Stop me if you've heard this one: After you talk about something specific, an ad related to that very topic pops up on your Facebook feed.
It's uncanny, unsettling and, like most urban legends, nearly everyone has a variant of this story. Thanks to the wealth of data the mammoth social network already has on you -- your location, network of friends, interests and shopping habits -- it's like Facebook is listening to you.
It almost certainly isn't.
In an informal study, CNET reporters discussed predesignated topics in front of their phones and then monitored their Facebook feeds for related ads. We found nothing to suggest Facebook had overheard our conversations. While we can't 100% disprove this idea, security experts have also failed to find evidence the social network is eavesdropping on users to target ads more effectively.
"No. Let me be clear on this: You're talking about this conspiracy theory that gets passed around that we listen to what's going on on your microphone and use that for ads," Zuckerberg told Sen. Gary Peters. "We don't do that."
But the fact that the conspiracy theory lives on is a testament to the massive machine Facebook has set up to hoover up your data and exploit it to deliver targeted ads. That theory gains credence from other instances elsewhere in the tech environment, like malware leaked from the CIA that could turn phones and TVs into listening devices, and some Samsung TVs that captured private conversations.
But Facebook doesn't need to listen to you to figure out what you're thinking about -- there are hundreds of other ways. And that ability to gather information has sparked increasing scrutiny since 2018, when lawmakers are looking to limit how much tech giants can learn about us, and how they can use it.. Now
You can't be blamed for feeling the allure of this conspiracy theory, especially when the ads are so specific. But Facebook learns about your preferences through hundreds of data points -- information like where you are, what you've bought, what you've looked for online and who your friends are can help tech giants make scary-accurate predictions.
Privacy experts have found that people jump to this conclusion so often because it's a simple answer, and the real reason why these ads are so specific is a complicated issue. Jake Laperruque, a senior counsel at the Constitution Project, said he frequently hears people jumping to that conclusion and tries to point out issues with the theory.
"They usually say, 'I can't imagine another way for this to get onto me for advertising,'" Laperruque said. "Think outside the box. What about location-based advertising, or what a friend is searching? Just spend a few minutes thinking about how much data companies have."
Asked about the conspiracy theory, Facebook reiterated a statement made in 2016.
"We only access your microphone if you have given our app permission and if you are actively using a specific feature that requires audio," the company said in a statement. "We do not access the microphone just because the app is opened nor do we use it when you're not in the app."
Facebook said it does buy de-identified audio data to train its AI for speech-enabled features like transcriptions.
Evidence against Facebook's eavesdropping
Security researchers have performed network traffic analysis to look for any audio data being sent to Facebook, without finding any evidence. And if Facebook was harvesting all that audio, it would be a gargantuan data drain, said Cloudflare CEO Matthew Prince.
Considering that Facebook has over 2 billion monthly active users, it would be a logistical nightmare to listen around the clock just so the company could send you relevant ads.
"I wouldn't be surprised if you would get to a level of total data usage that would exceed the entire capacity of the internet," Prince said. "Two billion times anything is going to be a really big number."
Analyzing speech and converting it to text for artificial intelligence to then serve ads is also a difficult task. Google and Amazon are racing to just understand human speech with their respective Home Assistant and Alexa. And that includes struggles with background noise, accents, mumbling, slang and volume.
"Listening to conversations in real time has a bunch of challenges," said Gabriel Weinberg, the CEO of private search engine DuckDuckGo. "Getting your voice-to-text correct, extracting all that information, you would need specific AI."
Facebook is reportedly building its own smart assistant, but it would need to be activated and isn't secretly recording and preinstalled on your phones.
Outside of the technical difficulties, it'd also be completely illegal for Facebook to do this, Laperruque said.
If Facebook were secretly recording people's conversations to serve ads, it would be breaking the Wiretap Act, the counsel said. If Facebook were caught doing this to its billions of users, it would be subject to trillions of dollars in liabilities, he said.
"There's criminal liability, and just like that, it would not be worth it for companies to expose themselves to legal risks," Laperruque said. "It's not like you could say, 'I got this advertisement because they were engaged in this massively illegal scheme.'"
So how are these ads so specific?
Even without listening at all times, tech giants know enough to tailor an ad so specific you'd think they were secretly recording your thoughts, too.
You are constantly tracked online, which allows tech companies like Facebook and Google to learn all sorts of things about you.
Tech companies know what websites you're visiting through their tracking pixels, where you are through geolocation data, and what you've bought -- Google knows about 70 percent of all payment card purchases in the US.
They don't just have this data for you -- they have it on your friends too. Even if you've never searched for a certain product online, if your friends have, you're much more likely to see ads for that. The same goes for just being the same location as someone else.
The way data tracking is structured online, tech giants don't need to listen in, experts say. Weinberg said that all the tech giants essentially have all they need by tracking searches, browsing history, geolocation and purchase history.
"With those four things alone, you can find out an amazing amount about somebody," Weinberg said. "You can get more from the current tracking infrastructure than from listening to your conversations."
The truth is out there
Despite this evidence, the theory persists -- even among experts who are aware of all this information.
Stephen Cobb, a senior security researcher at ESET, said he was conducting his own experiment to see if his devices were secretly recording his conversations to serve him ads. As did the CNET study, he had several conversations in his home about products he's never searched for, like Casper mattresses, Qwip toothbrushes and Allbird sneakers,and then looked for any ads popping up.
He knows about the massive trail of data that companies like Facebook and Google have on him. He also knows it's been tested by security researchers analyzing the data traffic, but Cobb remains skeptical.
For years, he's studied shady measures the ad industry would take to get clicks online, and he doesn't believe it's farfetched to argue that Facebook could be using audio that's secretly recorded. And like many who believe the theory, he's also seen ads that surprised him on several occasions.
"We've heard legitimate marketers talk glowingly about the potential for advertising to be targeted based on what you're talking about," Cobb said. "It might not be Facebook listening; it could be somebody else doing it and selling that information to Facebook."
Experts don't expect this conspiracy theory to ever go away. Until these ads stop being so specific, people will continue to jump to the same conclusion.
Cobb said he hasn't seen any ads for the products he's been purposely talking up over several days.
CNET's Laura Hautala contributed to this report.