Facebook’s advertising tools algorithmically labelled 65,000 Russians as interested in treason, potentially putting them at risk from the repressive state, until the company removed the category, following inquiries from journalists.
The labelling raises new concerns over data-driven profiling and targeting of users on the website, which has already faced criticism for the same tool algorithmically inferring information about users’ race, sexuality and political views despite data protection legislation requiring explicit consent to hold such information.
Facebook said the label was intended to only identify historical treason. “Treason was included as a category, given its historical significance. Given it’s an illegal activity, we’ve removed it as an interest category,” a spokesperson said.
Although Facebook does not directly expose user interests to external parties, advertisers can easily uncover them through careful use of the company’s public-access tools. For instance, they could run an advert targeting exclusively users living in Russia and marked as being interested in treason, then record the IP addresses of users who clicked through.
Those tools may be appealing to a state that is comfortable using the internet for repression, said Russia expert Mette Skak, an academic at Aarhus University. “Officially, the internet is not censored in Russia. However, these methods, which Facebook has probably unwittingly given the Russian authorities, make it much easier for governmental agencies to systematically track persons marked as potential traitors.”
In a statement, Facebook said that the Danish Broadcasting Corporation, which first highlighted the problem and shared the issue with the Guardian, had “raised a number of important questions about the way Facebook’s advertising systems work. Our goal is to ensure people see ads that are relevant and useful. It’s better for the people using our service, as well as for advertisers.
“When we identify misuse of our ads products, we take action. Depending on the violation, we may remove the ad, suspend the ad account or even report the advertiser to law enforcement.”
The news comes a day after Facebook was discovered to have given privileged access to its site to mail service Mail.Ru, a Russian site with links to the Kremlin.
In a 700-page document, released to the US Congress in late June, Facebook admitted that it gave some applications special access to users’ friends’ data beyond the May 2015 deadline, when it shut that access off to most developers. This access, the same type used by the This Is Your Digital Life app at the heart of the Cambridge Analytica scandal to scrap the information of 87m Facebook accounts, was provided to Mail.Ru for two weeks after the general deadline.
Facebook told CNN that the company hadn’t found any evidence of Mail.Ru abusing that access. “Facebook is a global company with users all over the world so we work with developers globally to bring our services to people everywhere – as long as those developers adhere to our platform policies.
“Mail.Ru, one of the top five largest internet companies in the world, has built apps for the Facebook platform and for other major platforms, including iOS and Android for years. We’ve found no indication of misuse with Mail.Ru. If we find misuse, we ban the developers.”
Algorithmically determining users’ interests is a key aspect of Facebook’s advertising platform. It allows advertisers on the site to target users more accurately than they could by using simple demographic measures. For instance, advertising sporting products only to users who care about sport or allowing record labels to advertise music to users who are already known to like a given artist.
But, while Facebook offers users heavy controls over what it does with the information they provide, such as uploaded photos and status updates, it offers much less control over information it has inferred about them. Users can manually remove individual interests on a settings page, but cannot opt out of the profiling altogether, nor prevent interests being inferred on a category-by-category basis. Hiding adverts targeted to a particular interest also does not clear that interest from Facebook’s profile of a given user.
Under GDPR, certain types of sensitive personal data, including sexuality, religion and political interests, are specially protected. Since that law came into effect, Facebook has specifically asked users if they’re comfortable with that information being posted on their profiles. But the company offers no similar protections for information about those categories that it has inferred itself – for instance, that a user might be “interested in homosexuality” or “interested in Islam”.
Facebook said: “Businesses do not get any personally identifying information about you. And you’re only ever included because of the actions you take online, not your personal characteristics.” It added: “‘Homosexuality’ is a broadly used category with many legitimate uses. For example, LGBTQ advocacy groups use this segment to reach people interested in these topics. So we’ll be keeping it.”