You Are the Product

A few years ago, Facebook suggested I connect with someone I hadn't spoken to in over a decade — a former colleague from a job I'd left long before I ever created an account on the platform. We had no mutual friends there. I had never searched for her name. I had never, as far as I could recall, typed it anywhere Facebook could plausibly have seen. And there she was, sitting near the top of my "People You May Know" list, as if the algorithm had simply been waiting for the right moment to surface her.

My first reaction was the mildly pleasant surprise most people have in that moment — oh, I haven't thought about her in years. My second reaction, a few seconds later, was the one that actually matters for this article: how does it know that?

I never found a clean answer, and that itself is instructive. The honest possibilities are all a little uncomfortable. Maybe she had uploaded her phone contacts at some point, and my old number was still in them. Maybe a mutual acquaintance had done the same. Maybe our devices had simply been in the same place often enough, years ago, for Facebook's location signals to draw a line between us that neither of us had drawn ourselves. The point isn't which mechanism it was. The point is that the connection existed in Facebook's model of the world before it existed in mine.

The Byproduct That Became the Business

The first three articles in this series covered Windows and Google, and both involved a version of the same reassurance: the data collection was a mechanism, not the whole of the product. Windows has an actual sale behind it — you or a manufacturer pays Microsoft for a license, and the telemetry is monetization layered on top of a transaction that would exist without it. Google is less clean, because nobody pays for search or Maps directly — Google monetizes you to advertisers the same way Facebook does. But Google's core function is still somewhat separable from your profile. A search query can return a relevant result on its own terms, without a deep behavioral history behind it, even if Google chooses to use one.

Facebook doesn't have that layer of separation, even in principle. There is no version of a social network that doesn't collect data about who you know, what you engage with, and how you spend your attention, because that data isn't adjacent to the product. It is the product. The News Feed, the friend suggestions, the groups you're nudged toward, the ads you see — all of it is generated directly from the graph of your relationships and behavior. Take the data collection away and there's nothing left to build a social network out of.

That's a meaningfully different arrangement than the one I described with Windows, and a sharper version of the one I described with Google. With Windows, the surveillance is a tax on a product that would exist without it. With Google, the surveillance rides alongside a product that's at least conceptually separable from it. With Facebook, the surveillance and the product are the same thing wearing two names.

Shadow Profiles: The People Who Never Signed Up

My "People You May Know" experience is a small, personal example of something Facebook — now Meta — has been reported on for building at scale for over a decade: what researchers and journalists have called shadow profiles. The mechanism is straightforward once you see it. When you upload your phone's contact list to find friends, or when Facebook's mobile app is granted access to your contacts, every name, number, and email address in that list becomes a data point Facebook can use — whether or not the people in it have ever made an account.

Do that enough times, across enough of your friends' phones, and Facebook can build a surprisingly complete profile of someone who has never agreed to a terms of service, never clicked accept on anything, and may not even know the platform exists in relation to them. Their name. Their number. Who they're connected to, inferred entirely through other people's address books. Meta has acknowledged the practice exists in general terms, framing it as a byproduct of features people requested — friend-finding, contact syncing — rather than a deliberate surveillance program aimed at non-users. That framing is, in a narrow sense, true. It's also true that the outcome is a company maintaining data on people who are not its customers and never consented to being its subjects.

Let's stay with that for a bit. I think it's the sharpest version of a problem this whole series keeps circling. With Windows and Google, the uncomfortable question was whether your own consent was informed. With shadow profiles, there's no consent transaction to even interrogate. The person being profiled was never in the room.

That fourth item — Off-Facebook Activity — is worth actually visiting if you have an account, because it's one of the few places Meta shows its own work. Most people who look at it are surprised by the length and specificity of the list: a fitness app, a food delivery service, a mattress company, a tax preparer, none of which they remember explicitly agreeing to share anything with Facebook. Each entry is a business that installed Meta's tracking code on its own site or app, and each one is quietly reporting back.

The Cambridge Analytica Moment

No discussion of Facebook and data can skip the event that, for a lot of people outside the security field, was the first time any of this became personally alarming. In 2018, reporting revealed that a political consulting firm called Cambridge Analytica had obtained personal data on as many as 87 million Facebook users, harvested through a personality quiz app built by a researcher named Aleksandr Kogan. A few hundred thousand people had actually installed the quiz. Facebook's platform design at the time allowed the app to also pull data on those users' friends — which is how a few hundred thousand installations turned into tens of millions of profiles, many belonging to people who never touched the app at all.

That data was reportedly used to build psychological profiles for targeted political advertising, including work connected to the 2016 U.S. presidential campaign and the Brexit referendum. Facebook was eventually fined five billion dollars by the U.S. Federal Trade Commission — at the time, the largest privacy penalty the agency had ever levied against any company.

Facebook has since closed the specific API pathway that made the friends'-data harvesting possible. That's a real, meaningful change, and I don't want to undersell it. But the underlying design philosophy — build the graph as densely and completely as possible, and figure out the guardrails after something goes wrong — is a pattern, not an isolated incident. It's the same pattern that shows up in the shadow profile mechanism, and the same pattern that shows up in what I'm about to describe next.

The Algorithm Doesn't Care What You Meant

In 2021, a former Facebook employee named Frances Haugen left the company with a large cache of internal research documents and brought them to journalists and lawmakers. What came out of that — reported widely as the "Facebook Files" — was, for me, the most damning material in this entire chapter of the story, because it wasn't external researchers speculating about harm. It was the company's own internal teams documenting it.

Among the findings: Meta's own researchers had studied Instagram's effects on teenage users and found that the app made body image issues worse for a meaningful share of teen girls who already struggled with them — with some of that research reportedly finding roughly one in three teen girls who felt bad about their bodies said Instagram made those feelings worse. That research existed inside the company for a period of time before any of it became public. The internal findings didn't stop the product from operating the way it did; they were, per the reporting, largely treated as a communications risk to be managed rather than a design problem to be fixed.

Separately, reporting on internal Facebook documents described a 2017–2018 change to the News Feed ranking algorithm that weighted certain emotional reactions — including the "angry" reaction — several times more heavily than a simple "like" when determining what content to show more of. The practical effect, according to that reporting, was that content provoking outrage and anger was systematically more likely to be amplified than content that didn't, because the system was optimizing for engagement, and anger is remarkably good at generating engagement. Facebook reportedly dialed back some of that weighting in later years after internal researchers flagged the effect.

I want to be careful here, because it would be easy to read this section as "Facebook made an algorithm that deliberately spreads hate," and that's not quite the claim, nor do I think it's the most useful way to understand what happened. The more precise and, honestly, more unsettling claim is this: nobody had to design the system to prefer outrage. They designed it to prefer engagement, which is a completely defensible, ordinary business goal. Outrage simply turned out to be one of the most reliable paths to engagement available to human psychology, and a system optimizing purely for the metric found that path on its own.

This Is Not a Story About Evil Companies

I've said this in every article so far in this series, and I mean it just as much here as anywhere else. I don't think the people who built Facebook's ranking systems sat in a room and decided to make teenagers feel worse about their bodies, or to make political discourse angrier. I think they built a system to maximize a metric, the metric responded to what actually works on human attention, and the company was slow — sometimes years slow — to reckon publicly with what its own research was telling it privately.

Facebook's genius, if that's the right word for it, was never really about data collection as a technical feat. Windows and Google both collect more raw data than Facebook does. What Facebook did differently was make the collection feel like the opposite of surveillance. You get real things back for it — a photo of your nephew you'd have otherwise missed, a message from a college friend you'd lost touch with, a reminder that someone's birthday is today. The product delivers genuine warmth. The cost of that warmth is just invisible, the same way it's been invisible everywhere else in this series. That's the pattern, again, in its most emotionally effective form yet.

I didn't delete my Facebook account. I deleted the app off my phone and, these days, only look at the account very occasionally from a browser. The permissions the app wanted, and the sheer pull of scrolling a feed designed to be scrolled, were the biggest reasons — not any single data revelation. Looking back, I can also understand how easily I could have granted that app access to my contacts, or my location, simply by being asked often enough, at the right moments, until saying yes stopped registering as a decision at all. I kept Instagram a while longer, mostly out of professional habit and to keep up with a small number of people, though I no longer have much meaningful presence there either. I don't say any of this as a recommendation — plenty of people I respect maintain the opposite position, that the connections are worth the cost, consciously chosen. What I'd ask, the same thing I've asked in every article so far, is whether the choice was actually made consciously, with the mechanism understood, rather than simply inherited because everyone else was already there.

In the next article, we turn to the company that markets itself as the exception to everything in this series so far — the one whose privacy reputation is, in real and meaningful ways, earned. But "better than Facebook" and "actually clean" are different claims, and I want to look honestly at where that distinction breaks down.