Meta Tracks You Even If You Don't Have an Account: The Shadow Profile Problem

Meta builds and maintains detailed profiles of individuals who have never created a Facebook, Instagram, or WhatsApp account. These shadow profiles are constructed from data uploaded by other users — contact lists, email addresses, phone numbers — combined with tracking data collected through Meta's advertising pixels embedded on millions of websites. The result is that Meta holds personal information about hundreds of millions of non-users who never consented to any data collection and may not even be aware that Meta possesses their data.

How Shadow Profiles Are Built

When a Facebook user uploads their phone contacts — a process Meta actively encourages and sometimes makes difficult to avoid — every phone number and email address in that contact list is ingested into Meta's systems. If ten different Facebook users have the same non-user's phone number in their contacts, Meta can infer that person's name, social connections, communication patterns, and network position with high confidence. Meta's tracking pixel, embedded on over 8 million websites, adds browsing data to these profiles. The combination creates a dossier on individuals who have explicitly chosen not to use Meta's services.

Legal and Ethical Challenges

Shadow profiles raise fundamental consent issues. Non-users have not agreed to any terms of service, have not consented to data collection, and have no mechanism to view, correct, or delete the data Meta holds about them. GDPR theoretically provides European non-users with the right to access and deletion, but exercising these rights requires knowing that a shadow profile exists — information Meta does not proactively disclose. Legal challenges to shadow profiles have been filed in multiple jurisdictions, with varying results. Courts have struggled to apply frameworks designed for consensual data collection to a practice that operates entirely without the data subject's knowledge.

Meta has acknowledged the existence of information about non-users in regulatory filings but has resisted calls for transparency about the scope and detail of shadow profiles. The company argues that contact information uploaded by users belongs to those users and that Meta's processing of it falls within its terms of service — a position that effectively allows consenting users to waive the privacy rights of their non-consenting contacts.

Individuals concerned about shadow profiles can request data access from Meta under applicable privacy laws, ask contacts not to upload their information to social platforms, use browser extensions that block Meta's tracking pixels, and support legislative efforts to require explicit consent from all individuals whose data is processed, not just platform users.