What personal information is collected by Facebook?

Facebook collects a significant amount of personal information from its users. This includes information that users actively provide when signing up for and using the service, as well as data that is passively collected by Facebook as users interact with the platform and third party services.

Information users provide to Facebook

There are several categories of personal information that users directly provide to Facebook when registering for an account and filling out their profile:

Basic account information – When signing up for a Facebook account, users must provide a name, email address or mobile number, password, date of birth, and gender.

Profile information – Users can add a profile photo, biography, location, relationship status, family members, education history, work history, and more.
Posts and messages – Any posts, comments, private messages, and chat conversations are stored by Facebook.
Contacts and connections – When users sync their contact lists or send friend requests, they provide Facebook with information about their connections.

Interests and other preferences – Pages that a user follows, ads they click on, events they respond to, and more provide Facebook with information about their preferences and interests.
Payment information – For users that make purchases through Facebook, such as in games, the platform stores payment card details and billing addresses.

In addition to information that users actively add to their profiles and timelines, there are also actions they can take that expressly communicate information about themselves to Facebook:

Like, share, comment – These actions on friends’ content provides information about the user’s opinions and stances.
Login activity – The services that users choose to login to via Facebook impart information about their third-party accounts.
Use of reactions – The specific emotional reaction chosen for a post reveals how the user feels about certain content.

polls – Taking polls informs Facebook about a user’s perspectives.
Surveys – Filling out forms and surveys directly provides personal insights.
Seller ratings – Leaving feedback and ratings for purchases tells Facebook about shopping habits.

Information Facebook gathers passively

In addition to the information that users actively provide, Facebook also utilizes its platform, pixels, and third party partnerships to passively gather a wealth of personal data about its users as they interact with Facebook and use the internet. Some examples of passive data collection include:

IP address and device identifiers – IP addresses can be used to determine location and internet service provider information. Device identifiers like cookies help track users across sites and services.
Usage data – Metrics around how long users spend on the platform, what content they interact with, how frequently they log on, what browser/os they use, etc.

Progress on games – For users that play games via Facebook, all associated gameplay data is collected.
Pixels on third party sites – Facebook’s omnipresent pixels and social plugins allow tracking across the internet.
Partnerships – Data sharing agreements with companies like Experian provide additional information about users.

Facial recognition – Facebook’s computer vision technology identifies users in photos and videos.
Metadata – The company extracts metadata from photos and videos uploaded by users.
Transactions – Facebook tracks shopping activity and interactions with businesses.

Locations – Through options like Nearby Friends and location tags, users provide real-world location information.

How Facebook uses personal information

Facebook leverages the vast trove of personal information described above for the following purposes:

To customize and target ads – User data helps serve relevant, highly targeted ads.

To optimize the user experience – Information like usage patterns helps enhance the platform’s design.
To provide measurement insights – Analytics on posts and ads informs marketing efforts.
To conduct research – User data may be used for research projects and patent development.

To train AI systems – Massive datasets help machine learning and artificial intelligence initiatives.
To enable connections – Location, contacts, interests etc. facilitate linking users with people and groups.
To promote safety and security – Personal details help with identity verification and preventing harmful conduct.

To comply with legal obligations – Facebook may be compelled to share certain information with authorities.
To develop new services – User trends may inspire creation of new Facebook-owned platforms and apps.

Information Facebook makes available to users

Facebook provides users with various options to review and manage the information associated with their accounts. Here are some of the key sources of personal data visibility and control:

Activity log – Thisshows users’ own engagement on Facebook, like posts, searches, reactions, comments etc.
Access your information – Users can download all information Facebook retains about them.
Ad preferences – The ad preferences page displays inferred user interests used to target ads.

App and browser data – Shows apps and browsers permitted to send activity data to Facebook.
Locations – Provides map of locations tracked and ability to clear history.
Recognition data – Users can view and delete face recognition template for themselves.

Additionally, the platform surfaces ongoing notifications and prompts regarding how data is being collected and used, such as:

Consent for facial recognition
Reminders about inactive apps still receiving data

Notices when downloading personal information
Permissions required when apps want access to data
Notifications when tagged in photos

Alerts about login attempts from unrecognized devices

Limitations on gathering and usage

While Facebook collects a vast array of personal information, there are certain limitations and restrictions in place:

Age restrictions prevent children under 13 from having accounts and limit data collection from 13-17 year olds.

Users can opt out of facial recognition.
Tracking and ad targeting can be limited through privacy settings.
Users can object to processing of their data under GDPR rights.

Deceased users can have accounts memorialized or permanently deleted.
Downloading data is rate limited to prevent abuse.
Users can appeal violations of Facebook’s data policy.

Data from third party partners must adhere to Facebook’s privacy policies.
Facebook participates in global privacy frameworks like APEC CBPR and TRUSTe.

Major controversies around data practices

Despite its privacy controls, Facebook has still faced scrutiny over its data practices including:

Cambridge Analytica scandal involving misuse of millions of users’ data.
phone number provided for 2FA was used for advertising.
Patent filing revealed plans to estimate creditworthiness from user data.

Violation of 2011 consent decree around privacy settings.
Facial recognition without obtaining explicit consent.
Hidden tracking of users who opted out of platform via Like buttons.

Large number of data breaches exposing user info.

These incidents highlight the tension between Facebook’s business model built on data collection and shifting public expectations around data privacy.

Facebook’s response and path forward

In response to criticism around its handling of personal information, Facebook has taken the following steps:

Simplified privacy settings and tools for users.
Enabled end-to-end encryption across messaging services.
Implemented data use limitations like Off-Facebook Activity controls.

Developed techniques like differential privacy to anonymize data.
Paused facial recognition rollout.
Hired privacy staff to conduct impact assessments.

Announced goal of compliant with GDPR globally.
Funded external privacy research projects.

However, many advocates argue the core business model is incompatible with privacy expectations, and that Facebook has not gone far enough to reform itself. With ongoing regulatory pressure, the company will likely have to make further concessions around how personal data is leveraged in the future.

Conclusion

Facebook’s massive collection of personal user information fuels its advertising-driven business model but also raises risks around privacy and ethical data practices. While the company has given users some transparency and control around their data, controversies continue to emerge. With public awareness and regulatory scrutiny growing, Facebook faces increasing pressure to place meaningful limits on how it gathers and monetizes the information of billions of people.