657 points by edent 2185 days ago | 315 comments on HN
| Mild positive Editorial · v3.7· 2026-02-28 14:16:51
Summary Privacy Rights & Data Tracking Advocates
This investigative blog post exposes Facebook's off-Facebook activity tracking feature and reveals how personal data is shared between companies through offline conversion matching and data enrichment services. The author traces mysterious transaction records to Spreadshirt/Lan Tim 2, raising significant concerns about privacy violations and corporate opacity, and advocates for greater transparency, user control, and regulatory oversight of data practices.
> It goes to show, Facebook's level of transparency of data isn't good enough.
I'm actually quite (pleasantly) surprised that Facebook provides this information, and somewhat curious why the author is angry at them rather than "Lan Tim 2".
As anyone who is, or has, worked in ad-tech would tell you, this is pretty _tame_ in terms of the "offline conversion problem."
When there are $billions$ of dollars at stake for this type of information, you can guarantee there will be many companies attacking this problem.
Therefore, not to be a pessimist, but if you think that 1) using a fake cell number on Facebook is going to help or that 2) there aren't services like Google doing this already, potentially with just as good match rates as Facebook, or 3) that using Firefox + adblock is all you need, then you're going to be constantly plugging holes in a leaking boat.
This is seriously just a purchase event for a t-shirt that OP got. There is no mysterious Lan Tim 2 its just a random app for a random merchant that uses FB Ads and uses offline conversion / uploads.
This seems like a decent level of effort to build out especially if it’s to become an effective thing. What’s driving it, is it to show that facebook ads are delivering a total value in excess of the online conversions? Is this being done because there’s questions over Facebook ads value return? Are we sure that Facebook ads even do deliver good value prop, like is this program showing successful linkage / is that linkage ad-related or organic?
> Suppose I go to a restaurant, and I booked using my name and phone number. The restaurant sends that data to Facebook to say "Terence Eden ate at this restaurant on this day."
Do I read this correctly that a restaurant will just dump its complete visitor log to FB and then let FB "sort it out".
Meaning that FB gets to vacuum the info on everyone including those without FB accounts?
So one of the comments on the post got my pressure up before coffee had a chance to kick in:
"It's just offline conversion events being uploaded so you'd stop getting these ads, or so they can market to you again in the future. You purchased this product, gave them a phone number.. Not sure where the issue lies? You agreed to the terms on Spreadshirt which is probably where you opted for marketing."
This is the basic approach. You give it to us. You agree to whatever we put in legalese and now we can do whatever we want. What?
It is disheartening, but I agree with the rest of the posts on HN that it is not at all surprising.
Just checked mine. Literally hundreds of entries. 700+
Crikey. Just downloaded all the data and having a browse. 22k line location file (about 3k locations) stored too. I don't have the app installed on any device i own. I presumed the mobile page wouldn't have permission. Checking the data it does seem to stop when I changed phone (samsung preinstall fb app)
$ date -d @1495296127
Sat 20 May 17:02:07 BST 2017
$ date -d @1573424412
Sun 10 Nov 22:20:12 GMT 2019
What are they doing with ancient location data?
Also have every deliveroo purchase I've made in there
they have an entry for every deliveroo purchase i've made
When the game is at this stage it's better to just not play.
When an advertising platform has to pay fartsniffers to follow you around to offer marginally better ctr than email spam, maybe just don't run ads?
Work manually on growing networks of users, actually walk up to them and chat, talk in relevant business forums and you won't spend thousands of dollars you don't have casting a net in hopes of finding people who more likely than not just don't want to be associated with your practices.
I have LAN TIM 2 on my facebook account and I have never bought anything from spreadshirt.
Moreover my facebook account is just a dummy one which only has the bare minimum of information to own my business page, which I don't even post to (I have dedicated social media people who do that).
Facebook doesn't even have my phone number, only my name and my business email address.
Am I the only one who thinks it would be pretty cool to hook this up as SaaS product that sends me an alert when I get a new offline conversion? Kind of like how my credit card sends me a push notification when I get charged for something. I like the level of transparency it provides.
Then you could also do something on a case by case basis where you can click to say “I don’t want Facebook to have this offline conversion.”
Perhaps ironically, I'm frankly astounded at the apparent naïveté still held about Facebook, Google, et al.
> I have never used FaceBook [sic] login for anything
> Facebook doesn't even have my phone number, only my name and my business email address.
People, if any company has A-N-Y-thing that can be associated with you, online or offline, you have no privacy. None. It is gone forever.
There is billions of dollars at stake for companies to build as complete a picture as possible of you and every detail of your life. And billions more remains on the table. That is plenty motivation to fuel a highly-lucrative market for accurate, meaningful profiling for years.
Sure, there's a long list of actions you could take to begin minimizing your exposure, the practicality of each varying widely. But frankly, most of them would only serve to make going about daily life inconvenient. (And the correlation between effectiveness and convenience isn't 1:1...)
The best case scenario is your data becoming stale, such that its values diminishes to a degree that makes it effectively background noise.
There is simply no means of unembedding yourself. But also, more discouragingly, for most people there is no practical means to avoid being ingested.
Home Depot lets you sign up to have your receipts emailed to you. Turns out if you do this they will send what you purchase to Facebook with your email, which was connected to my account.
I use Firefox to avoid being tracked by Facebook, and never login with Facebook. But it looks like I slipped up in signing up for email receipts!
Even if I didn't have a Facebook account, Facebook would still be building a profile on me using my email address /phone number in anticipation of the day I made an account.
I design Ad Tech systems, currently work as an architect for a DSP, and I deleted my Facebook accounts years ago. People who think they are privacy conscious and use Facebook are a living oxymoron.
> Suppose I go to a restaurant, and I booked using my name and phone number. The restaurant sends that data to Facebook to say "Terence Eden ate at this restaurant on this day." Facebook can then tell if I saw an advert which led me to make a purchase.
That's just great. So I guess the gift that marketing agencies have given us is that we can't trust anybody. The only thing left to do is go entirely cash-only and never give any personal details to any business whatsoever.
The marketing industry has become so toxic that it is now poisoning everything.
I just checked, and have "LAN TIM 2" and "DiepTrinh" on my list.
The data from "LAN TIM 2" was sent to Facebook on the 5th of March 2020, yesterday that is.
The only stores I've shopped at lately were ALDI and EDEKA, and yesterday I bought a Webhosting offer directly at the hoster's site, no third party involved.
I have never bought a custom shirt.
What I do have is a Motorola G7 Plus, which is filled with uninstallable background services from Facebook. Two days ago I upgraded it to Android 10 and now all those background services, like "Facebook App Manager" or "Facebook Installer", "Facebook Services", all names which truly frighten me, are activated again. I had deactivated them months ago on Android 9 as soon as I got this phone. I really am wondering about the data this phone is pushing to Facebook without my consent.
I really wonder what caused those two entries, I never give any consent to any company to share my data.
God I hate Facebook, they are the cancer of the internet.
Maybe because Facebook doesn't tell you anything past "Lan Tim 2" so how do you know who to be angry with? Who is "Lan Tim 2"? What business or what transaction is behind that entry?
Based on some of the network analysis I did on my phone, I think this is related to Facebook's analytics engine. Most apps I've seen communicate with graph.facebook.com to send telemetry (when which screen was opened etc.).
It wouldn't be beyond Facebook to immediately connect that telemetry to your user profile, making these apps show up in your profile.
"This is a summary of the 285 apps and websites that have shared your activity." hmmm, that's more than I expected. A lot of them are from sites which probably had a Facebook pixel on them.
The problem is, they don't give me any meaningful data other than a code name and an incorrect date. If they'd said "This is from Company X on or around date Y regarding action Z" that would be more transparent, and more useful.
Working in ad-tech I know these problems are ubiquitous but apart from trying to patch these issues when we notice them in whatever in significant ways we can what else can you do?
You are so right. People forget that the cell companies know who you are and where you are 100% of the time. They also know every site you visit on their network. Things like this remind me of people using TOR and then signing into Instagram or Facebook. You just destroyed your anonymity. These sites would need to allow for anonymous login structures that almost none do.
> you're going to be constantly plugging holes in a leaking boat.
True, but the ad industry isn't like a boat. They don't want to track everything or build a complete profile about everyone. They just want to track most things and build a fairly complete profile about most people.
That means every privacy step you make has some incremental gains. Just because a private detective could use the collected data to build a complete profile of you, doesn't mean the ad company will - they'll collect data from the easiest sources, and if you make it too hard for them to get data about you, they'll simply collect data about other people.
That is very true. Also the Google Page Rank has evolved strongly towards that direction. If you have meaningful content, praised by your peers, you get better organic traffic.
I only had half a dozen, all from the last month. This is pretty surprising. I use Instagram regularly, though I only sign into Facebook occasionally.
All of the activity I had was from games that I casually installed and then deleted in the past month. These are games that I signed into with Google Play, which displayed advertisements primarily for Facebook.
Speaking of which, some of Facebook's advertisements are absurd.
False flags and information is the only way to deal with this stuff...
If FB thinks you're a 72 yr old retired dentist from OK, and you buy nothing but feminine hygiene products and 3 wheel wheel barrels, you're pretty worthless as a consumer.
The future of ad block is disinformation. Makes the entire ecosystem worthless
From the article, it sounds like Spreadshirt outsources its manufacturing. (Just guessing, but they may even do drop shipping.)
There's no specific reason to believe this isn't the real name of the manufacturer. I tried to find more information about Lan Tim to see if that's likely the case, but I couldn't, but that's not very conclusive.
I have friends around the world I still IM. Maybe I could get some of them onto Signal or do international texts (Which get expensive) but many of them I can only communicate with via Messenger.
I don’t have an account, not have i ever had one, but assume they are tracking me in various ways. It would be very nice to see what that is without having to provide more PII.
> I have LAN TIM 2 on my facebook account and I have never bought anything from spreadshirt.
Lan Tim 2 is likely a contract manufacturer. Spreadshirt outsources the production of their t-shirts to Lan Tim 2. Likely, many companies do this as well. Lan Tim 2 probably does more than just t-shirts.
It's like with most craft beer sold in cans. The individual breweries cannot supply the demand for their product, so they have another company that specializes in mass production do it according to their recipe.
The contract manufacturer is likely the one giving data to FB, not the spreadshirt.
Root your phone and use a community made ROM? Vendor bloatware that comes with your phone is and always has been garbage. The only reason phone vendors have to develop and ship apps on their phones is to sell you out, to improve their unit economics.
If you have location history enabled in Google Maps, they tie it to ad impressions and offline credit card transactions they buy from Visa and friends.
But the "fear" bit they instill is that it may prevent you from ever logging back into the apps/sites in question.
Editorial Channel
What the content says
+0.55
Article 12Privacy
High Advocacy Framing
Editorial
+0.55
SETL
+0.57
CENTRAL provision. The entire article champions privacy protection and reveals violations of privacy through corporate data tracking and sharing without informed consent. Author exposes Facebook's off-Facebook activity feature and advocates for user control and transparency.
FW Ratio: 57%
Observable Facts
Article title and core premise: investigating mysterious entries in Facebook's off-Facebook activity tracking feature.
Author states: 'I expected my Off Facebook Activity to be completely blank. It wasn't' — documenting unauthorized data association.
Multiple readers report finding phantom transactions attributed to companies they never purchased from.
Post explains offline conversion matching: 'Facebook can match offline activity with online activity...companies can match their customer data to this data.'
Inferences
The investigation serves as advocacy for privacy rights by exposing hidden data practices.
The framing positions privacy transparency as a user right that corporations currently violate.
The author's call to action (check activity, delete apps, use disposable phone numbers) empowers readers to protect privacy.
+0.20
PreamblePreamble
Medium Advocacy Framing
Editorial
+0.20
SETL
+0.20
Content advocates for human dignity and privacy protection through investigation of unauthorized data sharing. Frames privacy as foundational to personal autonomy.
FW Ratio: 60%
Observable Facts
Blog post explicitly calls Facebook's data collection 'mysterious' and raises transparency concerns.
Author encourages readers to check and clear their off-Facebook activity ('Delete that @Airbnb app, folks!').
Comments section includes reader expressing concern: 'Facebook's ability to collect data even from their most private users.'
Inferences
The investigative framing suggests the author views personal privacy as a fundamental right that requires protection.
The call to action implies readers have agency and responsibility to protect their own dignity.
+0.15
Article 6Legal Personhood
Medium Advocacy Framing
Editorial
+0.15
SETL
ND
Discusses the ability of corporations to identify and track individuals through data matching, raising concerns about recognition and control of one's identity.
FW Ratio: 67%
Observable Facts
Author demonstrates how phone numbers and personal data are used to match individuals across platforms without consent.
Post references FullContact's data enrichment practices: 'Companies work with clients to match their customer data...via an API.'
Inferences
The data matching practices represent a form of identity surveillance that users cannot easily control or even discover.
+0.15
Article 19Freedom of Expression
Medium Advocacy Framing
Editorial
+0.15
SETL
ND
Author exercises freedom of expression through investigative journalism, publishing findings about corporate data practices. Demonstrates free speech in service of privacy advocacy.
FW Ratio: 75%
Observable Facts
Blog post published freely with no apparent censorship or restriction.
Author cites other researchers and commentators; enables reader comments and discourse.
Post references and links to other sources of information (Facebook JSON download, Wayback Machine, researcher reports).
Inferences
The publication itself exemplifies freedom of expression regarding corporate accountability.
+0.15
Article 21Political Participation
Medium Advocacy
Editorial
+0.15
SETL
ND
Author advocates for regulatory oversight, tagging EU regulators (@vestager, @dreynders) and asking if practices violate GDPR. Engages in public discourse about governance.
FW Ratio: 67%
Observable Facts
Post directly addresses EU officials: 'isn't that against GDPR, @vestager & @dreynders?'
Author frames the issue as requiring public policy attention and regulatory response.
Inferences
The framing positions citizens' right to participate in governance discussions about technology regulation.
+0.15
Article 28Social & International Order
Medium Advocacy
Editorial
+0.15
SETL
ND
Advocates for social order around data protection and corporate accountability. Calls for regulatory framework (GDPR) to govern data practices.
FW Ratio: 67%
Observable Facts
Post concludes: 'It goes to show, Facebook's level of transparency of data isn't good enough' — positioning the need for systemic change.
Author references GDPR as an existing framework that should apply to these practices.
Inferences
The framing suggests a need for international norms and laws governing corporate data practices.
+0.15
Article 29Duties to Community
Medium Advocacy
Editorial
+0.15
SETL
ND
Discusses corporate duties: Spreadshirt's obligation not to misuse customer data; Facebook's obligation to provide transparency. Frames data protection as mutual responsibility.
FW Ratio: 67%
Observable Facts
Post questions: 'Spreadshirt took the phone numbers given to it for one reason - and then used them for another' — suggesting violation of duty.
Author emphasizes companies' responsibility in data sharing: 'companies share with us...interactions.'
Inferences
The analysis positions corporations as having specific duties to limit data use to stated purposes.
+0.10
Article 1Freedom, Equality, Brotherhood
Low Advocacy
Editorial
+0.10
SETL
ND
Tangentially addresses dignity through discussion of individuals being tracked without knowledge or consent.
FW Ratio: 50%
Observable Facts
Article discusses individuals being identified and tracked through personal data (phone numbers) without explicit consent.
Inferences
Implicit criticism of data matching practices suggests violation of equal treatment principle.
+0.10
Article 3Life, Liberty, Security
Low Advocacy
Editorial
+0.10
SETL
ND
Relates to security of person through discussion of unwanted data tracking creating vulnerability.
FW Ratio: 50%
Observable Facts
Author expresses concern about phantom transactions appearing in Facebook account: 'It wasn't' blank as expected.
Inferences
The mystery purchases represent a form of violation of personal security and autonomy.
+0.10
Article 17Property
Medium Advocacy
Editorial
+0.10
SETL
ND
Discusses data commodification: personal information treated as tradeable asset by corporations. Raises concerns about individuals' control over their own data.
FW Ratio: 67%
Observable Facts
Post describes Lan Tim 2 as 'white label' operation and explains how customer data is shared between retailers, manufacturers, and marketers.
Discussion of data enrichment services like FullContact that assemble databases from business cards and other sources.
Inferences
The framing suggests individuals should retain control over their personal information and its use as property.
+0.10
Article 26Education
Medium Advocacy
Editorial
+0.10
SETL
ND
Content educates readers about Facebook's data tracking mechanisms, offline conversions, and data enrichment practices. Enables informed participation in digital culture.
FW Ratio: 67%
Observable Facts
Post explains technical mechanisms: 'Off-Facebook activity doesn't just mean stuff that happens online...Facebook also does offline conversions.'
Provides reader guidance on how to check and manage their own off-Facebook activity.
Inferences
The educational approach empowers readers to understand and navigate corporate data practices.
-0.10
Article 8Right to Remedy
Medium Advocacy
Editorial
-0.10
SETL
ND
Content raises that victims of data sharing lack effective remedies or transparency. Facebook's explanation of offline conversions is opaque; users cannot identify who shared their data or prevent it.
FW Ratio: 67%
Observable Facts
Author states: 'Facebook's level of transparency of data isn't good enough' and notes inability to find purchase records matching the Facebook data.
One commenter: 'I track my expenses, no purchases made on those days at all, yet DiepTrinh shows up' — indicating lack of remedy mechanism.
Inferences
The absence of clear attribution and user control mechanisms suggests inadequate access to effective remedy for privacy violations.
ND
Article 2Non-Discrimination
Not directly addressed.
ND
Article 4No Slavery
Not relevant.
ND
Article 5No Torture
Not relevant.
ND
Article 7Equality Before Law
Not directly addressed.
ND
Article 9No Arbitrary Detention
Not relevant.
ND
Article 10Fair Hearing
Not relevant.
ND
Article 11Presumption of Innocence
Not relevant.
ND
Article 13Freedom of Movement
Not relevant.
ND
Article 14Asylum
Not relevant.
ND
Article 15Nationality
Not relevant.
ND
Article 16Marriage & Family
Not relevant.
ND
Article 18Freedom of Thought
Not directly relevant.
ND
Article 20Assembly & Association
Not relevant.
ND
Article 22Social Security
Not relevant.
ND
Article 23Work & Equal Pay
Not directly relevant.
ND
Article 24Rest & Leisure
Not relevant.
ND
Article 25Standard of Living
Not relevant.
ND
Article 27Cultural Participation
Not relevant.
ND
Article 30No Destruction of Rights
Not directly addressed.
Structural Channel
What the site does
0.00
PreamblePreamble
Medium Advocacy Framing
Structural
0.00
Context Modifier
ND
SETL
+0.20
Static blog post; no structural provisions that protect or violate dignity principles.
-0.05
Article 12Privacy
High Advocacy Framing
Structural
-0.05
Context Modifier
ND
SETL
+0.57
Structural signal is neutral to slightly negative: the blog itself has no privacy violations, but does not implement advanced privacy protections beyond basic practices.
ND
Article 1Freedom, Equality, Brotherhood
Low Advocacy
Not directly relevant to structural provision.
ND
Article 2Non-Discrimination
Not applicable.
ND
Article 3Life, Liberty, Security
Low Advocacy
Not applicable.
ND
Article 4No Slavery
Not applicable.
ND
Article 5No Torture
Not applicable.
ND
Article 6Legal Personhood
Medium Advocacy Framing
Not applicable.
ND
Article 7Equality Before Law
Not applicable.
ND
Article 8Right to Remedy
Medium Advocacy
Not applicable.
ND
Article 9No Arbitrary Detention
Not applicable.
ND
Article 10Fair Hearing
Not applicable.
ND
Article 11Presumption of Innocence
Not applicable.
ND
Article 13Freedom of Movement
Not applicable.
ND
Article 14Asylum
Not applicable.
ND
Article 15Nationality
Not applicable.
ND
Article 16Marriage & Family
Not applicable.
ND
Article 17Property
Medium Advocacy
Not applicable.
ND
Article 18Freedom of Thought
Not applicable.
ND
Article 19Freedom of Expression
Medium Advocacy Framing
Not applicable.
ND
Article 20Assembly & Association
Not applicable.
ND
Article 21Political Participation
Medium Advocacy
Not applicable.
ND
Article 22Social Security
Not applicable.
ND
Article 23Work & Equal Pay
Not applicable.
ND
Article 24Rest & Leisure
Not applicable.
ND
Article 25Standard of Living
Not applicable.
ND
Article 26Education
Medium Advocacy
Not applicable.
ND
Article 27Cultural Participation
Not applicable.
ND
Article 28Social & International Order
Medium Advocacy
Not applicable.
ND
Article 29Duties to Community
Medium Advocacy
Not applicable.
ND
Article 30No Destruction of Rights
Not applicable.
Supplementary Signals
How this content communicates, beyond directional lean. Learn more
build aba2bc8+myve · deployed 2026-02-28 16:36 UTC · evaluated 2026-02-28 16:29:11 UTC
Support HN HRCB
Each evaluation uses real API credits. HN HRCB runs on donations — no ads, no paywalls.
If you find it useful, please consider helping keep it running.