Facebook info sharing created Zoosk.com dating profile for married woman

Mari Sherkin has been out of the dating game for a long time. At least that's what she thought — she's been married for more than 25 years.

Imagine her surprise when she started getting hundreds of emails from men who wanted to date her.

The men had found Sherkin's profile on Zoosk.com, a popular dating website — a website she had never heard of and a profile she says she didn't create.

So, how did it happen?

Last January, Sherkin says she got a pop-up ad on Facebook from Zoosk.com.

"I didn't know what it was," she said. "So I clicked on the X to close it. At least I thought I did.

"However, what happened was it brought me to the Zoosk site, which turned out to be a dating site. Having been married since 1988, I wasn't interested in a dating site, so I closed it."

She says that within minutes, she started getting messages in her Facebook inbox from men.

"'A Zoosk member wants to meet you,' [it read]. I was absolutely unaware of what was going on.

"So I opened it and found out — unbeknownst to me — Zoosk had created a dating profile for me."

Dating profile used Facebook photo

Sherkin says she was horrified to see the dating profile, which used her Facebook photo, her name and her postal code.

She and her husband live in a small community 2½​ hours northwest of Toronto.

She worried her neighbours, friends and family would see the profile and wonder why a married woman would sign up for a dating site.

"My palms started sweating, my heart started racing, my stomach started doing flip-flops. I had a full-on panic attack.

"All I could think of was — who's seen this? Has my husband seen this? Have his friends seen this? Has his family seen this? I was absolutely mortified."

And Mari isn't the only one. There are many similar complaints online from women who say they have no idea how a dating profile was created for them on Zoosk.

Zoosk Victims is just one of the Facebook pages that feature dozens of complaints about the dating website and how it creates profiles.

Authentication protocol shares information

Graham Williams, a Vancouver-based technology expert, points to what is known as an "open authentication protocol" — or OAuth — where people often unwittingly share personal information with third-party websites.

"This open authentication scheme is used by Facebook, it's used by Google, it's used by Twitter.

"And it is basically saying to users out there — you don't want to have to remember 100 different passwords or 100 different log-ins, so we're going to let you log in with your Facebook credentials."

So, by logging in with Facebook, for example, you automatically agree to share your private information with other websites.

The problem is, a lot of people end up giving away more of their privacy than they intended.

"A lot of sites — they can overreach in my opinion. They are looking for a lot of stuff. They are looking for your name, your phone number, your address, your location, your marital status."

It's an issue that's on the radar of the Office of Canada's Privacy Commissioner. In a written statement to Go Public, communications director general Anne-Marie Hayden writes: "Our office has long been raising concerns about overly complex privacy policies and highlighting the need for companies to obtain informed consent for the collection and use of personal information."

Canada's technology laws outdated, says advocate

So where does the problem lie?

The answer is complicated, according to Sharon Polsky, who heads up the independent advocacy group Privacy and Access Council of Canada.

Polsky says Canada's outdated technology laws are just part of the problem.

"Most of them came in at about the same time fax machines were being developed … smartphones didn't exist," she said.

"The laws were built to respond to technology that's quite obsolete right now. [They] haven't been updated in a way that helps protect privacy of individuals.

"Right now in Canada, there's nothing to stop an organization from gathering that information about you and doing pretty much as they please with it as long as you're notified."

That notification is the key — and also the problem.

Polsky says a lot of people don't realize they are just a click away from granting permission to take and use their personal information.

"You think you're doing one thing. You think you're getting rid of that pop-up screen or that link.

"[But] by using that website — by just visiting — you have agreed to their terms of service, which means in the nanosecond it takes to actually connect to that website your information is gone."

And it's perfectly legal.

Zoosk denies creating profiles without permission

Zoosk is based in the U.S. According to the company, it has 29 million members across 80 countries.

Go Public requested a Skype interview, but vice-president of marketing and communications, Allison Braley instead provided Go Public with a written statement (emphasis in the original).

"Under NO circumstances do we take Facebook data to create a Zoosk profile without a user’s express permission," she wrote.

"In fact, Facebook has very strong protections in place preventing us from doing this. A user must explicitly give us permission to use their data during their sign-up process. Our profiles are all created by users and not by Zoosk."

While Zoosk denies creating profiles for users, its terms of use agreement clearly states that it can do exactly that.

"By accessing or using our services through a social networking site, you are authorizing Zoosk to collect, store, retain and use, in accordance with our privacy policy, any and all of your information that Zoosk has obtained from the social networking site, including to create a Zoosk profile page and account for you."

The company says it no longer puts pop-up ads on Facebook.

Like a lot of people, Sherkin was surprised to hear how easy — and perfectly legal — it is for users to give their personal information away.

Sherkin says it was difficult to remove her profile from the Zoosk website. With the help of a tech-savvy friend, she managed to do that in January. She's also shut down her Facebook account.

But, she says, months later she was still getting email and Facebook messages from men she doesn't know.

Sherkin tells us she decided to Go Public to warn others how easy it is to end up in the same situation — and she also wonders whether the company's behaviour crosses another line.

"I don't feel their practices are ethical. They violated me, my profile, my information, they took my identity. To be honest with you, they have caused my husband and I a lot of embarrassment."

Submit your story ideas:

Go Public is an investigative news segment on CBC-TV, radio and the web.

We tell your stories and hold the powers that be accountable.

We want to hear from people across the country with stories they want to make public.

Submit your story ideas to Kathy Tomlinson at Go Public.

Follow @CBCGoPublic on Twitter.