Facebook bases its entire business on collecting data about its users so it can make money through targeted ads. That’s the price you pay in exchange for access to the largest platform to connect with friends and family. But what you may not be aware of is that the company also work with several data brokers to gather information about users’ offline life. This can include things like places that you frequent, how much money you make and the number of credit cards you have.

The fact that Facebook is buying data from third party data brokers isn't new, but that this includes data about users' offline lives isn’t widely known, and a report from ProPublica is shinning a light on the practice. The research found about 29,000 different categories Facebook provides to ad buyers, and almost 600 were “provided by a third party,” most of these related to users’ financial history.

However, unlike Facebook's native data collection, users cannot see what information these third-party sources have on them directly from the social network’s website. When asked about the lack of disclosure, Facebook responded that it doesn't tell users about the third-party data because it's widely available and it is not collected by them. Steve Satterfield, a Facebook manager of privacy and public policy, says that users who don't want that information to be available to Facebook should contact the data brokers directly.

He also points to a help center page with links to the opt-outs for six data brokers (Acxiom, Epsilon, Experian, Oracle Data Cloud, TransUnion and WPP ) that sell personal data to Facebook.

ProPublica of course decided to try this procedure and found that it was extremely complicated, in some cases requiring a written request sent by mail along with government-issued identification. Asking data brokers to provide the information that they have on them is also a cumbersome process.

Since the report went online Facebook has defended itself saying that ProPublica fails to mention that a person can click on the upper right corner of any ad on Facebook to learn why they’re seeing the ad, and if it’s because they’re in a data provider’s audience, Facebook discloses this and links to the data provider’s opt-out — it’s not clear if this still involves the complicated process ProPublica reported on.

“Furthermore, we think when people choose not to see ads based on certain information, they don’t want to see those ads anywhere. When a person makes changes to her Ad Preferences (which apply to Facebook’s ad categories), we do our best to apply those choices wherever we show ads to that person using Facebook data. We wanted controls for data provider categories to work similarly, so we required the data providers to provide opt-outs that work across all the services that use their data for ads.”

You can read ProPublica's report here.