CheckMyNews Chrome extension security report

CheckMyNews (Social Media Monitor) is a browser extension used in an academic research study run by LIX (Laboratoire d’Informatique de l’École Polytechnique) under GDPR oversight (École Polytechnique / Inria). What it does (only after you explicitly consent, and for participants 18+): • On Facebook, collects the ads you receive, the ads you click, and the explanations Facebook provides (e.g., “Why am I seeing this ad?”). • Collects public posts and posts that link to news organizations. • Measures exposure and engagement signals, including: time an ad/post is visible on screen; scroll/move/click signals; (x,y) mouse position when entering an ad area; and actions such as reactions, comment interactions (including writing a comment), shares, saves/hides/reports, opening landing pages, interacting with carousel media, checking advertisers, and related actions described in the study consent. • Collects information shown in Facebook Ad Preferences pages (information you shared with Facebook and information Facebook inferred about you). • On a predefined set of monitored news websites, collects which news articles you read and how long you spend reading them. Identifiers and technical data: • May collect hashed versions of your email and Facebook ID if you shared them with Facebook. • Collects connection/technical information such as IP address, browser type, operating system, and diagnostics (e.g., whether an ad blocker is installed; when you connect to Facebook). Important note: Ads, explanations, posts, and Ad Preferences attributes can reveal sensitive topics (special category data) inferred by Facebook and may be inaccurate. Participants may also be asked to complete surveys; survey answers are stored in the research database. How data is stored and shared: Data is stored on a dedicated secured server and may be shared with academic researchers upon justified request via authenticated access once validated. Data may be shared with research partners under contract and may be transferred outside the EU with appropriate safeguards (e.g., standard contractual clauses). Retention: Research data is kept for 10 years. Consent and its date are stored for 15 years. Your rights / contact: You can request access, correction, deletion, portability, restriction, or object to processing by contacting the DPO: dpo@inria.fr . You may also complain to the CNIL (cnil.fr). Study contact: Oana Goga (Inria Research Director) – oana.goga@inria.fr