Facebook and Instagram: your privacy is their product — and they'll prove it

Facebook and Instagram aren’t just hugely popular social apps: they’ve also built up a questionable reputation that has earned them sanctions on both sides of the Atlantic. One of the loudest landed in 2023, when the Irish regulator fined Meta EUR 1.2 billion — then the largest European fine on record — for breaking, once again, the rules that protect European citizens’ privacy.

Throughout its history —first as Facebook, then as Meta in a very visible attempt to scrub its image— the company has done everything in its power, including illegal practices, including collecting information by whatever means necessary, to profit at its users’ expense: selling data, shaping opinions, spreading fake news, and transferring European data to US security agencies.

They even tried issuing their own cryptocurrency. It was announced as Libra and, after global pushback, rebranded as Diem; public scepticism towards the company’s reputation sank the project.

That said, it would be unfair to ignore the good parts. Anyone who was born before 1990 has probably enjoyed these apps at some point, fascinated by the idea of staying in touch with friends and family on the other side of the world. And there’s one practical plus: Meta hides EXIF metadata when you upload or forward images —the original location is swapped for internal codes only the platform understands—. That doesn’t mean they delete the data; they just keep it for their own use.

All of that aside, the goal of this post is the usual one here at josecurity.es: shine a light on the less visible side of technology and the companies that abuse it.

How Meta’s business model actually works

The scheme is simple to understand: keep users glued to the app.

The more time you spend on the network, the more interactions their algorithms log; the more interactions, the richer your interest profile gets; the richer the profile, the more advertisers pay. To squeeze out that attention, the system prioritises content that triggers strong reactions: kitten videos and idyllic landscapes, yes, but also inflammatory posts, conspiracy theories and misinformation.

Most of the time the escalation is gradual —the classic foot-in-the-door effect: first light content, then something more extreme, and so on until you’re trapped.

The best demonstration came from Signal —as La Vanguardia reported—. The app bought ads on Facebook and Instagram precisely to show how much data Meta collects and hands over to any advertiser. They designed hyper-specific messages based on combinations of profession, marital status, age, hobbies, even zodiac sign.

Here are some of the examples actually delivered to real users —first in translation, then close to the original campaign copy—:

«You’re seeing this ad because you’re a newly-wed pilates instructor who loves cartoons».

Another: «You got this message because you’re a teacher and —even more interestingly— you’re a Leo and single. This ad used your location to confirm you’re in Moscow. You like supporting comedy sketches, and this ad thinks you’re good at them».

Or this last one: «You’re getting this ad because you’re a family doctor with a master’s in art history. Divorced, too. This ad used your location to see you’re in London. Your online activity shows you’ve been into boxing, and you’re probably training on your new motorcycle».

Advertising messages that Signal sent to Instagram users. Source: Enrique Dans, enriquedans.com

With just a few of the thousands of data points Facebook —alongside Instagram and WhatsApp— accumulates, a surprisingly precise portrait of any individual can be drawn. Signal wanted to make it crystal clear what happens behind the scenes in these «free» social networks that bombard you with advertising without ever telling you what information you’ve given up or why that specific ad arrived on your feed. I don’t know whether the campaign opened any eyes, but I’m almost certain that seeing one of those messages must have felt like walking in naked in front of the screen.

A few years later it emerged that Meta was far from celebrating the stunt, and it ended up canceling Signal’s account.

The moral is clear: everything you post on Facebook or Instagram —photos, «likes», comments, or mere geolocation— doesn’t stay inside your friend circle. It’s shared, to a greater or lesser degree, with advertisers prepared to pay for that data.

I’ll never tire of repeating this: before using any online platform, it’s worth reviewing the default settings, hardening the app, and putting solid privacy controls in place.

Settings designed to get you to reverse your own changes

Facebook has been criticised for years for confusing menus and for moving options around with every update. That back-and-forth isn’t accidental: it’s a dark pattern designed so that, with a slip, you fall back to the configuration the company prefers —the one that smooths the flow of your personal information to third parties.

Another very common point: using your Facebook account as the login method for third-party apps through OAuth (Open Authorization, open authentication). One click and you avoid creating a new username and password, but in exchange you hand that app permissions over your profile, which expands your attack surface.

The advice is simple: take two minutes to register a separate account for these functions, protect the access with 2FA (Two-Factor Authentication, two-factor authentication), and keep your profiles separated; in the long run, you’ll be glad you didn’t tie everything to the same master key.

Misinformation as the loudest amplifier

Facebook has served as a megaphone for fake news with serious social and political consequences. During the Arab Spring (2010–2012), different factions used the platform to amplify their narrative; in Myanmar (2018) and in Ethiopia (2021) its role in fuelling ethnic violence was documented, or what happened on July 30 and 31, 2026, when a hoax went viral on social networks deceiving thousands of young Moroccans into believing the Ceuta border would open unmonitored for fifteen hours. Built on old videos, that misinformation triggered a coordinated mass-crossing attempt (more than 70,000 people) ultimately aimed at reaching Europe — and there are reasonable, unconfirmed suspicions that the Kingdom of Morocco, the USA and Israel were behind it. The problem isn’t just how fast the content spreads, it’s the algorithms that prioritise inflammatory content because it keeps users on the platform longer.

Add the sheer insistence with which Meta —and, to a lesser degree, Google— tries to reverse your settings. Disable location history and sooner or later you’ll run into a nudge like «Learn more about your location data».

The actual goal isn’t educational: they’re hoping you click the link that re-enables the feature in a moment of inattention. Once you’ve done it, they’re unlikely to nudge you again; they’ve already won.

A brief timeline of privacy incidents

Extra risks that usually go unnoticed

• Ghost profiles. Even if you don’t have an account, it’s likely Meta has a «shadow profile» of you, assembled from the information third parties share when they sync their address books, in which many have you saved with your date of birth, where you live, your position, e-mail, etc.
• Algorithmic bias. The drive to maximise attention can amplify hate speech or political misinformation, polarising public debate.
• Information bubble (filter bubble). By only showing you what you already agree with, the platform narrows your exposure to diverging points of view and weakens democratic dialogue.
• Mental health. Several studies link compulsive use of social networks to anxiety, FOMO (fear of missing out) and depression, especially among teenagers.
• Vulnerability of minors. Algorithms don’t reliably distinguish adults from minors, so targeted advertising reaches young people without effective safeguards. Platforms such as Instagram are now using AI tools to detect when someone is lying about their age, though how well these measures actually work is still debated.

Step one: put the mobile app away

The simplest way to win some privacy back is to uninstall the mobile app and access Facebook through the browser instead. Use Brave, Firefox, or any browser that supports Facebook Container extensions, and avoid Chrome if you can. Going through a browser also avoids the constant cross-app data sharing between the Meta applications installed on your device.

A practical checklist to harden your Facebook account

1. Review «Privacy and Security» after every major update.
2. Switch off background location tracking; only turn it on when uploading travel photos if you actually want them geolocalised.
3. Limit the visibility of old posts to «Friends Only» or «Only Me».
4. Remove apps and websites you no longer use from Settings > Apps and websites.
5. Download a full copy of your data and check what the platform actually keeps about you.
6. Review permissions: deny access to your contacts and limit cross-app tracking.
7. Configure tagging: require approval for every mention or photo before it appears on your profile.
8. Mute or report any content that incites hatred or violence, or that spreads hoaxes.
9. Schedule offline windows: plan digital breaks, or use apps that block the network after a set time.
10. Diversify your information sources: to escape the echo chamber, follow outlets and voices with different points of view.

References

Dans, E. (2021, May). The brilliant Signal campaign on Facebook. Blog of Enrique Dans. https://www.enriquedans.com/2021/05/la-genial-campana-de-signal-en-facebook.html

La Vanguardia (2021, May 5). Signal muestra algo de lo que Facebook sabe de cada uno. https://www.lavanguardia.com/tecnologia/20210505/7429802/signal-deja-evidencia-facebook.html