Facebook Keeps A History Of Everyone Who Has Ever Poked You, Along With A Lot Of Other Data (BLOG)

Across the pond, European law grants citizens a “right to access,” meaning that companies have to provide a person with all of the personal data they have on them if they request it. An Austrian-based group called Europe v. Facebook has posted a couple of the reports compiled by the social networking giant everyone loves (and loves to hate).


Facebook doesn't forget pokes

Most of you probably know that Facebook knows a lot about you. But did you know that if you were to print it out, it might take up about 880 pages? I went through one of the lengthy dossiers from Europe v. Facebook. Here are the juicy bits for a female Facebook user with the initials ‘L.B.’ who has been a member of the site since 2007:


Facebook keeps track of every person who has ever poked you. Facebook user L.B. has been poked over 50 times from 2008 through 2011 (K.D. was a frequent poker in 2008, though a user by the initials T.V. is currently the pokiest of L.B.’s friends).


Facebook keeps track of the devices associated with your account
The report includes a list of the machines that L.B. has used Facebook from, how often she has signed in from the machine, as well as a list of all the other Facebookers who have logged in on that machine. As pointed out recently by blogger Nik Cubrilovic, Facebook leaves cookies on computers that have the ability to track users even when they’re logged out of Facebook. Facebook now plans to scale back that cookie use, but it still will want information about who’s signing in on which machines to thwart hackers, block spammers, and know which computers are in Internet cafes, for example. Given the hundreds of millions of users the company has, “Facebook is pretty much indexing all computers worldwide,” says Max Schrems of Europe v. Facebook.
Facebook keeps track of every event you’ve ever been invited to, and how you responded to the invitation. L.B. has attended about 29 events since 2009, has declined nine invitations since 2010, and has failed to RSVP at all to about 75 events dating back to 2007 (how rude!). The inviter, location and name of the events have been blacked out on the report posted to Europe v. Facebook’s site for privacy reasons.


A list of exes?
Facebook keeps track of everyone you defriended and when. As some have pointed out, the Facebook Timeline will also expose this information to anyone who’s interested. L.B. has removed over a dozen of her friends over the years. The Facebook report also includes a list of friend requests that L.B. rejected.
Facebook includes a history of messages and chats in the report.Europe v. Facebook says that some users say their reports include messages they’ve deleted.

If you want to see all 880 glorious pages yourself, you can download the filehere [pdf]. It also includes things you’d expect, like a list of all of L.B.’s friends and personal information from her profile page.

(What I was surprised not to see here was a list of the things that L.B. had looked at and/or clicked, such as other peoples’ profile pages, photos, or status updates. As we have seen before, that is something Facebook knows about its users. Update, Sept. 28: While “real-time activities” are missing from L.B.’s report, you will see them in another report on the site, for M.S.)

So, just keep this in mind next time you’re on Facebook. All your pokes are going into a permanent record.

European users can request their information with this Facebook form(instructions here). Max Schrems of Europe v. Facebook put his request in to Facebook’s Ireland office and says it took the company about 30 days to send his report, and that it arrived on a C.D. from California.

One thing that I found a bit concerning about the process is that it only requires a photo of your government i.d., your name, and birthdate to confirm your identity. Given how easy it is to get one’s hands on someone else’s ID (say if you’re dating someone and s/he leaves a wallet about your house), I could imagine some scenarios in which this process could be abused.