In recent years, consumers have achieved several important wins in privacy and technology law that imposed modest constraints on the surveillance economy. Under a handful of state privacy laws such as the California Consumer Privacy Act (CCPA), many consumers now possess legal backing for their rights to know how companies are using their personal information and to better control its use. Mobile platform vendors have also made more privacy protections available and easily discoverable by users.
CR’s “Who Shares Your Information With Facebook?” study was designed to help researchers better understand the state of the surveillance economy in 2023 and document real-world surveillance practices, including hard-to-measure server-to-server data transfers.
Why focus on Facebook specifically? While the list of data brokers and other companies holding consumer data is extremely long and ever-changing, many of the companies have one thing in common: They choose to advertise on Facebook.
By collecting a large sample of consumer data from Facebook, we are thus able to study an exceptionally broad—though not statistically representative of American consumers or the U.S. population—cross section of the data moving through the surveillance marketing economy.
Key Findings
What we discovered in consumers’ data files was striking. The overall scope of data sharing and targeted advertising that occurs on Facebook is immense.
- We found slightly more than 186,000 different companies represented in the donated data of 709 study participants.
- Each of these 186,000-plus companies shared data on an average of eight participants in our study.
- The average participant in our study was identified in the data by 2,230 different companies; some were identified by more than 7,000 companies.
- The company that shared data on the largest number of participants was LiveRamp, a data broker, which shared data on 679, or about 96%, of study participants.
- The 100 companies that most frequently appeared in our sample each shared or directed their service provider to share data on more than half of the 709 volunteers. Of those companies, 39 are retailers or consumer brands, 28 are agencies or services providers, 19 are data brokers, 4 are political services firms, and 10 are best classified as “other.”
Policy Recommendations
Many consumers will rightly be concerned about the extent to which their activity is tracked by Facebook and other companies, and may want to take action to counteract consistent surveillance.
Based on our analysis of the sample data, consumers need interventions that will:
- Reduce the overall amount of tracking.
- Improve the ability for consumers to take advantage of their right to opt out under state privacy laws.
- Empower social media platform users and researchers to review who and what exactly is being advertised on Facebook.
- Improve the transparency of Facebook’s existing tools.
Consumer Reports is also calling on the Federal Trade Commission (FTC) to move forward with its Commercial Surveillance and Data Security Rulemaking, which we believe should set strong, clear rules that limit what companies are allowed to do with our most sensitive, personal data. Sign the petition to let the FTC know you want robust data privacy rules now!
To read the full report, please see the attached PDF.
Contact: cyrus.rassool@consumer.org