Facebook, Google and social media apps track you online. Protect yourself with these steps

Everybody's hooked. Photo / Getty

DIGILIFE_STRAP

They pass around your private information and manipulate your attention so they can sell it. Yet still we spend hours a day on the world's biggest social media platforms - but should we? This Herald series explains exactly what's at stake when you like your friend's Facebook post, Google symptoms when you're sick and share fake news.

She was six months' pregnant when the anti-abortion lobbying started coming in.

Auckland mum-to-be Natalia Lopez had grown accustomed to the steady stream of cots, prams and baby onesies that were mirroring her online searches.

The same could not, however, be said when she scrolled down her newsfeed one night to see a graphic anti-abortion video clip from Family First buried in among posts from her family and friends.

She'd never seen anything from the organisation before and it seemed a strange coincidence to suddenly be receiving messages so pertinent to her current situation.

The video that hit her newsfeed was titled "Before you defend abortion, be sure to understand what you're defending" and featured a graphic animation of a foetus being ripped apart limb by limb during a second trimester abortion.

"What disturbs me most about it was that they didn't know what I was going through when I was targeted with these ads," Lopez toldthe Herald.

"I could have been in the middle of making one of the toughest decisions a woman can make and to have a lobby group pushing their view on to me just didn't seem right."

Lopez was further annoyed because the information on the medical procedure was being skewed to favour the anti-abortion argument.

"It was all emotionally loaded. And the animation also depicted the foetus much larger and with more defined features than you would see during that stage of the pregnancy."

Lopez tagged the video as misleading and hasn't seen anything from Family First since then. (The Herald checked with national director Bob McCoskrie, who told us the video was targeted at anyone over 18 and that 142,000 people had watched it on Facebook.)

This is simply the world we live in these days. Social media firms know when we're engaged, pregnant, on holiday, sick or worried about balding. Companies are watching our movements online to ensure they can feed us the most relevant information possible – all in the hope of securing that sale.

Lopez could of course simply quit Facebook.

But in 2020, that's not so easy. The likes of Facebook, the Facebook-owned Instagram and WhatsApp, and Twitter have become integral to how we keep up with family and friends. And for most of us, they're intertwined with our work lives, too.

For most of us, checking our social feeds is the first thing we do when we wake, and the last thing we do before sleeping. And in between those social media bookends to our day, we spend a staggering six hours online each day on average. But how much do you really know about those social media platforms and what data they are collecting about you?

Think about everything you've googled. Your secrets, your health concerns, your symptoms, your hopes, insecurities – everything punched into an algorithm and stored out of view until it later becomes relevant. How much is all this information worth? And how powerful is it?

And did you know that your attention is being manipulated to keep you on these platforms so your attention can be sold to advertisers? You're not just getting a newsfeed from the friends and family you follow - an algorithm has tracked your interests and dishes up the posts that will keep you hooked. The company introduced the like button on its posts so you keep going back for that dopamine hit.

As Steve Andriole recently wrote in Forbes,  "It's worth saying again: Every time we blog, tweet, post, rideshare, order from Amazon, rent an Airbnb – or anything that leaves a digital trail – we feed into this surveillance capitalism."

You may well have been broadly aware that Facebook tailors your newsfeed to interests you've revealed while using the social network.

But did you know that Facebook tracks you even when you're not using Facebook?

We know this because in January Facebook launched its Activity Tracker feature, that reveals many businesses share your real-world activity with the social media giant.

Facebook is to be commended for finally making this information transparent - albeit with some nudging from regulators and politicians - but the scope of its information-harvesting is still staggering.

For example, even if you're a Domino's fan but have never mentioned the brand on Facebook - or even pizza - the social network might still throw up ads for a discount off your next Simply Cheese.

That's because Domino's is one of thousands of companies that have a business relationship with Facebook that sees them share your so-called "off-Facebook" activity with the social network - which might be a visit to a website, a search, or a purchase from one of its stores.

Facebook says sensitive data, such as health and financial information, are not included in the information trading. But the Wall Street Journal and others have noted that various health and fitness, weight loss, heart rate and maternity wear and even ovulation apps have shared information with the social network.

A Wall Street Journal reporter complained about targeted apps related to her recent download of the What to Expect pregnancy app. Privacy International, a British-based charity, reported in September that several menstruation cycle tracking apps have been sharing their users' intimate details with the social network – including the last time a user had unprotected intercourse. These apps included Maya (more than 5m downloads) and Period Tracker MIA Fem: Ovulation Calculator (over 2m users).

BIGTECH2

The brighter news: Facebook now lets you see most of the businesses that have shared information about you, and a broad outline of the activity they've recorded (it says for "technical reasons" not everything is revealed to you. And that includes, for example, items you've put in an online shopping cart).

While logged to Facebook, navigate to "Office Facebook Activity" through settings or visit it directly here.

From that screen, you can also turn off tracking, company by company, if you don't like personalised ads. But pack a lunch. This reporter had some 595 apps and websites sharing off-Facebook activity (including the NZ Herald, among other local and international publishers).

Turning them off one by one takes time.

Facebook does offer an option to zap all sharing at once. Go to facebook.com/off_facebook_activity/activity_list then click Manage Future Activity. But there is a catch - you'll be logged out of sites and services where you've chosen to log on using your Facebook details - a handy time saver. For those sites - if you want to turn them off - you'll have to change your account details so you log on with your email address and a password. (As ever, Facebook is banking on you find this too inconvenient, and throwing in the towel).

98 pieces of information

More broadly, the Washington Post recently revealed that Facebook actively tries - through monitoring your on- and off-Facebook activity - to discover 98 separate pieces of information about you to help it make the billions of dollars it does every year through targeted ads.

According to a Washington Post story which revealed how the social network targets advertisers, the 98 points include perhaps unsurprising things like your gender and age, but also data points such as whether your politics are conservative or liberal, whether you're a heavy buyer of alcohol, what groceries you buy and the types of holidays you enjoy.

If you think that sounds Big Brother, then you can take a smidgen of comfort from the fact Facebook is less intrusive than it used to be. The Cambridge Analytica scandal that made headlines in 2018 revealed that people who took a personality test on Facebook in 2016 (including 63,714 Kiwis) not only shared their personal data with Donald Trump's presidential campaign (via fine print most had not read) but inadvertently volunteered their Facebook friends' data to be shared, without their knowledge, as well.

That loophole is now closed, but there's still plenty of snooping going on, even if these days it's confined to your own account.

To retake control, visit Facebook.com/settings.

Then click on the Ads tab then your interests. From there, you can delete various "interests" that Facebook has assigned to you.

You can also opt out of ads that are delivered to your feed based on your relationship, employment or education, or data provided by partners.

While you're on the Facebook settings screen, also take some time to review your Privacy options - who sees various elements of your profile, and who sees posts or photos by default.

But do note that you have to separately visit the Location and Face Recognition tags to stop tracking or your location displayed or your face being automatically recognised and tagged as you when friends take pictures.

And also bear in mind that you have to make regular repeat visits to Facebook.com/settings as the goal-posts frequently shift.

Going incognito on Google

Google is the only company that comes close to rivalling Facebook's reach of some 2.2 billion users. At last count, 3.5 billion searches a day are made on the site. Simon Parkin illustrated its power in a 2018 Guardian article.

"If Google is the engine that drives the internet, personal information is the oil that makes it purr. Via its Maps app, it knows where you've been, how you got there (foot, car, bus, train), how long you stayed and whether or not it was your first visit," Parkin wrote.

Don't believe him? Click google.com/maps/timeline while logged into any Google service, and you'll see a map of everywhere you've been since you first used Google on your phone (if you've had location tracking turned on).

"The company stores your search history across every device on which you're logged in, while algorithms reportedly scour your emails for signs that you might be pregnant, engaged or unwell," Parkin adds.

Privacy Commissioner John Edwards wants Facebook and Google to practice "privacy by design." That is, enabling key privacy features by default or at least not burying them under layers of settings.

"Google likely knows your age, gender, hobbies, career, interests, relationship status, every YouTube video you've watched, every image you've searched for, whether or not you're depressed and, possibly, even why you're depressed before you do."

Go to myactivity.google.com/myactivity for a journey through your search history, google.com/settings/ads for your ad profile, and myaccount.google.com/permissions for Google's list of which apps you use, and when and where you use them.

But wait, there's more. Google also collects data from your calendar, your Google hangout sessions, your location history, the music you listen to, the Google books you've purchased, websites you've created via its services, the phones you've owned, the pages you've shared and how many steps you walk in a day, by Parkin's analysis.

If you think he's being over the-top, head to google.com/takeout to download all of your information - though be warned it will likely run to gigabytes, so go and make cup of tea, or five, while you wait for it to funnel down.

Similarly, Facebook lets you download your data. Start here.

As Parkin said, if this information was held by a government, it would inspire widespread civil liberty marches.

In June last year Google added new privacy controls, which make it easier to disable or temporarily disable tracking features.

Many are already familiar with the Incognito mode offered by Google's Chrome web browser (hit the three dots on the top right of Chrome to enable what some - cough - call the Porn Mode), which stops your search history being recorded, or sites leaving "cookies" tracking software on your computer (which can be used for targeting advertising, but which also help to enable time-saving "remember me" log ons).

Now, Google has expanded its Incognito options to include YouTube and the stealth function will shortly be added to Maps and Search, Google chief privacy officer Keith Enright told the Herald.

Google's new privacy options are worth their salt, but are not that easy to find amid layers of menus. The best way to tweak your ad and privacy settings is to proceed directly to the My Account screen.

On Twitter, head here to remove your allocated "interests" or "inferred interests from partners".

Help on the way

After the Christchurch mosque shootings, the Australian Government has taken a notably more front-foot approach than ours to cracking down on social media.

A law change means social media platforms can now be fined up to 10 per cent of their revenue, or their executives jailed for three years, if they fail to take "swift" action to take down "abhorrent" content.

Google's Timeline feature (google.com/maps/timeline) lets you see everywhere you've been, over the years, when using Google software on your Android or iPhone with location on.

The ACCC - the Aussie equivalent to our main consumer watchdog, the Commerce Commission - received a A$27 million top-up in December, earmarked for extra monitoring of digital platforms.

And late last year, the ACCC filed a federal case against Google alleging it misled consumers into thinking they had disabled location-tracking - when, in fact, the search giant was still able to track every move they made - not realising that what seemed a one-stop process actually required two steps (our Commerce Commission is keeping a "watching brief" on the case. Google is defending the action and since the period of alleged offending has added its new incognito mode, mentioned above).

The Harmful Digital Communications Act (2015) has given Kiwis a useful new tool when they think they are being cyberbullied. The law came with an "approved agency" to enforce it: NetSafe, which can advocate on your behalf if you have an issue with the likes of Facebook, Twitter or Google. You might find it impossible to get someone on the phone from a Big Tech company, but NetSafe can.

In terms of concerns about the social media platforms invading your privacy, the Privacy Act (1993) has not been a hugely effective tool - unsurprisingly, given it was authored before the internet went mainstream.

An update to the act is still going through Parliament (it passed its second reading late last year) but is expected to go into force later this year.

Privacy Commissioner John Edwards did not get several items on his wishlist, including the ability to levy fines of up to $1m on misbehaving companies, or a provision for "data portability" - meaning you own information collected about you, rather than the company which harvested it, and you can take it with you after you close an account.

But he did get others included, such as mandatory data breach disclosure - so soon, any organisation will be required to tell you if it loses your data to hackers.

And, in terms of social media privacy for everyday users, Edwards points to two new powers his office will enjoy under the new law.

First, "It clarifies the law so there is no room for ambiguity about overseas companies and whether they come under the jurisdiction of our privacy law," he says.

In a 2018 stoush with the Privacy Commissioner's office, Facebook said it did not have to comply with the NZ Privacy Act because it had no office based here:

"When the Privacy Bill comes into force, I'll have the ability to issue compliance notices to business to improve the digital environment for consumers, whether you are based here, or just doing business here," Edwards said.

The Privacy Commissioner said he would be taking aim at what he calls "click-to-consent", or one-click acceptance of terms and conditions that can run to thousands of words of legalese.His message to Big Tech: Such deliberate attempts to bury privacy-invasion provisions deep in the fine print must stop. "While it is true that neither the current law nor the Privacy Bill allows the commissioner to issue the massive fines available to my colleagues [in Europe and the US], you will be liable for damages for any harm caused by the deception or obfuscation of your purposes," Edwards said.

While Edwards is optimistic, it could be that test cases are required, given Facebook's moving-feast terms and conditions have variously had its NZ membership under Irish and now United States privacy law - at least in its view.

The Privacy Commissioner does give Facebook and Google credit for recently being more transparent about how information is shared, and giving their users more control.

But Edwards still laments that people have to dig through layers of settings to find then switch on the new safeguards.

He would prefer the Big Tech companies take what he calls a "privacy by design" approach, with elements like location tracking and face-recognition turned off by default, and only enabled with informed user consent. As things stand, we're some distance from Edwards' ideal.

• Part One: Big Brother is watching you
• Part Two: Fake News - a threat to democracy?
• Part Three: Kids and social media
• Part Four: How to beat smartphone addiction