You can't, because all the websites they're tracking you on are actually helping Facebook by choice. They didn't plant a GPS tracker on your car, they paid a bunch of amoral civilians to monitor your movements through the city.

Our legal system isn't equipped to handle the majority of free people deciding to act like broad-spectrum stalkers within the span of a few years. Society only works if most people aren't evil or utterly susceptible to evil influence.

They didn't plant a GPS tracker, you bought it and use it for navigation, messaging, and social media.

No, because of a 1996 US Federal law, information collected about you is no longer your property, even if there is no business relationship.

When was it ever? Anyone could write an article about you. Articles about specific people are discussed all the time on Hacker News. Usually the person being written about doesn’t get a say about their reputation.

The common law arguably put the question you ask in the hands of a jury.[1] It is public figures whose lives are fodder for public consumption; more generous privacy rules traditionally have applied for the more mediocre among us.

[1] https://law.jrank.org/pages/9409/Privacy-Common-Law.html

Sadly, I'm inclined to agree with your assessment, from my utterly amateur legal armchair.

We need new laws for this. GDPR is a good start, if one happens to be an EU citizen, if a bit toothless.

We need new laws because automated collection of vast amounts of personal data, at scale, is a thing different in kind from manually collecting personal data about a specific person. Due to the expense and difficulty, the earlier system would tend to scale broadly with someone's fame, or at least wealth, which matches our expectations: it's not surprising that, say, a gossip magazine would have a fat file on Leonardo DiCaprio, and we figure he has lawyers on hand to deal with any consequent fallout.

In fact, we all used to be quite grateful for the unsung laborers who would collect and publish a doxxing book, called the white pages, which would list the names, phone numbers, and addresses, of most local people. Of course they were legally obligated to unlist those who requested it...

> We need new laws for this. GDPR is a good start, if one happens to be an EU citizen, if a bit toothless.

It actually has a better bite than most. The problem is that the one suposed to do the biting doesn't do a lot of it.

What law specifically?

I would guess the "Telecommunications Act of 1996".

https://transition.fcc.gov/Reports/tcom1996.txt

Probably the text starting here:

  SEC. 702. PRIVACY OF CUSTOMER INFORMATION.
  Title II is amended by inserting after section 221 (47 U.S.C. 
  221) the following new section:
  SEC. 222. PRIVACY OF CUSTOMER INFORMATION

If it is about customer (!) information, does it still apply to people simply visiting websites, and due to not knowing better, not blocking Google and FB trackers? It would not seem like they are automatically Google's or FB's customers.

On the off-chance that the parent's description has a typo, it may be this 1976 court ruling:

United States v. Miller, 425 U.S. 435

> Can I file a restraining order against Facebook? Or Google?

Not as long as you're maintaining an active relationship with them. First step is to break up and stop using their services entirely.

You do not need any relationship in order to have a shadow profile on Facebook.

If you're a European citizen, then you can invoke your legal right to erasure.

It's not a silver bullet of course. Discord, for instance, just 'anonymises' message history by renaming your account to Deleted User. But most people's message history is enough to deanonymise them, making that completely null and void. If you ask for your messages to actually be deleted they will refuse your request.

I published a tool on GitHub for deleting message history in the most efficient way I could find. Yet users of the tool sometimes get their accounts banned because Discord's TOS prohibits unauthorised use of their API. I speculate this is because they don't want custom clients which don't send back telemetry.

Discord is either tone-deaf to common privacy concerns or they're completely conscious of them and don't want people to clear their message history.

One tactic I've worked out with individual mods is I have them ban me, then unban me, which causes all of my posts to be erased from the public chat. Of course Discord probably still has them privately, but it's better than nothing.

That's interesting, thanks for the tip. I would hope they would have a sort of garbage collection that deletes orphaned messages, but this is Discord we're talking about.

Are they owned by Microsoft yet?

I don’t think this will be enough in case they get sued if the messages contain personably identifiable information they will have serious problems.

How does the EU enforce the deletion of said data from Facebook servers standing on US ground?

How do I enforce deletion if I have unwittingly only a "shadow account" in Facebook?

Fine the Facebook subsidiaries incorporated in the EU. Or completely ban them from doing business, which prevents advertisers in the EU from giving them money.

This is impossible - the fine would have to be absurdly high to matter and if they disabled their business in the EU there would be riots. Facebook can essentially do whatever they want as they are also likely sending information to services.

> This is impossible - the fine would have to be absurdly high to matter

Fines here are proportional to profits, so it would be absurdly high for Facebook.

> and if they disabled their business in the EU there would be riots.

Not really. In the last five years I've seen an ever growing anti American sentiment around here. I guess it's because all the antics that were coming from the angry Cheeto.

America is now seen as unstable and unreliable. The sentiment around here is basically (generally speaking): "and what happens of they decide to elect (another) Trump again?"

> if they disabled their business in the EU there would be riots.

Line em up.

California Privacy Act also gives you similar rights.

Not really: https://ruben.verborgh.org/facebook/.

Not if the Irish have any say in the matter.

That's an interesting question, but it doesn't accurately describe the collection/transfer of data as far as FB or Google are concerned.

Millions of websites/apps/stores willingly deliver this information to Facebook/Google for free, and it's your relationship with each of those websites/apps/stores that governs the collection and sharing of that data.

GDPR, for instance, makes a distinction between "data controllers" and "data processors." The businesses are the controllers, and FB/Google are processors. Both have responsibilities regarding the handling of your data, but most of the requirements fall on the controller. The processors are able to assume that the controller had the right to share the data with them.

I guess no, because you agreed to terms and conditions that they can.

How about if one deleted the account with them 5 years before and they still follow you. I hope that is stalking.

I would agree. If you cease use and end the agreement then they should stop. If they continue then they should be liable.

“When you delete content, it's no longer visible to other users; however, it may continue to exist elsewhere on our systems”

This is from FB’s terms and conditions, so I guess they can still keep the data.

If you agree to any other website’s terms and conditions saying “any third party can track you”, you have again given permission.

The problem with this interpretation is that valid contracts depend, among other things, on informed consent and on the legality of what's being required, meaning you can't trick someone into being bound to terms they never really accepted or sufficiently understood and you can't bind them to illegal terms.

In this case, most people haven't read the Facebook terms of service and it is probably unreasonable to expect everyone to not only read them, but to keep abreast of any updates. So it's a grey area. And if you pass laws and regulations around data privacy, then FB won't be able to legally impose such conditions. But as I said earlier, there isn't much inertia behind data privacy. Nobody with power wants it.

> valid contracts depend, among other things, on informed consent and on the legality of what's being required

Yes, and they also depends on power dynamics.

That's why there are a lot of restrictions on what can be written in a contract between public utilities and users. An electricity provider could strong-arm users into signing draconian contracts otherwise.

Social networks have the same negative externalities: if most of your friends move from using emails to using Facebook to communicate and you are not on it your life gets provably worse. You are cut out from a lot of your social circle.

Having walled-garden social networks is anti-competitive by design.

Unfortunately legislators turn a blind eye to this.

>Nobody with power wants it.

Or is too influenced by big technopoly lobbying dollars.

“most people haven't read the Facebook terms of service and it is probably unreasonable to expect everyone to not only read them”

I completely disagree with this thought process. If a website is asking your birthday, every like / dislike , every detail about relatives and is able to predict if you like someone even before you do .. you better know how they will use all this data.

Strictly speaking you're correct, but you're describing the should rather than the is. There are too many overly-long ToSes written in arcane legalese to do mundane things like use a website or play a game for the average person to comprehend even the fist time for everything they use, let alone keeping up with the changes and their implications.

To coin a meme: "Ain't nobody got time for that"

On the other hand consent given once does not imply giving consent forever.

For those who have signed up. What about "shadow profiles"?

It seems that the term "shadow profile" refers to a feature where Facebook retains contact information uploaded by other users in order to recommend them as friends if/when you create a profile [1]. For all the fear associated with the term, that's pretty benign. Is there any evidence for a link between these "profiles" and some of the more egregious claims of privacy infringement?

[1] https://www.zdnet.com/article/firm-facebooks-shadow-profiles...

For privacy advocates the simple act of linking people that way is worrying enough. Not much of a concern for me (my government's creepiness is vastly overshadowed by its incompetence) but it could certainly be dangerous to free thinkers in certain regimes.

I find it hard to believe that they can't associate more information with those profiles than just who has who else as a contact (or has in the past), some derived/guessed and some from purchasing access to other data-sets, and I find impossible to believe that they won't if they can. Not just FB but other purveyors of advert targetting stalkerdom too. This isn't "don't trust the man" foil-hat paranoia - knowing as much as possible about as many people as possible is their well documented business model.

And of course, the shadow profiles would have had names, email addresses, phone numbers, and linkages that could help answer questions like "mother's maiden name". If shadow profiles were included in the recent huge leak then people who had not ever touched nor wanted to touch facebook, may have just become easier social engineering targets.

Terms and conditions which would have a hard time holding up in court without a signature and witness. Maybe things will change in the future since my own bank does this for online agreements as well as a few government agencies but those do have more stringent KYC rules for online verification.

They track you even without an account, so no not everyone agreed to their terms and conditions.