I've always wondered how this works with CCPA. I attempted to exercise my right to data deletion and was directed to log in. Do those with shadow accounts not have the right to have their data deleted?
I always thought this was an interesting thought exercise just conceptually (not even legally.)
If you and I are friends, is the knowledge of that friendship mine? Is it yours? Can I freely share that knowledge with someone else? The impact of this just became so absurdly large when we started saving those data points forever and mining them for all sorts of purposes they weren't originally intended for.
I think the point was that this data, the shadow profile, is derived from a friend’s pictures etc, and as such the legal copyright to the picture (that would need to be deleted) lies with the friend.
Or that’s how I understood it anyway, correct me if I’m wrong.
The copyright doesn't affect anything. The information about people derived from the picture is a separate artifact from the picture itself. That information is owned by Facebook, not the copyright holder of the picture, and its distribution is subject to a different set of laws. It counts as Personal Data under GDPR and Personal Information under CCPA, as well as biometric information under BIPA in Illinois.
The real issue is that CCPA can only be enforced by the California Attorney General's office. This means that Facebook's violation of CCPA is, quite literally, as much of a political issue as a legal one. (CCPA's private right of action only applies to data breaches, not to other CCPA violations.)
