Thread by @WolfieChristl

FB has access to massive personal information about its users. But this is not the whole story.

"We rely on data signals from user activity on websites and services we do not control"

This disclosure in FB's SEC filing explains a lot:
sec.gov/ix?doc=/Archiv…

HT @PrivacyMatters

First, the "GDPR, ePrivacy Directive, and CCPA, have impacted, and we expect will continue to impact, our ability to use such signals in our ad products".

Second, Apple/Google already do or may soon "limit the ability of application developers to collect and use these signals".

This is why Facebook is fighting browsers like Safari and Firefox introducing tracking protections and Apple's restrictions on mobile app tracking so hard.

And this is why Facebook has been fighting the GDPR, its enforcement and similar laws for years, and still does.

Facebook lobbyists posing as small-business lobbyists:

"The GDPR benefits only us because we can afford to comply"

FB in its SEC filing:

The GDPR affects our ability to combine our data with data from websites, apps, advertisers and marketers, which is key to our business.

Of course, actual GDPR enforcement against FB and other tech giants is still missing, unfortunately.

And we urgently need other measures that limit the coercive power of FB, and even more so of Google. Anyway, stepping back from data protection legislation is not among those.

Another gem, also H/T @PrivacyMatters:

Since Dec 2020, Facebook's messenger products including Messenger and Whatsapp are fully subject to the (old) EU ePrivacy Directive, which also "may adversely affect" its "advertising business".

The whole SEC filing is very interesting.

Generally, FB depends at least as much on personal data collected from sources other than its own platforms, including web/app/pixel and other uploaded/synced data, data-broker data for modeling/attribution etc.

I'd say this is, perhaps to a lesser extent, also true for Google.

If I get this right, then FB had already a similar yet shorter paragraph in its previous 10-k SEC filing (d18rn0p25nwr6d.cloudfront.net/CIK-0001326801…) but didn't have such a clear statement about its reliance on data from services it "does not control" in the filing before
(d18rn0p25nwr6d.cloudfront.net/CIK-0001326801…).