The Facebook Data Scandal: Yes, You Do Need to Understand It (Part II)

In PART I we talked about exactly what happened that not only got Facebook into hot water but brought to the fore some deep truths about what “data companies” like Facebook, Google, Yahoo, and Microsoft are really all about. In PART II, we’ll talk about what it means to you.

Facebook CEO Mark Zuckerberg promised that he’s patched the software hole that researcher Aleksandr Kogan crawled through on behalf of Cambridge Analytics. He probably has, although he insists that there was no “breach” involved because — you guessed it — users willingly handed over their data. Either way, though, it doesn’t stop him from continuing to sell data about you. (Google knows a lot about you, too, and there are plenty of others. More about that in a second.)

You willingly handed Facebook your data, even if you didn’t realize the implications. You give it to your bank, your credit card company, Amazon.com and every other online retailer, and if you don’t use secure connections you give it to anyone with $50 worth of equipment in your WiFi vicinity. (If you use in-flight WiFi, you might as well print your data on paper and hand it around from the drinks cart.)

A great deal has been made about well-publicized data breaches, such as the ones at Target and Lord & Taylor. Hundreds of millions of credit card accounts were hacked and the information sold for as little as $10 per account. In the end, though, it didn’t much matter, at least not to consumers. Strict federal regulations saw to it that consumers couldn’t be held liable for purchases made by others on their accounts. Change your password and it was the end of the problem for you.

Not so with your Facebook data, because of the depth and breadth of the information involved. And if you think Facebook knows a thing about you, it’s chicken feed compared to Google, which makes Big Brother look like a deaf-and-blind four-year-old with a bag over his head.

If you’re even a moderate user of its services, Google has a record of every photo you’ve ever taken, every email you’ve sent or received, every single Google search you’ve ever done, every place you’ve ever been with your Android phone (and how you got there), and every YouTube video you’ve ever watched. They know the contents of every file you’ve ever placed on Google Drive, and they know every Google Calendar event you’ve ever attended.

But even so, do you really care? So what if a bunch of people trying to sell you stuff gets your email address and sends you targeted ads? It might be a little disconcerting to get an email offering to sell you motorcycle insurance 48 hours after you took delivery of your new Harley, but maybe you need that insurance so there’s no harm, right? And, let’s make sure it’s clear, Google uses all these data to make your experience with its services far more useful and seamless than if they didn’t track it. You may not realize it, but one of the reasons your search recommendations are often so uncannily accurate is because of everything that Google has learned about you.

But what if you logged in to check out what a Stormy Daniels video actually looks like and the next day got bombarded with ads for sex toys? Or maybe you got an email asking for $10,000 so your kids wouldn’t get a link to that website and a list of every page you visited, and the list is appended to the bottom of the email so you know they really know?

(Not for nothing, but Google dropped its famous “Don’t be evil” motto from its Code of Conduct in 2015. Just sayin’.)

Don’t think for a second this kind of thing doesn’t happen. It does, but you don’t hear much about it because few victims are willing to report it, in the same way banks don’t report thousands of breaches annually because they’d rather pay off than let the public find out how vulnerable they are.

And, just so you know, Google will hand your data over to any government agency with a “legitimate” request for it, which it did some 32,000 times last year. It’s worth noting that there are studies now going on to determine if data mined from sources like these can be used to predict whether someone is going to commit a crime.

(Right now you might be thinking, “Say, I don’t think I ever gave Facebook or Google the right to collect and use my information.” Well, let’s see: Do you remember clicking "Yes" when you were asked, “Have you read and agreed to our Terms of Service?” Do you remember actually reading those Terms of Service? I doubt you did. Nobody ever does. You know that “free” Dark Web search that Experian advertises on daytime TV all the time? You should read their Terms of Service that you have to agree to. It’s the size of the Old and New Testaments combined and, buried deep within, you’ll find yourself practically giving them permission to sell your high school transcripts to anyone who asks.)

And while Facebook and Google are two of the biggest players in this arena (the arena being the provision of seemingly benign services in order to gather massive amounts of personal data), they’re far from alone. LinkedIn, the business connections site owned by Microsoft, will be rolling out a closetful of new features over the next few months in order to get its 546 million members to engage with it more frequently. Why? So that LinkedIn users keep their information updated in order for Microsoft to take more profitable advantage of it.

These are facts of modern life. But, as I’ve written before, despite the many examples of serious security and privacy breaches, The Big One hasn’t happened yet. When it does, there is going to be much gnashing of teeth and blame throwing at the “officials,” whoever the heck those are, who were supposed to be protecting us.

But protecting us is an almost impossible job. We can’t even correctly define what we should be protected from. Some people like targeted ads when they do Google searches, no matter how scarily accurate the material presented. (I once did a search on the Cassini probe to the planet Saturn and was rewarded with endless ads for Saturn automobiles every time I Googled something.) But how would you like to be turned down for a loan or medical insurance based on something you once searched for, or blackmailed, or put on a TSA watch list?

Is there anything you can do to protect yourself?

Yes, there is, but I know for a dead certainty that 90 percent of you aren’t going to do anything at all. For the other 10 percent I’ve got a few tips.

• The first one is easy: Don’t post anything, anywhere, about yourself that you don’t want the whole world to know. If you already have, you’re pretty much out of luck. The Internet never forgets anything. (Villanova basketball hero Donte DiVincenzo made headlines following his team’s NCAA victory for something he tweeted when he was 14 years old.) Corollary #1: Never post anything when you’re angry, no matter how strong the temptation. There are very few things that can’t wait 24 hours, and it’s a virtual certainty you’ll word it differently tomorrow. Like I said, the Internet never forgets.
   
• For the “Too late…I already let it happen” stuff, you can delete your Facebook and Google data. Both of these services store your profile and other data in central data bases. Somewhat surprisingly, both make it possible for you to not only see those data, but to delete them as well. How often they get refreshed depends on what you let them track, but here’s how to at least get rid of what they have on you now (or so they promise):

Facebook

First, take a look at what they have. Log in using a browser (not the Facebook app). Under “General Account Settings” click on the link way down at the bottom that says “Download a copy of your Facebook data,” then “Download archive.” Enter your password when prompted and in about 5-15 minutes you’ll get an email with a link to your data. Fasten your seat belt and have a look.

If you want to delete it, you have to use the app. Look for the “hamburger” in the lower right. It’s three stacked horizontal lines that’s the universal icon for “more stuff here.” Scroll down to “Settings,” tap it and then tap “Activity Log.” You can access your data using various filters and then selectively get rid of it by tapping “Clear,” although it’ll take about three months for your information to actually be scrubbed from Facebook’s servers.

One other thing: Virtually every app you downloaded through Facebook is also getting access to much of your personal information, and possibly that of your friends. (Yes, you clicked a button giving permission.) If you want to see what you let them do, log into your Facebook account, click the down-arrow at the top and go to Settings, then select the setting for apps. Hover over an app and click the Edit Settings icon. Make sure your seat belt is still fastened as you look at such settings as whether the app can post your personal information on its own. Change whatever settings you want or click the Remove button (along with the button to delete all the activity it’s been tracking) to get rid of the app altogether.

Google

Sign into your account and go to Google’s history page, then click “View your Google history.” There are seven sections listed, such as “Web & App History” and “YouTube Watch History.” Look through them for an eye-opening experience. If you really want to freak yourself out, check out “Location history.” (You did know that Google owns Waze, right?) In each section, select the three-dot menu in the upper right of the page and click on “Settings,” where you can toggle off activity tracking (which is a little deceiving because it doesn’t end all tracking. More about that another time.) That three-dot menu button will also give you access to “Delete options,” and clicking on “Advanced” will let you select how much data you want to get rid of, including an “All time” option to dump all of it. Again, you need to do all of this separately for each section.

• Never take one of those online quizzes. First of all, they’re all stupid and useless in terms of providing you with meaningful results, but more importantly because nearly all are designed to grab data about you. If you’re really driven to take one, go to an Internet café where you can do it anonymously and your personal IP address can’t be traced and don’t log in to anything. If you’re asked to supply an email address for the results (“for security reasons,” as the Experian Dark Web site explains), don’t do it. Or create a new, one-time email address, as described below.
   
• Use your email address for emails only. Create a separate one for online shopping and dumb quizzes. When the spam starts piling up, delete it and create a new one. (I started with DeleteThis01@....com. I’m now up to DeleteThis27@….com.)

And bear this one last thought in mind:

If the product is free… then the product is you.

Lee Gruenfeld is a managing partner of Cholawsky and Gruenfeld Advisory, as well as a principal with the TechPar Group in New York, a boutique consulting firm consisting exclusively of former C-level executives and "Big Four" partners. He was vice president of strategic initiatives for Support.com, senior vice president and general manager of a SaaS division he created for a technology company in Las Vegas, national head of professional services for computing pioneer Tymshare, and a partner in the management consulting practice of Deloitte in New York and Los Angeles. Lee is also the award-winning author of fourteen critically-acclaimed, best-selling works of fiction and non-fiction. For more of his reports — Click Here Now.