F
Verdict
EXHIBIT A
Meta.
"we sell what you think."
Meta knows what you scrolled past at 2am. They sell that signal to advertisers, hand it to governments on request, and share it with "trusted partners" §9.4 (the highest bidder). Opting out is a maze §13, deleting your account doesn't delete the data §11.1, and yes — your photos can train their AI §7.5.
Industry: Social Media
Last analyzed: 2026-05-18
Policy updated: 2026-04-08
§2 · The privacy card
At a glance, honestly.
Eight signals, color-coded. Like a model card for a machine — except the machine is reading your data.
Privacy Card · Meta · Analyzed 2026-05-18
F
Data sold / shared YES MIXED
Cross-site tracking UNKNOWN MIXED
AI training YES opt-out: limited
Deletion right AVAILABLE GOOD
GPC honored NO BAD
Keeps forever? YES BAD
Child protections CONDITIONAL MIXED
Automated decisions YES human review: no
Collects
Identifiers, Location, Browsing History, Search History, Contact Info +5 more
Shares with
Advertisers, Affiliates, Government
§3 · The label they should have shown you
The Privacy Label, honestly.
An Apple-style label for what's collected and a Cranor-style back-of-pack for what they do with it. Every cell links to the exact line in their policy.
META — DATA COLLECTED
PER APPLE PRIVACY-LABEL TAXONOMY ↗
● USED TO TRACK YOU
Data shared with third parties for cross-property tracking.
Identifiers §4.2
User ID · Device ID · Advertising ID
Location §6.1
Precise location · Coarse location
Browsing History §5.3
Cross-site browsing via Meta Pixel
Search History §5.3
In-app and inferred from partner sites
◐ LINKED TO YOU
Tied to your identity and stored against your account.
Contact Info §4.2
Email · Phone · Legal name
User Content §4.2
Photos · Posts · Messages · Audio
Usage Data §5.3
Product interactions · Ad interactions
Purchases §7.1
Marketplace + ad-attributed
Sensitive Info §8
Inferred politics · ethnicity · health
○ NOT LINKED TO YOU
Aggregated, supposedly anonymous.
Diagnostics §7.2
Crash data · Performance metrics
↓ BACK OF LABEL · WHAT THEY DO WITH IT (CRANOR FRAMEWORK)
Purposes
Advertising, Analytics, AI training, Safety. §7.1
4+ stated purposes. The interesting ones are buried in §7.
Sold or shared?
Yes. Advertisers, Affiliates, Government. §9.4
"We don't sell data" is technically true and substantively false.
Retention
Indefinite, with caveats. §11.1
Indefinite, with caveats. "For as long as necessary." Inferences derived from you are kept after deletion.
User controls
Deletion: available · Opt-out: limited §13
Delete works. Opting out of inference does not exist.
Automated decisions
Yes. No human review. §8
Ad targeting · Content ranking · Account suspension. All algorithmic.
AI training on your data
Yes. EU opt-out only. §7.5
Your public posts/photos train commercial models.
Children's data
Under 13 blocked · 13–17 limited §8
Ad targeting paused for teens, but content profile still kept.
Breach disclosure
"As required by law." §15.3
Translation: the bare minimum legal window in your jurisdiction.
§4 · The questions you actually have
The questions, answered.
No legalese. The eight things every visitor actually wants to know — answered the way your most cynical friend would put it.
YES
§5.3 Are they tracking you on other sites?
Pixels on millions of sites. Even sites you'd never expect.CONDITIONAL
§9.4 Who can see what you do?
Advertisers always · governments on request · affiliates (IG, WhatsApp) · Meta employees, often.CONDITIONAL
§11.1 Can you delete everything?
You can delete the account. Inferences derived from you are kept.NO
§13 Do they honor your opt-out?
Global Privacy Control: ignored. Cookie banners reset every 30 days.CONDITIONAL
§8 Special handling for minors?
Under 13: blocked. 13–17: ad targeting paused, content profile kept.§5 · The receipts
The receipts, translated.
Five of the worst clauses, lifted verbatim. Strikethroughs are theirs. Marginalia is ours.
META PRIVACY POLICY · §4.2 — INFORMATION SHARING §4.2
We may share certain non-personally-identifying information with our trusted advertising and analytics partners ↑ "trusted" = highest bidder in order to enhance your experience and provide more relevant content. i.e., they sold it. all of it. By using our services, you consent to our use of cookies and similar technologies. consent = you opened the app VERDICT: F
META PRIVACY POLICY · §7.5 — AI & MACHINE LEARNING §7.5
We may use publicly available content on our platforms ↑ your photos, posts, comments to improve our AI models and develop new features. i.e., train commercial models we resell Users in the European Union may object to this use. good luck finding the form AI OPT-OUT MAZE
META PRIVACY POLICY · §11.1 — DATA RETENTION §11.1
We retain your information for as long as necessary to provide our services, ↑ "necessary" never defined comply with legal obligations, and resolve disputes. disputes = anything ever After account deletion, certain information may be retained in backup systems for an additional period. period = forever RETENTION: ∞
META PRIVACY POLICY · §13 — YOUR CONTROLS §13
You can request deletion of your account deletion = of some of it at any time. We will honor your choice they reserve a lot of exceptions within a reasonable period. Inferences derived from your data your "shadow profile" may persist in aggregated form. DELETE ≠ DELETE
META PRIVACY POLICY · §2.1 — CONSENT §2.1
By using our services, "using" = opening the app once you consent to the practices described in this policy. consent without choice = not consent If you do not agree, you should discontinue use. i.e., agree or fuck off. FORCED CONSENT
§6 · The deceptive design
Dark patterns spotted.
Tricks the policy and surrounding UX use to make you "consent" without really consenting.
Using the product equals agreement. There's no real "no thank you" — only "leave."
"By using our services, you consent to the practices described in this policy.
Essential cookies, marketing, analytics, and tracking are bundled. Accept-all is one click; reject is buried three modals deep.
"By clicking "Accept", you agree to the use of all cookies described in this policy.
Privacy controls live seven clicks deep, behind a settings UI that changes layout every quarter.
"Adjust your ad preferences in Settings > Privacy > Ads > Ad Topics > Advanced > …
Marketing emails opt-in by default. You have to find the unchecked-box-shaped needle in a haystack of settings.
"[ ✓ ] I would like to receive product updates and personalized offers
Cookie/tracking preferences reset every 30 days, betting that one in ten of those times you'll slip and hit Accept All.
"Your cookie preferences have been reset. Please review and confirm.
The reject button reads "No thanks, I don't want a personalized experience." The accept button is highlighted, bigger, primary-colored.
"[ Reject and use a worse version ] [ ACCEPT ALL ]
§7 · What you can actually do
Your rights, by where you live.
Same company, wildly different rights depending on your jurisdiction. Direct links to the specific opt-out / delete / access flows.
EU (GDPR)
DIFFICULTY: MEDIUM
- ✓ Right of access
- ✓ Right to erasure
- ✓ Right to data portability
- ✓ Right to object to processing
- ✓ Right to opt out of AI training
Source: §15.1
§8 · Receipts
The actual sources.
Every claim above is anchored to a line in the policy we analyzed. Click any section ID to view it in context.
ANALYZED BY: claude-opus-4-7 ·
PROMPT VERSION: honest-policy-v1.3 ·
ANALYZED AT: 2026-05-18T03:12Z
SOURCE: https://www.facebook.com/privacy/policy/ · POLICY VERSION: 2026-04-08 · SNAPSHOT HASH: sha256:9a4b2…f0c2
SOURCE: https://www.facebook.com/privacy/policy/ · POLICY VERSION: 2026-04-08 · SNAPSHOT HASH: sha256:9a4b2…f0c2
- §2.1Consent & agreement"By using our services, you consent to the practices described in this policy."
- §3.4Cookies & similar tech"By clicking 'Accept', you agree to the use of all cookies described in this policy."
- §4.2Information sharing"We may share certain non-personally-identifying information with our trusted advertising and analytics partners…"
- §5.3Cross-site tracking"We collect information about your browsing activity on third-party sites that have integrated our pixel or SDK."
- §6.1Location"We may collect precise location information when you grant permission, and approximate location at all times…"
- §7.1Advertising purposes"We use the information we collect to deliver and personalize advertising on and off our services."
- §7.2Analytics & product"We use diagnostic and performance data to improve our services."
- §7.5AI & machine learning"We may use publicly available content on our platforms to improve our AI models and develop new features."
- §8Automated decisions & sensitive inferences"Some decisions about your account and the content you see are made automatically by our systems."
- §9.4Third-party recipients"We share information with advertisers, affiliates, government and law-enforcement, and other partners…"
- §11.1Data retention"We retain your information for as long as necessary to provide our services, comply with legal obligations, and resolve disputes."
- §13Your controls & choices"You can request deletion of your account at any time. We will honor your choice within a reasonable period."
- §14.2Marketing communications"We may send you product updates and promotional communications, unless you opt out."
- §15.1EU rights (GDPR)"If you are located in the European Economic Area, you have specific rights under the GDPR…"
- §15.2California rights (CCPA/CPRA)"If you are a California resident, you have specific rights under the CCPA…"
- §15.3Other jurisdictions"Where required by applicable law, additional rights and protections may apply."
- §16.1Cookie banner behavior"Your cookie preferences will be revalidated periodically to ensure they remain current."