Facebook sending 'nonposts' to its servers

Aral Balkan independently verified my claims that Facebook are keylogging your status updates as you type.

To give you “suggestions”, Facebook sends everything you type in a status update to its servers (so they know what you’ve typed, even if you don’t submit the status update itself). Watch the screen capture below to see how Facebook are doing it:

Hat tip to Aral Balkan of the privacy advocacy site ind.ie

In the past, Facebook released a study where they analysed exactly this information.

We only know of that study because Facebook released it. Given the negative feedback that study and the emotional contagion study got, they probably won’t be making the mistake of publishing such studies in the future. They run such algorithmic studies on users all the time, of course, because it is their business to do so (see ind.ie/the-camera-panopticon).

As a small follow-up to this post, I may add that whatever which way Facebook decides to log metadata on status updates is not my main concern. It seems Facebook are scanning for names as you type into the status update box, and whilst it's nice to have suggestions to make life easier, it's also nice to just have a HTML <textarea> where I can start typing out thoughts and ideas without a flurry of activity on Facebook's servers. Twitter has a blank textarea, and Reddit has a blank textarea, and I love them for that. No network traffic as I type. Just an empty box where I can type. I am aware that Google and many other web apps use an autosuggest feature, but they are mostly for search, and a status update box is a bit more personal.

My main concern is that they are sending something to their servers in the status update box, and this raises issues relating to a lack of informed consent. Users are expected a modicum of privacy, even if it is Facebook we are talking about (where users expressly waive their right to privacy when agreeing to sign up).

Facebook does call this information 'metadata' and although not entirely harmful in itself, is a quick click away from full data being collected. As I said before, the fact they are interfering with my text as I type is inconvenient in itself. I have been contacted by various tech bloggers and journalists about this post, and have refused to talk more about it. As a fellow netizen, I leave it to others to make up their own mind about Facebook. Personally I still use Facebook and will happily trade my personal information for the convenience it provides, and the reach it gives me to my social graph.

Facebook is toxic by nature, and raising alarm bells about its awful privacy practices is tiring and gets us nowhere, I know that. But I will call Facebook out when they take liberties with my data.

Here's the original untouched post I published:

Edit: I got confirmation they are not storing any posts, only logging that you were indeed typing out something in the box. The flurry of network activity as I type is there for a solid reason apparently, so there's no need to permaban Facebook from the Internet just yet.


I was inspecting Facebook's network traffic today in Firefox Devtools, when I realized that any text I put into the status update box was sent to Facebook's servers, even if I did not click the post button. Ever curious, I Googled this behaviour and came across a study which reveals some very frightening information:

Facebook calls these unposted thoughts "self-censorship," and insights into how it collects these nonposts can be found in a recent paper written by two Facebookers. Sauvik Das, a Ph.D. student at Carnegie Mellon and summer software engineer intern at Facebook, and Adam Kramer, a Facebook data scientist, have put online an article presenting their study of the self-censorship behaviour collected from 5 million English-speaking Facebook users. (The paper was also published at the International Conference on Weblogs and Social Media.*) It reveals a lot about how Facebook monitors our unshared thoughts and what it thinks about them.

The study examined aborted status updates, posts on other people's timelines, and comments on others' posts. To collect the text you type, Facebook sends code to your browser. That code automatically analyses what you type into any text box and reports metadata back to Facebook.

I subsequently recorded this behaviour with some basic screencast software to illustrate what is happening. That's correct, there is a HTTP post request sent containing the text I just entered. This is outright Orwellian, and inconvenient. Since I am now aware of this, I am more cautious about what I enter into the text area, however I can't help but notice the adverse effect of my new found awareness ― am I experiencing the censorship of my own thoughts because of a faceless entity such as Facebook that doesn't care about you? I very much believe that is the case.

Also Noteworthy:
- Facebook are keylogging. Followup screen capture by Aral Balkan