In Facebook CEO Mark Zuckerberg’s second session with lawmakers this week, there were a few high points, many low points, and an absurd number of deflected or unanswered questions. But between all of the bromides and promises to get back to members of Congress with answers to questions that he claimed he didn’t know, a pair of exchanges stood out—and revealed the limits of the company’s promises that it gives people complete control of their data.
In a line of questioning from Rep. Ben Lujan, a Democrat from New Mexico, Zuckerberg allowed that his company creates profiles on people who don’t actually use Facebook—what are sometimes referred to as “shadow profiles.” This was important for a number of reasons—chief among them because across two days of testimony to Senate and House committees, Zuckerberg repeatedly hammered on the point that Facebook doesn’t own user data and that users have control over how their data is shared on Facebook.
“I believe that everyone owns their own content online, and that’s the first line of our terms of service if you read it,” Mark Zuckerberg told Rep. Marsha Blackburn, a Republican from Tennessee, about an hour into Wednesday’s hearing. The idea that people who use Facebook own their data and can choose how that data is used was a frequent Zuckerberg talking point on Tuesday and Wednesday (not to mention one that his PR team had included in his notes, which the public caught a glimpse of on Tuesday after he left them visible long enough for a journalist to snap a photo).
But about an hour and a half later, Lujan drilled down on the issue, pushing Zuckerberg on whether his platitudes about not owning our data squares with reality. “Facebook has detailed profiles on people who have never signed up for Facebook, yes or no,” the congressman asked, noting that these non-Facebook user profiles are often called shadow profiles, a term Zuckerberg claimed he wasn’t familiar with. Then the congressman asked again: “It’s been admitted by Facebook that you do collect data points on average nonusers. My question is, can someone who does not have a Facebook account opt out of Facebook’s involuntary data collection?”
To that, Zuckerberg gave a nonanswer. “Anyone can turn off and opt out of any data collection for ads, whether they use our services or not,” the CEO said. “But in order to prevent people from scraping public information, which again, the search feature you brought up only showed public information, people’s names and profiles and things they’d made public. Nonetheless, we don’t want people aggregating even public information. So, we need to know when someone is trying to access our services.” Beyond the fact that this wasn’t coherent, it also wasn’t an answer to the question, which Lujan picked up on right away, noting that when people who aren’t Facebook users visit Facebook to opt out of data collection, Facebook directs them to sign up for Facebook in order to opt out. Having a Facebook account appears to be the only way to do that.
Another representative, Republican John Shimkus of Illinois, asked Zuckerberg why Facebook tracks people who are logged off Facebook across different devices, to which the CEO replied that it’s for security and ad reasons. The security reason, he said, is that Facebook wants to know how many public pages someone is looking up or scraping, even when they’re not logged in, which ostensibly is useful to prevent mass harvesting of public profile data. For ads, the reason is that they run an ad network off Facebook, and collecting data of people off Facebook is one way that ad networks target people and make money. Zuckerberg said that if people want they can opt out of the ad network. Of course, as Lujan pointed out, to opt out Facebook asks that you log on.
All of which means that Zuckerberg’s repeated cries that people who use the internet—not even just people who use Facebook—have control over their data on Facebook isn’t really true in practice. To opt out of Facebook’s data collection, first you’d have to even know a service you’re not on is collecting your information, and then you’d have to sign up for that service to opt out of it. (There’s a joke about Kafka to be made somewhere in there.) And, of course, to be on Facebook means the company is collecting data about you no matter how restrictive you make your settings—unless you delete your account, but even then, it may be collecting data about you anyway. The whole thing is a head trip, and more than anything it reveals how we can never really control how Facebook collects data. If you can’t even evade the company’s data collection by abstaining from having a Facebook profile, what choice do you really have?
Hopefully, Congress will continue to worry about this—and consider how to make companies that collect data on people without their consent or knowledge to quit it. But doing that would require some kind of lawmaking or directive from our elected representatives—something that, to judge by this week’s hearings overall, may be something they’d rather not have to do.
