Leila has two identities, but Facebook is only supposed to know about one of them.
Leila is a sex worker. She goes to great lengths to keep separate identities for ordinary life and for sex work, to avoid stigma, arrest, professional blowback, or clients who might be stalkers (or worse).
Her “real identity”—the public one, who lives in California, uses an academic email address, and posts about politics—joined Facebook in 2011. Her sex-work identity is not on the social network at all; for it, she uses a different email address, a different phone number, and a different name. Yet earlier this year, looking at Facebook’s “People You May Know” recommendations, Leila (a name I’m using using in place of either of the names she uses) was shocked to see some of her regular sex-work clients.
Despite the fact that she’d only given Facebook information from her vanilla identity, the company had somehow discerned her real-world connection to these people—and, even more horrifyingly, her account was potentially being presented to them as a friend suggestion too, outing her regular identity to them.
Because Facebook insists on concealing the methods and data it uses to link one user to another, Leila is not able to find out how the network exposed her or take steps to prevent it from happening again.
“The worst nightmare of sex workers is to have your real name out there, and Facebook connecting people like this is the harbinger of that nightmare,” she said. “With all the precautions we take and the different phone numbers we use, why the fuck are they showing up? How is this happening?”
It’s not a question that Facebook is willing to answer. The company is not forthcoming about how “People You May Know,” known internally as PYMK, makes its recommendations. Most of what Facebook does reveal about the feature is on a help page, which says that the suggestions “come from things like” mutual friends, shared networks or groups, or “contacts you’ve uploaded.”
When the suggestions turn out to be unnerving, that explanation is both vague and woefully incomplete. A Facebook spokesman told me this summer that there are more than 100 signals that go into PYMK. All someone like Leila—who was not connected to her clients by anything like mutual friends, networks, groups, or contacts—can know is that the data that exposed her must be something else, in that large undefined set of factors.
Leila suspects either that Facebook collected contact information from other apps on her phone or that it used location information, noticing that her and her clients’ smartphones were in the same place at the same time.