Electronic Privacy Information Center  

Facebook Privacy

Latest News | Introduction | Facebook Features | Resources | Articles | Previous News

 

Latest News/Events

Introduction

Facebook was started by Mark Zuckerberg as a social networking site for Harvard undergraduates in 2004. Facebook then expanded to other colleges and universities. For a period of time, users required an "edu" email address to join. Users would join a "network" with its own subdomain (for example, the University of Pennsylvania is at upenn.facebook.com) that related to their university affiliation.

The concept of a network is important for the privacy experience of a facebook user because one can usually set their privacy controls to allow access to anyone, to their friends, or to members of their networks. On February of 2006, Facebook began allowing high school students and members of some large companies to join, still all in their respective networks. In September of 2006, Facebook began to allow anyone to join by associating themselves with a network for an employer or a geographic location such as city.

In October of 2007 Microsoft purchased a 1.6 percent stake in Facebook for 240 million dollars. That deal valued Facebook at 15 billion dollars. Facebook provides a website with current statistical snapshot of its user base. In December of 2007, Facebook had 58 million users. At the 15 billion value, this means 258 dollars per user.

Significant Facebook Features and Policies

Facebook has several features with a significant impact on privacy and security of personal information. These features raise issues of data collection, retention, distribution and control. The various privacy issues raised may in some cases have legal consequences.

Account Creation

Facebook does not permit the privacy enhancing techniques of pseudonymous logins or the creation of multiple profiles. Facebook's terms require users to provide "accurate, current and complete" information when registering for the site. This means that a user must provide accurate information for their name, date of birth, and school and work affiliation. Facebook's terms require users to agree not to "register for more than one User account, register for a User account on behalf of an individual other than yourself," or "falsely state or otherwise misrepresent yourself, your age or your affiliation with any person or entity." Users are thus forbidden from having several profiles for different social circles, such as for friends, professional colleagues, teachers and family. Users must have a single identity across all those social interactions. Since they must accurately give Facebook their name and date of birth, this single identity is required to be tied to their real life identity.

Account Deletion

Facebook offers no way to conveniently delete one's account once one has created a profile. Facebook does offer that an account can be "deactivated." Once deactivated, Facebook says that a deactivated account cannot be seen or found by others:

Deactivation will completely remove your profile and all associated content on your account from Facebook. In addition, users will not be able to search for you or view any of your information. If you reactivate your account, your profile will be restored in its entirety (friends, photos, interests, etc.).

Reactivating an account is done by logging in again with the same username and password. This means that all of the information that the user has uploaded is retained by Facebook. Facebook does permit users to delete items such as wall posts, photos, friends and profile information. This has to be done via Facebook's interface, and must be done one item at a time.

Facebook reserves the right to delete your account. According to their terms, Facebook "may terminate your membership, delete your profile and any content or information that you have posted on the Site or through any Platform Application . . . for any reason, or no reason, at any time in its sole discretion, with or without notice . . . ."

Tagging

Facebook users can add metadata tags to photographs. These tags can be identified to particular areas of the photograph. So a picture of a family in front of a landmark can have the individual faces of family members tagged with their names, and the landmark tagged with its name.  When the image is displayed, the tags become hyperlinks to the profile of the subject of the tag. If the subject of the tag is not a Facebook member, then the tag remains in plain text, not linking to anything. When photos of a person are displayed, this display includes their own photographs and those published by others and tagged with that person's name.  When a user views an image that has been tagged with that user's name by another, the user has the option of removing the tag. A user is given a brief notice when others tag images with that user's name.

Contact Importer

Facebook users are invited by Facebook to "[f]ind out which of your email contacts are on Facebook." Facebook asks users for their email address and password for many of the major providers of webmail services (Yahoo, Hotmail, Gmail, etc...). Facebook then logs on to the account, and downloads all the contacts there. Facebook can also import email contacts from applications such as Outlook and Thunderbird. Users are then shown a list of which individuals are current Facebook members, and have the choice of sending friend requests to each of them. The screen comes with all the contacts pre-selected. The user is then given the option of inviting all of their other contacts to join Facebook. Again, all of the contacts are pre-selected. The default behavior is to send messages to all of one's contacts inviting them to become friends on Facebook.

Contact importer example.
Example of the contact importer.

Facebook promises not to retain the user's password and login. Facebook does not explain what happens to the emails collected, or to the association of those emails as "contacts" of a given user. The email addresses can be of significant value. As known contacts of a real person, a person knows that that email address is "live" and thus valuable to email harvesters.

Feed

Facebook users see a news feed when they log into their accounts. The news feed contains items about a Facebook user's friends as well as some advertisements. Some of a user's personal information is published to their friends' news feeds.

feed example
A newsfeed example, provided by Facebook.

The feed was introduced in September 2006.  When first introduced users had no control over what information was published to the Feed. Facebook users protested the privacy invasion, demanding control over their data. Facebook users were responding to the broadcast of their data, to Facebook making it more easily available. Seven hundred thousand users joined a group protesting the feed. Facebook users also created a petition to Facebook Administrators:

Whereas Facebook.com is a social networking Web site and utility owned as a private company started in February 2004 by Mark Zuckerberg;

Whereas Facebook.com is a useful and entertaining tool for those on its networks;

Whereas the users on Facebook.com support the site’s stated philosophy of helping people spread information through social networks;

Whereas the users on Facebook.com understand the privacy settings and their role in protecting personal, private information;

Whereas drastic changes were make to Facebook.com on September 5, 2006, including the introduction of the “News Feed” and “Mini Feed” that call into question the safety and privacy of its more than 9 million users;

Whereas there has been an unprecedented outpouring of opposition to the changes within the community;

Whereas many users feel uncomfortable participating on Facebook.com because of the changes to the point that some have deactivated their accounts;

We, the Facebook.com user community:

--Encourage Facebook.com administrators to actively communicate and consult with users in a democratic dialogue concerning any current and future changes.

AND:

--Demand the immediate removal of the “news feed” and “mini feed” feature from Facebook.com.

OR:

--Allow an individual to remove himself or herself from the “news feed” and “mini feed” feature on other users’ page.
--Allow an individual to remove his or her own personal “news feed” and “mini feed” feature from his or her personal profile.

Facebook responded by creating some opt-outs for the feed, and its CEO Mark Zuckerberg apologized on the Facebook blog. As Facebook's Feed privacy page explains: "Stories are published when you edit your profile information, join a new network, or update your Status." A user can opt out of other information being published to their feed, such as changes in relationship status or the addition of a friend.

Other Facebook features also publish information via the news feed. Consequently, not all privacy controls related to feeds is controlled by the Feed section of the privacy page.  Applications, Social Ads, and Facebook Beacon all communicate via the News Feed. User control, if any, of those information flows is located in pages devoted to those features, not the feed.

Users can also influence what items of their friend's personal information are presented to them. They can select that stories about some friends get published more or less frequently. They can also select what types of stories they are interested in, such as relationship news, changes in profile data, or the addition of new friends. This will cause these events to show up on their feed more or less often.

Platform Application Programming Interface (API)

In May 2007, Facebook launched the Facebook Platform. The platform allows third parties to create applications which access Facebook's database. The applications are meant to function in much the same way that the Facebook created applications work. Applications can publish to a user's feed and can access that user's information. When a user adds an application, the information about other users that the given user can see is made available to these third party application providers. The third party application provider may retain some of this information forever, and some information may be retained for a limited time.

Since the applications are developed and hosted by third parties, their algorithms necessarily involve the flow of personal information from Facebook to the application host and developer. When installing an application users are asked briefly a few choices about the application, such as whether they want it to know who they are, take up space on their profile, or publish information to the user's feed. The choices are all pre-selected.

adding blackjack application
Example of the addition of the Blackjack application.

 

The information that the application accesses includes everything about a user and what they can see, except for their contact information such as email address, phone number and postal address. The terms the user is agreeing on by clicking "add" includes examples of this information:

Examples of Facebook Site Information. The Facebook Site Information may include, without limitation, the following information, to the extent visible on the Facebook Site: your name, your profile picture, your gender, your birthday, your hometown location (city/state/country), your current location (city/state/country), your political view, your activities, your interests, your musical preferences, television shows in which you are interested, movies in which you are interested, books in which you are interested, your favorite quotes, the text of your "About Me" section, your relationship status, your dating interests, your relationship interests, your summer plans, your Facebook user network affiliations, your education history, your work history, your course information, copies of photos in your Facebook Site photo albums, metadata associated with your Facebook Site photo albums (e.g., time of upload, album name, comments on your photos, etc.), the total number of messages sent and/or received by you, the total number of unread messages in your Facebook in-box, the total number of "pokes" you have sent and/or received, the total number of wall posts on your Wall(TM), a list of user IDs mapped to your Facebook friends, your social timeline, and events associated with your Facebook profile.

Significantly, applications do not only access the information about a given user that has added the application. Applications by default get much of the information about that user's friends and network members that the user can see. So without any action from a user, an individual that has never joined any applications will have their information sent to the third party application when their friends or associates in their networks join.

default settings for sharing via the API
Default settings for what is shared to applications one has never added, including photos, relationships and other history. 

Facebook disclaims all risk from how the application uses the data, and in its terms states that users release and hold harmless Facebook for any damages from installing or using applications. Facebook also says that it may change its policy at any time by changing the terms on its website. Users have no enforcement other than to remove the application.

Though Facebook disclaims its own risks, and states that users have no recourse, Facebook imposes some terms on how developers may use users' information:

Values that can be stored indefinitely include User ID; Primary network ID; Event ID; Group ID; Photo ID; Photo album ID; Total number of notes written by the user; and Time that the user's profile was last updated. Any information that the application develops or collects on its own can be forever kept and associated with the above information. For example, the blackjack application above may generate a win/loss record for a user. The application is permitted to indefinitely store the User ID and associate that with that user's performance in blackjack.

Public Search Listing

In September of 2007, Facebook introduced public search listings. Previously, only Facebook members could search Facebook for other users. Now, non-members will be able to search. Further, major search engines such as yahoo and Goggle will index the public search listings. The listing shows a limited amount of information such as name, profile picture, and Friends.


Example of a public search listing, provided by Facebook.

This change exposes Facebook members to the general Internet. The information was exposed without the explicit permission of Facebook users. The change was announced via the Facebook blog, and users were given about 30 days to opt-out before the information reached major search engines.

Social Ads and Pages

Facebook's Social Ads and pages launched in November of 2007. Pages permit advertisers and businesses to have a presence on Facebook similar to Facebook users. Advertisers can create fan clubs, videos, and other interactions with users. When users interact with an advertiser page, this generates a message to that user's feed, alerting that user's friends to this interaction. Facebook describes this as similar to "word of mouth" advertising, except that Facebook is creating the words and publishing the information based on a user's lone interaction with the page.

Facebook's social ads launch when users interact with a page. The social ad includes the interaction with the page, plus text provided by the advertiser, and the user's name and profile picture. This entire message is displayed in the feed of the user's friends. The ads can also demographically targeted, aiming at users of a certain location, age or sex, or many of the other demographic criteria that users have submitted in their profile.


Example of a Social ad. After the user rates a movie, that user's friends are shown the rating, the movie,
the user's name and picture, and are invited to join the advertiser's service. Image from Facebook

Social ads potentially violate the privacy tort of appropriation of name and likeness. Generally, the tort is described in the Restatement of Torts § 652C Appropriation of Name or Likeness:

One who appropriates to his own use or benefit the name or likeness of another is subject to liability to the other for invasion of his privacy.

Comments:
a. The interest protected by the rule stated in this Section is the interest of the individual in the exclusive use of his own identity, in so far as it is represented by his name or likeness, and in so far as the use may be of benefit to him or to others. Although the protection of his personal feelings against mental distress is an important factor leading to a recognition of the rule, the right created by it is in the nature of a property right, for the exercise of which an exclusive license may be given to a third person, which will entitle the licensee to maintain an action to protect it.

b. How invaded. The common form of invasion of privacy under the rule here stated is the appropriation and use of the plaintiff's name or likeness to advertise the defendant's business or product, or for some similar commercial purpose. Apart from statute, however, the rule stated is not limited to commercial appropriation. It applies also when the defendant makes use of the plaintiff's name or likeness for his own purposes and benefit, even though the use is not a commercial one, and even though the benefit sought to be obtained is not a pecuniary one. Statutes in some states have, however, limited the liability to commercial uses of the name or likeness.

Another applicable legal principle is the Right of Publicity, from the Third Restatement on Unfair Competition § 46:

One who appropriates the commercial value of a person's identity by using without consent the person's name, likeness, or other indicia of identity for purposes of trade is subject to liability. . . .

The actual application of the tort will vary from state to state, in some cases being a part of the common law, and in some cases part of statute. For example California Civil Code § 3344(a) states:

Any person who knowingly uses another's name, voice, signature, photograph, or likeness, in any manner, on or in products, merchandise, or goods, or for purposes of advertising or selling, or soliciting purchases of, products, merchandise, goods or services, without such person's prior consent, or, in the case of a minor, the prior consent of his parent or legal guardian, shall be liable for any damages sustained by the person or persons injured as a result thereof. In addition, in any action brought under this section, the person who violated the section shall be liable to the injured party or parties in an amount equal to the greater of seven hundred fifty dollars ($750) or the actual damages suffered by him or her as a result of the unauthorized use, and any profits from the unauthorized use that are attributable to the use and are not taken into account in computing the actual damages. In establishing such profits, the injured party or parties are required to present proof only of the gross revenue attributable to such use, and the person who violated this section is required to prove his or her deductible expenses. Punitive damages may also be awarded to the injured party or parties. The prevailing party in any action under this section shall also be entitled to attorney's fees and costs
The law requires prior consent, has a minimum damage of $750, allows the injured person to capture the profits of the violation, and provides for attorney's fees to the winner.

Beacon Advertisements

Facebook's Beacon advertising system was also launched in November of 2007. Beacon is similar to social ads in that it broadcasts a user's interaction with an advertiser to the feeds of that user's friends. However, Beacon is broadcasting information from third party websites such as Overstock.com, or Ebay. Facebook promises advertisers that all they need to do is "[a]dd 3 lines of code and reach millions of users." The advertisers determine which user actions on their website -- such as adding a movie to queue, or purchasing an item, or signing up for the site -- will generate feed messages.

As originally designed, users were given a brief time-limited alert which gave them the ability to opt-out of each message. As launched, the application did not permit a global opt out and did not require an affirmative opt-in before each message was broadcast.


An example of the "toast" pop up that Facebook provides.
To opt out, a user must click on "No thanks" before the pop-up disappears. Image from RadiantCore.

Following protests, Facebook added two user controls to Beacon. First, users would be asked to affirmatively opt-in before a new site sent messages to their friends. Once they approved one message from that site, no further opt-ins were required. Secondly, CEO Mark Zuckerbereg announced that Facebook will allow users to globally opt-out of Beacon, preventing all message publication.

A security researcher published an examination of Beacon's data flow, "Facebook's Misrepresentation of Beacon's Threat to Privacy: Tracking users who opt out or are not logged in." The analysis shows that the Beacon system transmits information from all users of the third party site to Facebook, whether they are Facebook members, members who have opted out of Beacon ads, or never have been Facebook members. Facebook represents that it deletes the data if it cannot associate it with a Facebook member.

 

Resources On Facebook Privacy

Articles and Commentary on Facebook Privacy

Previous News

 

EPIC Privacy Page | EPIC Home Page

Last Updated: July 23, 2008
Page URL: http://www.epic.org/privacy/facebook/default.html