Facebook Figured Out My Family Secrets, And It Won't Tell Me How

Rebecca Porter and I were strangers, as far as I knew. Facebook, however, thought we might be connected. Her name popped up this winter on my list of "People You May Know", the social network's roster of potential new online friends for me.

Illustration: Jim Cooke/GMG, photo: Getty

The People You May Know feature is notorious for its uncanny ability to recognise who you associate with in real life. It has mystified and disconcerted Facebook users by showing them an old boss, a one-night-stand, or someone they just ran into on the street.

These friend suggestions go far beyond mundane linking of schoolmates or colleagues. Over the years, I'd been told many weird stories about them, such as when a psychiatrist told me that her patients were being recommended to one another, indirectly outing their medical issues.

What makes the results so unsettling is the range of data sources -- location information, activity on other apps, facial recognition on photographs -- that Facebook has at its disposal to cross-check its users against one another, in the hopes of keeping them more deeply attached to the site. People are generally aware that Facebook is keeping tabs on who they are and how they use the network, but the depth and persistence of that monitoring is hard to grasp. And People You May Know, or "PYMK" in the company's internal shorthand, is a black box.

To try to get a look into that black box -- and the unknown and apparently aggressive data collection that feeds it -- I began downloading and saving the list of people Facebook recommended to me, to see who came up, and what patterns might emerge.

On any given day, it tended to recommend about 160 people, some of them over and over again; over the course of the winter, it suggested more than 1400 different people to me. About 200, or 15 per cent of them, were, in fact, people I knew, but the rest appeared to be strangers.

And then there was Rebecca Porter. She showed up on the list after about a month: An older woman, living in Ohio, with whom I had no Facebook friends in common. I did not recognise her, but her last name was familiar. My biological grandfather is a man I've never met, with the last name Porter, who abandoned my father when he was a baby. My father was adopted by a man whose last name was Hill, and he didn't find out about his biological father until adulthood.

The Porter family lived in Ohio. Growing up half a country away, in Florida, I'd known these blood relatives were out there, but there was no reason to think I would ever meet them.

A few years ago, my father eventually did meet his biological father, along with two uncles and an aunt, when they sought him out during a trip back to Ohio for his mother's funeral. None of them use Facebook. I asked my dad if he recognised Rebecca Porter. He looked at her profile and said he didn't think so.

I sent the woman a Facebook message explaining the situation and asking if she was related to my biological grandfather.

"Yes," she wrote back.

Rebecca Porter, we discovered, is my great aunt, by marriage. She is married to my biological grandfather's brother; she met him 35 years ago, the year after I was born. Facebook knew my family tree better than I did.

"I didn't know about you," she told me, when we talked by phone. "I don't understand how Facebook made the connection."

It was an enjoyable conversation. After we finished the phone call, I sat still for 15 minutes. I was grateful that Facebook had given me the chance to talk to an unknown relation, but awed and disconcerted by its apparent omniscience.

How Facebook had linked us remained hard to fathom. My father had met her husband in person that one time, after my grandmother's funeral. They exchanged emails, and my father had his number in his phone. But neither of them uses Facebook. Nor do the other people between me and Rebecca Porter on the family tree.

Facebook is known to buy information from data brokers, and a person who previously worked for the company and who is familiar with how the tool works suggested the familial connection may have been discerned that way. But when asked about that scenario, a Facebook spokesperson said, "Facebook does not use information from data brokers for People You May Know."

What information had Facebook used, then? The company would not tell me what triggered this recommendation, citing privacy reasons. A Facebook spokesperson said that if the company helped me figure out how it made the connection between me and my great aunt, then every other user who got an unexpected friend suggestion would come around asking for an explanation, too.

It was not a very convincing excuse. Facebook gets people to hand over information about themselves all the time; by what principle would it be unreasonable to sometimes hand some of that information back?

The bigger reason the social network may be shy about revealing how the recommendations work is that many of Facebook's competitors, such as LinkedIn and Twitter, offer similar features to their users. In a 2010 presentation about PYMK, Facebook's vice-president of engineering explained its value: "People with more friends use the site more." There's a competitive advantage to be gained by being the best at this, meaning Facebook is reluctant to reveal what goes into its algorithm.

The caginess is longstanding. Back in 2009, users getting creepily accurate friend suggestions suspected that Facebook was basing the recommendations on their contact information -- which they had volunteered when they first signed up, not realising Facebook would keep it and use it.

Though Facebook is upfront about its use of contact information now, when asked about it in 2009, the company's then-chief privacy officer, Chris Kelly, wouldn't confirm what was going on.

"We are constantly iterating on the algorithm that we use to determine the Suggestions section of the home page," Kelly told Adweek in 2009. "We do not share details about the algorithm itself."

Not being told exactly how this tool works is frustrating for users, who want to understand the extent of Facebook's knowledge about them and how deeply the social network peers into their lives. The spokesperson did say that more than 100 signals go into making the friend recommendations and that no one signal alone would trigger a friend suggestion.

One hundred signals! I told the spokesperson that it might be in the search giant's interest to be more transparent about how this feature works so that users are less creeped out by it. She said Facebook had "in the name of transparency" recently added more information to its help page explaining how People You May Know works, an update noted by USA Today.

That help page offers a brief bulleted list:

People You May Know suggestions come from things like:

  • Having friends in common, or mutual friends. This is the most common reason for suggestions
  • Being in the same Facebook group or being tagged in the same photo
  • Your networks (example: your school, university or work)
  • Contacts you've uploaded

Depending on how you count them, the listed possibilities are roughly 95 signals shy of adding up to 100 signals. What are all the others?

"We've chosen to list the most common reasons someone might be suggested as part of People You May Know," a Facebook spokesperson wrote in an email when asked about the brevity of the list.

Rather than explaining how Facebook connected me to my great aunt, a spokesperson told me via email to delete the suggestion if I don't like it.

"People don't always like some of their PYMK suggestions, so one action people can take to control People You May Know is to 'X' out suggestions that they are uninterested in," the spokesperson wrote via email. "This is the best way to tell us that they're not interested in connecting with someone online and that feedback helps improve our suggestions over time."

Now, when I look at my friend recommendations, I'm unnerved not just by seeing the names of the people I know offline, but by all the seeming strangers on the list. How many of them are truly strangers, I wonder -- and how many are connected to me in ways I'm unaware of? They are not people I know, but are they people I should know?

This story was produced by Gizmodo Media Group's Special Projects Desk.



    Could it be a situation where if you send out enough recommendations to enough people, it will eventually get something right?

    Like, I send out email to 500million people that tomorrow, the S&P500 will go up, and another email to another 500million people that tomorrow S&P500 will go down. Then on the following day, to the group that I predicted the market correctly, I send out another email split 250million to 250million. Then on the 3rd day, I do the same to 125million/125million. And continue. At the end of the month, there is one email where I predicted the market correctly every single day for the entire month.

      Remind me to never use you for my stock market buying advice.

      Mentalist Derren Brown did exactly this trick to a bunch of people, instead using racehorse wins instead of stocks. google his name and "the SYSTEM"

      Thats how the old school football betting newsletters used to work, At the end you would always have a small number of betting 'tips' that were 100% correct. Then squeeze them for a subscription.

    I avoided facebook for ages, but signed up a couple years ago because my WoW guild used it for communication *sigh*. Used a fake name and details to create the account and only used it to talk about WoW stuff with the guild. Yet somehow FB linked it to a bunch of people I knew. I got a friend suggestion for my personal trainer, a friend I hadn't hung out with for about five years and several other people I knew peripherally.

    The annoying thing is my account *shouldn't* have been linkable to those people in anyway. So FB was trawling information outside of FB to glean my real identity then using that information to make the links.

    I spoke with some of the people trying to figure out how the connections were made. None of them mentioned me by name or email, or had pictures with me in them (not that I ever posted any selfies on FB anyway). It was and still is a mystery I'd love to have explained.

    After it actually send friend requests to several random people without me approving it I cancelled and deleted the account (well as deleted as FB accounts ever can be I guess). It's just too creepy and intrusive for my liking.

    This is why I never use Facebook, twitter, or google, except for throw-away email addresses.

    Last edited 26/08/17 1:13 pm

      No Twitter, no facebook... Google is next, when i can be arsed changing everything over and giving up youtube on my TV.

    Like many others I "have" to use Facebook because it's one of the few ways to keep in touch with people easily... and it's scary how it drags up people who I know. I know FB tracks us outside of the site and app but damn, I'd love to know how it comes up with some of these recommendations.

      I disagree that you have to use it. I quit facebook basically when it first started in Australia. I signed up and had a go at it. After about a year I quit. All my friends use it, my wife and everyone else around me. I get on fine without it. Somehow I manage to communicate with my friends, organise things to do with them, go to events etc and generally live my life without having to like or comment on anything.

      Once you remove it from your life you actually realise how much you don't need it and how nice it is to not receive targeted advertising constantly.

        It's much less convenient in my case to do so - especially with larger groups. Like if I want to organise a shift swap at work by far the easiest option is to use Facebook.

        I don't rely on it for close friends, but for colleagues and more distant friends I do.

        The annoying thing is so many companies are trying to use it in lieu of a proper website now. Want to know why the Blizzard servers are down - check facebook. Want to know when the local markets are being held - check facebook.

        It's understandable, but super frustrating at the same time.

          I think facebook is one of the worst things ever created for our society. It just useless crap. There is only one reason it exists, to generate revenue through targeted advertisement. That is its sole purpose. The sooner it goes away the better.

    By knowing your phone's contacts list it would be simple to find the matching Facebook accounts since a user's mobile number is generally linked to their Facebook account either as 'About me' information or as the security number.

    My view about when it happen is the link between you and view people that you have added, their info link you to other like school your city names and many other mostly if you use phone number

    Happened to me about a year ago after contacting someone on a completely different website then 3 days later that person showed up in my suggestion list.

    We were matched by my email address which I had changed in facebook 10 years ago. Neither of us could see each others email address so the other person couldn't have just saved it to their contact list then sync with facebook.

    Found out later after a bit of digging that facebook owns that site and is obviously dipping into it's data.

    I'm pretty sure they use way more than 100 signals/tentacles.

    Last edited 28/08/17 1:59 pm

Join the discussion!