Suit in California Superior Court Alleging Misuse of User Data by Facebook

The Tip of the Night for May 12, 2018 , discussed speculation that social media apps were accessing mics on smart phones to listen in conversations, and send users targeted advertising. I discussed a Wired article written by a former Facebook employee who denied that Facebook was recording its users conversations, and asserted that it was impractible for them to do so because of the amount of data that it would need to collect.

A complaint filed with the California Superior Court for San Mateo County, Six4Three, LLC v. Facebook, Inc., No. CIV 533328 (Cal. Super. Jan. 12, 2018), contends that Facebook does indeed access user's microphones, as well as their texts and location data:

Upon information and belief, at least by 2013 and continuing at least through 2015, Facebook continued to explore and implement ways to track users' location, to track and read their texts, to access and record their microphones on their phones, to track and monitor their usage of competitive apps on their phones, and to track and monitor their calls. For example, upon information and belief, Facebook expanded its program to access and monitor the microphone on Android phones in 2015 without securing the explicit consent of all users and while only providing partial disclosures as to what information was being obtained and for what purposes it was being used. ¶ 233.

The plaintiff in this suit, Six4Three, LLC, alleges that Facebook operated a fraudulent scheme that induced it and other developers to enter into contractual agreements with Facebook in exchange for access to social data. The complaint also alleges that Facebook misuses its users' photo data:

a user has any Facebook app installed on their iPhone, then Facebook accesses and analyzes (using facial and other image recognition) the photos the user takes and/or stores on the iPhone (see, e.g., https:/ /www .facebook.com/help/community/question/?id= 1 0209909027988265). Facebook's partial disclosures regarding iPhone photo access and what information it gleans from the photos have been woefully deficient. Ibid.

The complaint asserts that Facebook improperly collects and archives its users' photos:

. . . proposed technical "fix" by Facebook was to create an offline, searchable cache of Facebook's users' photos. But this solution (1) on its face violates Facebook's own terms, (2) would not permit the App to function as originally intended and in the same manner it had been, and (3) could result in a grave and substantial abuse of user trust, violate user privacy, and gut the core principle of an individual's ownership and control of their own data. ¶ 170

Strong reason to doubt that Facebook's denials about how aggressively to collects text, photo, and audio data from its users.

Are Your Social Media Apps Listening to You?

Recently, I've noticed my Instagram app displaying a remarkable amount of intuition in how it feeds ads to me. The day after discussing a particular flavor of a particular brand of a meal replacement drink at my friend's home (a brand I never googled or emailed about before) an ad for the exact same drink appeared in my queue. Today while driving along 14th Street in Manhattan, I remarked that I was surprised to see signs indicating a Target would be opening there soon. A short while later ads for Target popped up. Could it be that Instagram is using the microphone on my iPhone to listen to my conversations?

There certainly is a good deal of speculation online that Instagram, Facebook, and other apps listen to conversations spoken within range of the smartphone on which they are installed. See for example this Redditt board. Could it be that this is really taking place?

Antonio Garcia Martinez, a Facebook employee responsible for ad targeting, published an article in Wired this past November attempting to debunk this idea. In Facebook's Not Listening Through Your Phone. It Doesn't Have To, Garcia Martinez claims that voice over internet data for even half a day would amount to 130 MB per user (3KB per second). This much data for all 150 million daily users of Facebook in a single day would come to 20 petabytes. According to Garcia Martinez Facebook only stores 300 petabytes of data, taking in 600 terabytes each day. Facebook uses about 1 million target keywords, and searching for that many terms would cause a substantial decrease in a phone's performance. A test at Facebook, 'Project Chorizo', utilizing all available user data indicated that only a single digit percentage of posts provided useful data to the ad targeting algorithm.

On the other hand, Zoe Kleinman, a technology reporter for the BBC, in her March 2, 2016 article, Is your smartphone listening to you? indicated that it is indeed technically possible for an app to scan conversations. She engaged a cyber security experts from Pen Test Partners who in just two days were able to create an Android app that could listen in on conversations and then convert the spoken words to text that was transferred to their computer. Kleinman reports that:

It wasn't perfect but it was practically in real time and certainly able to identify most keywords.

The battery drain during our experiments was minimal and, using wi-fi, there was no data plan spike.

"We re-used a lot of code that's already out there," said David Lodge.

"Certainly the user wouldn't realise what was happening. As for Apple and Google - they could see it,

they could find it and they could stop it. But it is pretty easy to create."

A Google spokesperson questioned for the article noted that apps are restricted from collecting data without the knowledge of users.

Instagram posts its Data Policy and Privacy Policy online. (Don't forget that Facebook acquired Instagram in 2012.) In addition to collecting data from user profiles and user content, it also tracks web pages visited by a device, log file information, device identifiers, and meta data including geo tags for photos. If a purchase is made using the app, the user's credit card and debit card information may be recorded. Notably its Data Policy states that the app collects "information about other devices that are nearby or on your network, so we can do things like help you stream a video from your phone to your TV." (emphasis mine). Does this mean that Facebook can direct ads to you on the basis of what the users of other smartphones nearby you are interested in, especially when they are nearby for long periods of time, and in large numbers? The section on 'Device Information' indicates that apparently regardless of whether or not you allow the app to access your location, it can detect "[b]luetooth signals, and information about nearby Wi-Fi access points, beacons, and cell towers." There is nothing specifically mentioning using a microphone to record conversations, but it's clear that an awful lot of data is being taken in from your phone and those around it that can help analyze your potential interests.

Facebook may have your call and SMS data

Mark Zuckerberg's statements to Congress today included the remark that, “I don’t believe we’ve ever collected the content of phone calls.” This is somewhat misleading. Facebook has collected records on phone calls and SMS messages made by Android users. See this post to the FB blog. While it apparently does not collect the same information from people who install the FB app on their iPhones, the data I downloaded from my FB account includes all of the contact information on my iPhone.

Android users of the FB messaging app, may receive a notification like this one requesting to, "Continuously upload . . . your call and text history."