Following the news of a major Facebook data breach affecting over 530 million users, American University student Zamaan Qureshi decided to look into exactly what data the social media site had gathered about him.
Qureshi said in a Twitter thread Sunday that he was "unsurprised to learn that Facebook is following [him] all over the internet." Qureshi's tweet included a video of a screen recording showing the files he downloaded on his computer as well as some of the information certain websites gave to Facebook.
Qureshi is on The Real Facebook Oversight Board, a watchdog organization composed of the social media giant's most vocal critics that formed in 2020.
The board is a project developed by The Citizens, a U.K.-based advocacy group that includes Guardian and Observer journalist Carole Cadwalladr, whose reporting exposed the Facebook-Cambridge Analytica data scandal in 2018.
As a member of this board, Qureshi told Newsweek he was following the data breach closely. He discovered his data was included in the beach after he used the new phone number lookup feature on the "Have I Been Pwned" website.
"I've been aware that Facebook collects user data when you're not on the Facebook platform and that was concerning to me," Qureshi said. "[Facebook] says that they're transparent about how they do data collection, so I wanted to see if that's actually the case."
Qureshi downloaded his data through the Settings tab on Facebook and found "dozens" of folders and subfolders of information, including contact information and messages. He then found the Off-Facebook activity folder that showed pages of links he had visited over the past three years.
According to Facebook, Off-Facebook activity is a summary of activity that businesses and organizations share with the company about users' interactions, such as visiting their apps or websites. This activity includes interacting with websites and apps that users log into using their Facebook profiles. Businesses and organizations share this information with Facebook to "personalize user experience" by showing relevant ads, introducing users to new products, services and events, according to Facebook's website.
Qureshi found that Facebook knows information like when he ordered pizza on the Domino's Pizza app and that he applied to Fordham University.
Facebook said it requires these businesses and organizations to give notice to people before using these tools collect track user activity.
Qureshi said he ideally would like to leave Facebook, but as a college student in a pandemic, he has to use the app because so much of the school's clubs, activities and social events run on Facebook.
In the meantime, he said he optimized his account to not collect data.
Through Settings on the Facebook website or mobile app, users can view the apps and websites that have shared their activity with Facebook, download this information, clear their Off-Facebook activity history, and turn off future tracking.
Even if users turn off future activity, Facebook said will still receive data from businesses and organizations users visit. According to the Facebook website, Off-Facebook activity "may be used for measurement purposes and to make improvements to our ads systems, but it will be disconnected from your account."
Facebook said users will still see the same number of relevant ads, based on ad preferences and actions taken on Facebook.
Turning off future Off-Facebook activity will log users out of apps and websites they signed into using their Facebook log-in information and will prevent users from using their Facebook to log into other apps and websites in the future.
Qureshi hopes his thread will show people who are not constantly up-to-date on what's going on in the tech world will make some changes.
"I hope what my thread has done is show people what sort of data is being collected on them, even when they're not on Facebook," Qureshi said. "But at the end of the day, the problem is that [Facebook's] business model is to monetize user information to maximize profit over privacy."
Qureshi said the online data of young people who grew up with social media are especially at risk.
"Being completely unaware of what was going on, but having that data collected, I just think is incredibly concerning," Qureshi said. "We are completely powerless to these tech giants that sort of have full control and a full social profile of who we are."
Business Insider reported earlier this month that the personal data of 533 million Facebook users was posted on a hacking forum that could be used to commit fraud.
The data includes phone numbers, email addresses, full names, birth dates, location and other Facebook biography details.
According to a Facebook spokesperson, this data breach occurred in 2019 and was already addressed by the company.
Facebook also said that Off-Facebook activity is not related to the 2019 data scrape and said users can visit Have I Been Pwned to check if their phone numbers or emails were part of this breach.