 Following Facebook's scandal with Cambridge Analytica, Mark Zuckerberg went before Congress for two days of questions on Facebook's approach to users' data. As Zuckerberg presented it, Facebook users are in complete control of their data, with the company taking only what they share and deleting anything users don't want on the network. On Facebook, you have control over your information. The content that you share, you put there, you can take it down at any time. The information that we collect, you can choose to have us not collect. You can delete any of it. And of course, you can leave Facebook if you want. Now, none of that's false, but it's not the whole picture. There's a lot of data that Facebook collects behind the scenes, and most of it isn't obvious from Facebook's privacy tools. So active Facebook users can modify or delete their ad targeting data, or download almost all the data Facebook has collected on them. But there's a lot of data that falls outside the reach of those tools. You've said everyone controls their data, but you're collecting data on people that are not even Facebook users that have never signed a consent, a privacy agreement, and you're collecting their data. And it may surprise you that on Facebook's page, when you go to, I don't have a Facebook account and would like to request all my personal data stored by Facebook, it takes you to a form that says, go to your Facebook page, and then on your account settings, you can download your data. So you're directing people that don't have access, don't even have a Facebook page to have to sign up for a page to reach their data. We've got to fix that. The biggest problem is something called shadow profiles, data that Facebook keeps on non-Facebook users based on the contact lists that their friends have uploaded. Even if you've never signed up for Facebook, there's a good chance that you have a shadow profile. But you never know that from Facebook's data privacy tools, because those tools only work for active Facebook accounts. Congressman, I've logged out of Facebook, do you still have the ability to follow my interactions on the web? Congressman, you have control over what we do for ads and the information collection around that. On security, there may be specific things about how you use Facebook, even if you're not logged in, that we keep track of to make sure that people aren't abusing the system. There's a lot of other data that you can't get through Facebook's privacy tools. Zuckerberg kept telling Congress, you can download all your Facebook data, but the download tool omits a lot of information that Facebook clearly collects and uses, like the location that it pulls from your phone or web browsing data collected by Facebook's pixel tracking tool. Zuckerberg also said that Facebook gets rid of all that information when you delete your account, which is sort of true, but what about the shadow profile that predated your account? We just don't know. The biggest problem is that we don't know how much information falls into that category, or what Facebook's rules are for dealing with it. We don't know who has access or how they could use it. In this week's hearings, Zuckerberg didn't want to admit that non-profile data existed at all. But over and over, members of Congress were ready to force the issue. You didn't know what a shadow profile was. You didn't know how many apps you need to audit. You did not know how many other firms have been sold data by Dr. Kogan, other than Cambridge Analytica and Inoya Technologies, even though you were asked that question yesterday. And yes, we were all paying attention yesterday. The big question is, what's Washington going to do about it? One idea is the Consent Act, which would require explicit opt-in consent any time a tech company uses or shares data. There's also the Federal Trade Commission, which is investigating whether Facebook may have violated an earlier consent decree. But no matter what happens, you can expect to see Washington putting a lot more pressure on Facebook in the months to come.