What Facebook Actually Knows About You

Facebook has been collecting data since 2004, making it one of the most comprehensive personal data repositories ever assembled. Even if you have been careful about what you share, Facebook knows far more than what you have voluntarily posted.

Your Explicit Data

This is the data you knowingly provided: your name, email address, phone number, date of birth, gender, relationship status, education history, work history, hometown, current city, political views, religious views, and every post, photo, video, comment, reaction, and message you have ever created. Facebook stores every version of your profile, including information you later deleted or changed.

Off-Facebook Activity

In 2019, Facebook launched the Off-Facebook Activity tool, which revealed what privacy researchers had long known: Facebook tracks your activity across the internet. Through the Meta Pixel (embedded on millions of websites), the Facebook SDK (embedded in thousands of mobile apps), and the Conversions API, Facebook receives real-time data about your actions on third-party websites and apps.

This includes online purchases, articles you read, apps you open, searches you perform on other sites, and virtually any action that triggers a pixel event. As of 2026, researchers estimate that the Meta Pixel is present on over 30 percent of the top one million websites globally. Every time you visit one of these sites while logged into Facebook (or even while not logged in, if Facebook can identify you through cookies or device fingerprinting), that activity is recorded and added to your advertising profile.

Shadow Profiles

Facebook builds profiles of people who have never created a Facebook account. Here is how: when any Facebook user uploads their phone contacts, Facebook ingests every name, phone number, and email address in that contact list. If three of your friends uploaded their contacts, Facebook knows your name, phone number, and email address -- even if you never signed up.

Facebook also collects data about non-users through the Meta Pixel and SDK described above. If you visit a website with the Meta Pixel, Facebook creates or updates a shadow profile associated with your browser cookies and device identifiers. When you eventually create a Facebook account (or if Facebook can match your device to an existing profile), this shadow data is merged into your account.

A 2018 investigation by the European Parliament specifically asked Mark Zuckerberg about shadow profiles. He acknowledged that Facebook collects data about non-users for "security purposes." Independent researchers at universities including Northeastern and Princeton have confirmed that Facebook's shadow profiles contain detailed information about people who have never used the platform.

Face Recognition Data

Facebook's facial recognition system, DeepFace, was trained on user photos and achieved 97.35 percent accuracy on facial recognition benchmarks, approaching human-level performance. Although Facebook announced it would shut down its facial recognition system in 2021 and delete associated face templates, Meta retained the underlying DeepFace research and technology. The face recognition models themselves, trained on billions of user photos, were not deleted.

Messenger History and Encrypted Communications

Facebook Messenger has stored the full text of every message, photo, video, voice clip, and file ever sent through the platform. While Meta rolled out end-to-end encryption for Messenger by default in December 2023, all messages sent before that date were stored in plaintext on Meta's servers. That represents nearly two decades of messaging history for early adopters.

Delete vs. Deactivate: The Critical Difference

Facebook offers two options, and the difference between them is fundamental:

Deactivation

Your profile is hidden from other users
Your data remains fully intact on Meta's servers
You can reactivate at any time by logging back in
Messenger remains active (you can still send and receive messages)
Facebook continues to use your data for advertising
Your face recognition template (if created before 2021) is retained
Apps and websites you logged into using Facebook Login may still access your data

Deactivation is a cosmetic change. Your data footprint is completely unchanged.

Permanent Deletion

Your profile, photos, posts, and videos are removed after a grace period
Your account cannot be recovered after the deletion process completes
Meta begins removing your data from production servers
The process takes up to 90 days to complete across all systems
Certain data is retained permanently (covered in detail below)

Step-by-Step: Permanently Delete Your Facebook Account

Step 1: Download Your Data

Before initiating deletion, download a complete copy of your Facebook data:

Go to Settings & privacy then Settings
Click Your Facebook Information in the left panel (or find it under Accounts Center)
Select Download your information
Choose date range (All time), format (HTML or JSON), and media quality
Click Request a download
Wait for the notification email (can take hours to days depending on account size)
Download the file before it expires

Review this download carefully. It will contain your full messaging history, every ad you clicked, every search you performed, every login location, and your complete off-Facebook activity log. This is the reality of what Facebook knows about you.

Step 2: Revoke App Permissions

Before deleting, remove Facebook's connections to third-party apps:

Go to Settings & privacy then Settings
Select Apps and websites
Remove all connected apps and websites
This prevents these services from receiving further data from Facebook and reduces the complexity of your post-deletion cleanup

Step 3: Initiate Permanent Deletion

Go to Settings & privacy then Settings
Navigate to Accounts Center then Personal details
Select Account ownership and control
Click Deactivation or deletion
Select your Facebook account
Choose Delete account (not "Deactivate account")
Click Continue to account deletion
Enter your password
Click Delete account

Step 4: Do Not Log In for 30 Days

After initiating deletion, Facebook gives you a 30-day grace period. If you log into Facebook, Messenger, or any app or website using Facebook Login during this period, the deletion is cancelled. This includes:

Logging into the Facebook app
Logging into Messenger (even just to read a message)
Logging into a third-party app or website using "Continue with Facebook"
Clicking a Facebook notification in an email

Remove the Facebook and Messenger apps from all your devices immediately. Log out of any websites that use Facebook Login. Set all Facebook notification emails to go to your spam folder for 30 days.

The 30-Day Grace Period and What Follows

During the 30-day grace period, your profile is hidden but your data is untouched. Meta uses this period to give you a chance to change your mind.

After 30 days, if you have not logged back in, Meta begins the deletion process. They state that it takes up to 90 additional days to delete your data from all production servers, backup systems, and disaster recovery infrastructure.

The total timeline from initiation to completion is therefore up to 120 days.

What Meta Keeps After Deletion

This is the information that survives your account deletion permanently:

Data Subject to Legal Process

Any data covered by a legal hold, subpoena, law enforcement request, or regulatory investigation is retained indefinitely. Given Meta's scale and the frequency of government requests (Meta received over 400,000 government data requests globally in 2024 alone), this exception may apply to more accounts than users realize.

Aggregated Data

Meta retains aggregated, de-identified data derived from your usage. While this data is not tied directly to your name, numerous academic studies have demonstrated that aggregated data can be re-identified using auxiliary information. A 2019 study published in Nature Communications found that 99.98 percent of Americans can be re-identified in any dataset using just 15 demographic attributes.

Shadow Profile Data

Deleting your Facebook account does not delete your shadow profile. If other users have uploaded contacts containing your phone number or email address, that data remains in Meta's systems. If the Meta Pixel has been tracking your browsing activity on third-party sites, that off-Facebook activity data is associated with your device identifiers, not just your Facebook account.

This is a critical point: even after full account deletion, Meta retains a data profile about you built from other people's data and third-party tracking infrastructure.

Messenger Data in Others' Accounts

Messages you sent to other users remain in their Messenger accounts. Facebook does not delete your side of conversations from other people's inboxes. Photos, videos, and files you sent through Messenger are retained in the other participants' message history.

Data Held by Third Parties

Every advertiser who targeted you, every app you logged into with Facebook Login, every website with the Meta Pixel that tracked your visits, and every data partner who received your information through Facebook's marketing API -- all of these entities retain their independent copies of your data. Account deletion does not trigger a recall of data already transmitted to third parties.

Your Data on Data Broker Sites

While your Facebook account was active, your publicly available data was systematically harvested by data brokers. Even with strong privacy settings, certain information leaks into the data broker ecosystem through multiple channels:

Public profile data. If your name, profile photo, cover photo, or any other field was ever set to public (Facebook's default settings historically made much of your profile public), data brokers captured it.

Friend list analysis. Even if your friend list is private, data brokers can infer your social connections through other users' public friend lists, mutual friend counts, and tagged photos.

Facebook marketplace listings. If you ever listed an item for sale on Facebook Marketplace, your name and approximate location were publicly available and collected by data brokers.

Group memberships. Public group memberships reveal your interests, health conditions, political affiliations, and other sensitive information that data brokers aggregate into your profile.

Voter registration and public records matching. Data brokers match your Facebook identity to public records (property ownership, voter registration, court records, business licenses) using your name, location, and other identifiers. Your Facebook data enriches these public records profiles.

The result is that deleting your Facebook account removes one source of ongoing data collection but does nothing to address the comprehensive profiles that already exist across the data broker network. People-search sites like Spokeo, BeenVerified, Radaris, WhitePages, TruePeopleSearch, and Intelius will continue to display your information regardless of your Facebook account status.

Automate Your Privacy with GhostMyData

Deleting Facebook stops Meta from collecting new data, but the data broker ecosystem has already captured years of your personal information. Cleaning up that exposure requires a systematic approach.

GhostMyData scans 1,500+ data broker sites to find where your personal information is exposed, then automates the removal process:

Automated opt-out submissions to people-search sites and data brokers
CCPA deletion requests for brokers that require formal legal process
Continuous monitoring to catch re-listings as brokers refresh their databases
Real-time progress tracking for every removal request

Facebook is just one source. Your data lives across hundreds of broker sites that operate independently of Meta.

Start your free privacy scan to see where your personal information appears across the data broker network.

Frequently Asked Questions

If I delete Facebook, does that also delete Instagram and WhatsApp?

No. Facebook, Instagram, WhatsApp, and Threads are separate products within Meta's ecosystem. Deleting your Facebook account does not affect your accounts on other Meta platforms. However, Meta's Accounts Center links these accounts, and some shared data (like your advertising profile and cross-platform identity graph) may persist in other Meta services. You need to delete each account separately and submit individual CCPA deletion requests for each platform.

What happens to Facebook groups I created if I delete my account?

If you are the sole admin of a Facebook group, you should either appoint another admin before deleting your account or delete the group first. If you delete your account without assigning a new admin, Facebook may assign admin rights to another member, or the group may become unmanageable. Your posts within the group are deleted with your account, but the group itself and other members' posts remain.

Can Facebook still track me after I delete my account?

Yes, to a degree. The Meta Pixel embedded on millions of third-party websites continues to track your browsing activity through cookies and device fingerprinting, even without a Facebook account. To limit this tracking, use browser extensions that block the Meta Pixel, clear your cookies regularly, use a privacy-focused browser, and consider using a VPN. Your shadow profile may continue to receive data from other users' contact uploads.

How do I submit a CCPA deletion request to Meta separately from account deletion?

Navigate to Meta's Privacy Center through Facebook's Help Center. Under the privacy rights section, select "Delete My Information" for California residents. You will need to verify your identity. This is a legally distinct process from account deletion and may cover data that standard account deletion misses, including advertising profiles, off-Facebook activity data, and data held by Meta's business tools infrastructure. You can submit this request before, during, or after account deletion.

Do shadow profiles get deleted when the people who uploaded my contact info delete their accounts?

No. Once Facebook has ingested contact data from a user's phone, that data becomes part of Facebook's graph. Other users deleting their accounts does not remove the contact data they previously uploaded. Your shadow profile persists as long as Meta retains it, which is effectively indefinitely. There is currently no reliable way for non-users to request deletion of their shadow profiles, although CCPA requests from California residents may provide some legal basis to demand it.

How to Delete Your Facebook Account — And What Meta Keeps Anyway