Surveillance marketers are changing how they track you online, and The Markup is joining forces with Consumer Reports to investigate. But we need your help.

Companies may now be tracking you in a way that’s completely undetectable by users and their devices.

The Markup has done extensive reporting on the Meta Pixel (previously the Facebook Pixel) and other tracking pixels in the last year, revealing that organizations—from hospitals to crisis hotlines to tax filing companies to the U.S. Department of Education—have sent sensitive data to Facebook. We’ve spurred congressional investigations, data breach notifications, and class action lawsuits. Dozens of organizations have removed the Meta Pixel from their websites as a result. We were able to do all of this because members of the public shared their data with us, through our “Facebook Pixel Hunt” study in partnership with Mozilla Rally. Those donations let us see how real people’s information ended up in Facebook’s hands as they surfed the web.

Now, we need your help again. Instead of relying on tracking pixels—which is web traffic that The Markup, Consumer Reports, and others can detect using tools in the browser—companies may now be tracking you in a way that’s completely undetectable by users and their devices.

We need a new way to see what companies are up to…. And that’s where you come in.

It’s called “server-to-server tracking,” which essentially means that when companies get some information about you, their servers send it directly to another company’s server. Privacy research tools often rely on certain signals from your computer, mobile device, or browser to detect tracking. But “server-to-server tracking” doesn’t emit any of these sorts of signals.

We need a new way to see what companies are up to with your data, and we have reason to believe that starting with what they’re sharing with Facebook will get us there. And that’s where you come in.

We need your help seeing what companies have sent to Facebook about you, including what they’ve sent using server-to-server tracking. (We’ll likely also see data that was sent through the Meta Pixel.) We’ll walk you through how to download your data from Facebook and share it with us. Then, Consumer Reports will use two specific parts of your data file:

• Your Facebook events. These include “events” reported to Facebook by other companies, including companies that have their servers tell Facebook’s servers about something that you did—for example, if you tapped on a button on a company’s mobile app, added an item to your cart or wishlist, or bought something in its physical store. Companies that use this feature will recognize it as Facebook’s Conversions API.
  
• Facebook custom audiences that include you. These are lists of email addresses or phone numbers that companies upload to Facebook. Facebook advertises this as a way for companies to target their ads to people who are already in their “existing audiences” or if Facebook thinks you are similar to those people. For example, a company could upload its newsletter subscriber list.

The entire process should only take you 5 to 10 minutes. It involves downloading some data from Facebook.

Step 1: Sign up as a volunteer

• Visit Consumer Reports’ Facebook tracking volunteer sign-up page.
• Use the form on the page to sign up as a volunteer.
• Follow the full instructions, including how to download your Facebook data, in the Google Form you’ll see after signing up. These instructions will also be emailed to you.

Step 2: Fill out the Google Form and download your Facebook data

• The Google Form will ask for your email address and for you to read through the consent form. You’ll be consenting to sharing the data that Facebook has about you but not your personal content, photos, or messages. Any personally identifying information will be kept confidential. We dig into exactly what data is being collected below.
• Then, it will guide you through downloading a subset of your data from Facebook and uploading it to the form.
• It will ask you some optional survey questions and give you space to share any feedback.
• Finally, submit your data so researchers and journalists at The Markup and Consumer Reports can use it to investigate the new ways companies are tracking users like you. That’s it! 

Everyone! We mean it. The more people who help, the more we’ll understand about this new tracking technique. Even if you haven’t logged in to Facebook in years, you can help.

While we won’t know demographic information about you, we especially encourage you to contribute your data if you fall into one of the categories below, because digital advertisers heavily target members of these categories (so we’re likely to get high-quality data) and because we’re really interested in seeing the names of companies targeting ads to these groups.

• Parents with kids who are 18 or younger
• Anyone over the age of 65
• Women between the ages of 18 and 35
• People who have linked their Facebook account to a financial service or health care service (for example, if you use your Facebook account to log in)

We already know that the Meta Pixel collects information about you even if you don’t have a Facebook account. The same applies here. Even if you don’t have a Facebook account, Facebook probably still has data about you—but you won’t be able to download it using our instructions for this investigation. However, we’re really interested in looking into this in the future.

If you’ve never made a Facebook account before and want to help us investigate what data Facebook has about you, send a note to hello@themarkup.org or community@cr.consumer.org, and we’ll contact you if we do a follow-up investigation. 

Consumer Reports collects:

• The name of the company that sent shared information about you to Facebook
• Dates and times that information was shared
• Identifiers for type of data shared, such as when you ran an app or made a purchase
• Your zip code, from the optional survey
• Whether you use certain privacy tools while browsing online, from the optional survey
• The name and photo associated with your Google account. Google Forms collects this data in order to allow users to upload their data securely, but Consumer Reports will not use this information and will not associate it with the Facebook data you upload in any way. You can also avoid sharing this information by creating a new Google account for the purpose of uploading your data. 
• Consumer Reports will anonymize the data so it can’t extract any specific data about you, and it will store and process your Facebook data separately from any of your personal information. 

If you’re a Facebook user, Consumer Reports will not collect your posts, including messages or photos—the download guide explains how to get the data Facebook has on you without downloading your personal content in the process. Additionally, even if you ultimately upload your personal content, Consumer Reports will only pull the data listed above for this study.

You’ll be able to contribute data going forward, but Consumer Reports will start analyzing the data on Aug. 14, and we’ll be looking to publish stories in the coming months.

We hope you can join us. We’re excited to see what we can find.