èƵ

Facebook may guess millions of people’s sexuality to sell ads

Three-quarters of all EU users may have had sensitive data inferred about them by Facebook, including things like sexual orientation, religion and political leanings
A woman looking at Facebook on her computer
What you click on reveals a lot about you
Rachel Torres/Alamy

Facebook knows more about you than you might think. A study has for the first time revealed the scale of its data gathering, suggesting the social media company has deduced sensitive information about nearly three-quarters of all Facebook users based in the European Union, totalling 40 per cent of all EU citizens – around 200 million people. By looking at the pages you like and the things you click, Facebook can infer your sexual orientation, religion and political leanings, then uses this information to target you with adverts.

We’ve long known that Facebook profiles its users in this way, but the process is hidden away in the background. Now Ángel Cuevas Rumín, at Charles III University of Madrid, Spain, and his colleagues haveshed some light on the practice.

That matters, because the EU is increasingly cracking down on profiling. In September, for targeting adverts based on sensitive information, including “ideology”, “sex” and “religious beliefs”, without obtaining explicit consent first. New EU-wide legislation, called the General Data Protection Regulation (GDPR), comes into force in May and clarifies that users must be specifically asked before companies collect and use their sensitive information or profile users on the basis of sensitive data.

Before starting the project, Cuevas was browsing Facebook when he found an ad that said: “Connect with the gay community & rent affordable places from people like you. Book Now.”

After some digging, he found that Facebook had categorised him as interested in homosexuality. “I have never given Facebook information about my sexual orientation, nor given them permission to use this to target me with adverts,” says Cuevas.

Targeting belief

To show how easy it is to target people on the basis of sensitive information, the team purchased three Facebook ad campaigns, one targeting users interested in “Islam”, “Judaism”, “Christianity” or “Buddhism”, another targeting people based on political opinions, such as “radical feminism” or “socialism”, and the third targeting people registered as interested in “transsexualism” or “homosexuality”. For €35, they reached more than 25,000 people with interests across the three groups.

However, Facebook says that interests and sensitive information are not the same. For example, just because you like a page about homosexuality doesn’t mean you are gay. “This report is not accurate,” a Facebook spokesperson told èƵ. “Like other internet companies, Facebook shows ads based on topics we think people might be interested in, but without using sensitive personal data. Our advertising is fully compliant with current Irish Data Protection law and we are actively preparing for the GDPR to ensure we are compliant when it comes into force in May.” Facebook’s European operations are based in Ireland.

All of the independent data protection experts contacted by èƵ expressed concerns about personal information being used in this way, because it likely doesn’t match people’s expectations.

For example, many people would consider clicking on an advert for a sexually transmitted infection clinic personal information. “Context matters and it’s not black and white, but Facebook are wrong in my view,” says Pat Walshe, a data protection and privacy consultant.

While it is true that a person can be interested in homosexuality without being gay, and vice versa, it is clear that there is a large crossover between these two categories. By selling ads based on the first category, Facebook allows advertisers to target a large number of people in the second.

“Although there may be a semantic difference between profiling one’s interests and profiling their personal aspects, the effect is the same: an individual becomes affiliated with a class or type of identity in a manner that might permit discrimination or abuse of power,” says Carly Nyst, an independent consultant on technology policy. “In an era in which the US government expresses a desire to establish a ‘Muslim registry’, for example, a trove of data that links individuals to Islam is an incredibly powerful and sensitive thing.”

Behind the scenes

Advertisers on Facebook can choose from hundreds of thousands of options to target their adverts, including location, demographics, behaviours and interests. The vast majority would not be considered sensitive information. For example, some interests are as simple as Facebook thinking you enjoy èƵ because you’ve liked the èƵ Facebook page. Others are inferred from the way you act online. Exactly how Facebook does this is kept secret, although it is possible to see which interests Facebook has assigned to you using their “Ad Preferences” tool.

To work out how often sensitive interests are used to target adverts on Facebook, Cuevas and his colleagues created an internet browser extension people can use that gives you a real-time estimate of how much money you generate for the site by analysing how you interact with adverts. It also records why a specific advert was shown to an individual.

Between October 2016 and October 2017, more than 3000 people from EU countries used the tool, corresponding to 5.5 million adverts. The team extracted in excess of 2000 reasons Facebook gave for showing someone an advert that related to sensitive interests, including politics, religion, health, sexuality and ethnicity. In total, about 90 per cent of the people who used the extension were targeted with ads based on these categories.

By comparing the demographics of the people who used the browser extension and the demographics of EU citizens, the team came up with an estimate of how many people may have been targeted using sensitive interests – about 40 per cent of all EU citizens, or around 200 million people.

Covering tracks

Cuevas and his colleagues are now adapting their tool so that it can automatically delete inferences about you related to sensitive information on your Facebook account. Users can already do this manually via the “Manage your ad preferences” settings in Facebook, but it is unclear how many people choose to.

“This just shows why we need laws to govern this. Often, we don’t know whether things going on in the background are ethical, so there need to be boundaries to protect individuals,” says at the Oxford Internet Institute.

at the University of East Anglia, UK says that the company’s profiling makes a “mockery of data protection”, and that even if the GDPR seems to make the practice illegal, it may not be enforced or interpreted that way. “Sadly, I am not optimistic that they will be brave enough to take this bull by the horns.”

Europeans are worried about their personal data. , 63 per cent of EU citizens do not trust online businesses, and more than half do not like providing personal information in return for free services. But they often have little choice.

“Companies like Facebook and Google have a monopoly. They offer services nobody else is offering, so your only options are to either take it or leave it,” says Cuevas.

Article reference:

Article amended on 16 February 2018

Clarification:We have corrected remarks attributed to Pat Walshe

Topics: Facebook / Internet / Privacy / Social media