[Paper Review] Facebook Shadow Profiles

Luis Aguiar, Christian Peukert+2 more|arXiv (Cornell University)|Feb 8, 2022

Privacy, Security, and Data Protection4 citations

TL;DR

This paper quantifies Facebook's ability to build shadow profiles of non-users by tracking their web browsing behavior via embedded 'Like' and 'Share' buttons, finding that Facebook tracks about 40% of US internet users' browsing time regardless of Facebook usage. It demonstrates that this data enables accurate predictions of demographic traits like age and gender, imposing data externalities on non-users through inferred profiling without consent.

ABSTRACT

We quantify Facebook's ability to build shadow profiles by tracking individuals across the web, irrespective of whether they are users of the social network. For a representative sample of US Internet users, we find that Facebook is able to track about 40 percent of the browsing time of both users and non-users of Facebook, including on privacy-sensitive domains and across user demographics. We show that the collected browsing data can produce accurate predictions of personal information that is valuable for advertisers, such as age or gender. Because Facebook users reveal their demographic information to the platform, and because the browsing behavior of users and non-users of Facebook overlaps, users impose a data externality on non-users by allowing Facebook to infer their personal information.

Motivation & Objective

• To measure the extent to which Facebook tracks the browsing behavior of both users and non-users of its platform.
• To assess whether Facebook can construct accurate shadow profiles of non-users using only browsing data and user-provided demographic information.
• To quantify the data externality imposed on non-users when Facebook users share personal information.
• To evaluate the predictive power of browsing behavior for demographic characteristics in the absence of direct user consent.
• To examine the implications of large-scale, cross-site tracking for privacy, advertising, and market concentration.

Proposed method

• The study uses a representative sample of US internet users with access to proprietary browsing data collected via Facebook’s engagement buttons (e.g., 'Like' and 'Share' buttons) on third-party websites.
• It leverages cookies to track individuals across websites, even without interaction with the Facebook buttons, enabling passive data collection on both Facebook users and non-users.
• The authors train machine learning models to predict demographic attributes (age, gender, household composition) using browsing behavior data, with Facebook users’ self-reported demographics as training labels.
• Prediction accuracy is measured by comparing model outputs to actual demographic data, with baseline accuracy calculated using no information.
• The analysis compares prediction performance across user groups (Facebook users vs. non-users) and evaluates the incremental value of user data in improving predictions for non-users.
• The study estimates the share of total browsing time tracked by Facebook and quantifies the data externality via the improvement in prediction accuracy when user data is included.

Experimental results

Research questions

• RQ1 What share of an individual’s online browsing activity is tracked by Facebook, regardless of whether they are a Facebook user?
• RQ2 To what extent can Facebook accurately predict demographic characteristics of non-users using only browsing behavior and user-provided data?
• RQ3 How does the inclusion of Facebook users’ demographic information affect the accuracy of predicting non-users’ personal characteristics?
• RQ4 What is the magnitude of the data externality imposed on non-users due to Facebook users’ data sharing?
• RQ5 How does the predictive power of browsing data compare across different demographic groups and for different personal attributes?

Key findings

• Facebook tracks approximately 40% of the browsing time of both Facebook users and non-users across the US internet user population.
• For Facebook users, the model predicts age with 25% higher accuracy and female gender with 16% higher accuracy than baseline, using only browsing behavior and user demographics.
• For non-users, the model predicts age with up to 30% higher accuracy than baseline, children in household with 14% higher accuracy, and female gender with 6% higher accuracy.
• The inclusion of Facebook users’ demographic data significantly improves prediction accuracy for non-users, demonstrating a data externality from users to non-users.
• The study finds that browsing behavior alone, combined with user data, enables meaningful inference of personal characteristics, even without direct consent from non-users.
• Despite limited data access, the results suggest that Facebook’s ability to build shadow profiles is substantial and poses potential privacy and market concentration concerns.