Facebook moves to block ad transparency tools

This story was originally published by ProPublica and appears here under a Creative Commons license.

A number of organizations, including ProPublica, have developed tools to let the public see exactly how Facebook users are being targeted by advertisers.

Now, Facebook has quietly made changes to its site that stop those efforts.

ProPublica, Mozilla and Who Targets Me have all noticed their tools stopped working this month after Facebook inserted code in its website that blocks them.

“This is very concerning,” said Sen. Mark Warner, D-Va., who has co-sponsored the Honest Ads Act, which would require transparency on Facebook ads. “Investigative groups like ProPublica need access to this information in order to track and report on the opaque and frequently deceptive world of online advertising.”

For the past year and a half, ProPublica has been building a searchable database of political ads and the segments of the population advertisers are paying to reach. We did this by enlisting thousands of volunteers who installed a web browser extension. The tool shared the ads users see as well as Facebook’s details on why the users were targeted.

In a statement to ProPublica, Facebook said the change was meant to simply enforce its terms of service. (The Guardian also published a story Sunday flagging the change.)

“We regularly improve the ways we prevent unauthorized access by third parties like web browser plugins to keep people’s information safe,” Facebook spokesperson Beth Gautier said. “This was a routine update and applied to ad blocking and ad scraping plugins, which can expose people’s information to bad actors in ways they did not expect.”

Facebook has made minor tweaks before that broke our tool. But this time, Facebook blocked the ability to automatically pull ad targeting information.

The latest move comes a few months after Facebook executives urged ProPublica to shut down its ad transparency project. In August, Facebook ads product management director Rob Leathern acknowledged ProPublica’s project “serves an important purpose.” But he said, “We’re going to start enforcing on the existing terms of service that we have.” He said Facebook would soon “transition” ProPublica away from its tool.

Facebook has launched an archive of American political ads, which the company says is an alternative to ProPublica’s tool. However, Facebook’s ad archive is only available in three countries, fails to disclose important targeting data and doesn’t even include all political ads run in the U.S.

Our tool regularly caught political ads that aren’t reflected in Facebook’s archive. Just this month, we noticed four groups running ads that haven’t been in Facebook’s archive:

• the National Rifle Association

• an electoral reform advocacy group targeting Bernie Sanders supporters

• a local anti-corruption group and

• a union advertising to Democrats about health care policy.

After we contacted Facebook, the company canceled the ads and said it is “investigating why these particular ads weren’t classified as political so we can learn and update our protocols.”

Journalists in other countries — including those with impending elections like Canada, Ukraine, Guatemala and Israel — currently have no way to track political ads or targeting information. Facebook announced Monday that it plans to expand its archive to those countries this year and will debut a global tool “by the end of June.”

Facebook’s archive doesn’t disclose the targeting advertisers do by racial, ethnic, religious, partisan and other sensitive attributes. Some of those microtargeting categories have been used to affect the political process: For instance, Russian agents targeted many African-Americans during the 2016 election.

In an email, Facebook said it doesn’t plan to disclose sensitive targeting categories in its archive because doing so “could expose people’s information.” It didn’t elaborate on how that might happen.

The proposed Honest Ads Act, which is expected to be re-introduced in Congress this year, would require Facebook to publish “a description of the audience targeted by the advertisement.”

Facebook has also developed another tool that it says will allow researchers to analyze political ads more easily. That tool, called an API, is in “beta” and restricted to a few participants, including ProPublica, who had to sign a nondisclosure agreement about the data it provided.

One researcher with access said the API is not sufficient. It only allows searching by keyword, said Laura Edelson, a researcher at New York University who studies online political advertising. “You can only find ads about things that you already know you’re looking for,” Edelson said. “So any kind of emerging activity is potentially undiscoverable.”

What it all adds up to, said Knight First Amendment Institute senior attorney Alex Abdo, is “we cannot trust Facebook to be the gatekeeper to the information the public needs about Facebook.”

Here are the details of how our tool worked and what Facebook has done:

All Facebook users can find details about how they’re being targeted by clicking through a series of options on the site. Our tool, the Political Ad Collector, automated the process. Every time one of our over 16,000 participants in crowdsourcing project scrolled past an ad like this one ...

... our extension automatically captured the text and related picture. It also opened the ellipses on the top right of the ad, which leads to this menu:

From there, it read the information contained in “Why Am I Seeing This” and copied that to the database as well:

We have collected more than 100,000 political ads in this way. But Facebook’s latest update blocks tools like ours from clicking on the “Why Am I Seeing This” menu.

The company added code that prevents clicks generated by computers — including browser extensions — on just that one button. Web browsers make a distinction between a click generated by the computer and one generated by your mouse. Clicks from your mouse are marked “isTrusted“ and those generated by computer code are not.

Facebook pointed out that other options, besides seeing the explanation for an ad’s targeting, exist behind that menu, like the ability to hide an ad or report it.

Facebook’s site does not make such a distinction between user or computer-generated clicks on other behaviors that have been abused by bad actors. For example, it is still possible to automatically like a page, watch a video or click through on an ad — loopholes exploited by bots and misinformation campaigns attempting to gain credibility or turn a profit.

When we asked Facebook why it does not use a similar filtering mechanism on other parts of the platform, it said it prevents “bot-like behavior” in other ways, including a collaboration with an effort to help take down an ad fraud ring.

This is not the first time Facebook has changed its code in a way that has broken our tool. For example, all ads are supposed to contain the word “sponsored” as part of a mandatory disclosure, so users can distinguish between ads and their friends’ posts. Our tool recognized ads by searching for that word. Last year, Facebook added invisible letters to the HTML code of the site. So, to a computer, the word registered as “SpSonSsoSredS.” Later, it also added an invisible “Sponsored” disclosure to posts from your friends. Many of the participants in our project noticed the effects of this change because it caused some menus to pop open unexpectedly or the page to scroll to the top repeatedly. Nowadays, the disclosure says “SpSpSononSsosoSredredSSS.” Some of these changes were likely also intended to thwart ad blockers.

Here's what the change looks like in the JavaScript code:

The same new section of code that blocks our tool also sends a “log event” to Facebook, noting when an ad transparency tool is detected. Facebook says the change is meant to document “what percent of the traffic was from plugins that identify content without our permission versus Facebook users checking [Why am I seeing this] manually."