Focusing public attention on emerging privacy and civil liberties issues

Facebook Privacy

Latest News/Events

  • EPIC to Urge Congress to Strengthen Privacy Laws for Facebook Users: In prepared testimony (PDF) for a Congressional hearing  on "Online Privacy, Social Networking and Crime Vicitimization," EPIC Executive Director Marc Rotenberg urged lawmakers to update federal law to protect the privacy of Facebook users. Mr. Rotenberg said that Facebook's constant changes to the privacy settings of users have made it virtually impossible for users to control who gets access to their personal information. He also said that the failure of the Federal Trade Commission to investigate Facebook's business practices means that Congress must now amend the federal privacy law to limit the ability of Social Network companies to disclose user information to third parties without informed and explicit consent. Also testifying at the hearing are witnesses from the FBI, the Secret Service, Symantec, and Facebook. For more information, see EPIC Social Networking Privacy, EPIC Facebook, and EPIC In re Google Buzz. (Jul. 28, 2010)
  • Facebook Scores Low on Consumer Satisfaction: In a recent study by Foresee Results and the University of Michigan, Facebook has scored extremely low in the area of customer satisfaction. The 2010 American Customer Satisfaction Index E-Business Report included social networking companies for the first time, and Facebook scored a 64, putting it "in the bottom 5% of all measured private sector companies and in the same range as airlines and cable companies." The polling company attributed Facebook's low scores to "privacy concerns, frequent changes to the website, and commercialization and advertising." For more information, see EPIC Facebook Privacy and EPIC Public Opinion on Privacy. (Jul. 22, 2010)
  • Federal Trade Commission Takes Action Against Twitter, Social Network Service Settles Charges It Deceived Consumers: The FTC announced a significant enforcement action today. The Commission's complaint against Twitter charged that "serious lapses in the company's data security allowed hackers to obtain administrative control of Twitter." The FTC found that the lax practices allowed access to nonpublic tweets even though the company assured users in its privacy policy that it was "very concerned about safeguarding the confidentiality of your personally identifiable information." Under the terms of the settlement, "Twitter will be barred for 20 years from misleading consumers about the extent to which it maintains and protects the security, privacy, and confidentiality of nonpublic consumer information." EPIC has two complaints currently pending at the FTC concerning similar practices by Facebook, another social networking service. For more information, see EPIC - Facebook Privacy, EPIC - In re Facebook I, and EPIC - In re Facebook II. (Jun. 24, 2010)
  • Privacy Conference Attendees Set Out Social Networking Bill of Rights: Participants at the 2010 Conference on Computers, Freedom, and Privacy have prepared a Social Network Users' Bill of Rights. The Bill of Rights sets out principles for providers of  social network services, including clarity of policies, empowerment of users, freedom of speech, data minimization, and user control. For more information, follow #billofrights and see EPIC: Social Networking Privacy and EPIC: Facebook Privacy. (Jun. 23, 2010)
  • EPIC, Privacy Groups Recommend Further Changes for Facebook: EPIC has joined a letter, organized by the ACLU of Northern California, calling for Facebook to fix ongoing privacy problems with the social network service. The letter, signed by several privacy organizations, recommends that Facebook make "Instant Personalization" opt-in, limit data retention, give users greater control over their information, and allow users to export their content from Facebook. EPIC has a complaint currently pending at the Federal Trade Commission, charging that Facebook has engaged in unfair and deceptive trade practices. For more information, see EPIC Facebook Privacy. (Jun. 16, 2010)
  • Privacy Issue Attracts Fire in California Attorney General Race: Facebook privacy has become a hot topic in the California race for Attorney General. In the Democratic primary, Kamala Harris has attacked former Facebook Chief Privacy Officer Chris Kelly over the company's privacy practices. But Kelley has recently criticized some of the Facebook changes and said that "instant personalization" should be opt-in. Kelly has also supported a Moveon Facebook campaign though some bloggers have doubts. During the last election cycle, EPIC launched PRIVACY08 to encourage candidates to debate privacy issues. Also see EPIC Facebook Privacy. (Jun. 7, 2010)
  • Congress Pursues Investigation of Google and Facebook's Business Practices: Following similar letters from other Congressional leaders, the head of the House Judiciary Committee has asked Google Inc. and Facebook to cooperate with government inquiries into privacy practices at both companies. Rep. Conyers (D-MI) noted that Google's collection of user data "may be the subject of federal and state investigations" and asked Google to retain the data until "such time as review of this matter is complete." Rep. Conyers also asked Facebook to provide a detailed explanation regarding its collection and sharing of user information. The House Judiciary Committee is expected to hold hearings on electronic privacy later this year. For more information, see EPIC: Facebook Privacy, EPIC: In re Facebook II, and EPIC: Search Engine Privacy. (Jun. 1, 2010)
  • Facebook Expected to Announce Privacy Changes: Following a recent column in the Washington Post by Facebook CEO Mark Zuckerberg, the company is expected to announce new, simplified privacy settings this week.  EPIC objected to the last several rounds of changes that Facebook made, filing a complaint with the FTC in December when the company reclassified much of users' data as "publicly available information," a supplement to that complaint in January, and another complaint this month when Facebook forced users' profile information to become publicly available links instead of private data.  For more information, see EPIC: Facebook, EPIC: In re Facebook, and EPIC: In re Facebook II. (May. 25, 2010)
  • New Facebook Privacy Complaint Filed with Trade Commission: Today, EPIC and 14 privacy and consumer protection organizations filed a complaint with the Federal Trade Commission, charging that Facebook has engaged in unfair and deceptive trade practices in violation of consumer protection law. The complaint states that changes to user profile information and the disclosure of user data to third parties without consent "violate user expectations, diminish user privacy, and contradict Facebook’s own representations." The complaint also cites widespread opposition from Facebook users, Senators, bloggers, and news organizations. In a letter to Congress, EPIC urged the Senate and House Committees with jurisdiction over the FTC to monitor closely the Commission's investigation. The letter noted the FTC's failure to act on several pending consumer privacy complaints. For more information, see EPIC: Facebook Privacy. (May. 5, 2010)
  • Senators Oppose Facebook Changes, Schumer Urges Trade Commission to Regulate Social Network Services: Senators Charles Schumer (D-NY), Michael Bennet (D-CO), Mark Begich (D-AK), and Al Franken (D-MI) have sent a letter to Facebook CEO Mark Zuckerberg to express concern about "recent changes to the Facebook privacy policy and the use of personal data by third-party websites." Senator Schumer has also asked the Federal Trade Commission to establish guidelines for social networking sites. The Senators' statements came after Facebook announced it would disclose user data to websites without consent. Senator Schumer stated "Previously, users had the ability to determine what information they chose to share and what information they wanted to keep private." EPIC has filed a complaint and with the FTC about the recent changes to Facebook's privacy settings. For more information, see EPIC: Facebook Privacy and EPIC: In re Facebook. (Apr. 27, 2010)
  • Canadian Law Students File Privacy Complaint Against Facebook. The Canadian Internet Policy and Public Interest Clinic today filed a 35-page complaint (pdf) under the Personal Information Protection and Electronic Documents Act against Facebook, alleging 22 separate violations of Canadian privacy law. CIPPIC Press Release. (May 30, 2008)
  • International Privacy Officials Recommend Social Networking Privacy Safeguards. The International Working Group On Data Protection in Telecommunications has released a report and guidance (pdf) on privacy in social networking services. The report identifies risks to privacy and security, and provides guidance to regulators, service operators and users to counter these risks. Risks include the large amount of data collection; the misuse of profile data by third parties; insecure infrastructure and application programming interfaces. Regulators should ensure openness, and oblige data breach notification. Providers must be transparent; live up to promises made to users; and use privacy friendly defaults. Privacy and consumer groups are also recommended to raise the awareness of regulators, providers and the general public. (Apr. 17, 2008)
  • Facebook Eases Account Deletion, Default Third Party Information Sharing Remains.After recent criticisms concerning the practical impossibility of deleting account information, Facebook has changed its help page on deletion. Users may now contact Facebook to request permanent deletion of their information. However, Facebook's default sharing of excess personal information with thousands of third party application developers remains. User information travels to these third parties when they or their friends add an application to their profiles. Facebook disclaims all liability from what happens to that information. For more, see EPIC's page on Facebook. (Feb. 19. 2008)
  • UK Commissioner to Investigate Facebook Data Retention. Social networking site Facebook is under investigation by the UK Information Commissioner for its data retention practices. Facebook users may "deactivate" their accounts, leaving their personal information on Facebook servers but inaccessible to the public. Users have to individually delete each profile element. The investigation follows a complaint from a user unable to fully delete his profile. The Information Commissioner is an independent authority that enforces and oversees the Data Protection Act. (Jan 22, 2008)
  • Facebook Announces Beacon Opt-out, Promises Not to Retain Data. Social networking site Facebook announced that users would be able to globally opt-out of the "Beacon" advertising system. Beacon collects information on interactions with third party sites such as Fandango and Ebay. Beacon then broadcasts this information to a user's Facebook friends. Security researchers recently revealed that Beacon collects information on all users of those third party sites, not just Facebook members. Facebook's announcement promises that they will not keep or use this information on non-members and those who have opted out. (Dec 4, 2007)
  • Facebook Caves to Privacy Demands, Adopts Limited Opt-In. Social networking site Facebook.com significantly modified the privacy features of its new "Beacon" advertising system. Facebook users found their purchases on third party sites were being broadcast to their Facebook friends. Users had only limited options for opting out of the broadcast. In response to complaints from EPIC, the Center for Digital Democracy, Moveon.org, and thousands of users, Facebook will now ask that users opt-in before broadcasting their details. Facebook will continue to collect information from third party sites and will continue to ask for opt-ins until the user consents. (Nov 30, 2007)
  • Facebook to Collect, Distribute User Interactions With Third Party Sites. Social networking website Facebook.com introduced its "Beacon" feature to much controversy. Facebook users who shop at third party websites will have their purchases broadcast to their friends via Facebook. Facebook receives this third party information and shares it unless user opt-out during a brief pop-up window at the third party site. Interest group MoveOn.org has started a petition campaign and Facebook group against this feature. The MoveOn petition and Facebook group demand that Facebook share user information only with explicit opt-in permission. Facebook considered, but did not adopt, a blanket opt-out for the beacon feature. (Nov 28, 2007)
  • Facebook Unveils New "Social Ads." Social networking site Facebook.com unveiled "social ads," a new advertising product. Marketers create Facebook profiles and purchase advertising targeting other users profile information. Further, a users name and picture will be shown to their friends in promotion of a product after that user interacts with the marketer in some way. A law professor has questioned whether this violates the privacy tort prohibiting commercial appropriation of name and likeness. Facebook's privacy settings do not currently allow one to opt out of receiving marketing or being used in it. (Nov. 14, 2007)

Introduction

Facebook was started by Mark Zuckerberg as a social networking site for Harvard undergraduates in 2004. Facebook then expanded to other colleges and universities. For a period of time, users required an "edu" email address to join. Users would join a "network" with its own subdomain (for example, the University of Pennsylvania is at upenn.facebook.com) that related to their university affiliation.

The concept of a network is important for the privacy experience of a facebook user because one can usually set their privacy controls to allow access to anyone, to their friends, or to members of their networks. On February of 2006, Facebook began allowing high school students and members of some large companies to join, still all in their respective networks. In September of 2006, Facebook began to allow anyone to join by associating themselves with a network for an employer or a geographic location such as city.

In October of 2007 Microsoft purchased a 1.6 percent stake in Facebook for 240 million dollars. That deal valued Facebook at 15 billion dollars. Facebook provides a website with current statistical snapshot of its user base. In December of 2007, Facebook had 58 million users. At the 15 billion value, this means 258 dollars per user.

Significant Facebook Features and Policies

Facebook has several features with a significant impact on privacy and security of personal information. These features raise issues of data collection, retention, distribution and control. The various privacy issues raised may in some cases have legal consequences.

Account Creation

Facebook does not permit the privacy enhancing techniques of pseudonymous logins or the creation of multiple profiles. Facebook's terms require users to provide "accurate, current and complete" information when registering for the site. This means that a user must provide accurate information for their name, date of birth, and school and work affiliation. Facebook's terms require users to agree not to "register for more than one User account, register for a User account on behalf of an individual other than yourself," or "falsely state or otherwise misrepresent yourself, your age or your affiliation with any person or entity." Users are thus forbidden from having several profiles for different social circles, such as for friends, professional colleagues, teachers and family. Users must have a single identity across all those social interactions. Since they must accurately give Facebook their name and date of birth, this single identity is required to be tied to their real life identity.

Account Deletion

Facebook offers no way to conveniently delete one's account once one has created a profile. Facebook does offer that an account can be "deactivated." Once deactivated, Facebook says that a deactivated account cannot be seen or found by others:

Deactivation will completely remove your profile and all associated content on your account from Facebook. In addition, users will not be able to search for you or view any of your information. If you reactivate your account, your profile will be restored in its entirety (friends, photos, interests, etc.).

Reactivating an account is done by logging in again with the same username and password. This means that all of the information that the user has uploaded is retained by Facebook. Facebook does permit users to delete items such as wall posts, photos, friends and profile information. This has to be done via Facebook's interface, and must be done one item at a time.

Facebook reserves the right to delete your account. According to their terms, Facebook "may terminate your membership, delete your profile and any content or information that you have posted on the Site or through any Platform Application . . . for any reason, or no reason, at any time in its sole discretion, with or without notice . . . ."

Tagging

Facebook users can add metadata tags to photographs. These tags can be identified to particular areas of the photograph. So a picture of a family in front of a landmark can have the individual faces of family members tagged with their names, and the landmark tagged with its name. When the image is displayed, the tags become hyperlinks to the profile of the subject of the tag. If the subject of the tag is not a Facebook member, then the tag remains in plain text, not linking to anything. When photos of a person are displayed, this display includes their own photographs and those published by others and tagged with that person's name. When a user views an image that has been tagged with that user's name by another, the user has the option of removing the tag. A user is given a brief notice when others tag images with that user's name.

Contact Importer

Facebook users are invited by Facebook to "[f]ind out which of your email contacts are on Facebook." Facebook asks users for their email address and password for many of the major providers of webmail services (Yahoo, Hotmail, Gmail, etc...). Facebook then logs on to the account, and downloads all the contacts there. Facebook can also import email contacts from applications such as Outlook and Thunderbird. Users are then shown a list of which individuals are current Facebook members, and have the choice of sending friend requests to each of them. The screen comes with all the contacts pre-selected. The user is then given the option of inviting all of their other contacts to join Facebook. Again, all of the contacts are pre-selected. The default behavior is to send messages to all of one's contacts inviting them to become friends on Facebook.

Contact importer example.
Example of the contact importer.

Facebook promises not to retain the user's password and login. Facebook does not explain what happens to the emails collected, or to the association of those emails as "contacts" of a given user. The email addresses can be of significant value. As known contacts of a real person, a person knows that that email address is "live" and thus valuable to email harvesters.

Feed

Facebook users see a news feed when they log into their accounts. The news feed contains items about a Facebook user's friends as well as some advertisements. Some of a user's personal information is published to their friends' news feeds.

feed example
A newsfeed example, provided by Facebook.

The feed was introduced in September 2006. When first introduced users had no control over what information was published to the Feed. Facebook users protested the privacy invasion, demanding control over their data. Facebook users were responding to the broadcast of their data, to Facebook making it more easily available. Seven hundred thousand users joined a group protesting the feed. Facebook users also created a petition to Facebook Administrators:

Whereas Facebook.com is a social networking Web site and utility owned as a private company started in February 2004 by Mark Zuckerberg;

Whereas Facebook.com is a useful and entertaining tool for those on its networks;

Whereas the users on Facebook.com support the site's stated philosophy of helping people spread information through social networks;

Whereas the users on Facebook.com understand the privacy settings and their role in protecting personal, private information;

Whereas drastic changes were make to Facebook.com on September 5, 2006, including the introduction of the "News Feed" and "Mini Feed" that call into question the safety and privacy of its more than 9 million users;

Whereas there has been an unprecedented outpouring of opposition to the changes within the community;

Whereas many users feel uncomfortable participating on Facebook.com because of the changes to the point that some have deactivated their accounts;

We, the Facebook.com user community:

--Encourage Facebook.com administrators to actively communicate and consult with users in a democratic dialogue concerning any current and future changes.

AND:

--Demand the immediate removal of the "news feed" and "mini feed" feature from Facebook.com.

OR:

--Allow an individual to remove himself or herself from the "news feed" and "mini feed" feature on other users' page.
--Allow an individual to remove his or her own personal "news feed" and "mini feed" feature from his or her personal profile.

Facebook responded by creating some opt-outs for the feed, and its CEO Mark Zuckerberg apologized on the Facebook blog. As Facebook's Feed privacy page explains: "Stories are published when you edit your profile information, join a new network, or update your Status." A user can opt out of other information being published to their feed, such as changes in relationship status or the addition of a friend.

Other Facebook features also publish information via the news feed. Consequently, not all privacy controls related to feeds is controlled by the Feed section of the privacy page. Applications, Social Ads, and Facebook Beacon all communicate via the News Feed. User control, if any, of those information flows is located in pages devoted to those features, not the feed.

Users can also influence what items of their friend's personal information are presented to them. They can select that stories about some friends get published more or less frequently. They can also select what types of stories they are interested in, such as relationship news, changes in profile data, or the addition of new friends. This will cause these events to show up on their feed more or less often.

Platform Application Programming Interface (API)

In May 2007, Facebook launched the Facebook Platform. The platform allows third parties to create applications which access Facebook's database. The applications are meant to function in much the same way that the Facebook created applications work. Applications can publish to a user's feed and can access that user's information. When a user adds an application, the information about other users that the given user can see is made available to these third party application providers. The third party application provider may retain some of this information forever, and some information may be retained for a limited time.

Since the applications are developed and hosted by third parties, their algorithms necessarily involve the flow of personal information from Facebook to the application host and developer. When installing an application users are asked briefly a few choices about the application, such as whether they want it to know who they are, take up space on their profile, or publish information to the user's feed. The choices are all pre-selected.

adding blackjack application
Example of the addition of the Blackjack application.

The information that the application accesses includes everything about a user and what they can see, except for their contact information such as email address, phone number and postal address. The terms the user is agreeing on by clicking "add" includes examples of this information:

Examples of Facebook Site Information. The Facebook Site Information may include, without limitation, the following information, to the extent visible on the Facebook Site: your name, your profile picture, your gender, your birthday, your hometown location (city/state/country), your current location (city/state/country), your political view, your activities, your interests, your musical preferences, television shows in which you are interested, movies in which you are interested, books in which you are interested, your favorite quotes, the text of your "About Me" section, your relationship status, your dating interests, your relationship interests, your summer plans, your Facebook user network affiliations, your education history, your work history, your course information, copies of photos in your Facebook Site photo albums, metadata associated with your Facebook Site photo albums (e.g., time of upload, album name, comments on your photos, etc.), the total number of messages sent and/or received by you, the total number of unread messages in your Facebook in-box, the total number of "pokes" you have sent and/or received, the total number of wall posts on your Wall(TM), a list of user IDs mapped to your Facebook friends, your social timeline, and events associated with your Facebook profile.

Significantly, applications do not only access the information about a given user that has added the application. Applications by default get much of the information about that user's friends and network members that the user can see. So without any action from a user, an individual that has never joined any applications will have their information sent to the third party application when their friends or associates in their networks join.

default settings for sharing via the API
Default settings for what is shared to applications one has never added, including photos, relationships and other history.

Facebook disclaims all risk from how the application uses the data, and in its terms states that users release and hold harmless Facebook for any damages from installing or using applications. Facebook also says that it may change its policy at any time by changing the terms on its website. Users have no enforcement other than to remove the application.

Though Facebook disclaims its own risks, and states that users have no recourse, Facebook imposes some terms on how developers may use users' information:

  • You must treat users' privacy with the same respect we do. If you directly collect personally identifiable information from users, you must post a privacy policy detailing what you'll do with that info.
  • You must be honest and accurate about what your application does and how it uses information from Facebook users. Your application cannot falsely represent itself.
  • You can only show information from Facebook Platform to a user if you retrieved it on behalf of that particular user.
  • You can only cache user information for up to 24 hours to assist with performance. The only exceptions are those listed in the Facebook Platform Documentation.

Values that can be stored indefinitely include User ID; Primary network ID; Event ID; Group ID; Photo ID; Photo album ID; Total number of notes written by the user; and Time that the user's profile was last updated. Any information that the application develops or collects on its own can be forever kept and associated with the above information. For example, the blackjack application above may generate a win/loss record for a user. The application is permitted to indefinitely store the User ID and associate that with that user's performance in blackjack.

Public Search Listing

In September of 2007, Facebook introduced public search listings. Previously, only Facebook members could search Facebook for other users. Now, non-members will be able to search. Further, major search engines such as yahoo and Goggle will index the public search listings. The listing shows a limited amount of information such as name, profile picture, and Friends.

public search
Example of a public search listing, provided by Facebook.

This change exposes Facebook members to the general Internet. The information was exposed without the explicit permission of Facebook users. The change was announced via the Facebook blog, and users were given about 30 days to opt-out before the information reached major search engines.

Social Ads and Pages

Facebook's Social Ads and pages launched in November of 2007. Pages permit advertisers and businesses to have a presence on Facebook similar to Facebook users. Advertisers can create fan clubs, videos, and other interactions with users. When users interact with an advertiser page, this generates a message to that user's feed, alerting that user's friends to this interaction. Facebook describes this as similar to "word of mouth" advertising, except that Facebook is creating the words and publishing the information based on a user's lone interaction with the page.

Facebook's social ads launch when users interact with a page. The social ad includes the interaction with the page, plus text provided by the advertiser, and the user's name and profile picture. This entire message is displayed in the feed of the user's friends. The ads can also demographically targeted, aiming at users of a certain location, age or sex, or many of the other demographic criteria that users have submitted in their profile.

social ad
Example of a Social ad. After the user rates a movie, that user's friends are shown the rating, the movie,
the user's name and picture, and are invited to join the advertiser's service. Image from Facebook

Social ads potentially violate the privacy tort of appropriation of name and likeness. Generally, the tort is described in the Restatement of Torts § 652C Appropriation of Name or Likeness:

One who appropriates to his own use or benefit the name or likeness of another is subject to liability to the other for invasion of his privacy.
Comments:
a. The interest protected by the rule stated in this Section is the interest of the individual in the exclusive use of his own identity, in so far as it is represented by his name or likeness, and in so far as the use may be of benefit to him or to others. Although the protection of his personal feelings against mental distress is an important factor leading to a recognition of the rule, the right created by it is in the nature of a property right, for the exercise of which an exclusive license may be given to a third person, which will entitle the licensee to maintain an action to protect it.

b. How invaded. The common form of invasion of privacy under the rule here stated is the appropriation and use of the plaintiff's name or likeness to advertise the defendant's business or product, or for some similar commercial purpose. Apart from statute, however, the rule stated is not limited to commercial appropriation. It applies also when the defendant makes use of the plaintiff's name or likeness for his own purposes and benefit, even though the use is not a commercial one, and even though the benefit sought to be obtained is not a pecuniary one. Statutes in some states have, however, limited the liability to commercial uses of the name or likeness.

Another applicable legal principle is the Right of Publicity, from the Third Restatement on Unfair Competition § 46:

One who appropriates the commercial value of a person's identity by using without consent the person's name, likeness, or other indicia of identity for purposes of trade is subject to liability. . . .

The actual application of the tort will vary from state to state, in some cases being a part of the common law, and in some cases part of statute. For example California Civil Code § 3344(a) states:

Any person who knowingly uses another's name, voice, signature, photograph, or likeness, in any manner, on or in products, merchandise, or goods, or for purposes of advertising or selling, or soliciting purchases of, products, merchandise, goods or services, without such person's prior consent, or, in the case of a minor, the prior consent of his parent or legal guardian, shall be liable for any damages sustained by the person or persons injured as a result thereof. In addition, in any action brought under this section, the person who violated the section shall be liable to the injured party or parties in an amount equal to the greater of seven hundred fifty dollars ($750) or the actual damages suffered by him or her as a result of the unauthorized use, and any profits from the unauthorized use that are attributable to the use and are not taken into account in computing the actual damages. In establishing such profits, the injured party or parties are required to present proof only of the gross revenue attributable to such use, and the person who violated this section is required to prove his or her deductible expenses. Punitive damages may also be awarded to the injured party or parties. The prevailing party in any action under this section shall also be entitled to attorney's fees and costs

The law requires prior consent, has a minimum damage of $750, allows the injured person to capture the profits of the violation, and provides for attorney's fees to the winner.

Beacon Advertisements

Facebook's Beacon advertising system was also launched in November of 2007. Beacon is similar to social ads in that it broadcasts a user's interaction with an advertiser to the feeds of that user's friends. However, Beacon is broadcasting information from third party websites such as Overstock.com, or Ebay. Facebook promises advertisers that all they need to do is "[a]dd 3 lines of code and reach millions of users." The advertisers determine which user actions on their website -- such as adding a movie to queue, or purchasing an item, or signing up for the site -- will generate feed messages.

As originally designed, users were given a brief time-limited alert which gave them the ability to opt-out of each message. As launched, the application did not permit a global opt out and did not require an affirmative opt-in before each message was broadcast.

toast
An example of the "toast" pop up that Facebook provides.
To opt out, a user must click on "No thanks" before the pop-up disappears. Image from RadiantCore.

Following protests, Facebook added two user controls to Beacon. First, users would be asked to affirmatively opt-in before a new site sent messages to their friends. Once they approved one message from that site, no further opt-ins were required. Secondly, CEO Mark Zuckerbereg announced that Facebook will allow users to globally opt-out of Beacon, preventing all message publication.

A security researcher published an examination of Beacon's data flow, "Facebook's Misrepresentation of Beacon's Threat to Privacy: Tracking users who opt out or are not logged in." The analysis shows that the Beacon system transmits information from all users of the third party site to Facebook, whether they are Facebook members, members who have opted out of Beacon ads, or never have been Facebook members. Facebook represents that it deletes the data if it cannot associate it with a Facebook member.

Resources On Facebook Privacy

Articles and Commentary on Facebook Privacy

Previous News

  • Facebook's Data Grab: New Policies Transfer Control of User Data to Facebook: Facebook announced significant changes at F8 this week that will integrate Facebook with many web sites, but also make it more difficult for Facebook users to limit the disclosure of personal information. The announcement follows recent changes to Facebook privacy settings and privacy policies. "Instant personalization" will give Facebook's business partners access to users' likes, interests, friends, and other details, unless users opt-out. Facebook has also removed a key privacy safeguard and will allow third parties to store user data indefinitely. EPIC has a complaint pending at the FTC concerning recent changes to Facebook's privacy settings. For more information, see EPIC: Facebook Privacy and EPIC's Previous FTC Complaint regarding Facebook, EPIC: In re Facebook. (Apr. 22, 2010)
  • Facebook Announces Changes to Privacy Policy. Again.: Faceboook has announced "another set of revisions" to its privacy policy. The changes appear to make it easier for Facebook to gather locational data on users and to disclose user data to third-party web sites. It also appears that Facebook will make more use of data set to "Everyone." Facebook is soliciting comments on the changes. In December, EPIC filed a complaint with the FTC regarding the last series of changes to the Facebook privacy settings. EPIC, joined by nine other privacy and consumer organizations, said that the "changes violate user expectations, diminish user privacy, and contradict Facebook’s own representations." The FTC responded that the EPIC complaint "raises issues of paricular interest" to the Commission. For more information on the ever-changing Facebook privacy policy, see EPIC Facebook Privacy and EPIC In re Facebook. (Mar. 26, 2010)
  • EPIC Recommends Effective Consumer Privacy Standards, Calls Notice and Choice a "Failed Experiment": At the third FTC Privacy Roundtable, EPIC senior counsel John Verdi will recommend that the Commission push forward with effective and meaningful privacy safeguards for American consumers. Mr. Verdi will say that the "notice and choice" approach has failed, and will recommend that the FTC enforce Fair Information Practices, such as the OECD Privacy Guidelines. The discussion can be viewed via webcast. Additional information on the FTC roundtable event can be found here. For more information, see EPIC In re Google Buzz, EPIC In re Facebook, and EPIC In re Google and Cloud Computing. (Mar. 17, 2010)
  • Judge Waits to Decide on Proposed Settlement in Facebook Privacy Case: Following a hearing last week, U.S. District Court Judge Seeborg reserved decision about the approval of Facebook’s proposed 9.5 million dollar settlement in a case involving Facebook Beacon. According to the settlement terms, Facebook would contribute about $6 million to the establishment of a privacy organization. Facebook, however, would maintain control over this organization, as Facebook's top lobbyist would become co-President and all significant decisions would require a unanimous vote. EPIC and several other privacy organizations, including the Consumer Federation of America and the Privacy Rights Clearinghouse, have written a letter to Judge Seeborg, ask him to reject the settlement as proposed. For more information, see EPIC: Facebook Privacy. (Mar. 1, 2010)
  • Study Ranks Top 20 Companies for Privacy in 2010, Facebook Drops Off List: Ponemon Institute released its annual study identifying the top twenty companies that are most trusted for privacy. American Express was ranked first, earning the Most Trusted for Privacy distinction for the fifth year in a row. Facebook suffered several privacy missteps over the last year, including a recent change in privacy settings at the end of 2009, and as a result, failed to make the 2010 list. Google, however, returned to the Top 20, ranked at 13. The survey also produced significant findings regarding consumer attitudes towards privacy, including the finding that consumers feel they are losing control over their personal information. Further, the responses revealed that consumers’ fear of identity theft is the main factor for brand trust diminishment, while a company’s implementation of privacy features contribute to brand trust. Other significant positive factors were limits on the collection of personal information and online anonymity. (Feb. 26, 2010)
  • Facebook Users Object to Beacon Settlement: Facebook users filed papers in federal court objecting to a proposed deal that would extinguish the company's liability for disclosing personal information in violation of federal law. Users criticized the class action settlement, stating "the class receives no meaningful relief." Other objectors alleged "in effect, Facebook is paying itself the benefit but class members are releasing their individual privacy claims." EPIC previously submitted a letter to the judge hearing the case. EPIC's letter opposes the settlement and proposes alternatives that would enable stronger privacy safeguards for Facebook users in the future. For more information, see EPIC Facebook Privacy, EPIC Harris v. Blockbuster. (Feb. 2, 2010)
  • EPIC Urges FTC to Protect Users' Privacy On Cloud Computing and Social Networking Services: EPIC submitted comments to the FTC prior to the agency’s second privacy roundtable. EPIC warned of the ongoing privacy risks associated with cloud computing and social networking privacy, highlighting the Google cloud computing complaint and Facebook privacy complaint filed by EPIC in 2009. The comments note that the FTC has failed to take any meaningful action with respect to either complaint, demonstrating the Commission's “lack of leadership and technical expertise.” EPIC's comments also draw attention to the success of international privacy initiatives, in hopes of encouraging the FTC to take meaningful action to protect American consumers. For more information, see EPIC: Cloud Computing and EPIC: Social Networking Privacy. (Jan. 28, 2010)
  • EPIC, Privacy Groups Oppose Facebook Settlement: EPIC and other privacy groups sent a letter to the federal judge overseeing a class-action settlement against Facebook in California, opposing the settlement as unfair and unreasonable. As proposed, the settlement does not provide any benefit for Facebook users whose private data was illegally exposed by Facebook "Beacon." Instead, the deal would create a new "privacy foundation" subject to Facebook's influence. Fair settlements typically provide compensation to class members or a remedy that addresses the underlying harm, which in this case was a violation of federal privacy law. The letter from EPIC proposes alternatives that would enable stronger privacy safeguards for Facebook users in the future. For more information, see EPIC Facebook Privacy, EPIC Harris v. Blockbuster. (Jan. 19, 2010)
  • EPIC’s Facebook Complaint of "particular interest" to FTC: The FTC has sent a letter to EPIC regarding the December 2009 complaint, submitted by privacy organizations, about Facebook’s recent changes to user privacy settings. In the letter, the Bureau of Consumer Protection Director states that the complaint “raises issues of particular interest” for the FTC. Further, Vladeck stresses the importance of providing “transparency about how this data is being handled, maintained, shared, and protected . . . .” The Commission, however, cannot confirm or deny whether an investigation has been launched. The letter came one day before EPIC filed a supplemental complaint regarding Facebook’s privacy practices. For more information, see EPIC: In re Facebook. (Jan. 19, 2010)
  • Canadian Privacy Commission to Investigate Facebook: Canada’s Privacy Commissioner Jennifer Stoddart has launched an investigation into the information collection and use practices of online social networking sites. This investigation is being conducted as the Parliament prepares to review the Personal Information Protection and Electronic Documents Act. Stoddart plans to examine “issues that we feel pose a serious challenge to the privacy of consumers, now and in the near future,” and to foster discussions about "the impact of these technological developments on privacy." This is not the first time the Commissioner has investigated the information practices of Facebook. In August 2009, Facebook made several changes to its privacy policy, following recommendations by the Commissioner and a complaint filed by the Canadian Internet Policy and Public Interest Clinic. For more information, see EPIC: Facebook Privacy and EPIC: Social Networking Privacy. (Jan. 19, 2010)
  • Privacy Groups File Amended Complaint regarding Facebook: EPIC and several other groups filed a supplement to the groups' original complaint with the Federal Trade Commission concerning Facebook’s recent privacy changes. The new complaint provides additional evidence of Facebook’s unfair and deceptive trade practices relating to Facebook CEO's public statements, the most recent version of the Facebook for iPhone application, Facebook Connect, and "web-suicide" applications. The complaint also offers numerous examples of media stories and blog posts in support of an investigation by the Federal Trade Commission into Facebook’s unfair and deceptive trade practices. For more information, see EPIC: In re Facebook. (Jan. 14, 2010)
  • EPIC Defends Privacy of Facebook Users: Files Complaint with the Federal Trade Commission: EPIC has filed a complaint with the Federal Trade Commission, urging the FTC to open an investigation into Facebook’s revised privacy settings. The EPIC complaint, signed by nine other privacy and consumer organizations, states that the  "changes violate user expectations, diminish user privacy, and contradict Facebook’s own representations." EPIC cites widespread opposition from Facebook users, security experts, bloggers, and news organizations. A previous EPIC complaint to the FTC, concerning the data broker industry, produced the largest settlement in the FTC's history.  For more information, see EPIC: In re Facebook, Frequently Asked Questions Regarding EPIC's Facebook Complaint, and EPIC Facebook Privacy. EPIC PRESS RELEASE. (Dec. 17, 2009)
  • Facebook Asks Users to Review Privacy Settings, Recommends Privacy Options, Questions Remain: Facebook is asking users to review and update their privacy settings. However, the privacy recommendations, suggested by Facebook, may result in greater disclosure than users intend. Facebook faces ongoing privacy scrutiny following Beacon, proposed changes to the Terms of Services, and a settlement now pending in California. EPIC has urged Facebook to respect user privacy settings. EPIC is also defending the privacy rights of Facebook users who participated in Beacon. For more information, see EPIC: Facebook Privacy. (Dec. 9, 2009)
  • Facebook to Drop Regional Networks, Change Privacy Settings: Facebook announced that it intends to eliminate regional networks, which allow users to restrict information shared with others based geography. The social networking service will also modify the site's privacy settings and require users to update the rules governing who can access their data. In February, revisions to Facebook's terms of service prompted users to revolt and Facebook to rescind the changes hours before EPIC planned to file a complaint with the Federal Trade Commission. Prior changes to the service resulted in disclosure of Facebook users' video rental records without their permission, prompting federal lawsuits. For more, see EPIC Facebook Privacy and Social Networking Privacy (Dec. 4, 2009)
  • EPIC Urges Court to Enforce Video Privacy Law: Today, EPIC filed a friend of the court brief with the Fifth Circuit Court of Appeals, urging the Court to enforce federal privacy protections for Facebook users who rented videos from Blockbuster, a Facebook business partner. The Video Privacy Protection Act prohibits companies from revealing consumers' video rental histories. EPIC wrote, "Congress established a private right of action to ensure that there would be a meaningful remedy when companies failed to safeguard the data they collected" and warned, "absent a private right of action, there would be no effective enforcement, no remedy for violations, and no way to ensure that companies complied with the intent of the Act." The lawsuit was filed by Cathryn Harris and other Facebook users after Blockbuster made public their private video rental information. Blockbuster, a participant in Facebook's Beacon program, claimed that consumers cannot sue the company and must submit to mandatory arbitration. EPIC's brief, which includes a detailed history of the video privacy law, urges the appeals court to uphold a lower court ruling, which held that the plaintiffs are allowed to pursue their claim that a federal law was violated. For more information, see EPIC Harris v. Blockbuster, EPIC The Video Privacy Protection Act, and EPIC Facebook Privacy. (Nov. 4, 2009)
  • Facebook Updates Privacy Policy in Response to Canadian Privacy Investigation: Facebook released a revised privacy policy. The updated policy provides a more concise description of the privacy practices of the developers of third-party applications. Facebook also announced that it will evaluate the collection of user data by application developers. According to a blog post, the revised policy is a response to a complaint filed by Canadian Internet Policy and Public Interest Clinic in 2008, and attempts to “[fulfill] our commitment to the Privacy Commissioner of Canada to update our privacy policy to better describe a number of practices.” Concerns remain about the use of Facebook users' data. For more information, see EPIC Facebook Privacy. (Oct. 30, 2009)
  • Facebook to End Beacon, Establish Privacy Foundation: Facebook has entered into a proposed agreement to end Beacon, the controversial advertising technique that broadcast user purchases in their public profile. EPIC and other privacy advocates objected to Beacon’s privacy implications and successfully persuaded Facebook to adopt opt-in for the service. Under the terms of a class-action lawsuit in California, Facebook will now terminate Beacon and contribute $9.5 million towards the creation of a foundation dedicated to protecting online privacy. A class-action lawsuit concerning Beacon is also pending in Texas. For more information, see EPIC Facebook Privacy and EPIC Testimony on the "Impact and Policy Implications of Spyware on Consumers and Businesses." (Sep. 22, 2009)
  • Following Canadian Investigation, Facebook Upgrades Privacy: The Canadian Privacy Commissioner issued a report last month raising concerns over Facebook business practices. The Office asked the social networking firm to cease the sharing of user information with application developers, clarify the policy on deactivation and deletion of accounts, protect the personal information of non-users, and "memorialize" the account of deceased users. In complying with the Commissioner's report, Facebook will include new notifications, update its Privacy Policy, and implement technical changes to enable more user control over information accessed by third-party applications. EPIC had previously raised similar concerns about the use of Facebook data by application developers. See also EPIC Facebook and EPIC Social Network Privacy. (Aug. 28, 2009)
  • Canadian Privacy Commissioner's Deadline for Facebook Arrives, Some Changes are Made at the Social Network Company: In mid-July, the Canadian Privacy Commissioner released a report recommending several changes to Facebook's business practices. The Commissioner's Office advised the social networking firm to limit application developers' access to user information, and inform users specifically about the nature and use of shared information. The Office also said that deactivated account information should be deleted, and that the privacy policy be amended to include all intended uses of personal information. Facebook was given 30 days. Facebook updated its privacy policy last week and has asked application developers to respect user privacy settings. See also EPIC Facebook and EPIC Social Network Privacy. (Aug. 17, 2009)
  • EPIC Forces Disclosure of Government Contracts with Social Media Companies, Privacy Terms Missing: In response to an EPIC Freedom of Information Act Request, the Government Services Administration released several contracts between the federal government and web 2.0 companies, including agreements with Blip.tv, Blist, Google (YouTube), Yahoo (Flickr), and MySpace. EPIC also obtained amendments to agreements with Facebook, Slideshare.net, Vimeo.com, and AddThis.com. The contracts do not address the privacy obligations of social media companies. The GSA letter to EPIC explained that “no specific Web 2.0 guidance currently exists,” but provided EPIC with Training Slides that raise privacy issues. The GSA Agreement with Google actually states that, “to the extent any rules or guidelines exist prohibiting the use of persistent cookies in connection with Provider Content applies to Google, Provider expressly waives those rules or guidelines as they may apply to Google.” Some of the agreements also permit companies to track users of government web sites for advertising purposes. For more information see EPIC Social Network Privacy, EPIC Facebook, and EPIC Cloud Computing. (Aug. 12, 2009)
  • Canadian Privacy Commissioner Holds that Facebook Must Strengthen Privacy Safeguards: The Office of the Privacy Commissioner of Canada today released a Report of Findings into the Complaint Filed by the Canadian Internet Policy and Public Interest Clinic against Facebook Inc. The complaint, filed under the Personal Information Protection and Electronic Documents Act, contained twenty-four allegations concerning a range of Facebook business practices, including Default Privacy Settings, Advertising, and Third-Party Applications. The Commissioner found that Facebook has taken some steps to address privacy, but that more safeguards are necessary. Facebook has 30 days to respond. See EPIC Facebook Privacy and EPIC Social Networking Privacy. (Jul. 16, 2009)
  • Facebook to Change User Privacy Settings: Facebook announced planned changes to user privacy controls today. Chris Kelly, Facebook's Chief Privacy Officer, stated that the new policy will promote "control, simplicity and connection" for user data. The announcement states there will be no changes in term of "the information Facebook provides to advertisers" but does not address concerns about the information provided by Facebook to app developers. In June, European Privacy Commissioners warned about the secondary use of personal data collected by social network services. The officials issued an opinion requiring robust security, privacy-friendly default settings, and the application of European privacy law. In April, EPIC supported the adoption of the new Facebook Terms of Service when Facebook said that "users own and control their information." See EPIC Social Networking Privacy. (Jul. 1, 2009)
  • EPIC Seeks Government Agreements with Social Networking Companies: EPIC submitted a Freedom of Information Act request to the Government Services Administration seeking agency records concerning agreements the GSA negotiated between federal agencies and social networking services, including Flickr, YouTube, Vimeo, Blip.tv, and Facebook. In the FOIA request, EPIC is asking for the public release of the contracts and any legal opinions concerning the application of the Privacy Act of 1974 and Freedom of Information Act to the services that collect information on citizens. For more information see EPIC’s pages Social Networking, Facebook, and Cloud Computing. (Apr. 30, 2009)
  • Facebook Gets Ready to Adopt Terms of Service: Facebook has announced the results of the vote on site governance. The initial outcome indicates that approximately 75 percent of users voted for the new terms of service which includes the new Facebook Principles and Statement of Rights and Responsibilities. Under the new Principles, Facebook users will "own and control their information." Facebook also took steps to improve account deletion, to limit sublicenses, and to reduce data exchanges with application developers. EPIC supports the adoption of the new terms. For more information, see EPIC's page on Social Networking Privacy. (Apr. 24, 2009)
  • Facebook Seeks Vote on Site Governance: In February, Facebook announced that it was opening its site governance to user voting after the new Terms of Service were widely criticized, and were to be the subject of an EPIC complaint to the Federal Trade Commission. Facebook restored the old terms and sought user feedback on the new Facebook Principles and the Statement of Rights and Responsibilities. These governing documents have now been updated to reflect feedback from users and experts. The voting to adopt the new terms or to maintain the previous terms is now open till April 23, 11:59 a.m. PDT. For more, see the efforts of People Against the New Terms of Service, and EPIC's Social Networking Privacy page. (Apr. 20, 2009)
  • Facebook Announces Governing Principles, Statement of Rights and Responsibilities: Today, Facebook proposed guidelines and a statement of rights and responsibilities governing its relationship with users. The social networking service called for user comment on the principles, which include "Ownership and Control of Information" and "Transparent Process." Facebook further committed to "open up Facebook so that users can participate meaningfully in our policies and our future." Facebook's announcement follows last week's abandonment of changes to its Terms of Service on the eve of an EPIC complaint to federal regulators. For more and see the efforts of People Against the New Terms of Service, and EPIC's "Social Networking Privacy" page. (Feb. 26, 2009)
  • On Eve of EPIC Trade Commission Complaint, Facebook Backs Down on Revised Terms of Service: Hours before EPIC planned to file a complaint with the Federal Trade Commission regarding changes to Facebook's Terms of Service, the social network service announced that it will restore the original policy. The new Terms of Service were announced on Feb. 4, were widely criticized, and were to be the subject of the EPIC complaint. Facebook users observed that, under the revised policies, Facebook asserted broad, permanent, and retroactive rights to users' personal information - even after they deleted their accounts. The EPIC complaint was supported by more than a dozen consumer and privacy organizations. Previous EPIC Complaints at the FTC have concerned Choicepoint, Microsoft Passport, and the Google-Doubleclick merger. For more, see EPIC's "Social Networking Privacy" page. Support EPIC's efforts to maintain your privacy in the social networking world. (Feb. 18, 2009)
  • Facebook Responds to Users' Demands. In response to the negative reactions of so many of its users, Facebook put new privacy controls on the News Feed feature into operation. Mark Zuckerberg, the CEO of Facebook, published an open letter on the Web site on September 8th apologizing for not having consulted with users prior to introducing feature, which notified users of all their contacts' activities, such as profile changes from "in a relationship" to "single." However, the change is simply an opt-out and puts the burden on Facebook users to protect their privacy. Over 700,000 users signed an online petition demanding the company discontinue the feature, stating that this compromised their privacy. (Sept. 25, 2006).
  • Outcry Over New Facebook Feature. When social networking Web site Facebook introduced their new News Feed feature on September 5, the company was accused of invading the privacy of its users and facilitating stalking. The goal of the new feature was to make it easier for users to keep up to date with the latest happenings in the lives of their online friends. However, user upset at its introduction sparked debate over how much control users expect to have over the information they place on these Web sites, and also whether the means of dissemination of this information matters. (Sept. 5, 2006).