Derek Cohen is a 32-year-old marketing consultant in Salt Lake City, Utah who today — four years after Cambridge Analytica used personality tests to glean Facebook users’ profile information and target ads to them — uses quizzes to obtain Facebook users’ personal details, and then uses those details to target ads to them and others like them on Facebook.
Using Facebook’s current advertising tools, Cohen gets unsuspecting users to provide him with personal details — things like their bathing suit size, homeownership status, and how much they spend on clothing — and then plugs the information into Facebook’s ad platform to reach these people and millions like them. The quizzes disguise themselves as fun online activities, for example, "Which Taylor Swift Song Best Represents Your Shopping Personality?," but are created to glean advertising data.
Cohen, who initially built this service for an app called Qzzr, relies on the so-called “Facebook Pixel,” a tracker anyone can put on their website to target customized Facebook ads to people who visit their webpages. The Facebook Pixel helps power basic advertising, like those ads for boots that pop up on Facebook after you visit a website looking for boots. But it can be used in other ways, such as tracking your answer when you tell a quiz you wear an XXL bathing suit, and it can do so without you knowing.
Over the past two weeks, Facebook CEO Mark Zuckerberg and COO Sheryl Sandberg have repeatedly defended the company’s current ad business. In multiple interviews, they've said they’ve plugged the holes that allowed Cambridge Analytica illicitly obtain data on up to 87 million of their users. And they’ve said that their current ad system is good for Facebook, its users, and advertisers, because it helps show people relevant advertising. But Cohen demonstrates what's still possible in Facebook's refined ad targeting system.
“It was funny to me to see this big deal being made out of what Cambridge Analytica did,” he told BuzzFeed News. “What I’m able to do with the options Facebook gives me is better. I can target more specific than that.”
Cohen has been running these quizzes for two years, and has worked with 10 advertising clients to reach approximately 4 to 5 million people with ads, he said. And though he can no longer transfer the targeting audiences he built using these quizzes between advertisers, since Facebook banned the transferring of audiences last week, he did share them with five to 10 additional advertisers before the changes.
Qzzr, with Cohen's assistance, initially managed the Facebook-tied quizzes for its clients. Facebook's terms of service prohibit Qzzr from managing others ad accounts this way, but they permit offering advertisers the technology. Now, Qzzr offers the technical capabilities to run these quizzes to its top tier customers but is not involved in the ad buys, its CEO Josh Kasteler, told BuzzFeed News. "We don't feature it, and don't have it on the site but it is still within the platform, " he said. "There's probably less than the people I can count on my hand that use it."
"If we wanted to, we could’ve sold data or rented out audiences,” Kasteler said. "But we’re not doing anything with it and never have.”
A Facebook spokesperson told BuzzFeed News that it's looking into the issue. "We're investigating this specific advertiser and taking a close look at quiz experiences on and off the platform," he said.
Cohen runs ads on Facebook, many of which cost less than $500 per audience, that send people to the quizzes. Then, he waits until approximately 700 respondents have given him answers he wants — a certain type of homeowner that’s desirable to a solar company, for instance —and he combines those users into a “custom audience” on Facebook, which he can then expand by asking Facebook to target millions of other people similar to the 700 he’s reeled in. Facebook knows a ton about these users, so it can find people with similar lifestyles and interests at a push of a button. Facebook calls these people “lookalikes."
Cohen said the data he collects through his quizzes is anonymized. “All we had to do was create the lookalike audiences, and that would get us the first step we need to go down the rabbit hole.”
Cohen also said he mostly stayed away from collecting personal identifiable information, though he did say a bathing suit quiz he ran that was trying to find out people’s body types did request test takers' email addresses. “Something we did was — what’s your summer beach outfit? And then when they get one, we’d say, ‘Hey, here it is, if you want 20% off, give us your email address and we’ll send you a coupon’ — we could use that information if we wanted to.”
As for disclosure, Cohen said he’s sure the people whose data he collects have no idea. “Look at what’s going on right now. Nobody knew anything. ” he said. “Nobody ever knows that they’re being added to advertising audiences."