MN, FB, marketing companies and our data

[OhYouBadBadKitten]

Hi MN,

Several people expressed concerns about privacy when you introduced the logging in via fb ability. I've a few questions to ask at this point and as there will be other people here who are far more expert in online data on here, these are questions best asked in public. You will know me as a long termer here, who clearly enjoys using this site.

Firstly, with regards to GDPR, how will you be complying with the requirements of new legislation?

How much data do you hold on us? Who do you share it with and how is our information held?

When we fill out daft and not so daft marketing surveys on here, what are the data protection requirements incumbent on both yourselves and the marketing companies?

Have Cambridge Analytica ever been one of the companies that have gathered data through you, either overtly, or covertly under other trading names?

Have any other analytical companies gather political or other information on users, other than for marketing products purposes?

Please can you reiterate and summarise what permissions are given to facebook when logging into this site. Are these permissions limited to data held only by the user, or to their friends list as well?

How absolutely sure can you be that facebook have not also gathered information from mn beyond the permissions explicitly given? Are these reassurances purely given by facebook, or have you looked specifically about the data protection side with your own experts?

How does mn benefit from logging in through fb? Did they approach you for this, or did you approach them? Do you hold any data about users from their fb profiles?

I realise this is a long list of detailed questions that may take time to answer them. But I do feel they are important questions. Thank you.

Glad, what I worry about is that often people put just fluff on facebook and save their serious stuff for mn, where they are to the general public, usually fairly anonymous.

But if facebook have the ability to track people through mn, as it looks like the clause in the developers agreement allowed (even if they don't exercise that right) they can collate political views, health aspects, everything that are espoused on mn and tie them into the particular user or a sub group of users, exactly as CA did who used this sort of data to microtarget people who answered the psych quiz app on fb.

I've just read this twitter thread, fb on android seems to have access to everything, including all call data
twitter.com/dylanmckaynz/status/976368845635035138?s=19

I agree with you Kitten. The whole thing is fraught with danger. Fortunately I don't subscribe to FB and I only log on to MN with my MN identity, but those who have done so have real cause for concern.

I see in the news today that FB are owning up to a 'breach of trust'. But we should not have to trust them. There should be firewalls around networks like FB that prevent the leaking of data and make trust unnecessary. But that will never happen because it removes their income stream.

I wonder if a separate thread might be better about fbs over reach in general, so that we don't drift this thread away the original purpose. Thread drift is often interesting and valuable, but I think its better to keep this site stuff thread specifically about mumsnet.

I know there is a thread about Cambridge Analytica (I almost feel it's like typing Voldemort's name typing that)

Where's the best section for a separate fb discussion? Chat?

What I worry about is that often people put just fluff on facebook and save their serious stuff for mn
Genius move on the part of Facebook wasn't it allowing people to login to other sides using their Facebook profile...Zuckerberg spreads his tentacles into every part of your online life

I reckon chat could be the best forum for a thread about Facebook 👍

Drudge

Most Apps do this. This is what I was talking about when I said beware of free apps, espcially those not on Google Play. Apps are often a trojan horse for gaining access to private data.

When you download an app, you will be asked whether you allow the apps to access this data. Most people just say yes. Usually the app requests this info even though it is not required for the functionality of the app. Beware! Better to pay for an app from a known source. And try to avoid using them at all unless you have to

www.mumsnet.com/Talk/_chat/3201531-Facebook-and-your-data

Here is the thread for non mumnset related aspects of facebook and I guess google. Let's take the great advice given above over to there :)

@JustineMumsnet I hope the conference went well.
I wondered how you were getting on with your facebook/google investigations were going?

What we need to know is:
When a MN user logs in my clicking on the Facebook link, exactly what data is sent by Mumsnet to Facebook?

Watching this with interest.

or indeed what do Facebook take, or could they take if they chose to
Glad.

Sorry for the delayed response - yesterday was a bit of a car crash (conference was v good txs OYBBK). Here's what I've established talking to our tech and data team. If you login into Mumsnet using Facebook then Facebook can see that you've done that. However, they cannot in our technical view, see what pages Mumsnet users are viewing or tie that to their Facebook profile.

However, we have, it turns out been been running Facebook pixels (cookies) on Mumsnet pages. We did this to understand our users in aggregate (demographics) and to be able to reach them/ others like them on Facebook. We believe that via that pixel Facebook has been able to see both that you are on Mumsnet and what Mumsnet pages you are viewing (whether you use Facebook to log-in to Mumsnet or not). Specifically, they can tell the date and time you visited Mumsnet; and the web address, or URL, you've been on.

Facebook uses this data to show you more relevant ads - for example from brands that would like to reach parents. Facebook calls this ‘interest-based advertising’ You can turn off interest-based advertising in Your Ad Preferences in Facebook from here. Google has a similar choice for your settings <a class="break-all" href="//myaccount.google.com/privacy​" rel="nofollow" target="_blank">here.

Given the conversation we've been having and recent events concerning Facebook we've decided to remove those pixels from the Mumsnet site and we did so on Friday.

We absolutely don't pass on Mumsnet user names or any user registration data to Facebook. Whilst we can't rule it out 100% technically, we believe that it would be very difficult for Facebook to infer a Mumsnet user name from pages that Mumsnet users have viewed and to do so they would need to create a bespoke mechanism, which in our view is pretty unlikely.

Again thanks for your questions. We'll be making sure to update our privacy policy/ include the answers in our FAQs that we're producing ahead of the GDPR introduction.

Thank you so much for coming back to us Justine :) Thank you for looking into this properly too. It sounds like critical questions have been answered and apart from the pixels sounds pretty good. Thanks for taking action on that. It cuts out a lot of risk. You've been really prompt with this.

So I don't quite understand why fb have the log in via them function, it sounds like they don't really gain much, unless it's a way of encouraging sites to use their pixels. I think it's something to keep a watchful eye on in case new cases of data breaches occur, in ways that haven't been thought of yet.

I've just looked up facebook pixel. I'm glad you've removed that!

OYBBK - I assume facebook use the log-in function so you have to keep your facebook account to log into other sites. Prevents you leaving them.

That would certainly be advantageous to them.

So I don't quite understand why fb have the log in via them function, it sounds like they don't really gain much
What they say they gain and what they actually gain may not be the same thing

And yes as per @CarolDecker it's a way of tying all your online accounts together so that Facebook becomes integral to your online life

Thank you Justine.
I do wonder really why you still offer the log in by Facebook. It offers a very minor convenience to MN users, at the risk of giving FB an opening to collect data about them. Is it really worth it?

It would feel better and send a message if ties were cut. How much impact would it have on the site and users?

I do wonder really why you still offer the log in by Facebook.
I use oauth login with google, Facebook etc on various websites, surely up to the person to not use if they want rather then take away from those that do.

It offers a very minor convenience to MN users
true but perhaps we underestimate the strength of minor conveniences to nudge us towards certain behaviours?

if having the FB login option increases traffic then MN are obliged to keep it because it makes the company more profitable.

Similarly if this ceases to be the case and the tide turns against FB so that the FB option puts people off then it will be in the company interests for MN to remove it