Is Facebook Invading My Privacy?

Question

I have two Facebook accounts: A, and B.

FB account A uses my real email address and has my real life friends.

FB account B uses made up information and is in no way associated with my real life.

I recently installed Instagram on mobile using the same email address as FB account B. I have never selected the "Connect to Facebook" or "Connect Contacts" options.

Imagine my surprise when I look at my Instagram friend suggestions and see many of my REAL LIFE friends, people who are ONLY associated with FB account A.

This means somehow Facebook knows or is assuming that email address B is me even though I have never associated my name or any of my friends' names with it.

The only association I can think of is that I connect to Facebook using both accounts on the same devices, and with the same IP address. Otherwise, there should be no association between the two identities.

I haven't authorized Instagram to dig into my contacts or share data with Facebook, but somehow an Instagram account with my fake identity is being associated with my real life Facebook account.

I know that Facebook owns Instagram, but this feels like some kind of invasion of privacy. I know nothing of legal policy, and would like some advice on how to know if this is legal or not. Thank you for reading this.

(side note: my second identity is not being used for any nefarious purposes)

Answer 1

When you signed up for an account at Facebook or any of their related companies, you agreed to their Terms of Service by clicking the "accept" button; that's a binding contract. You agreed to their data sharing policies, which are outlined here Data Policy (which can vary due to jurisdiction, i.e. GDPR), and include data collection of IP addresses, device types, and any other types of data outlined in the TOS; and you agreed to Facebook's use of algorithmic methods to correlate data and suggest friends and connections among different accounts and third-party services.

Your only recourse to what you feel is the invasion of your privacy by the data collecting, sharing and integration is to exercise your right to end the contract you have with Facebook by deleting your account(s).

If indeed Facebook did violate some national laws in countries where they operate, or violate some their own policies in data sharing, you could have some legal recourse, depending on jurisdiction; but in the big picture, you'd be hard pressed to take Facebook to civil court yourself. Google will show you current class action lawsuits against Facebook, and you would need to be able to become a litigant in any of those by showing harm; and in your case, it's going to be difficult to show harm when both accounts were yours, and one was fake.

And, as noted by Nate Eldredge, your own example of data sharing between a fake account and a real account is a violation of Facebook's TOS restriction against opening an account under a false identity, and as a result Facebook has a contractual right to delete the fake account, and possibly your real account, too.