Today, social media is a significant part of Kenyans’ lives, with more than half of the adult population using at least one platform and spending over three hours on a day on it. However, many are oblivious to how the platforms profit from secretly monitoring their moves.
Like most social media users around the globe, Kenyans believe that to use such platforms, they have to divulge only necessary personal information such as phone number, email address, gender, age, physical address, and perhaps a profile photo.
But a new report reveals that unbeknownst to users, various social media platforms such as Facebook, WhatsApp, TikTok, X (formerly Twitter), and YouTube are secretly collecting additional data from users and making billions from it.
Data from the Communications Authority of Kenya (CA) shows that these are the most popular social media platforms in the country, led by Facebook, which is currently used by around 52 percent of Kenyans over the age of 15.
WhatsApp is used by 48.5 percent, YouTube by 29 percent, TikTok by 28 percent, X by 13 percent and Instagram by 12 percent. All have recorded significant growth over the last year.
The report, which follows an investigation by American consumer protection agency Federal Trade Commission (FTC), reveals that these platforms rely on the secretly collected information to earn from advertising, which dominates their revenue streams.
After the FTC ordered about nine social media and video streaming services to disclose how they collect, use, and present users’ personal information, the giant platforms have, for the first time, revealed intricate details about this.
Without going into detail, the FTC revealed that most of these platforms secretly collect personal information, including private conversations and device details, which they use to target advertising.
“While lucrative for the companies, these surveillance practices can endanger people’s privacy, threaten their freedoms, and expose them to a host of harms, from identify theft to stalking,” said FTC chairperson Lina Khan.
The companies use artificial intelligence technology to collect information about users’ browsing history, engagement with advertisements, actions on the platforms, and messages and conversations with other users.
They also collect device information, including metadata such as screen size, browser information, and internet protocol (IP) address, which can pinpoint a user’s exact location while using the internet.
But they do not stop there. The investigation reveals that the apps go on to obtain information from third-party apps and websites they integrate with, which they use to target advertising.
Some also collect user information from other social media and video streaming platforms, sometimes without the user’s consent.
In addition, all but one of the platforms disclosed that they collect non-user information from users when they upload and synchronise their contact list, or from advertisers when they upload their customers’ personal information such as email addresses.
However, despite the large amount of data collected by the platforms without the users’ knowledge, they were found to have “woefully inadequate” data collection, minimisation, and retention practices.
For example, the investigation found that the platforms mostly do not delete user data even when their accounts are closed and deleted, and keep the information gathered from users’ activities indefinitely.
Yet, users have “little or no way” to opt out of how their data is used by the automated systems.
The report was published based on feedback from the social media and video streaming platforms in December 2020 and January 2021, but the FTC did not say whether any of the platforms’ practices had changed over the years.
It comes at a time when countries around the world are trying to regulate social media platforms to minimise their violation of people’s privacy. Most jurisdictions, including the European Union and the United States, have so far implemented strict rules to protect online privacy.
In Kenya, social media regulation has so far focused more on content moderation rather than on privacy protection. However, the Office of the Data Protection Commissioner (ODPC) requires any company that handles people’s personal information to register with it and disclose data security and privacy protection mechanisms.
The ODPC database shows that only Google, which owns YouTube, and Microsoft, the LinkedIn parent firm, are registered as data handlers. All others are not in the database, meaning they are unregistered or handle user data through third parties.
