How Facebook builds shadow profiles without your consent
Every digital footprint assessment I run includes a shadow profile check. Even for clients who have never created a Facebook account. The results are almost always the same: Meta holds data on them anyway, assembled from sources they never touched.
The mechanism is straightforward. When someone uploads their phone contacts to Facebook, Instagram, or WhatsApp, every number and email address in that contact list gets ingested. If your PA saved your personal mobile number, your spouse shared their address book, or your children synced their contacts when they were fourteen, Meta now has your phone number, your name as it appears in someone else’s phone, and the social graph connecting you to the person who uploaded it.
That is layer one. Layer two is the Facebook Pixel, a tracking snippet embedded on roughly 30% of websites. Every time you visit a site running the Pixel, Meta captures your browsing behaviour and ties it to whatever identifiers it already holds. Your IP address, your device fingerprint, any cookies from previous interactions. You never logged in. You never consented. The profile grows anyway.
Layer three is inference. Meta’s algorithms map social connections from the contact uploads and cross-reference them with Pixel data. If three people in your household have Facebook accounts and all interact with the same IP address, Meta can infer the fourth person’s relationship to the group. The shadow profile becomes richer over time without the subject doing anything at all.
The deletion paradox for non-users
Here is the problem I explain to every client who asks about this: you cannot log in to delete data from an account you never created. Meta provides a form for non-users at facebook.com/help/contact/540977946302970, but I would rate this as very hard in practice. You are submitting a request to a company that has no verified relationship with you, asking them to delete data they assembled from other people’s actions.
I have submitted these requests on behalf of clients. Meta’s responses are slow, vague, and difficult to verify. There is no dashboard to confirm what was deleted. There is no way to check whether the Pixel data, the contact graph, or the inferred connections were actually purged. You are taking their word for it.
Under UK GDPR Article 17, you have the right to erasure. Meta is legally obligated to respond within one calendar month. If they refuse or fail to respond, you can escalate to the ICO. But the ICO has not taken enforcement action against Meta specifically for shadow profiles, and the practical reality is that verification is nearly impossible.
I think the regulatory framework is years behind the technology here. The right exists on paper. Enforcing it against a company that builds profiles from other people’s data, without any direct relationship to you, requires resources and persistence that most individuals simply do not have. It is one reason I flag shadow profiles as a risk category rather than a removal target in my assessments.
Oracle’s advertising shutdown changed the picture
Not everything in the ad-tech tracking space is getting worse. Oracle’s advertising division (BlueKai, AddThis, Datalogix) shut down entirely on 30 September 2024. Revenue had fallen from 2 billion dollars in 2022 to 300 million dollars by 2024, an 85% drop driven almost entirely by GDPR compliance costs and enforcement risk in Europe. No buyers were found for the division. It simply ceased to exist.
This matters because Oracle was one of the largest shadow profile operators in the world. BlueKai tracked browsing behaviour across millions of websites. AddThis collected data through social sharing buttons embedded on publisher sites. Datalogix matched online tracking data with offline purchase records. Together, they built identity profiles on hundreds of millions of people who had no idea Oracle held their data.
The shutdown eliminated a major source of shadow profiling overnight. For anyone who questions whether data removal and privacy enforcement actually achieves anything, Oracle is the counterargument. A 2 billion dollar business evaporated because the regulatory environment made shadow profiling unprofitable in Europe. The law did not force Oracle to shut down directly. The compliance burden made the business unviable. That is a more powerful outcome than any single fine the ICO has ever issued.
The ad-tech platforms still tracking you
Oracle’s exit did not eliminate ad-tech shadow profiling. It redistributed it. Several platforms still operate identity resolution systems that track individuals across devices and websites without direct consent. Here is what you need to know about each one.
The Trade Desk (UID 2.0) operates an identity framework built on hashed email addresses. When you enter your email on a participating publisher’s site, The Trade Desk generates a pseudonymous identifier that follows you across the open internet. The opt-out is at transparentadvertising.com. I rate this as medium difficulty because the opt-out process works but is not widely known, and re-enrolment can happen when you enter your email on another participating site.
Criteo runs one of the largest retargeting networks in Europe. If you have ever seen an ad follow you from one website to another, Criteo was likely involved. Their privacy page at criteo.com/privacy provides a straightforward opt-out. Easy.
Lotame operates a data management platform that aggregates audience data across publishers. Opt-out requests go to privacy@lotame.com. Medium difficulty, primarily because confirmation of deletion is slow.
ShareThis tracks user behaviour through social sharing buttons embedded on publisher websites. This is essentially what Oracle’s AddThis did before the shutdown. Opt-out at sharethis.com/privacy. Easy.
Taboola runs content recommendation widgets on news sites and blogs. Those “recommended articles” boxes at the bottom of news pages track your reading habits and build behavioural profiles. Privacy page opt-out available. Easy.
Outbrain operates the same model as Taboola, on a different network of publisher sites. Similar opt-out process through their privacy page. Easy.
Individually, none of these platforms are as large as Oracle’s advertising division was. Collectively, they still build behavioural profiles on millions of UK consumers who have no idea it is happening. If you are serious about reducing your digital footprint, the ad-tech layer cannot be ignored.
Your mobile advertising ID is the easiest win
Every smartphone has an advertising identifier. Apple calls it the IDFA. Google calls it the GAID. This identifier acts as a persistent tracking token that ad-tech companies use to link your behaviour across apps, websites, and physical locations through in-store beacons and Wi-Fi probes.
Disabling it is the easiest action in the entire shadow profile problem. On iOS, go to Settings, then Privacy and Security, then Tracking, and disable “Allow Apps to Request to Track”. On Android 12 and later, go to Settings, then Google, then Ads, and delete your advertising ID.
This does not stop all tracking. But it removes the single most useful cross-app identifier that ad-tech companies rely on. I recommend this as the first action for every client, before we even start on data broker removals or people-search opt-outs. It takes thirty seconds and cuts off one of the most productive data collection channels immediately.
Why shadow profile exposure scales with your contact network
For someone with a small social circle and minimal online activity, shadow profiles are an abstract privacy concern. For executives, public figures, and high-net-worth individuals, the exposure compounds in ways that consumer privacy advice never addresses.
Consider what a shadow profile actually contains for someone with a large contact network. Hundreds or thousands of people have uploaded contacts containing your personal mobile number, your private email address, your home address as it appears in their phone. Every one of those uploads enriches the profile. A FTSE 250 director whose number sits in the phones of board members, investors, advisors, PAs, and family members has a shadow profile orders of magnitude richer than an average consumer’s.
The Pixel tracking data makes this worse. If you are browsing luxury property sites, private aviation brokers, or wealth management platforms, that browsing behaviour feeds your shadow profile with signals about your net worth and lifestyle. None of this requires you to have a Facebook account. The profile builds passively from your browsing and from other people’s decisions to share their contacts.
When I assess clients with compound exposure, shadow profiles sit in a category I call “high impact, low verifiability.” Unlike 192.com listings or Companies House filings where you can see exactly what is published, you cannot search for your own shadow profile. You can only infer its existence from the inputs and take mitigation actions.
This is where most privacy advice falls short. Consumer guides tell you to submit the non-user deletion form and move on. For someone with genuine exposure, that form is one step in a process that includes every ad-tech opt-out listed above, mobile ID disabling, browser-level tracking prevention, and the kind of ongoing monitoring that most people will not sustain without professional support.
What I recommend
Shadow profiles are the most frustrating category of digital exposure I deal with. High impact. Low verifiability. Limited removal options. You cannot confirm what Meta holds. You cannot fully verify what was deleted. You cannot stop other people uploading contacts that include your details.
What you can do is work the problem systematically. Disable your mobile advertising ID today. Submit the Meta non-user deletion form if you have never had a Facebook account. Work through the ad-tech opt-outs above. Then shift your focus to the exposure sources you can actually verify and remove, starting with the open electoral register and working through the full list of UK data brokers that hold your data.
If your profile warrants it, a professional digital footprint assessment maps the full picture across all 20 categories of UK data exposure. Shadow profiles are one piece. The visible brokers, the credit reference agencies, and the facial recognition databases all feed the same problem. You solve this as a system, not as isolated opt-outs.
If you want to understand the full scope of your exposure, get in touch.
