in real life.

The reality? I took those steps months ago, from turning off location services to opting out of ads on Facebook and its sibling Instagram tied to off-site behavior. I told my iPhone to “limit ad tracking.” Yet I continue to see eerily relevant ads.

I tested my suspicion by downloading the What to Expect pregnancy app. I didn’t so much as share an email address, yet in less than 12 hours, I got a maternity-wear ad in my Instagram feed. I’m not pregnant, nor otherwise in a target market for maternity-wear. When I tried to retrace the pathway, discussing the issue with the app’s publisher, its data partners, the advertiser and Facebook itself-dozens of emails and phone calls-not one would draw a connection between the two events. Often, they suggested I ask one of the other parties.

Everyday Health Group, which owns What to Expect, said it has no business relationship with Hatch, the maternity brand whose ad I received. Facebook initially said there could be any number of reasons I might have seen the ad-but that downloading the app couldn’t be one of them.

What I’ve learned is that our ability to control ad tracking is limited and that much of what Facebook claims should come with lengthy footnotes. As my colleague Sam Schechner demonstrated, some app developers aren’t doing us any favors. They share personal data with Facebook-down to when a woman is ovulating-without adequately disclosing they’re doing so.

Facebook and others call this “industry standard practice.” But does anyone outside of the industry know that? And why does the standard have to mean someone telling Facebook every time I tap or click anything? I never opted in, and in some cases, data is shared before you can even click Accept on a privacy policy.

“We want people to understand how ads work and use our controls, which we’re simplifying and making clearer. We also believe the transparency and controls we offer lead in the ad industry,” said Joe Osborne, a Facebook spokesman.

There are too many moving parts and players in the data-sharing game for ordinary people to have much say in-or even an understanding of-how we’re targeted. Here’s what you might not know about Facebook’s targeting practices.

I. Turning off location services doesn’t stop Facebook from targeting your location.

The day after I stepped into a San Francisco clothing boutique called Reformation-and didn’t buy anything-Instagram showed me an ad for that store. I confirmed in iPhone settings that location sharing for Instagram was off.

A Facebook spokeswoman looked into why I saw the ad and said that location wasn’t a factor. (The retailer told me it doesn’t use location targeting at its stores.) I fell into a “look-alike” audience that the advertiser was trying to reach, meaning I share similarities with its existing customers. But the spokeswoman did confirm Facebook and Instagram still show location-based ads to users who have location services turned off. And it isn’t something you can opt out of. (Gizmodo and others have previously reported this.)

Turning off location services on your phone stops your device from sending Facebook your “precise” location, says a support tutorial. Facebook says it “may still understand your location using things like check-ins, events and information about your internet connection.”

Facebook says it doesn’t use Wi-Fi or Bluetooth to target people with location services turned off, but it will use their IP (aka internet protocol) addresses.

Anytime you’re connected to the internet, there’s an IP address associated with you, and it’s also loosely tied to some geographic location. Sometimes it’s wrong: If I’m on my San Francisco office network, Facebook might guess that I’m in New Jersey, where the domain is registered. But if Facebook picks up an IP address from your home network or local coffee shop, it could map you fairly accurately.

ARTÍCULO RELACIONADO

Google, Facebook y Twitter incumplen promesas para frenar noticias falsas: Comisión Europea

After discussing these issues with Aleksandra Korolova, an assistant professor of computer science at University of Southern California, who researches location tracking on Facebook, I confirmed with the company that data from other users can enhance its understanding of an IP address location.

If someone connected to the same coffee-shop network as me has location services turned on, for instance, Facebook could pinpoint us both. A spokeswoman said that when users have location services turned off, the company limits the location information it infers about them to the ZIP Code level. There’s nothing in its privacy policy saying it won’t use more specific IP-based location data in the future, however.

II. ‘Why I’m Seeing an Ad’ doesn’t explain why you’re seeing an ad.

Facebook has for years had a tool that’s supposed to tell you more about why you’re seeing an ad. Unfortunately, clicking “More information” often produces vague, unsatisfying results. An ad from CB2 said the furniture and home décor retailer wants to reach “people ages 25 to 54 who live or were recently in the United States.”

Some companies do run campaigns targeting a broad swath of people. But when you’re regularly seeing highly relevant ads, it’s clear that Facebook isn’t being specific enough about how the ad was actually targeted. And on Instagram, no such feature exists-you can hide ads but there’s no information about why you’re receiving them. Facebook says it is working on building ad-transparency features for Instagram. It’s also planning to share more details about why someone is seeing an ad on Facebook.

III. You might see ads based on activity outside of Facebook, even if you opt out of seeing ads based on activity outside of Facebook.

Facebook’s Pixel web tracker and SDK tool for apps allow independent developers to track visitors to their sites and apps and retarget them with ads on Facebook and Instagram, among other things.

Ten months ago, the company announced its Clear History tool to “enable you to see the websites and apps that send us information when you use them, delete this information from your account, and turn off our ability to store it associated with your account going forward.” A Facebook spokeswoman said, “The data a person clears will not be used to personalize their ads.” Facebook says the tool, which isn’t yet activated, will be tested in the coming months.

You can tell Facebook you don’t want to be shown ads influenced by your behavior off its platform. To enable it, go to ad settings. Where it says “Ads based on data from partners,” set the toggle to “not allowed.”

It doesn’t just stop ads based on Pixel or SDK data. If an advertiser is trying to reach users who bought something from one of its stores, for instance, and it tries to target them using its uploaded sales data, Facebook will prevent that ad from appearing in the feeds of anyone with the setting enabled. If an advertiser has its own list of customers who recently purchased something, however, it can still use that to target Facebook users who have opted out.

I asked Facebook why I was still seeing ads that seemed tied to my browsing history. A spokesman confirmed that the setting only covers data that Facebook itself handles. Facebook can’t guarantee that users won’t see ads influenced by browsing data that comes from a source other than Facebook. (To no longer see ads from companies who have your information, go the Ad Preferences page.)

None of this really explains what happened when I downloaded the What to Expect app and ended up almost immediately being pitched maternity-wear. I’m single, I long ago permanently hid the parenting ad topic and none of my Facebook “interests” relates to children. I don’t get pregnancy ads on Facebook or Instagram.

The What to Expect app was among those The Wall Street Journal found was sharing data with Facebook as recently as November, but the company said it stopped using Facebook’s SDK prior to January.

Two analytics firms that still do handle data for the app told me they didn’t have anything to do with my seeing the ad.

Everyday Health, the app’s maker, said it might have been my browsing history.

The clothing brand, Hatch, declined to share specifics about its targeting criteria.

And Facebook, upon looking into the ad, said I was targeted because I was part of a look-alike audience that resembles customers, uploaded by the advertiser, who apparently are in need of maternity-wear. The company reiterated I did not see that ad because I downloaded the pregnancy app. Must have been a coincidence.

By Katherine Bindley