Clubhouse's privacy challanging method to store your address book is one method to build a social graph outside of Facebook.&nbsp;It poses some ethical challanges but startegically sound.&nbsp;

Using the address book to kick off a social-graph

<h4 dir="ltr">1 day ago·6 min read</h4><figure><img alt="Image for post" src="https://miro.medium.com/max/500/1*GSmOPPI0dMRC6dtkeWpTpQ.jpeg" width="680" height="571"><figcaption dir="auto">Screenshot courtesy of the author</figcaption></figure>When you join the fast-growing, invite-only social media app Clubhouse — lucky you! — one of the first things the app will ask you to do is grant it access to your iPhone’s contacts. A finger icon points to the “OK” button, which is also in a bolder font and more enticing than the adjacent “Don’t Allow” option. You don’t have to do it, but if you don’t, you lose the ability to invite anyone else to Clubhouse.Once you’ve agreed to upload your phone’s address book, Clubhouse uses it to recommend people to follow who are already on the app, which is common practice for social apps these days. But it soon becomes apparent that Clubhouse also takes it a few steps further, in ways that are both creative and a little creepy.When I granted the app access to my contacts, within hours it was nudging me to invite my former pediatrician, barber, and a health worker who once cared for my dying father to join Clubhouse — and sending me push notifications every time someone from my contacts signed up so I could welcome them via private chat and “walk them in.”Granting an app access to your contacts is <a href="https://slate.com/technology/2013/06/facebook-data-breach-how-social-networks-use-find-friends-to-mine-your-contacts.html" rel="noopener nofollow" dir="ltr">ethically dicey</a>, even if it’s an app you trust. If you’re like most people, the contacts in your phone include not just your real-life friends, but also old acquaintances, business associates, doctors, bosses, and people you once went on a bad date with. For journalists, they might also include confidential sources (although careful journalists will avoid this). When you upload those numbers, not only are you telling the app developer that you’re connected to those people, but you’re also telling it that those people are connected to you — which they might or might not have wanted the app to know. For example, say you have an ex or even a harasser you’ve tried to block from your life, but they still have your number in their phone; if they upload their contacts, Clubhouse will know you’re connected to them and make recommendations on that basis.Some social networks even use this sort of info to start building secret dossiers on people who don’t use the app, sometimes called “shadow profiles.” (<a href="https://gizmodo.com/how-facebook-figures-out-everyone-youve-ever-met-1819822691" rel="noopener nofollow" dir="ltr">Facebook is a notable example</a>, though almost certainly <a href="https://lifehacker.com/google-knows-even-more-about-you-than-facebook-1825508058" rel="noopener nofollow" dir="ltr">not the only one</a>.) For instance, if User A uploads the number of a person named C who isn’t on the app, and User B also uploads the same number, now the app knows that C is connected to B and A, even though C has never used the app at all. While Clubhouse did not respond to my request for comment, it seems evident from the app that it is collecting at least some information about non-Clubhouse users, linked to their phone numbers.There are at least two additional ways in which Clubhouse appears to take users’ contact data further than the norm.The first is that as soon as someone who was in your address book joins Clubhouse, you’ll get a notification from the app that they’ve just joined, prompting you to “welcome” them and “walk them in.” Tapping on that notification takes you to a private Clubhouse room with both the new user and any other user who may have also had them in their contacts.There’s some potentially delightful serendipity here — I joined a welcome room for a person I hadn’t talked to in years on a whim, and while they weren’t actually there, I wound up virtually meeting some other random mutual friends of theirs. Which is cool, although you can probably also imagine scenarios in which being thrown into a private room with people you’ve never met might be less delightful. Still, it’s a sort of high-touch approach that heightens the, well, clubby feeling that has been a big part of Clubhouse’s early appeal.The second surprising way that Clubhouse harnesses your contact information is revealed when you go to invite others to the app. Tapping on the “invite” tab pulls up a list of what seems to be all the contacts in your phone whose numbers aren’t already associated with an account that has been invited to Clubhouse. The twist is that the list also shows you how many “friends on Clubhouse” each of those people already has — and ranks them from most connected to least connected.<figure><img alt="Image for post" src="https://miro.medium.com/max/500/0*CEbFXn1LWQnvqnr9" width="680" height="1008"></figure>Generously interpreted, the feature is probably based on the assumption that people who have lots of contacts already on Clubhouse are more likely to want to join or to find it useful once they do. But there’s also something a bit icky feeling about ranking the Clubhouse connectedness of people who have not chosen or agreed to have anything to do with Clubhouse—and who may not have even chosen to be in your phone’s address book, for that matter. Without knowing what other ways Clubhouse might be using this data, it’s hard to pinpoint the potential harms, aside from the fundamental lack of consent involved in collecting data on nonusers.Then there’s the matter of who people are finding atop those recommendation lists — that is, what the rankings are really optimizing for. Some of the top names may be friends of yours who are particularly tech- or marketing-savvy or who happen to belong to social groups that are well-represented on Clubhouse and for whatever reason just haven’t had the opportunity to join yet. Great.But in a lot of cases, at this point in Clubhouse’s growth — it was recently reported to have at least <a href="https://techcrunch.com/2021/01/24/clubhouse-announces-plans-for-creator-payments-and-raises-new-funding-led-by-andreessen-horowitz/" rel="noopener nofollow" dir="ltr">2 million weekly active users</a> — your contacts who are most connected to other Clubhouse users are likely to have already joined, or at least have been invited by someone else. And so instead, the names you see near the top of your invite list likely belong to entities that people have intentionally avoided inviting, despite their high connectedness.For instance, two of the names at the top of my invite list were not people at all, but restaurants — a pair of South Harlem Southern-food joints, one of which closed two years ago. Clubhouse also thought I might want to invite the psychiatrist who used to prescribe my ADHD medication, who I now know has 62 friends on Clubhouse. Fortunately, it doesn’t show me who those 62 people are — but Clubhouse must know and have that information somewhere in a database.I’m not the first person to find this awkward. It was a nudge from Blake Eskin, an assistant professor of journalism and design at the New School, that prompted me to look into this.A quick Twitter search turned up plenty of further examples, some queasier than others. (All of the following are used with permission of the author.)<figure><img alt="Image for post" src="https://miro.medium.com/max/500/0*2yT_NYofy96YXDj9" width="680" height="320"></figure><figure><img alt="Image for post" src="https://miro.medium.com/max/500/0*soHopcqLWuhXHfDQ" width="680" height="347"></figure><figure><img alt="Image for post" src="https://miro.medium.com/max/500/0*2SLQRRPmj1XAcdoa" width="680" height="376"></figure><figure><img alt="Image for post" src="https://miro.medium.com/max/500/0*_wU1dnlvPwWR4hSZ" width="680" height="672"></figure>Again, it’s hard to predict the exact ways in which this could go wrong without knowing Clubhouse’s policies around this data. One speculative scenario might be a subpoena in which Clubhouse is asked to turn over a list of who a given suspect or political dissident is connected to on the service. Even short of that, just imagine that drug dealer’s surprise if she knew an app she’s never downloaded was compiling a list of all the people who have her number in their phone.Clubhouse may or may not be the worst offender in terms of how it handles contacts that users upload. It’s conceivable that the company has thoughtful data-handling practices that mitigate the risks, although its nonresponse to my inquiry isn’t the most encouraging sign. What’s clear, though, is that Clubhouse makes these connections more visible than most — and that new users should think twice before clicking the “OK” button to grant the app access to your contacts, no matter how urgently Clubhouse nudges you to do so.

When you join the fast-growing, invite-only social media app Clubhouse — lucky you! — one of the first things the app will ask you to do is grant it access to your iPhone’s contacts. A finger icon…

product

Product & Design

W hen you join the fast-growing, invite-only social media app Clubhouse — lucky you! — one of the first things the app will ask you to do is grant it access to your iPhone’s contacts. A finger icon points to the “OK” button, which is also in a bolder font and more enticing than the adjacent “Don’t Allow” option. You don’t have to do it, but if you don’t, you lose the ability to invite anyone else to Clubhouse.

Once you’ve agreed to u pload your phone’s address book, Clubhouse uses it to recommend people to follow who are already on the app, which is common practice for social apps these days. But it soon becomes apparent that Clubhouse also takes it a few steps further, in ways that are both creative and a little creepy.

When I granted the app access to my contacts, within hours it was nudging me to invite my former pediatrician, barber, and a health worker who once cared for my dying father to join Clubhouse — and sending me push notifications every time someone from my contacts signed up so I could welcome them via private chat and “walk them in.”

Granting an app access to your contacts is <a dir="ltr" href="https://slate.com/technology/2013/06/facebook-data-breach-how-social-networks-use-find-friends-to-mine-your-contacts.html" rel="noopener nofollow">ethically dicey </a>, even if it’s an app you trust. If you’re like most people, the contacts in your phone include not just your real-life friends, but also old acquaintances, business associates, doctors, bosses, and people you once went on a bad date with. For journalists, they might also include confidential sources (although careful journalists will avoid this). When you upload those numbers, not only are you telling the app developer that you’re connected to those people, but you’re also telling it that those people are connected to you — which they might or might not have wanted the app to know. For example, say you have an ex or even a harasser you’ve tried to block from your life, but they still have your number in their phone; if they upload their contacts, Clubhouse will know you’re connected to them and make recommendations on that basis.

Some social networks even use this sort of info to start building secret dossiers on people who don’t use the app, sometimes called “shadow profiles.” (<a dir="ltr" href="https://gizmodo.com/how-facebook-figures-out-everyone-youve-ever-met-1819822691" rel="noopener nofollow">Facebook is a notable example </a>, though almost certainly <a dir="ltr" href="https://lifehacker.com/google-knows-even-more-about-you-than-facebook-1825508058" rel="noopener nofollow">not the only one </a>.) For instance, if User A uploads the number of a person named C who isn’t on the app, and User B also uploads the same number, now the app knows that C is connected to B and A, even though C has never used the app at all. While Clubhouse did not respond to my request for comment, it seems evident from the app that it is collecting at least some information about non-Clubhouse users, linked to their phone numbers.

There are at least two additional ways in which Clubhouse appears to take users’ contact data further than the norm.

The first is that as soon as someone who was in your address book joins Clubhouse, you’ll get a notification from the app that they’ve just joined, prompting you to “welcome” them and “walk them in.” Tapping on that notification takes you to a private Clubhouse room with both the new user and any other user who may have also had them in their contacts.

There’s some potentially delightful serendipity here — I joined a welcome room for a person I hadn’t talked to in years on a whim, and while they weren’t actually there, I wound up virtually meeting some other random mutual friends of theirs. Which is cool, although you can probably also imagine scenarios in which being thrown into a private room with people you’ve never met might be less delightful. Still, it’s a sort of high-touch approach that heightens the, well, clubby feeling that has been a big part of Clubhouse’s early appeal.

The second surprising way that Clubhouse harnesses your contact information is revealed when you go to invite others to the app. Tapping on the “invite” tab pulls up a list of what seems to be all the contacts in your phone whose numbers aren’t already associated with an account that has been invited to Clubhouse. The twist is that the list also shows you how many “friends on Clubhouse” each of those people already has — and ranks them from most connected to least connected.

Generously interpreted, the feature is probably based on the assumption that people who have lots of contacts already on Clubhouse are more likely to want to join or to find it useful once they do. But there’s also something a bit icky feeling about ranking the Clubhouse connectedness of people who have not chosen or agreed to have anything to do with Clubhouse—and who may not have even chosen to be in your phone’s address book, for that matter. Without knowing what other ways Clubhouse might be using this data, it’s hard to pinpoint the potential harms, aside from the fundamental lack of consent involved in collecting data on nonusers.

Then there’s the matter of who people are finding atop those recommendation lists — that is, what the rankings are really optimizing for. Some of the top names may be friends of yours who are particularly tech- or marketing-savvy or who happen to belong to social groups that are well-represented on Clubhouse and for whatever reason just haven’t had the opportunity to join yet. Great.

But in a lot of cases, at this point in Clubhouse’s growth — it was recently reported to have at least <a dir="ltr" href="https://techcrunch.com/2021/01/24/clubhouse-announces-plans-for-creator-payments-and-raises-new-funding-led-by-andreessen-horowitz/" rel="noopener nofollow">2 million weekly active users </a>— your contacts who are most connected to other Clubhouse users are likely to have already joined, or at least have been invited by someone else. And so instead, the names you see near the top of your invite list likely belong to entities that people have intentionally avoided inviting, despite their high connectedness.

For instance, two of the names at the top of my invite list were not people at all, but restaurants — a pair of South Harlem Southern-food joints, one of which closed two years ago. Clubhouse also thought I might want to invite the psychiatrist who used to prescribe my ADHD medication, who I now know has 62 friends on Clubhouse. Fortunately, it doesn’t show me who those 62 people are — but Clubhouse must know and have that information somewhere in a database.

I’m not the first person to find this awkward. It was a nudge from Blake Eskin, an assistant professor of journalism and design at the New School, that prompted me to look into this.

A quick Twitter search turned up plenty of further examples, some queasier than others. (All of the following are used with permission of the author.)

Again, it’s hard to predict the exact ways in which this could go wrong without knowing Clubhouse’s policies around this data. One speculative scenario might be a subpoena in which Clubhouse is asked to turn over a list of who a given suspect or political dissident is connected to on the service. Even short of that, just imagine that drug dealer’s surprise if she knew an app she’s never downloaded was compiling a list of all the people who have her number in their phone.

Clubhouse may or may not be the worst offender in terms of how it handles contacts that users upload. It’s conceivable that the company has thoughtful data-handling practices that mitigate the risks, although its nonresponse to my inquiry isn’t the most encouraging sign. What’s clear, though, is that Clubhouse makes these connections more visible than most — and that new users should think twice before clicking the “OK” button to grant the app access to your contacts, no matter how urgently Clubhouse nudges you to do so.

Clubhouse Is Suggesting Users Invite Their Drug Dealers and Therapists

Using the address book to kick off a social-graph

Related collections

Other curated ideas on this topic: