A years-long analysis shows that social media titans engaged in “vast surveillance” to make money from people’s personal information, according to the US Federal Trade Commission (FTC).

A report based on queries launched nearly four years ago aimed at nine companies found they collected troves of data, sometimes through data brokers and could indefinitely retain the information collected about users and non-users of their platforms.

“The report lays out how social media and video streaming companies harvest an enormous amount of Americans’ personal data and monetise it to the tune of billions of dollars a year,” FTC Chair Lina Khan said in a release. “Several firms’ failure to adequately protect kids and teens online is especially troubling.”

Khan contended that the surveillance practices endangered people’s privacy and exposed them to the potential of identity theft or stalking.

Business models that typically involve targeted advertising incentivised mass collection of user data at many of the companies, pitting profit against privacy, according to the report.

“While lucrative for the companies, these surveillance practices can endanger people’s privacy, threaten their freedoms, and expose them to a host of harms, from identify theft to stalking,” Khan said.

The Interactive Advertising Bureau countered that internet users understand that targeted ads pay for online services enjoyed free of charge and pointed out that the industry group “vehemently” supports comprehensive national data privacy law.

“We are disappointed with the FTC’s continued characterisation of the digital advertising industry as engaged in ‘mass commercial surveillance,’” IAB chief executive David Cohen said in a post responding to the report.

“Nothing could be further from the truth, as countless studies have shown that consumers understand the value exchange and welcome the opportunity to have access to free or highly subsidised content and services.”

Data not deleted?

The findings were based on answers to orders sent in late 2020 to companies including Meta, YouTube, Snap, Twitch-owner Amazon, TikTok parent company ByteDance, and X, formerly known as Twitter.

“Google has the strictest privacy policies in our industry — we never sell people’s personal information and we don’t use sensitive information to serve ads,” Google spokesperson Jose Castaneda told AFP.

Castaneda added that Google prohibits ad personalisation for users younger than 18 years of age and does not personalise ads for those watching “made for kids content” on YouTube.

The report found data collection practices “woefully inadequate” and that some companies did not delete all of the data users asked them to remove. The sharing of data by companies also raised concerns about how well they were protecting people’s data, according to the report.

Along with maintaining that social media companies were lax when it came to protecting children using their platforms, the FTC staff cited a report that such platforms were found to harm the mental health of young users.

The report called for social media companies to rein in data collection practices and for the US Congress to pass comprehensive federal privacy legislation to limit surveillance of those using such platforms.