What Google and Facebook Know About You: Dylan Curran's 2018 Thread

A Viral Post About Data Collected by Google and Facebook

Google and Facebook can hold a remarkable amount of information about the people who use them: where you have been, what you searched for, which apps you installed, who you message and which adverts you clicked. In March 2018 an Irish web developer, Dylan Curran, showed just how much by downloading his own archives and posting the results in a long Twitter thread. His Facebook file came to about 600 MB and his Google file to about 5.5 GB, which he estimated as roughly 400,000 and 3 million Word documents of text respectively.

The thread arrived a week after the Cambridge Analytica scandal broke, when people were already asking what tech companies knew about them, and it was shared hundreds of thousands of times. Edward Snowden praised it as "an exquisite breakdown using real-life examples".

Below are the screenshots from that thread and some of the replies, each with an explanation of what it shows, where Curran's claims need nuance, and what has changed since 2018. At the end you will find practical steps to see and limit what is stored about you.

Who Dylan Curran is and why the thread went viral

A photo of Dylan Curran that circulated with coverage of the thread; the friend beside him is not identified. Curran, a web developer from Ireland, spoke to several news outlets afterwards, including CBS News, about how few people know these archives exist.

The opening tweet, posted on 24 March 2018, promised to show how much the two companies store "without you even realising it". It collected about a quarter of a million likes. The timing mattered: on 17 March The Guardian and The New York Times had revealed that data from up to 87 million Facebook users had been harvested for political profiling by Cambridge Analytica.

What Google knew: location, searches and an ad profile

The first point concerns Google Maps Timeline, which records where your phone has been if Location History is switched on. Location History was an opt-in setting, so not everyone had it, but many people turned it on during phone setup without realising. In more recent years Google has said Timeline data will be kept on the user's own device rather than in its cloud.

Curran's own map shows a year of movements across Ireland, with times and travel durations between places. A record like this can reveal a home address, a workplace, a doctor's surgery or a place of worship, which is why location data is treated as especially sensitive under European data protection law.

Here he points readers to My Activity, where Google lists searches and other activity across signed-in devices. His claim that deleted history is kept until you delete it everywhere needs care: deleting items on My Activity removes them from your account, although Google says some data may be kept for limited business or legal purposes. Clearing history in one browser alone does not touch the account copy.

Google builds an advertising profile from your activity, estimating things such as age range, gender, interests and sometimes life events. Curran noticed ads for rapid weight loss, which made him wonder what the profile assumed about him. Today this lives in My Ad Center, where you can see and switch off personalised ads.

This tweet describes the security and device page, which lists the apps and devices connected to your Google account and when they were used. It is worth checking for security reasons alone, because it shows any unfamiliar phone or app that still has access.

YouTube watch and search history can reveal health worries, beliefs, politics or a pregnancy, as Curran pointed out. Both can be paused or set to delete automatically from your YouTube history settings.

Google Takeout lets anyone download a copy of their data. Curran's export came to 5.5 GB, a size that surprised many readers, although much of such a file is usually photos, videos and emails the user chose to store.

He lists what Takeout covers: bookmarks, emails, contacts, Drive files, YouTube uploads, phone photos and purchase records. Much of this is content people deliberately keep with Google, which is different from silent tracking, but it shows how much of a life can sit in one account.

The list goes on to calendars, Hangouts chats, music, books, Groups, websites built with Google tools, phones you have owned and even daily steps from Google Fit. Each service adds a little; together they form a detailed diary.

What Facebook's archive contained

Facebook offers a similar download, now found under Download Your Information in its Accounts Center. Curran's file was about 600 MB, far smaller than the Google file but, as the next tweets show, highly personal.

The archive included every message and file sent or received, uploaded phone contacts and voice messages. In the same week, other users found call and text logs in their downloads; Facebook said this happened only for Android users who had agreed to upload contacts from Messenger or Facebook Lite.

Facebook also keeps a list of topics it thinks you are interested in, used to target ads. Curran's list mixes football, manga, software engineering and the oddly broad topic "Girl", a reminder that these guesses are often clumsy as well as intrusive.

Even every sticker he had sent in Messenger was stored, which he called pointless. It illustrates a basic habit of the industry at the time: keep everything, because storage is cheap and the data might be useful later.

Facebook logs each login with the time, IP address and device. This security record helps detect hacked accounts, but it also maps where and when you use the service.

The archive listed every app ever connected to his Facebook account, from Tinder to personality quizzes. That kind of connection was exactly how Cambridge Analytica got its data: a personality quiz app collected information not only from people who used it but also from their friends.

Windows 10 and phones as tracking devices

Curran broadened the point to Microsoft, showing the Windows 10 privacy settings with many options switched on by default, including the advertising ID. Microsoft redesigned the setup screens in 2017 so users choose these settings during installation.

He lists what operating systems and apps can potentially access: location, installed apps, webcam and microphone, contacts, email, calendar, call history and messages. Access depends on the permissions granted, which is why reviewing app permissions on a phone is one of the most effective privacy steps.

Files, games, photos, music, browsing history and even radio stations can all be part of the picture, depending on which services you use while signed in.

This tweet, which contains strong language, makes his most quoted point: people would never accept a government putting cameras, microphones and trackers in their homes, yet we have installed them ourselves for convenience. Smart speakers, which were spreading fast in 2018, made the point sharper still.

Inside the Google Takeout file

The Takeout download arrives as folders, one per service: Drive, Fit, Location History, Mail, Maps, My Activity, YouTube and more. Browsing them is the quickest way to understand your own footprint.

His search history file had about 90,000 entries, including images he downloaded and pages he visited. To show how revealing this could be, he displayed the section about a file-sharing site.

Google Calendar data showed every event he had entered and whether he attended, including a job interview and his arrival time. Arrival times come from combining calendar entries with location data.

Curran said his Drive export included files he had deleted, among them a CV, a monthly budget and a private encryption key. Google Drive keeps deleted files in the bin for 30 days before removing them, so recently deleted items can still appear; emptying the bin deletes them sooner.

Google Fit recorded his steps, walks and workout sessions as separate files. He had already deleted this data and revoked the app's permissions, showing how easily such records pile up unnoticed.

Photos taken on his phone were sorted by year, with metadata such as date and place. Location tags in photo files can be removed or switched off in most camera apps.

The Gmail export contained every email he had sent or received, including deleted and spam messages. As with Drive, messages remain in Trash or Spam for 30 days before being removed.

The My Activity folder holds thousands of files, split by product: Ads, Android, Assistant, Books, Chrome, Image Search, Maps, Search, YouTube and more.

Inside are records of ads viewed or clicked, apps launched, websites visited while signed in and apps searched for or installed, each with a time stamp. Pausing Web & App Activity stops most new entries.

His account held every Google search back to 2009, plus image searches, map searches and news articles opened. Since 2020, new Google accounts automatically delete this activity after 18 months by default.

YouTube history went back to 2008. For new accounts, Google now sets YouTube history to delete automatically after 36 months.

Curran joked that he was probably now on an FBI watch list. It was a jest about how alarming the data looked, not a serious claim.

Why this data is risky, in Curran's view

He argued that the data has countless harmful uses, from people being misjudged because of a single search to an insider snooping on a partner's location and history. Tech companies say staff access is restricted and audited, but past cases of employees abusing access show the risk is not imaginary.

Anyone who breaks into a Google account gets a ten-year diary of that person's life. This is the strongest practical argument for two-step verification and a unique password on email accounts.

Dylan was shocked that this is news to people

Replying to a follower, Curran said he was stunned that so many people had no idea about any of this, and promised a demonstration of camera and microphone hacking.

And he’s planning to continue to spread the word

He also planned podcasts and videos on webcam hacking, account security and future technology, and asked for help because he could not work on it full time.

How readers reacted

One follower asked how much Google stores when you browse in Chrome's Incognito mode. It is one of the most common privacy questions.

Curran answered "All of it", which overstates things. Incognito stops the browser saving your history and cookies on your device once the window closes, but websites, your network provider, your employer and Google, if you sign in, can still see what you do.

Another user gave a more careful answer: if you are not logged in, activity is not tied to your account, though it may still be linked to your IP address. That is closer to the truth.

A woman asked whether she could recover data from the Google account of her brother, who had died in 2016. It is a painful and surprisingly common situation.

Curran replied kindly that without the password it was impossible and illegal. In fact, Google and Facebook both have formal procedures: Google accepts requests from immediate family and legal representatives of a deceased user, and offers an Inactive Account Manager to plan ahead, while Facebook allows memorialised accounts and legacy contacts.

Many replies were simply thanks, like this one from Lisbon, saying people need to open their eyes to how their data is used.

The British MP Jo Swinson, who later led the Liberal Democrats, called the thread fascinating and terrifying, and asked for a follow-up explaining how to delete it all. The final section below does exactly that.

Another reader joked that people would pay to have their Google records cleaned. In Europe, the GDPR, which took effect in May 2018, gives people a legal right to ask for erasure of personal data in many cases.

A Reddit commenter recalled the terms and conditions everyone jokes about not reading. Most of this collection was disclosed somewhere in those documents; few people ever read them.

Another suggested a bot that runs trillions of random searches to drown real data in noise. Browser extensions built on this idea exist, but experts doubt they protect much, since real activity can still be separated from random queries.

Some readers laughed it off with jokes about their browsing habits, a common way of coping with uncomfortable news.

And one found a bright side: the YouTube history list could help find old videos they had forgotten to save. The data is, after all, also a tool for the user.

What changed after 2018 and how to check your own data

The Cambridge Analytica affair had real consequences. Cambridge Analytica filed for bankruptcy in May 2018. In July 2019 the US Federal Trade Commission approved a record $5 billion penalty against Facebook over its privacy practices, under an order that also created an independent privacy committee on Facebook's board, and Facebook paid a further $100 million to the Securities and Exchange Commission. In the UK, Facebook agreed in October 2019 to pay the Information Commissioner's Office £500,000. The EU's GDPR, which came into force in May 2018, also gave Europeans stronger rights to see and delete their data.

Google, for its part, introduced auto-delete controls and in June 2020 made 18-month deletion the default for location and web activity on new accounts. Existing accounts must switch it on themselves.

To take control of your own data:

Download a copy with Google Takeout and Facebook's Download Your Information tool, so you can see what is there.
Review and delete activity on Google My Activity, and set auto-delete to 3 or 18 months for Web & App Activity, Timeline and YouTube.
Turn off personalised ads in Google's My Ad Center and in Facebook's ad preferences.
Remove old apps connected to your Google and Facebook accounts, and check app permissions on your phone for location, microphone and contacts.
Secure the accounts with a unique password and two-step verification, because the biggest risk is someone else getting in.
Plan ahead with Google's Inactive Account Manager and a Facebook legacy contact, so your family is not left in the position of the reader above.