I think the reason is more prosaic. Oculus Quest is a complete nonstarter in business for many companies because Facebook-anything is simply a no-go.

And they need to penetrate into this market because that's where the money is, not in subsidized headset retail.

Now whether someone will buy this "no need for Facebook anymore but not really" shtick is another story.

with that reasoning they would need to allow Google or MS AD accounts.

All Facebook needs is data that they can tie to a phone number or primary email. Geolocation and first name would be enough for that.

I think the real reason for requiring Facebook accounts was just padding user numbers and events for a quarterly report (likely for somebody's bonus to land).

But I don't have a Facebook account so what is there to correlate?

Facebook maintains “shadow profile” accounts for people who have not personally made an account [1], the answer to your question is “whatever information your friends and family exposed on your behalf and which is linkable to you”.

[1] https://medium.com/@SpiderOak/facebook-shadow-profiles-a-pro...

They did. I suspect that if they still do, there's going too be a really painful GDPR penalty heading their way.

They can still do it to non-Europeans

How can they tell how an email address is European?

Because you told them while you were creating your Meta account, and because the credit card you entered matched what you told them.

Sure, but we are talking about shadow accounts, not Meta accounts.

Cost of doing business? Is GDPR protecting me as an American from Facebook shadow profiling me? How significant are GDPR fines?

In theory 4% from yearly revenue (not earnings, revenue), in practice I haven’t seen it being applied.

Here you go. Click your country's flag to see your results https://www.enforcementtracker.com (if you're European, that is).

so you think they are confident enough to link somebodies randomly created alias, let's say "InteretDude420" to a real name? What if opened a VR Arcade and owned 100 Oculus Quests and made 100 separate accounts?

>so you think they are confident enough to link somebodies randomly created alias, let's say "InteretDude420" to a real name?

After a certain amount of fingerprinting, absolutely. It's not as if they are solely relying on user-submitted information such as a handle to make that link. And if no link can be made right this second, they can just continue to collect data under "InteretDude420" until they reach a certain amount of confidence to link it to a real identity.

And, even if they get it wrong some % of the time, who would ever notice or find out? Eventually they just get more data and increase the confidence rating for the correlation.

It is surprising how little information (even "anonymized information") is needed to de-anonymize someone. Plenty of papers on the subject if you are curious.

Yes, zip code/geo-location plus a few other points of personal data are often enough to identify an individual. Then tie that to a browser fingerprint and you can tie together all their "anonymous" screen names.

I read recently (or heard in a podcast; can't find the source lamentably) that almost all people can be uniquely identified by the top three locations they spend most time at.

I would expect most people spend most of their time at home and at work, so that doesn't really surprise me.

> let's say "InteretDude420" to a real name

For many targeted / personalized ads purposes you don't really care about the real name. You mostly care about linking hardware / software identifiers (IDFA etc.) to some kind of profile that you attached information to (Likes technology, fashion, classical music,...).

If you make 100 separate accounts and open a VR arcade you are probably just filtered out as an anomaly. It's not about having a 100% coverage, it's about having good enough coverage of most users. Just like filter out bot or ad blocker users as there's still enough regular people.

Considering all the metadata they can collect over indefinite periods of time, with 100% certainty, unless you invest extraordinary effort to give them enough misleading data.

There are plenty of studies (example: https://www.nature.com/articles/s41467-019-10933-3/) that show you need only limited amounts of data to be able to deanonymize people.

Facebook allegedly buys transaction data (you know like banks and payment processors etc. sell). So they have a browser fingerprint for you via cookies (you know that like and share button on every page on the internet) or just plain JS fingerprinting.

Matching all that data to the real information you just ran through paypal or other merchant (some merchants sell this data directly) is something an intern can do on their first day.

I thought they denied maintaining shadow profiles though? There seems to be some people at FB who actually care about getting this stuff right and doing the right thing but economic forces at this point appear to be pushing most of the company in a very different direction.

A massive number of sites have Facebook tracking built in, since FB pays them a fraction of a penny for each visit it monitors. They don't care what username you're using; they just need to correlative fingerprinting (IP addresses, browser/device profile, any data from other apps installed on the same device, etc).

If you opened that arcade, they'd probably recognize that through a couple hundred different datapoints and use that to further analyze user behavior (For example: Which FB/Instagram users went to your arcade, stayed for a significant amount of time, then left. Of those, which don't already own a Quest -- market to them).

Presumably if you use their app marketplace you'll have valid credit card information stored in a data center of there's somewhere.

Facebook indeed collects data on non-users

https://www.howtogeek.com/768652/what-are-facebook-shadow-pr...

It is deeper than that. After I google for anything , I generally see advertisements in my Facebook app for the specific thing. There is certainly some invisible link between Goog and Febu.

The word you're thinking of is remarketing.

You may not have an account on Facebook, but Facebook has an account on you.

It gets populated with data uploaded by other people, JavaScript widgets on random web pages that you visit, etc.

None that you know of.