This request received a reply and is in an unknown state. If you created this request, please log in and set a new status.

Access to Facebook Custom Audiences data

Request to:
Facebook Data Requests
Law used:
Data Protection Act, 1988 IE
Status of this request:
Request awaits classification
Summary of Request
Dear Facebook, I wish to get access to any information Facebook has on the presence of any identifier associated directly or not with my account within particular Facebook custom audiences. In essence, this would allow me to understand how marketers might be able to target me with Facebook-based advertisements.

Messages in this request

From << Name Not Public >>
Subject Access to Facebook Custom Audiences data [#58]
Date Dec. 15, 2016, 11:04 a.m.
To Facebook Data Requests
Status Awaiting response

Dear Facebook, I wish to get access to any information Facebook has on the presence of any identifier associated directly or not with my account within particular Facebook custom audiences. In essence, this would allow me to understand how marketers might be able to target me with Facebook-based advertisements.
[... Show complete request text] Kind Regards, << Name Not Public >>
  1. 8 months agoDec. 15, 2016, 11:05 a.m.: << Name Not Public >> sent a message to Facebook Data Requests.
From Facebook – Facebook Data Requests
Subject Re: Access to Facebook Custom Audiences data [#58]
Date Dec. 15, 2016, 11:08 a.m.
Status Awaiting response

Hi, Thank you for contacting us to make a data request. You can access your data on Facebook in several ways. First, you can access your personal data from your account (ex: on your timeline or in your activity log). Second, we provide a tool that allows you to download a copy of your account data. This tool is available from the Account Settings page. For more information, please visit: https://www.facebook.com/help/4051835... To learn more about your data on Facebook, please read the Data Policy: https://www.facebook.com/about/privacy/ This policy describes: • Categories of data being processed by Facebook • Personal data that Facebook receives from Facebook members • Sources of this info, if known • Reasons for processing this data • Recipients or categories of recipients to whom Facebook members’ personal data may be disclosed To access the self-service download tool from your account: 1. Click the account menu at the top right of any Facebook page 2. Choose Account Settings 3. Click the link at the bottom of the page "Download a copy of your Facebook data" Note: We have several measures in place to ensure the security of your information, and will require you to confirm your identity to complete the process and access your account information. Your downloaded file may contain sensitive information. You should keep it secure and take precautions when storing, sending or uploading it to any other services. You can also access the personal data held in your timeline any time by logging into Facebook. If you can’t access your account or don’t have an account, please follow the link below to complete a form and request your data: https://www.facebook.com/help/contact... You may be required to provide additional information to authenticate your identity. Thanks, The Facebook Data Access Request Team
  1. 8 months agoDec. 15, 2016, 11:08 a.m.: Received an email from Facebook Data Requests.
From Facebook – Facebook Data Requests
Subject Re: Access to Facebook Custom Audiences data [#58]
Date Jan. 16, 2017, 3:09 p.m.
Status Awaiting response

Dear Mr << Name removed >> , Thank you for your email. In response to your query regarding the targeting of advertisements, we set out below an explanation of how advertising targeting works and details on how you can learn more, including in relation to Custom Audiences. Please note that the manner in which specific targeting is configured is a confidential technical matter relating to how Facebook Services are engineered. Please read the following information from our About Advertising On Facebook (https://www.facebook.com/about/ads) page to learn more about how Facebook advertising works. To view and adjust your ad preferences: 1. Click the X or V near the top-right corner of any ad on Facebook 2. Select **Why am I seeing this?** You’ll see an explanation of why you’re seeing the ad, and you can add or remove yourself from audiences who are shown that ad. Click **Manage your ad preferences** to see more audiences you’re a part of that influence which ads you see on Facebook, including those advertisers who may separately have your contact details, which can be used for the creation of custom audiences by advertisers. Changing your ad preferences influences which ads you see, but it won’t change the total number of ads you see. Keep in mind that advertisers sometimes ask Facebook to show similar ads to multiple audiences, or to wide audiences. For example, a company might want to reach people who like sports. If you remove yourself from the audience of people who like football, but not from the audience of people who like basketball, you could still see the company’s ad. Note: Facebook always uses information about your age, gender, location and the devices you use to access Facebook when deciding which ads to show you. If you don’t want Facebook or other companies to collect or use information based on your activity on websites, devices or apps off Facebook for the purpose of showing you ads, you can opt out from all participating companies through the Digital Advertising Alliance (http://www.aboutads.info/choices/) in the USA, the Digital Advertising Alliance of Canada (http://youradchoices.ca/) in Canada or the European Interactive Digital Advertising Alliance (http://www.youronlinechoices.eu/) in Europe. You can also opt out using your mobile device settings. For more information about ads on Facebook: * Visit your ads settings (https://www.facebook.com/settings?tab...) * Learn more about Facebook ads (https://www.facebook.com/about/ads/) We hope this assists with your query. For your information, you are also entitled to contact the Office of the Irish Data Protection Commissioner, Canal House, Station Road, Portarlington, Co. Laois, Ireland with any concerns you may have. Kind regards, Alex Privacy Operations Facebook -----Original Message---- From: << Name removed >> << Name removed >> <<email address>> To: Facebook Subject: Access to Facebook Custom Audiences data [#58] Dear Facebook, I wish to get access to any information Facebook has on the presence of any identifier associated directly or not with my account within particular Facebook custom audiences. In essence, this would allow me to understand how marketers might be able to target me with Facebook-based advertisements. << Name removed >> << Name removed >> <<email address>> P ost Address: << Name removed >> << Name removed >> Facebook: paulolivier.dehaye << Address removed >>
-- Legal Note: This mail was sent through a Data Protection Portal. Replies might be published automatically. -----End Original Message-----
  1. 7 months agoJan. 16, 2017, 3:09 p.m.: Received an email from Facebook Data Requests.
From << Name Not Public >>
Subject Re: Re: Access to Facebook Custom Audiences data [#58]
Date Jan. 16, 2017, 3:26 p.m.
To Facebook Data Requests

Dear Facebook, This does not answer my request. I am asking for _all_ the audiences my profile is part of. Through the tool you describe I can only access a very tiny selection of two at the moment, and the selection keeps on changing with high frequency. If Facebook was to comply with the law, I would expect this "Advertisers with your contact info" section to list hundreds of advertisers, even if some have not used the relevant audiences for months. What matters is that I am part of one of their audiences, and this should be reported to me when I request it. Considering that my original request was sent on December 15th 2016, and that it has taken a full month for Facebook to reply, I think two additional weeks to respond to the concerns expressed here seem reasonable. Beyond this, I will make maximal use of my recourse options. Sincerely yours << Name removed >> << Name removed >> PS: I dispute that Irish Data Protection law would solely apply here, or that intellectual property/trade secret concerns would allow Facebook to unilaterally limit what can be disclosed. I am however OK with ignoring this for the moment. Request Number: 58 Reply To: <<email address>> P ost Address: << Name removed >> << Name removed >> << Address removed >>
-- Legal Note: This mail was sent through a Data Protection Portal. Replies might be published automatically.
  1. 7 months agoJan. 16, 2017, 3:26 p.m.: << Name Not Public >> sent a message to Facebook Data Requests.
On Feb. 1, 2017, 10:56 p.m., Paul-Olivier Dehaye wrote:

I have now filed a direct complaint with the Irish DPC regarding this matter.

On Feb. 1, 2017, 10:57 p.m., Paul-Olivier Dehaye wrote:

I have now filed a direct Safe Harbor complaint with TRUSTe regarding this matter (#49139).

Write a comment
From Facebook – Facebook Data Requests
Subject Re: Access to Facebook Custom Audiences data [#58]
Date Feb. 7, 2017, 12:03 p.m.
Status Awaiting response

Dear Mr << Name removed >> , Thank you for your email in relation to this matter. You can use our self-service tool to access your data any time, free of charge. This includes all Custom Audiences associated with your account. To access the self-service tool: 1. Click the arrow at the top right of any Facebook page and select Settings 2. Click Download a copy of your Facebook data below your General Account Settings 3. Click Start My Archive Note: We have several measures in place to ensure the security of your information, and will require you to confirm your identity to complete the process and access your account information. Your downloaded file may contain sensitive information. You should keep it secure and take precautions when storing, sending or uploading it to any other services. On a related note, we have been notified by Truste that you have referred a complaint to them regarding this matter under the Swiss/US Safe Harbor scheme.This complaint relates to matters in relation to which Facebook Ireland Limited ("FB-I") is the data controller and does not involve any data transfers from Switzerland to the United States. Irish law and jurisdiction therefore applies and not the CH/US Safe Harbor framework. Nonetheless, as a matter of courtesy, we will forward this response to Truste for their information, on the basis that it resolves the matter. Kind regards Alex Privacy Operations Facebook -----Original Message---- From: << Name removed >> << Name removed >> <<email address>> To: Facebook Subject: Re: Re: Access to Facebook Custom Audiences data [#58] Dear Facebook, This does not answer my request. I am asking for _all_ the audiences my profile is part of. Through the tool you describe I can only access a very tiny selection of two at the moment, and the selection keeps on changing with high frequency. If Facebook was to comply with the law, I would expect this "Advertisers with your contact info" section to list hundreds of advertisers, even if some have not used the relevant audiences for months. What matters is that I am part of one of their audiences, and this should be reported to me when I request it. Considering that my original request was sent on December 15th 2016, and that it has taken a full month for Facebook to reply, I think two additional weeks to respond to the concerns expressed here seem reasonable. Beyond this, I will make maximal use of my recourse options. Sincerely yours << Name removed >> << Name removed >> PS: I dispute that Irish Data Protection law would solely apply here, or that intellectual property/trade secret concerns would allow Facebook to unilaterally limit what can be disclosed. I am however OK with ignoring this for the moment. Request Number: 58 Reply To: <<email address>> P ost Address: << Name removed >> << Name removed >> << Address removed >>
-- Legal Note: This mail was sent through a Data Protection Portal. Replies might be published automatically. -----End Original Message-----
  1. 6 months, 1 week agoFeb. 7, 2017, 12:03 p.m.: Received an email from Facebook Data Requests.
On Feb. 13, 2017, 2:18 p.m., Paul-Olivier Dehaye wrote:

Suspended TRUSTe #49139 with the following text: """ Dear TRUSTe, I feel that there are unresolved issues within the scope ... Read all

Write a comment
From << Name Not Public >>
Subject Re: Re: Access to Facebook Custom Audiences data [#58]
Date Feb. 15, 2017, 1:30 a.m.
To Facebook Data Requests

Dear Alex, Thank you for your response. You responded to my request with "You can use our self-service [data checkout] tool to access your data any time, free of charge. This includes all Custom Audiences associated with your account." My original request to Facebook was dated December 15th 2016. I observe that my archived checkout results from December 6th 2016 and the newest one from February 13th 2017 are very different as far as ads are concerned, and that indeed the new version of that export now includes a list of "advertisers with [my] contact info". The simplest explanation I see is that the inclusion of that data in the self-service data checkout tool is very new. It feels a bit disingenuous not to acknowledge that in responding to my request. I have a few more questions about the information listed there. 1. Does that particular list cover only Custom Audiences? Are there any other sources for that list than Custom Audiences? Which? 2. What is the process leading up to the inclusion of an advertiser into that list? I understand the concepts of hashing and salting. Is each advertiser uploading to Facebook a list of hashes of email addresses they have (with the hashing done client-side)? Or is the list uploaded directly "in the clear"? Is there salting, per advertiser? Are any other identifiers used, such as phone numbers? 3. Is this list complete, or is it scoped in some way for time? What determines the boundary? Does Facebook have more extensive data but only discloses a given time range? 4. Why are some advertisers listed multiple times? Sincerely yours << Name removed >> << Name removed >> Request Number: 58 Reply To: <<email address>> P ost Address: << Name removed >> << Name removed >> << Address removed >> << Address removed >>
-- Legal Note: This mail was sent through a Data Protection Portal. Replies might be published automatically.
  1. 6 months agoFeb. 15, 2017, 1:30 a.m.: << Name Not Public >> sent a message to Facebook Data Requests.
On Feb. 18, 2017, 10 p.m., Paul-Olivier Dehaye wrote:

Withdrawn the complaint to Irish DPC, which had just notified me they had contacted Facebook on my behalf: Dear Irish ... Read all

On March 14, 2017, 10:37 a.m., Paul-Olivier Dehaye wrote:

Due to lack of response, the procedure has been reopened with TRUSTe as #49616.

On March 14, 2017, 11:02 a.m., Paul-Olivier Dehaye wrote:

Due to lack of response, the procedure has been reopened with the Irish DPC.

Write a comment
From Facebook – Facebook Data Requests
Subject Re: Access to Facebook Custom Audiences data [#58]
Date March 31, 2017, 6:35 p.m.

Dear Mr. << Name removed >> Thank you for your email. As an initial matter, we should point out that many of your requests are not access requests falling within the scope of section 4 of the Irish Data Protection Acts. Rather, they are general queries about the ways in which the Facebook service works. While we are not under any legal obligation to respond to such questions, we nonetheless strive to be as open as possible about our products, and appreciate your interest in our platform. We have therefore endeavoured to provide a response to each of your questions in turn: "1. Does that particular list cover only Custom Audiences? Are there any other sources for that list than Custom Audiences? Which?" The list which you are referring to, as provided in your DYI data, gives you access to a list of advertisers whose ads you have seen because you are in their Custom Audiences. There are no other sources for this list. "2. What is the process leading up to the inclusion of an advertiser into that list?" You can learn more about how custom audiences are created on the following page on our help center: https://www.facebook.com/business/hel... "I understand the concepts of hashing and salting. Is each advertiser uploading to Facebook a list of hashes of email addresses they have (with the hashing done client-side)? Or is the list uploaded directly 'in the clear'?" As is explained in the help center page we have referred you to above, the hashing of data is completed locally, and the hashed data is then uploaded over a secure channel to Facebook. "Is there salting, per advertiser?" No. "Are any other identifiers used, such as phone numbers?" A list of the data types which can be used for Custom Audiences is available on this page in our help center: https://www.facebook.com/business/hel... "3. Is this list complete, or is it scoped in some way for time? What determines the boundary? Does Facebook have more extensive data but only discloses a given time range?" In order to inform and be transparent with our users, we have architected systems which enables them to access the Custom Audiences they were included in for the previous 8 weeks. The list you refer to which we make available in DYI is a complete copy of that data. Data beyond this period is not captured by these systems and is not stored in readily accessible form. "4. Why are some advertisers listed multiple times?" The reason that some advertisers are listed multiple times is that some advertisers use multiple accounts while advertising. We hope provides you with the information you require. Please do let us know if we can be of further assistance. Should you have any continuing concerns about this matter, you are entitled to contact the Office of the Irish Data Protection Commissioner, Canal House, Station Road, Portarlington, Co. Laois, Ireland. Regarding your reference of this matter to Truste, as we have explained to you previously, Facebook Ireland Limited is the data controller regarding your use of the Facebook Service. As a result it is the entity which is responsible for responding to questions such as these. Your query is not directed to issues regarding data transfers to Facebook, Inc.; nor is this a matter that Facebook, Inc. would be in a position to assist you with, given it is not the data controller for the Facebook Service outside of the United States and Canada. Therefore, this is not a case which has any connection to the CH/US Safe Harbor scheme (and, correspondingly, Truste). However, we will nonetheless forward this response to Truste for their information. Yours sincerely, Alex Privacy Operations Facebook -----Original Message---- From: << Name removed >> << Name removed >> <<email address>> To: Facebook Subject: Re: Re: Access to Facebook Custom Audiences data [#58] Dear Alex, Thank you for your response. You responded to my request with "You can use our self-service [data checkout] tool to access your data any time, free of charge. This includes all Custom Audiences associated with your account." My original request to Facebook was dated December 15th 2016. I observe that my archived checkout results from December 6th 2016 and the newest one from February 13th 2017 are very different as far as ads are concerned, and that indeed the new version of that export now includes a list of "advertisers with [my] contact info". The simplest explanation I see is that the inclusion of that data in the self-service data checkout tool is very new. It feels a bit disingenuous not to acknowledge that in responding to my request. I have a few more questions about the information listed there. 1. Does that particular list cover only Custom Audiences? Are there any other sources for that list than Custom Audiences? Which? 2. What is the process leading up to the inclusion of an advertiser into that list? I understand the concepts of hashing and salting. Is each advertiser uploading to Facebook a list of hashes of email addresses they have (with the hashing done client-side)? Or is the list uploaded directly "in the clear"? Is there salting, per advertiser? Are any other identifiers used, such as phone numbers? 3. Is this list complete, or is it scoped in some way for time? What determines the boundary? Does Facebook have more extensive data but only discloses a given time range? 4. Why are some advertisers listed multiple times? Sincerely yours << Name removed >> << Name removed >> Request Number: 58 Reply To: <<email address>> P ost Address: << Name removed >> << Name removed >> << Address removed >> Facebook: paulolivier.dehaye
-- Legal Note: This mail was sent through a Data Protection Portal. Replies might be published automatically. -----End Original Message-----
  1. 4 months, 2 weeks agoMarch 31, 2017, 6:35 p.m.: Received an email from Facebook Data Requests.
From << Name Not Public >>
Subject Re: Re: Access to Facebook Custom Audiences data [#58]
Date April 10, 2017, 12:48 p.m.
To Facebook Data Requests

Dear Facebook Thank you for your responses to 1., 2., and 4., which are complete answers to my questions. As for 3., I think the implementation of your systems is deficient if you do store this information (even in hard to reach form) but do not make it available to your users who ask. Please provide me with a full list of "advertisers with [my] contact info" for my account, without scoping for 8 weeks. My understanding is that while the data is not in a readily accessible form, the difficulty of the access should be balanced against the data subject's rights and fundamental freedoms. If you were not to disclose this information, I would then ask TRUSTe to open an arbitration case to present my arguments on why you should. Sincerely, << Name removed >> << Name removed >> Request Number: 58 Reply To: <<email address>> P ost Address: << Name removed >> << Name removed >> << Address removed >>
-- Legal Note: This mail was sent through a Data Protection Portal. Replies might be published automatically.
  1. 4 months, 1 week agoApril 10, 2017, 12:48 p.m.: << Name Not Public >> sent a message to Facebook Data Requests.
From Facebook – Facebook Data Requests
Subject Re: Access to Facebook Custom Audiences data [#58]
Date May 2, 2017, 7:09 p.m.

Dear Mr << Name removed >> , Thank you for your further inquiry in this matter. Where the provision of information would involve disproportionate effort on the part of a data controller, there is an exemption from the general right of access for data subjects (see section 4(9)(a) of the Irish Data Protection Acts 1988 and 2003 and Recital 40 of Directive 95/46/EC). Our systems enable us to provide you with access to the Custom Audiences you were included in for the previous 8 weeks, and we also provide you with a wealth of other information and controls over advertising on Facebook. As examples, we have previously referred you to the following links: https://www.facebook.com/about/ads https://www.facebook.com/settings?tab... https://www.facebook.com/ads/preferences https://www.facebook.com/business/hel... https://www.facebook.com/business/hel... The additional data you are seeking is not retained in a form that can feasibly be accessed on a per user level and (particularly once the above factors are taken into account) we consider it would require disproportionate effort to locate it and provide it to you. We hope you found this response helpful, however please let us know if we can be of further assistance. Yours sincerely, Alex Privacy Operations Facebook -----Original Message---- From: << Name removed >> << Name removed >> <<email address>> To: Facebook Subject: Re: Re: Access to Facebook Custom Audiences data [#58] Dear Facebook Thank you for your responses to 1., 2., and 4., which are complete answers to my questions. As for 3., I think the implementation of your systems is deficient if you do store this information (even in hard to reach form) but do not make it available to your users who ask. Please provide me with a full list of "advertisers with [my] contact info" for my account, without scoping for 8 weeks. My understanding is that while the data is not in a readily accessible form, the difficulty of the access should be balanced against the data subject's rights and fundamental freedoms. If you were not to disclose this information, I would then ask TRUSTe to open an arbitration case to present my arguments on why you should. Sincerely, << Name removed >> << Name removed >> Request Number: 58 Reply To: <<email address>> P ost Address: << Name removed >> << Name removed >> << Address removed >>
-- Legal Note: This mail was sent through a Data Protection Portal. Replies might be published automatically. -----End Original Message-----
  1. 3 months, 2 weeks agoMay 2, 2017, 7:09 p.m.: Received an email from Facebook Data Requests.