“The law is supposed to make all consents to the collection, use and sharing of personal information, a meaningful consent,” said David Fewer, general counsel for the Canadian Internet Policy and Public Interest Clinic.

A “meaningful consent” is defined by the federal government as a “valid consent,” where the user is informed of the platform’s privacy practices in comprehensive and understandable language.

“I just think that organizations haven’t met that burden of providing kind of meaningful opportunities to individuals to exercise their rights about their personal information,” said Fewer.

“The important thing to remember is that it’s not data that is being taken, it’s data that is being given,” said David Gerhard, head of computer science at the University of Regina. “Facebook’s not reaching in and stealing anything that you’re not consenting to give, even if you don’t believe that you’re consenting to give it.”

The Data Trail 

Immediately after signing up to Facebook, a user’s information goes into computer servers owned by Facebook. These servers have the ability to store and make multiple copies of user data for various purposes.

“Facebook needs to be able to take a piece of information from its server and share it on your computer,” said David Gerhard. “It has to make copies of it, has to transmit it across international borders in the act of participating in the internet.”

To some degree, data collection, sharing and monitoring is needed so the platform can function properly. However, with immense data collection, companies are able to track and learn about users and use this information for profit.

“Surveillance is fundamentally baked into the business model of social media,” said McPhail.

“They do that by keeping track of who your contacts are, who you’re communicating with. They do that by keeping track of what you click on, what you look at … most of them also by following your interactions, when you leave their site and move across other places on the internet.”

Through cross website tracking, users’ data does not stay on Facebook’s platform. Data is shared between Facebook and countless other websites users visit.

“When you go to a website and the website is going to serve you an ad, it holds a little auction,” said Gerhard. “It lists all the things that it knows about you and then all of the ad companies try to outbid each other to decide who is going to be able to serve you that ad.”

If an advertiser wins an ‘auction’, the ad company will use all the information collected about an individual and select a specialized ad, in hopes the ad is successful enough to influence a purchase. 

Data sharing practices do not end there. In addition to sharing data with third parties and advertisers, data brokers are also in the business of surveillance.. 

“Data brokers are so big and so massive,” said McPhail. “They literally advertise that they have things like 200 million individual data points about a billion people.”

 The technology and practices that Facebook depends on to optimize their advertising model are industry secrets and invisible to the average user. It is even difficult for experts to figure out how Facebook analyzes and trades user data, according to Fenwick McKelvey, a communications professor and researcher at Concordia University.

Social Media’s Dark Reality 

For unsuspecting users, scrolling on social media produces dopamine, a brain chemical that generates feelings of happiness and pleasure — and can lead to addictive behaviour. 

“There’s always something new to scroll across our screens whether it’s Facebook, Twitter, Snapchat, any of these platforms and novelty is inherently rewarding to the human brain,” said registered psychologist Michael White. “So, it keeps us coming back.”

Users may also gain a warped sense of reality due to filter bubbles the highly-tailored platforms create. Aided by constant data collection, users’ social media feeds are torqued toward information deemed to fit their interests.

“What this means is people get a sense that more of the world agrees with them then maybe is true because they get served news stories and advertising that aligns with their opinions, which reinforces their opinions,” said Gerhard.

Consequently, there are instances where specific gender and age categories are shown certain advertisements but not others. This can potentially be discriminatory as some users may be filtered out of job listings and opportunities.

As well, brokers combine user profiles with other data sets and sell it to banks and insurers, said McPhail.

“So (consumers) don’t understand that it’s not just about the ad. It’s also about whether or not you get the mortgage, whether or not you get the life insurance,” she said.

“So they kind of got you, right?”   

An hour after Hrynowetsky requested her information from Facebook, she received a folder which included 35 labelled files of data about her. The files included all her contacts, comments, interactions, likes, location, private messages, search history and payment history on Facebook’s platform. 

Hrynowetsky was shocked to find out Facebook had gathered all of her clients’ contact information which she had stored on her phone, not Facebook’s platform.  She was also startled how Facebook stored her location history, comment history, and all of her interactions with others. 

“If I had read everything that they had put in the 10- or 20-page agreement, and if I said no, then I can’t use the platform,” said Hrynowetsky. “So they kind of got you, right? I can’t say to them, okay, listen, you can use this, but you can’t use this. So there’s no negotiating.”

Combined, Facebook’s Terms of Service and Data Policy were 19 pages long.

“Privacy is a human right.” 

Our team reached out to Facebook Canada repeatedly for further comment on their data collection as well as data sharing practices. There was no response to any of our official inquiries as journalists.

We also posed questions as social media users, using the contact link at the bottom of Facebook’s data policy. We asked if Facebook shares user data with brokers, if they have plans to be more transparent on where data goes, and if the company would consider a review of its sign-up process to ensure meaningful consent.

Facebook did not directly answer any of these questions, only stating that data gathered by third parties via  Facebook is under the scope of the third party’s terms and policies and not Facebook’s.

In Canada, digital privacy is governed by the Personal Information Protection and Electronic Documents Act (PIPEDA), which provides guidelines for limiting collection of personal information but lacks enforcement power. 

The federal government drafted the Digital Charter of 2020 and introduced Bill C-11 into the House of Commons on Nov. 17. The bill seeks greater individual control over personal information and new enforcement powers for the Office of the Privacy Commissioner through the Personal Information and Data Protection Tribunal. 

This includes proposed fines ranging from three per cent of global revenue or $10 million for non-compliance and five per cent of global revenue or $25 million for “serious violations.”

“The private sector bill on the table at Parliament right now is going to add enforcement powers, which is great on the surface,” said McPhail. “If you dig a bit deeper, those powers would not always be engaged the way that we would want them to be.”

McPhail cited Clearview A.I., a technology firm that scraped millions of photos off social media platforms to train facial recognition software.

“Even under the new law (the privacy commissioner) probably still wouldn’t have been able to levy a fine,” she said. 

Bill C-11 also stops short of recognizing online privacy as a right, unlike the approach the General Data Protection Regulation, the European Union’s privacy law, has taken. 

“Privacy is a human right,” said Fewer. “It’s a component of our individual autonomy. It’s why we live in a free democratic society like Canada.”

McPhail argues for international intervention. “If platforms are global, we need some basic global safeguards and frameworks that are in place to attempt to constrain just the open power of these kinds of bodies,” she said. 

Hrynowetsky expressed that she was concerned after learning of Facebook’s data collection practices but also more aware of the role she and other users play in this information economy.

“The more that people are on there, the more business they’re creating, the more advertisements they’re creating, the more information they’re gaining. So that’s, I think that’s kind of scary.”