Facebook Shadow Profile: What It Is and How It Works

A Facebook shadow profile is a data file that Facebook (now Meta) allegedly builds about people who are not Facebook users, or about logged-out visitors, by combining information collected from other people’s contact lists, browsing activity, and partner websites. The term is not an official Facebook product name; it is a descriptive label used by journalists, researchers, and privacy advocates. This article explains where the term came from, what data collection actually occurs, how the profiles are believed to work, and what you can and cannot do about them.

Formula

The calculator above gives a rough estimate of how many shadow profiles might exist for a given group of people. The formula is:

Estimated shadow profiles = Non-users × (Match rate ÷ 100)

Where:

• Contacts who use Facebook – the number of people in your address book who have active Facebook accounts.
• Non-users in those contacts – the number of people in your address book who do not have Facebook accounts.
• Match rate (%) – the estimated percentage of non-users whose email or phone number can be matched to other data sources. This is an assumption you set; real match rates are not published by Meta.

The second output multiplies the total contacts by the match rate and by 5, as a very rough guess at how many data points (name, email, phone, location, device ID, etc.) might be associated with each profile. This is purely illustrative.

Worked Example

Using the default values: 50 contacts who use Facebook, 10 non-users, and a 60% match rate.

1. Multiply non-users by match rate: 10 × 0.60 = 6
2. Estimated shadow profiles = 6
3. Total data points estimate: (50 + 10) × 0.60 × 5 = 60 × 0.60 × 5 = 36 × 5 = 180

So with these inputs, the calculator suggests about 6 shadow profiles and roughly 180 associated data points. Remember, this is a thought exercise, not a measurement of real Facebook systems.

Origin of the Term

The phrase “shadow profile� was popularized in 2011 by a security researcher named Kurt Thomas, who used it in a paper about how social networks could infer information about non-members. The concept, however, predates that paper. In 2010, the Wall Street Journal published an investigation into Facebook’s data practices, noting that the company collected data on non-users through “like� buttons embedded across the web. The term stuck because it accurately describes a profile that exists in the shadows—visible to the company but not to the person it describes.

It is important to note that “shadow profile� is nonstandard terminology. Facebook/Meta has never used the term in official documentation. The company refers to “inferred data� or “data about people who are not logged in.� The word is informal, journalistic shorthand, not a legal or technical term. You will not find it in Meta’s privacy policy, but you will find it in thousands of news articles and privacy blogs.

How the Data Collection Actually Works

Facebook collects information about non-users through several channels. The most well-documented one is the “contact upload� feature. When a Facebook user syncs their address book or email contacts, Facebook receives the names, email addresses, and phone numbers of everyone in that list—including people who have never signed up. Facebook then tries to match that information to existing user accounts or to other data it has purchased from data brokers.

A second channel is the Facebook Pixel and social plugins. The “Like� button and the share button appear on millions of third-party websites. When a page containing these buttons loads, Facebook receives a signal from the visitor’s browser, even if the visitor is not logged into Facebook. This signal can include the IP address, browser type, the URL of the page, and sometimes a cookie that Facebook has placed on the device previously. Over time, Facebook can build a browsing history for that device.

A third channel is data purchased from data brokers. Facebook has acknowledged buying offline data—such as purchase histories, household income estimates, and property ownership records—from companies like Acxiom and Experian. This data can be linked to email addresses or phone numbers, which may belong to non-users.

Finally, Facebook uses “device fingerprinting.� When you visit a site with a Facebook widget, the company can record details about your device—screen resolution, operating system, installed fonts, and more—to create a unique identifier that persists even if you clear cookies.

What a Shadow Profile Contains

Based on court documents and internal leaks, a shadow profile can include some or all of the following:

• Name, email address, and phone number (from contact uploads)
• IP addresses and device identifiers
• Browsing history on sites that use Facebook tools
• Location data from mobile apps
• Inferred interests and demographics (from browsing patterns and purchased data)
• Connections to Facebook users (who knows whom)

It is unlikely that a single shadow profile contains all of these. The exact contents vary depending on how much data was collected and matched. The key point is that the profile exists without the person’s knowledge or consent and is not accessible to them.

Can You See or Delete Your Shadow Profile?

No. You cannot log into a shadow profile, view it, or delete it. Facebook does not provide a tool for non-users to access data held about them. The only legal avenue is to submit a data access request under privacy laws like the GDPR (Europe) or CCPA (California). Meta has responded to some of these requests by providing a file of data, but reports indicate that the files are often incomplete and do not clearly show what was inferred.

You can reduce the amount of data Facebook collects about you, even if you are not a user:

• Install browser extensions that block trackers (e.g., Privacy Badger, uBlock Origin).
• Use a privacy-focused browser like Firefox with strict tracking protection enabled.
• Log out of Facebook on every device and clear cookies regularly.
• Ask your friends and family not to upload your contact information to Facebook.
• Use a VPN to hide your IP address from trackers.
• Opt out of data broker databases where possible (e.g., Acxiom, Oracle Data Cloud).

None of these steps will delete an existing shadow profile, but they can stop new data from being added.

Common Misconceptions

One common misconception is that shadow profiles are used to show ads to non-users. In reality, Facebook does not show ads to people who are not logged in. The purpose of shadow profiles is to improve ad targeting for existing users. For example, if a non-user browses a shoe website, Facebook might learn that the device is interested in shoes. Later, when a Facebook user on the same device logs in, Facebook can show them shoe ads. The non-user’s data is used as a signal, not as a target.

Another misconception is that shadow profiles are illegal. They are not, in most jurisdictions. Data collection by private companies is generally legal unless it violates specific privacy laws. The GDPR and CCPA have forced more transparency, but they do not ban the practice outright. The controversy is ethical, not legal.

A third misconception is that deleting your Facebook account removes your shadow profile. It does not. Deleting your account removes your user profile, but the shadow profile—if one exists—is a separate data file tied to your email or phone number, not to your account. Meta has not stated whether shadow profiles are deleted when a person later signs up and then deletes their account.

Frequently Asked Questions

Does Facebook really create shadow profiles?
Yes, based on internal documents leaked in 2018 and statements from former employees, Facebook does build data files on non-users. The company has acknowledged collecting data on non-users for “security purposes� and to improve ad targeting, though it avoids the term “shadow profile.�

Can I find out if I have a shadow profile?
Not directly. You can submit a data request under GDPR or CCPA, but Meta’s response may not include inferred data. There is no public tool to check.

Will using Facebook in a private browsing window stop data collection?
No. Private browsing prevents your browser from saving history, but Facebook can still see your IP address and device fingerprint when you visit a site with a Facebook pixel. You need a tracker blocker or VPN to hide that information.

Does Facebook sell shadow profile data?
No. Facebook does not sell personal data to third parties. It uses the data internally for ad targeting and measurement. However, it does share data with partners who help with ad delivery and measurement, and it buys data from brokers to enrich profiles.

Are shadow profiles the same as “off-Facebook activity�?
No. “Off-Facebook activity� is a feature that lets logged-in users see and clear data Facebook has collected about their activity on other websites and apps. Shadow profiles are for non-users and are not visible to anyone.

If I never use Facebook, can I still be in a shadow profile?
Yes. If you have ever appeared in someone else’s address book that was uploaded to Facebook, or if you visited a website with a Facebook pixel, your data could be in a shadow profile. The more contact points you have, the more likely a profile exists.

Related

• How to Block Websites on Chrome for Android
• Install 32-bit Linux on Mac: What Works Now
• Why Use Both HTTPS and VPN? Key Reasons

in contacts | Contacts who use Facebook | - | 50 | 0 | 100000
in nonusers | Non-users in those contacts | - | 10 | 0 | 100000
in pct | % with email/phone matched | % | 60 | 0 | 100
out est | Estimated shadow profiles | - | round(nonusers * pct / 100) | 0
out total | Total data points (est.) | - | round((contacts + nonusers) * pct / 100 * 5) | 0