We quantify Facebook's ability to build shadow profiles by tracking individuals across the web, irrespective of whether they are users of the social network. For a representative sample of US Internet users, we find that Facebook is able to track about 40 percent of the browsing time of both users and non-users of Facebook, including on privacy-sensitive domains and across user demographics. We show that the collected browsing data can produce accurate predictions of personal information that is valuable for advertisers, such as age or gender. Because Facebook users reveal their demographic information to the platform, and because the browsing behavior of users and non-users of Facebook overlaps, users impose a data externality on non-users by allowing Facebook to infer their personal information.

13 pages, 5 figures, 4 tables