“No, we’re not using anyone’s microphone to do any of that,” Messenger head of product Stan Chudnovsky told CNN’s Laurie Segall at Web Summit, a tech conference in Lisbon, Portugal. “None of that is happening.”
But many Facebook users won’t believe him or Facebook’s earlier denials. History and the available evidence make it not crazy to suspect the social network, while the sophisticated tracking systems that inventory our interests online remain too opaque for normal humans to decipher.
So it’s easy to go with the simplest theory for a frighteningly accurate ad: An app has been tuning into your everyday chit-chat without permission.
The “Facebook is listening” meme
The story goes like this: Soon after having a seemingly private conversation with your phone nearby, Facebook began showing ads for something you mentioned—something you hadn’t liked or mentioned on Facebook.
(Listen to last week’s episode of the Reply All podcast for examples.)
The idea that an app you trusted to connect you with friends would violate your confidence like that should horrify anybody. Sadly, there are precedents for such a profit-driven privacy invasion.
Think of the mobile apps shipped with “SilverPush” code that listened to high-frequency audio beacons in TV ads so mobile marketers could know what commercials you watched. Or the Lenovo apps that shipped with “Superfish” software to serve ads matching images you saw online.
To add to the paranoia, once an app has permission to use the microphone—which Messenger needs for calls to friends and Instagram requires to record video—you won’t see a further indication that it’s listening when the app’s open.
If you’re really worried, you can yank Facebook’s apps’ access to the microphone: Open your phone’s Settings app, then tap Privacy (in iOS) or Apps (in Android). But that will make Messenger and Instagram less useful, and it doesn’t rule out Facebook exploiting some vulnerability to bypass those restrictions
My own attempts to test this theory—by talking to myself about travel destinations with its app open, an exercise that left me feeling like a dork—have yet to yield matching ads.
Ad tracking is a giant black box
In his Summit appearance, Chudnovsky offered a different explanation for these uncanny ad matchups: “People spending a lot of time on Facebook and in Messenger.”
But you and your friends don’t need to spend time on Facebook for it to sense your interests, as the company touts in pitches to advertisers for tools like its Pixel cross-site tracking code.
“Facebook lets you define and reach the exact target audience you want,” one page brags.
Advertisers can’t target you by name—something I’ve seen when running ads on Facebook for posts on my public page—but they can set such precise targeting criteria that knowing a potential customer by name becomes unnecessary.
“They do use many other signals, so it’s likely that in these cases, the ads are simply eerily accurate,” Jules Polonetsky, CEO of the Future of Privacy Forum, wrote in an e-mail.
To its credit, Facebook does let you see what advertisers know about you if you click through to your ad preferences. When did you last look at that? Don’t worry, Facebook knows.
‘Can you imagine the outcry?’
There’s one easy reason to disbelieve the Facebook-is-listening thesis: Legally and politically, such a thing would be suicidal for Facebook.
“Facebook has very publicly and specifically denied using the microphone for ad targeting, so they would face significant FTC liability if they were,” Polonetsky said.
And keeping such activity from the Federal Trade Commission—which already has Facebook under a 20-year settlement over alleged misconduct that includes regular monitoring of its privacy practices—would be an immense challenge with massive downside risks.
“Can you imagine the outcry?” e-mailed Rich Mogull, CEO of the security-research firm Securosis. “You couldn’t keep something like that secret for long.”
Besides, he added, covert audio recording in the background “would also kill your battery and violate App Store terms of service.” To a mobile-app vendor, Apple (AAPL) may represent a higher authority than the FTC.
Correction: An earlier version of this post incorrectly identified CNN Laurie Segall as a CNBC correspondent.
More from Rob: