Leila has two identities, but Facebook is only supposed to know about one of them.
Leila is a sex worker. She goes to great lengths to keep separate identities for ordinary life and for sex work, to avoid stigma, arrest, professional blowback, or clients who might be stalkers (or worse).
Her "real identity"--the public one, who lives in California, uses an academic email address, and posts about politics--joined Facebook in 2011. Her sex-work identity is not on the social network at all; for it, she uses a different
email address, a different phone number, and a different name. Yet earlier this year, looking at Facebook's "People You May Know" recommendations, Leila (a name I'm using using in place of either of the names she uses) was shocked to see
some of her regular sex-work clients.
Despite the fact that she'd only given Facebook information from her vanilla identity, the company had somehow discerned her real-world connection to these people--and, even more horrifyingly, her account was potentially being presented to them as
a friend suggestion too, outing her regular identity to them.
Because Facebook insists on concealing the methods and data it uses to link one user to another, Leila is not able to find out how the network exposed her or take steps to prevent it from happening again.
See the full article from gizmodo.com
Facebook denies it, but maybe the most obvious explanation is that Facebook is somehow inferring connections from the proximity of people's phones.