Over the past few months, as the Guardian and the Observer reported misuses of personal data that people share with Facebook, you may have imagined you heard a loud rustling of papers or a racket of clicks. That would have been the sound of executives in companies all over Europe checking the terms and conditions under which they handle their own customers’ data. “Do our policies align with our practices?” many would have asked themselves.

The issue was front of mind for most managers anyway, because around that time EU member countries were preparing for the coming into force on 25 May of the General Data Protection Regulation (GDPR), with its more stringent rules about collection, use and security of personal information.

By the grace of God, not they but Mark Zuckerberg went before legislators to be questioned about why Facebook was not more open about what it does with the personal data of those who use its services, and why the data of tens of millions of people were made available to researchers and appeared to have been put to political uses. Bit by bit, some more information emerged and inquiries continue.

The Guardian/Observer journalism was lauded, but at the same time a persistent smattering of readers were asking me what the newspapers’ publisher, Guardian News & Media, was doing with the personal data of those who browse its own digital platforms. In particular, what arrangements did GNM have with Facebook, they asked. An example: “In light of the Cambridge Analytica/Facebook fiasco, I am a bit surprised that reputable institutions (that’s you) continue to drive the public towards these social media platforms of dubious ethical practices. The links on your site are an endorsement of these businesses.”

Another response to a story about Cambridge Analytica: “… fine work and up to the standards The Guardian set for yourselves. Thanks. But I cannot help noticing the little icon suggesting readers use the same Facebook to share and ‘like’ the story with ‘friends’. There’s a certain irony in promoting Facebook’s gathering of data in a story about how they released the same data, by mistake, for misuse by a customer.”

I reflected for a while on the laser-like way in which some readers target potential hypocrisy. In this they are like newspaper leader writers. I read the GNM privacy policy, cookies policy and terms and conditions, and found them clearer than many.

This is the substance of my exchange with GNM management.

Readers’ editor question: What information about a Guardian/Observer reader could reach Facebook and how, as a result of the reader’s engagement with GNM digital presences?

GNM management answer: [Description of how GNM places its journalism on Facebook-owned platforms in order to reach potential readers where they congregate] There are also times when we want to reach Guardian readers who use Facebook to market our own products and services – by which we mean things like our live events, Guardian Soulmates and Guardian Jobs. To do this, we place some Facebook code – a pixel – on our web pages that allows Facebook to place cookies on our visitors’ web browsers. When a Guardian reader who uses Facebook returns to Facebook, Facebook can identify them as part of a group of Guardian readers and on behalf of the Guardian, they can serve them with marketing messages from us.

The data that can be obtained from a visit to the Guardian is limited to the URL of the pages that have been visited and, in some cases, the status of any unfinished or completed commercial transactions undertaken with us (for instance, on Guardian Jobs), together with any other information a browser might pass on (such as its IP address).

If a Guardian reader is also a Facebook user, as in the example above, Facebook can aggregate this data; this helps it to create a set of “audiences” that they can offer to potential advertisers. It is not permitted to share any of the information obtained from a user’s visit to the Guardian at an individual level with a third party.

I add here that GNM is no outlier; this kind of arrangement with Facebook is typical of news media organisations, as recent research by the Reuters Institute for the Study of Journalism shows.

Q: Is the result different if the reader does not have a Facebook account?

A: If you are a Guardian reader who has never visited Facebook, Facebook’s terms state that they will not retain any information: that after their servers receive the information sent by the Facebook pixel, Facebook uses the information in the Facebook cookies to attempt to match the browsing session to a person known by them. If the web browser of the person does not contain a Facebook cookie, then according to the terms: “no match is made and that person is not eligible to be served an ad, added to an audience or have their actions counted in conversion reports.”

Q: Is the result different if the reader is a Guardian member?

A: We treat everyone the same regardless of whether they are a member/supporter or not.

Q: What steps is Guardian News & Media taking to satisfy itself that Facebook has not mishandled personal information about readers, now that the journalism of the Guardian and Observer has made everyone more aware about how Facebook could do so?

A: While we have recently run a number of investigative articles relating to Facebook – stories which had a worldwide impact – we are satisfied that there has been no breach in the terms of conditions that we have with Facebook in respect of the relationship described above.

...Increasingly, our readers fund us directly – either by buying a newspaper, or taking out a print or digital subscription or through making a one-off, regular or monthly contribution. But to grow that number of supporters we are reliant on marketing, and we still rely in part on [a] need to make money from advertising to fund our journalism. Investigative reporting is expensive and we need to find ways to fund it.

We take the privacy and concerns of our readers seriously, and while we believe there is a responsible way to work with Facebook, we will continue to assess the detail of our relationship with them and with other third parties such as ad tech providers.

Readers, GNM is one player in what is a much bigger game. After long acquaintance with data protection issues, my pragmatic conclusions are:

• large-scale data about people is immensely valuable;

• journalism’s public service functions cannot survive under the old advertising-funded model because the search and social media giants have severely harmed it;

• at least until a sustainable new model is found, the journalism organisations that attract large audiences will use data in lawful ways that a proportion of you would probably prefer they did not, and a proportion of you would probably accept as a reasonable trade-off;

• in various forums – legislative, executive, judicial and from time to time in the court of public opinion – a titantic struggle is under way over how much control any of us will have over our digital data in an era in which, in some contexts, you are your data;

• so far, the quality of democratic debate about that struggle has been weakened by the secrecy of the largest players, governmental as well as corporate;

• organisations such as GNM – necessarily commercially involved yet journalistically enquiring and disclosing too – are part of the imperfect means available to generate better informed debate.

Paul Chadwick is the Guardian’s readers’ editor