Facebook Marketing Partnership With Data Brokers Spurs New Round of Privacy Concerns

Facebook’s move to allow marketers to import consumer lists obtained through data broker companies, announced today, met with substantial concern from privacy advocates.

Facebook’s move to allow marketers to import consumer lists obtained through data broker companies, announced today, met with substantial concern from privacy advocates due to the amount of data the companies hold on consumers.

Facebook said it would expand its custom audiences tool to allow advertisers to use data obtained through the data brokers Acxiom, BlueKai, Datalogix and Epsilon to market to specific users on its platform.

Many large advertising platforms already allow marketers to use lists provided by data brokers. But Jeffrey Chester, the executive director of the Center for Digital Democracy, still felt that Facebook’s move was game-changing.

“When you combine the world’s largest private dossier of individual profiles with these huge data broker behemoths that have just vast storehouses of data about us, you’re talking about a very powerful offline/online data set targeting users in unique ways,” he said.

“It’s a question of scale and lack of accountability on both sides,” he added.

Regulators, including the Federal Trade Commission and a congressional privacy caucus, have expressed concern about the lack of transparency among data brokers.

Data brokers compile and sell marketing segmentation profiles, as well as sensitive information related to consumer credit and criminal backgrounds. The companies are legally limited in how they share credit and criminal information, though critics say enforcement is inadequate.

Data brokers have a lot more information than a single marketer would, some of it clearly private. In a worst-case scenario, privacy experts said, the brokers could tap into that sensitive information to drive Facebook ads.

“This information is not all equal, within your shopping habits there are more personal items that you buy and less personal items, and data brokers also have information that is universally considered personal — your criminal record and so on, that’s not being monetized yet, but once you have this partnership with a data broker it’s not hard to image a way to add more data and get more value. There has to be some limit here,” said David Jacobs, consumer protection counsel at EPIC.

Facebook says it will require data brokers to adhere to the laws that restrict their use of private information.

A prospective Facebook marketer would most likely tap a data broker to assemble a list of people who fall within the company’s targeted demographic and/or those who may be in the market to buy their product. A car dealership could ask a data broker to indicate which consumers are likely in the market for a new car, for example.

Data brokers obtain their information from online and offline sources. One major source of offline information is customer loyalty programs. A consumer who buys a car magazine at Safeway using a loyalty card could appear on the list of those likely to be in the market for a car, and could subsequently see ads for automakers, dealerships and insurance companies. (The example is hypothetical because little is known about how data brokers work.)

Using the new tool, a marketer could take a list of consumers compiled by a data broker and use it to market to those specific consumers on Facebook. The marketer’s list would likely identify people by email address, but potentially also by other criteria. The marketer would “hash,” or encrypt, the data before giving it to Facebook. Facebook would compare that hashed list to a hashed list of its own users’ identifying information to find matches. It would then serve advertisements to the matching users.

Facebook says it will not provide any information about its users to the marketers or data brokers. It would simply tell the marketer how many users had seen the ads and likely provide them with basic demographic information about those users, as it already does through other advertising services. Users can opt out, but will have to do so separately for each data broker.

Facebook also says it will serve the ads without knowing to whom, but privacy experts say that the company will certainly have access to that information.

User perception alone could generate another round of privacy woes for Facebook, whose users are prone to distrust its handling of their data, as the recent flap over subsidiary Instagram’s privacy policy revealed.

Seeing ads whose origins they don’t understand could startle some users, privacy advocates said.

“If it looks to them like Facebook knew they were at the drugstore last night, the average user would have concerns about that,” said Justin Brookman, director of the consumer privacy project at the Center for Democracy and Technology.

Not knowing where the ads come from could also cause users discomfort, said Rainey Reitman of the Electronic Frontier Foundation.

Online tracking and “is in itself concerning enough, but when it comes to something like Acxiom or one of these other data brokers, it’s even farther removed because you can’t block it just by blocking cookies. There’s this open question of where they got the information,” she said.

Facebook wouldn’t know, either, which criteria triggered an ad on a particular user’s profile. But over time, the patterns of ads served to particular users could tell the social network more about them, said Reitman.

The blending of offline and online lives may also ruffle some users’ sensibilities.

“There is something genuine and legitimate about the idea that you have different personas in different contexts, so it’s perfectly understandable and not inconsistent for a person to want their Facebook identity and the data that’s associated with it to be different from who they are at work or what they shop for at the pharmacy,” said Jacobs.

Being reminded of their offline activities while on Facebook could dampen their willingness to share information on the social network, said Jacobs. It could also potentially chill their behavior offline, said Brookman.

Some user dissatisfaction seems inevitable. But Brookman concluded that Facebook must have decided that the user “freak-out cost” was worth it to them.

The company will have to find the right way to put data brokers’ profiles to work, Brookman said.

“There’s an incentive for Facebook to not make it look too creepy. It’s a delicate balance they have to play. The more well targeted [advertising] is, the creepier it is, but the more money it is,” he said.