I joined Facebook (WhatsApp specifically) in January after working at Amazon for many years. It's evident to me that the company has been and continues to invest massively in privacy and privacy protection – to the extent of inventing new internal technologies that enforce it automatically while handling data, so that software developers don't have to add manual "Should this person/software system be able to access this content" checks all over the various sprawling systems that comprise such a massive platform: software that is privacy-protecting while handling data by default. This tech spans both employees and users. Additionally, all projects undergo a privacy review process, so as not to rely purely on technology. (And, who knows, maybe someday the tech will be open sourced such as FB released Apache Thrift, PyTorch, React, and tons of other tech).
(I will acknowledge that privacy means different things to different people, and that some people may consider a company building a profile of their behavior – even if used in an anonymized and aggregated way – to be violating their privacy. I personally don't consider it to be, but I accept that others have different views on this and don't want to be tracked, even if it's with the intention of making the product experience and advertising better. Personally, if I have to see ads, I'd rather they be personalized and relevant to my interests, than generic ads for Tide detergent or Coca-Cola. I actually bookmarked websites for two out of the last three ads YouTube showed me because they were products I didn't know about that I am actually interested in.
However, I have this comfort level in part because I am a software engineer who has worked on these systems, and I realize that the systems that build profiles and show content based on them are just machines that don't care one way or the other about people as individuals; and the engineers building those systems and managing those data sets are, by and large, with few exceptions, professionals doing a job, and have no interest in snooping on you. The larger tech companies also have internal monitoring systems that detect employee misuse of data, which is why you hear in the news about people occasionally being fired for it.
I'm sure there are people at your ISP who could single out and monitor your Internet traffic if they wanted to (though TLS would mean they could only learn what sites you visit – that could still be compromising information, e.g., do you visit porn sites?); and people at your cell phone company can probably listen in to your phone calls and SMS in real time if they wanted to [1]. We know the police have that ability, so the carrier certainly does. Some administrator who runs a system always has access to its data. But the people operating these systems are, like you and me, sane people doing a job and don't want to get fired for abusing our access. We strive to minimize what we collect, anonymize it, encrypt it, aggregate it so that data for individuals is not present in the anonymized collective used to serve content, etc.)
[1] Last time I checked, SMS was actually broadcast over the radio in the clear, so in fact anyone with the right radio receiver and software could intercept and decode all SMS in an area. Maybe cell standards have evolved since then; I don't know anything about it – perhaps someone else can comment. If they've improved cell standards such that SMS over radio to the tower is encrypted, then there's still an administrator at your telecom provider who can read them. <shameless plug> So if you're paranoid, that's another potential reason to use an end-to-end encrypted communicator like WhatsApp :-), where nobody but you and the participant on the other side can access the communication. iMessage, Signal, and Wickr also to my knowledge provide legitimate E2EE.
Facebook is in the process of implementing E2EE for Facebook Messenger and Instagram Direct Messages. In other words, the company is investing in a relatively massive internal engineering effort to take away its own ability to read your messages, at no benefit to the company beyond being able to provide the stronger privacy that users want. That's another reason I believe in the company's sincerity about privacy. And what you post on your wall, you're generally posting intentionally for all your friends or the public to read, depending on your permission settings. You can also post a message on your wall that's only visible to a limited audience you define too, but I doubt the wall will ever be E2EE because of the audience sizes involved. E2EE provides substantially less value when a media star that anyone can follow posts messages that are read by millions. What's more interesting is whether other people can see that you follow a particular person – that's also probably something you can control via the right privacy settings. Facebook has a lot of privacy settings for your account, way more than most users know about. In fact I'm pretty sure there's a switch to you can toggle and ask the company not to profile you – but I haven't checked recently so don't hold me to that.
Personally, I'd rather be profiled and see content and advertisements relevant to my interests, than shitty content and ads, so I tolerate the profiling, as long as companies keep the data they collect to themselves.
If you buy a house or get a cable subscription, by comparison, the companies involved will immediately sell your personal information to all sorts of data brokers, which is why you'll start getting junk mail immediately. (Even if they didn't, real estate ownership is public record, so data brokers would eventually get at it anyway, just less conveniently.)
FAANG companies to my knowledge no longer share or sell any data that they collect outside their walls. (I'm not an authority on this. Amazon never did to my knowledge. Pretty sure Google never did. Doubt Netflix does – maybe at a very aggregate level. Pretty sure Facebook no longer does, but I don't know their policies about working with scientists. After getting burned so badly over the university researcher who passed on data he collected to Cambridge Analytica, I'd guess that's stopped or tightened significantly. I have not looked into FB's policies about research. Researchers that work with Amazon have to be at least part-time employees and are locked tightly with contracts that gives Amazon authority over their ability to publish or share any data from their employment; giving Amazon the ability to go after them hardcore if they abuse their access. FAANG and related parties will however engaged in sophisticated matching schemes that allows them to track ad conversion between each other (such as if Amazon is advertising on Facebook) without actually sharing any personally identifiable data, using complex cryptography and anonymity processes.
None of that really changes the fundamental nature of the product. It’s sort of like oil companies talking about how careful they are handling the oil in response to concerns over global warming.
I wanted to comment on the same statement. At a minimum all those companies share with law enforcement and national security to some extent. Beyond that I've heard of data sharing agreements and some kinds of data sales at more than one of the FAANGs, and can't see why they would stop, though I can definitely see why they might be two-faced about it and try to give that impression.
(I will acknowledge that privacy means different things to different people, and that some people may consider a company building a profile of their behavior – even if used in an anonymized and aggregated way – to be violating their privacy. I personally don't consider it to be, but I accept that others have different views on this and don't want to be tracked, even if it's with the intention of making the product experience and advertising better. Personally, if I have to see ads, I'd rather they be personalized and relevant to my interests, than generic ads for Tide detergent or Coca-Cola. I actually bookmarked websites for two out of the last three ads YouTube showed me because they were products I didn't know about that I am actually interested in.
However, I have this comfort level in part because I am a software engineer who has worked on these systems, and I realize that the systems that build profiles and show content based on them are just machines that don't care one way or the other about people as individuals; and the engineers building those systems and managing those data sets are, by and large, with few exceptions, professionals doing a job, and have no interest in snooping on you. The larger tech companies also have internal monitoring systems that detect employee misuse of data, which is why you hear in the news about people occasionally being fired for it.
I'm sure there are people at your ISP who could single out and monitor your Internet traffic if they wanted to (though TLS would mean they could only learn what sites you visit – that could still be compromising information, e.g., do you visit porn sites?); and people at your cell phone company can probably listen in to your phone calls and SMS in real time if they wanted to [1]. We know the police have that ability, so the carrier certainly does. Some administrator who runs a system always has access to its data. But the people operating these systems are, like you and me, sane people doing a job and don't want to get fired for abusing our access. We strive to minimize what we collect, anonymize it, encrypt it, aggregate it so that data for individuals is not present in the anonymized collective used to serve content, etc.)
[1] Last time I checked, SMS was actually broadcast over the radio in the clear, so in fact anyone with the right radio receiver and software could intercept and decode all SMS in an area. Maybe cell standards have evolved since then; I don't know anything about it – perhaps someone else can comment. If they've improved cell standards such that SMS over radio to the tower is encrypted, then there's still an administrator at your telecom provider who can read them. <shameless plug> So if you're paranoid, that's another potential reason to use an end-to-end encrypted communicator like WhatsApp :-), where nobody but you and the participant on the other side can access the communication. iMessage, Signal, and Wickr also to my knowledge provide legitimate E2EE.
Facebook is in the process of implementing E2EE for Facebook Messenger and Instagram Direct Messages. In other words, the company is investing in a relatively massive internal engineering effort to take away its own ability to read your messages, at no benefit to the company beyond being able to provide the stronger privacy that users want. That's another reason I believe in the company's sincerity about privacy. And what you post on your wall, you're generally posting intentionally for all your friends or the public to read, depending on your permission settings. You can also post a message on your wall that's only visible to a limited audience you define too, but I doubt the wall will ever be E2EE because of the audience sizes involved. E2EE provides substantially less value when a media star that anyone can follow posts messages that are read by millions. What's more interesting is whether other people can see that you follow a particular person – that's also probably something you can control via the right privacy settings. Facebook has a lot of privacy settings for your account, way more than most users know about. In fact I'm pretty sure there's a switch to you can toggle and ask the company not to profile you – but I haven't checked recently so don't hold me to that.
Personally, I'd rather be profiled and see content and advertisements relevant to my interests, than shitty content and ads, so I tolerate the profiling, as long as companies keep the data they collect to themselves.
If you buy a house or get a cable subscription, by comparison, the companies involved will immediately sell your personal information to all sorts of data brokers, which is why you'll start getting junk mail immediately. (Even if they didn't, real estate ownership is public record, so data brokers would eventually get at it anyway, just less conveniently.)
FAANG companies to my knowledge no longer share or sell any data that they collect outside their walls. (I'm not an authority on this. Amazon never did to my knowledge. Pretty sure Google never did. Doubt Netflix does – maybe at a very aggregate level. Pretty sure Facebook no longer does, but I don't know their policies about working with scientists. After getting burned so badly over the university researcher who passed on data he collected to Cambridge Analytica, I'd guess that's stopped or tightened significantly. I have not looked into FB's policies about research. Researchers that work with Amazon have to be at least part-time employees and are locked tightly with contracts that gives Amazon authority over their ability to publish or share any data from their employment; giving Amazon the ability to go after them hardcore if they abuse their access. FAANG and related parties will however engaged in sophisticated matching schemes that allows them to track ad conversion between each other (such as if Amazon is advertising on Facebook) without actually sharing any personally identifiable data, using complex cryptography and anonymity processes.