Terms of Service

When British Columbia resident Deborah Douez signed up for a Facebook account, she didn’t expect that she’d end up going to court against the social-media giant. In 2012, she was told by a friend that her name and photo were showing up in Facebook ads promoting a company that sponsors competitive obstacle mud races, and the friend was wondering if Douez was working for that company.

But Douez wasn’t. All she had done was “like” the company’s Facebook page, the way countless other users do every day. Facebook was using her name and picture as part of a feature it had rolled out the previous year called “Sponsored Stories.” In effect, Douez’s identity was being used to help with an online sales pitch. “I was kind of shocked, because I had liked the page, but it didn’t mean that I was endorsing them,” she says. “It’s one thing to like something and quite another to then support it in a way that’s commercial in nature.”

Douez spoke to another friend who is a lawyer and who was already looking at the same ad campaign. In 2012, Douez sued Facebook on behalf of 1.8 million British Columbians who also had had their faces and names used this way, Douez contends in contravention of British Columbia’s Privacy Act. “When it comes to privacy law, in particular, I think it’s really important that those laws get protected and honoured by anyone who chooses to do business in this country,” she says.

“The underlying claims are without merit and we will continue to defend ourselves vigorously,” a Facebook spokesperson stated in an email.

Related stories

What you're doing when you click "Agree"

Jun 01, 2018 | King's Investigative Workshop

About Terms of Service

Jun 01, 2018 | Fred Vallance-Jones

Timeline, Data and Elections

Jun 01, 2018 | King's Investigative Workshop

It has taken years of court proceedings that went all the way to the Supreme Court of Canada to get to the point where a B.C. court certified the case as a class action on May 10. In many ways, Douez’s case encapsulates an issue now facing us as a digitally connected society: huge quantities of data are collected by enormous companies that then use the information to target advertising—and that has implications for our lives, our society and our democracy.

In exchange for connecting with friends and family, reading the latest headlines, and sharing updates about our lives, we agree to let Facebook and other large internet companies store and use our information. Over time, these companies have built vast data-storage centres bursting with personal data on a sizeable fraction of the world’s population, now about 2 billion users, in the case of Facebook. This has allowed the companies to provide us with services that have become central to our lives, at no apparent cost to us. But it has also created one of the most powerful advertising machines ever known with messages that can be targeted to those likely to be interested in a product or service. Facebook, Google and others have become rich.

Political parties soon noticed, and targeting voters through Facebook proved a successful tactic for Barack Obama’s 2012 campaign. By the time Justin Trudeau led the Liberals to victory in the 2015 Canadian federal election, spending on social media advertising had soared into the millions. Facebook openly boasted about its successes on an advertising “success stories” page on its website, stating, “The Canadian political party used Facebook and Instagram to identify, persuade and mobilize supporters for its leader Justin Trudeau, lifting the party from third place in the House of Commons to the winner of the 2015 federal election.”

But less savoury players also sensed potential, and Russian operatives used the same advertising platform to spread divisive and false information during the 2016 US election. Most famously, Cambridge Analytica, a company that specializes in data-driven targeting, including in political campaigns, obtained the Facebook profiles of up to 87 million users, mainly in the US, to help feed a sophisticated voter-targeting operation.

Even before the Cambridge Analytica scandal broke in March, there was a growing backlash against Facebook and other technology companies, of which Douez’s case is but one example. Much tougher data-privacy rules that have come into force in Europe, and there are increasing calls in Canada and elsewhere to reign in Facebook and the other big data companies.

But it all starts with a click. This video created by King’s students provides an overview of how Facebook collects and uses data.

When you create an account on Facebook, Instagram (which Facebook owns), Google, or other similar online services, you are asked to agree to the terms of service. On Facebook, the login page prominently states that, “it’s free and always will be.”

Sort of.

Further down the page, just above the big green Sign Up button, is some much smaller type:

By clicking Sign Up, you agree to our Terms, Data Policy and Cookie Policy. You may receive SMS notifications from us and can opt out at any time.

The policies are linked from this statement, in case a user wishes to read them. But it’s likely that few people signing up for Facebook realize that clicking the green button is akin to signing a contract—one that essentially states that in exchange for joining a platform that presents itself as a place of convenience and connection, the user agrees to let Facebook gather data and use it for a wide variety of purposes, including advertising.

Perhaps the most important thing you agree to give Facebook is data about yourself and everything you do while on the platform. As you’re scrolling, the company is gathering information on your activity. It knows your likes, what you share, and what and whom you interact with. While the platform’s privacy settings allow you to choose which other users see your posts, Facebook stores everything on “farms” of computer servers distributed around the world. And your data can be replicated in more than one place.

As Facebook has grown, so has the need for data centres to hold it all.

The power of data

All this information makes Facebook extremely powerful. It can track users’ location, can see how they communicate with one another and even when they have a peek at one another’s profiles. Using website cookies, and, in Facebook’s case, a similar technology called the Facebook Pixel, companies can track users for advertising purposes even when they are visiting other sites on the internet. It’s the experience we have all had: that ad for a gadget we looked at on Amazon appearing on our Facebook page.

“Yes we use Facebook and it feels free, but we’re selling ourselves each and every day when we click on something and we like something and we post our pictures of our families,” says Tamara Small, a political scientist at the University of Guelph. The result is a data cloud that follows us everywhere we go, updating with every click we make. “Facebook is one of the biggest companies in the world because they have something that people want, which is data,” she says. “It adds up to a world of constant online surveillance, all facilitated by that initial click.

At its core, Facebook’s business model is about advertising targeted at individual users and their specific interests and traits. Using Facebook, an advertiser can choose from dozens of parameters or combinations of parameters to target potential buyers. These ads can appear as promoted posts in a user’s news feed, along the sidebar, on Facebook affiliates (most notably Instagram) or even on other sites not connected to Facebook. Purchasing an ad is as simple as opening an online form and choosing to whom you would like to pitch.

Potential advertisers can pick which gender, location, and age they’d like to target, plus a whole series of specialized categories, such as hobbies and activities, sports, relationship status, as well as types of restaurants and mobile phones (down to the make and model). It’s possible, for instance, to ensure your ad is only shown to older men without a college degree who like baseball and live in a particular postal-code area.

For Alan Mislove, an associate dean of the College of Computer and Information Science at Northeastern University in Boston, there’s something unsettling about such power. “The way Facebook advertising works, anybody can be an advertiser.” he says. “That’s where I think the risk is. Previous advertising services didn’t put that much power in almost anybody’s hands.”

It can be formidable power indeed. You can advertise to specific people, providing you have a list of individuals’ postal codes, email addresses, or phone numbers. Even more powerful is the “lookalike” feature that can find other people similar to those on your list. So, if a company has a list of 1,000 customers, Facebook can find and advertise to other users who share similar traits. Those advertisers can narrow their audience even further by examining how we interact on the platform.

“Those ‘wows’ and ‘hahas’ and my ‘angries’ and the ‘love’ can be an even more fine-tuned inventory for the advertisers,” says Kyung Lee, a professor at Dalhousie’s business school. He specializes in technology, innovation management and entrepreneurship.

It’s no surprise that company’s revenue is now almost entirely from advertising, according to disclosures made by Facebook to the United States Securities and Exchange Commission. In 2010, two years before the company first sold shares to the public, it had total revenue of just under $2 billion (US)—approximately $1.9 billion of which was from advertising. By 2017, that had grown to almost $41 billion in total revenue, nearly $40 billion from advertising, a twenty-fold increase in seven years.

Facebook contends that the ability to use data to target ads is beneficial.

“It lets advertisers reach the right people,” the company said in a written statement attributed to Rob Goldman, the company’s vice president of ads. “Data lets a local coffee shop survive and grow amid larger competitors by showing ads to customers in its area, and it lets a non-profit promote a diabetes fundraiser to those interested in the cause.”

23 million Canadian users

According to Facebook, the service has more than two billion monthly users and more than 23 million in Canada. This has made it a central player in the media and political landscape in this country, in the US, and around the world. Indeed, those seeking power discovered Facebook’s targeted-advertising regime, as well as its native ecosystem of posts, as a powerful way to reach and influence voters. That has turned out to have profound implications for our democratic system.

Steve Patten, a political scientist at the University of Alberta, has studied the effect of data-driven microtargeting on political discourse and says that parties, based on their existing knowledge of the electorate and voter databases they all maintain, can start to target different people with different messages. “They may know that you own a snowmobile and that snowmobilers are inclined to vote Conservative,” he says. “Until a few years ago, nobody would have ever thought of a community such as atvers and snowmobilers and how they vote, but now they do.”

Patten says this kind of specific messaging for different people harkens back to the days before mass media when politicians on “whistle stop” tours by train could give different messages to different regions.

Facebook, of course, allows far more specific targeting than in the 19th century. Combined with the ability to target specific people through custom audiences using emails or phone numbers, there’s a huge potential to reach people with messages that resonate particularly with them.

“I’m not sure people necessarily realize that your email address is something that can be used for targeting ads on Facebook,” said David Fraser, a privacy lawyer with the firm McInnes Cooper in Halifax.

“So if I know your email address and I know your political inclinations and I know your political fears or I know what buttons to push, just using your email address I can direct an ad at you.”

All of the three main Canadian federal political parties used Facebook and other social media during the 2015 general election. The Liberals under Justin Trudeau spent roughly $9 million on “other” advertising—that is “other” than radio and TV, according to campaign-spending disclosures to Elections Canada. Facebook used the Liberals’ success in the 2015 campaign as an example of success parties have had using the platform.

While this might just seem a harmless way to reach voters, it also represents a shift in the way political messages are consumed. Candidates have always had private conversations with voters, on the doorstep or campaign trail, but Facebook campaigning takes what is a public part of the process—mass-media advertising—and moves it into a private space. “Segmentation and microtargeting produces a tendency to talk out of both sides of your mouth,” says Colin Bennett, a political-science professor at the University of Victoria. “And politicians do that anyway, but I think that accentuates this.”

For political campaigners, Facebook is also a way of gathering data about supporters that could be useful in later outreach efforts. Data collection can be as simple as having a button on a Facebook ad for users to click that takes them to a campaign page where they can enter information about themselves, sometimes under the guise of signing a petition or indicating support for a policy position.

The information collected online can also be added to the parties’ voter-management databases, storehouses that the parties use to identify supporters, seek donations, and manage their “ground games” at election time. But, as some figured out, there were far more proactive and, eventually, alarming ways to use the platform. In the latter stages of the 2012 presidential election, the Barack Obama re-election campaign realized there was a huge hole in its voter-identification efforts—the campaign wasn’t reaching young people without landlines who, therefore, had no listed phone numbers. In a 2012 Time article, writer Michael Scherer described how the campaign created an app that allowed young supporters to connect with the Democratic party. But the app did more than that. Its users also granted the campaign permission to look at their Facebook friends lists, and suddenly, the campaign had access to more than 5 million people it otherwise couldn’t reach. The campaign dubbed it “targeted sharing.”

This timeline looks at some of the highlights of data use in elections.

Psychometric testing

In 2012, Michal Kosinski, then at Cambridge University, collaborated with two colleagues and Microsoft on a landmark study that looked at what could be inferred by analyzing Facebook likes. The team recruited 58,000 volunteers who provided their Facebook likes and demographic profiles and took a number of psychometric tests (psychometrics combines data analytics with psychology).

The researchers discovered they could distinguish straight and gay men 88 per cent of the time, black and white Americans 95 per cent of the time, and Republicans and Democrats 85 per cent of the time—just from Facebook likes. Kosinksi says that each individual interaction we have on social media may not reveal much, but put them together and a larger picture can emerge.

“The fact that you watched Forrest Gump or the fact that you played a given computer game or maybe that you visited a given website is to some tiny, little degree revealing about your political views, sexuality, age, gender, and many other intimate traits that you have,” Kosinski says. In time, he found that Facebook likes could predict someone’s personality more accurately than people who know the person closely.

In 2014, according to Motherboard, Kosinski was approached by a fellow Cambridge researcher Aleksandr Kogan, who wanted access to the data he had gathered for the paper. It was for a project he couldn’t talk about in detail. Ultimately, Kosinski said no, and Kogan pursued the research on his own. He created a personality survey. Users were asked to consent to the app taking not only their own profile information from their linked Facebook account but also that of their friends. In all, Kogan’s app collected information from approximately 320,000 users. Facebook has now acknowledged the profiles of at least 87 million of its users, including more than 600,000 in Canada, were harvested. Since the Cambridge Analytica scandal broke, Kogan has claimed he thought what he was doing was perfectly normal.

The data Kogan collected was passed to a company that was working to help elect Donald Trump as president, Cambridge Analytica. It leveraged the data to develop a sophisticated voter-targeting algorithm. Facebook ads could contain messages precisely targeted at the opinions and emotions of specific users. After the election, the CEO of Cambridge Analytica, Alexander Nix, boasted in a press release, “We are thrilled that our revolutionary approach to data-driven communication has played such an integral part in President-elect Trump’s extraordinary win.”

Cambridge Analytica’s claimed role in the election had been broadly known since at least the middle of 2017, but it became the centre of a publicity firestorm when the Guardian and the New York Times published exposés in March 2018 based on the disclosures of Christopher Wylie, a 27-year-old Canadian and former Cambridge Analytica employee.

Wylie revealed the guts of the data collection and voter targeting with details not heard before. Facebook stock dropped nearly 15 per cent in a few weeks (it subsequently recovered) and the hashtag #DeleteFacebook began trending on Twitter as outraged users realized the extent of how the data, collected on the basis of that simple “agree,” had been used for purposes they surely never dreamt of when they signed up.

Then, in February, the US special prosecutor probing Russian interference in the 2016 election, Robert Mueller, indicted 13 Russian nationals associated with a Russian firm called the Internet Research Agency. According to the indictment, 12 of the Russians posed as Americans, created fake social-media personas and groups, including on Facebook and Instagram, and stole the identities of real Americans, to post material designed to disrupt the election process. This effort included purchasing social media advertising to promote the fake groups, the indictment said. The Russians also created fake Twitter accounts. The goal: support Bernie Sanders and Donald Trump; oppose Hilary Clinton and Republicans Ted Cruz and Marco Rubio.

According to the indictment, the Internet Research Agency sought to wage “information warfare” on the U.S.. These incidents have helped feed what was already a growing backlash against Facebook in particular, but other internet giants as well. And it was all enabled by that business model: offer useful and free services and get almost unlimited data in return.

Some experts, including Taylor Owen, a professor of digital media and global affairs at the University of British Columbia, believe that the public outcry over Cambridge Analytica may lead governments in the U.S. and Canada to move from a relatively hands-off approach to Silicon Valley companies, to more aggressive regulation. More regulation is something that Facebook itself lists as a risk factor for shareholders in its disclosures to securities regulators. “If people do not perceive our products to be useful, reliable, and trustworthy, we may not be able to attract or retain users or otherwise maintain or increase the frequency and duration of their engagement,” Facebook’s 2017 annual report says.

Shortly after the revelation that Russians had bought $100,000 worth of ads on Facebook, the company announced that it would no longer be possible for advertisers, including political advertisers, to post ads that nobody but the intended recipient could see. It rolled out a feature, which is being given its trial run in Canada, that allows any Canadian user to see the targeted ads being run by a Facebook page. For now, it only allows users to see the ads currently being run.

In addition to this, as of May 24, 2018, Facebook users anywhere in the world can search an archive of political ads that have appeared on Facebook in the U.S.  Ads placed on or after May 7, 2018 are archived. The organization that placed the ad, as well as the cost and where people who saw the ad were located is disclosed. The feature is to be expanded to other countries in the future.

Facebook has also announced it is winding down its partner-categories program, by which ads could be further targeted based on data provided by outside organizations, including the huge data brokers that collect information on internet users and are key players in the technology that allows ads to follow you around the internet.

In the fall of 2017, Facebook Canada rolled out its Election Integrity Initiative at a news conference attended by Canada’s minister of democratic institutions, Karina Gould. It includes a Cyber Hygiene Guide meant for political candidates to use for tidying up their Facebook account in order to make them less vulnerable to any malicious activity meant to harm Canadian elections. The guide includes instructions on how to recognize tactics used by outside players, how to make an account more secure and how to react to “offensive content.”

Matthew Johnson, director of education at the Canadian non-profit MediaSmarts, says by becoming more media literate, users of online services can become “critically loyal,” in that “you don’t necessarily abandon your political views or you beliefs, [but] you also gain in a way a higher loyalty to the truth, to accuracy.” Most recently, Facebook announced it is going to make its various privacy and data policies easier to understand and discover, in its user interface.

Linda Frum, a member of a Canadian Senate committee that has called for toughening of laws against foreign interference in Canadian elections, also says laws can only do so much.

“There’s all kinds of ways that foreign interests can play a malevolent role in our elections, and some of them are very difficult to crack down on,” she says. “You have to rely on Facebook and Twitter and the other social-media outlets to do a certain amount of vetting.”

But analysts such as Owen see the problem as being more serious than that, rooted in the very nature of Facebook and similar companies as enterprises that need to collect more and more data, and make more and more money from it, in order to keep the profits rolling in and share prices up.

“Facebook, for example, is designed to, by default, collect the maximum of data it can from each of its users,” Owen says. “It is designed to filter the content we see by an algorithm that was programmed by people with intent.” And this intent, he says, will always be to serve the company.

Recommendations for change

In February, 2018, the House of Commons committee on access to information, privacy, and ethics issued 19 recommendations after a year-long review of the Personal Information Protection and Electronic Documents Act, the legislation that applies to companies collecting data from Canadians. The committee didn’t go as far as some privacy advocates might have wanted but did recommend that the government look at how to enhance the importance of consent online.

“We have fundamental freedoms in our country,” says Bob Zimmer, the Conservative MP who chairs the committee. “And we want to make sure that that person’s freedoms are maintained and aren’t given away because we check a check box.”

The Liberal government has yet to announce what it will do in response to the report, but in the wake of the Cambridge Analytica revelations, the president of the treasury board, Scott Brison, has said the government is open to strengthening privacy laws, in unspecified ways, and the privacy commissioner, Daniel Therrien, has launched an investigation into the possible misuse of the Facebook data of Canadians.

In mid-April, Facebook’s head of public policy for Canada, Kevin Chan, appeared before Zimmer’s committee and faced a barrage of questions from the MPs on the company’s privacy practices.

Facebook’s deputy chief privacy officer, Rob Sherman, also appeared by video link from California. Sherman assured MPs that Facebook would allow Canadians to use the same privacy settings and controls it is debuting under the GDPR, the European Union’s General Data Protection Regulation.  It requires stricter rules around giving consent and the right of a user to download all of their data and transfer it to another company if they like. The company has been less clear on whether Canadians will receive the full benefit of the GDPR privacy protections, which went into effect on May 25. Canadian users enter in a contract with Facebook in California, whereas European users do so with a subsidiary in Ireland. Moreover, Facebook is reported to have moved 1.5 billion users outside Canada, the US, and EU who previously came under the jurisdiction of the Irish subsidiary to the main headquarters in the US, taking them out reach of the gdpr.

Deborah Douez, meanwhile, is pursuing her class-action suit against Facebook. It has taken years because Facebook challenged her right to have the trial heard in British Columbia, saying that a clause in its terms of service—the one she agreed to when she signed up—required litigation to take place in California. The British Columbia Court of Appeal sided with Facebook, but last year, the Supreme Court of Canada reversed that, and soon Douez’s case will be heard in court.

She thinks part of the answer for Facebook is to go back to the beginning, to that moment when users click “Agree” and consent to the collection of their data, and force the company to clearly outline its terms of service.

“You have to really study up to understand what’s happening,” she says. “I don’t think people have a clue of how this stuff is going to affect them in the future.”

Terms of Service is published in partnership with The Walrus.

About the author

King's Investigative Workshop