Responding to Facebook on Privacy Controls

Last week after I wrote about Google’s new social networking service and the strength of its security model compared to its competitors’, Facebook’s Simon Axten responded:

Hi Gabriel, Thanks for your post. I work for Facebook and thought I’d drop in to make a few points. First, we don’t share information with advertisers, and we explain this clearly on our privacy “Learn More” page, which is accessible from any Facebook page: https://www.facebook.com/privacy/explanation.php. Instead, our ad system works by pairing a message with an audience, so, for example, a store in San Francisco that sells running gear can choose to show ads to people who have indicated on their profile that they live in San Francisco and are interested in running. The advertiser only ever receives anonymous data reports about who viewed and clicked on the ad, and people who meet the criteria will see the ad no matter what privacy settings they’ve selected for their information. In other words, a person who shares with friends only (or even with a single person) is just as likely to receive an ad as one who shares more broadly. Facebook also provides people with a couple easy ways to control their sharing on a per post basis. The first is the lock icon in the publisher (the box at the top of the profile where you post content), which, when clicked, allows you to choose an audience for your content at the time that you post it. The second is Groups, a product we launched in October of last year that allows you to build a space for important groups of people in your life and share only with those people. You can learn more about groups here: https://blog.facebook.com/blog.php?post=434700832130. Finally, I would direct you to this blog post about the experience of one Google + user, which indicates that Google’s policy on names is actually quite consistent with ours: http://nwn.blogs.com/nwn/2011/07/google-profiles-pseudonym-avatar-names-suspension-policy.html. Like Google, we require people to use their real name on their profile, but offer an alternate name field so they can include other names people might know them by. You can add an alternate name on Facebook by going to your account settings. Please don’t hesitate to contact us in the future if you have questions about our product or policies. You can do so at any time by emailing [email protected]. Thanks again.

Thanks to Mr. Axten for responding –an open conversation about privacy and free speech online is a first step toward making sure the internet will be a space where the rights of users come first. It’s encouraging that Facebook took the time to publicly consider these issues. In his response, Mr. Axten makes two claims about Facebook’s privacy policies. The first is that Facebook doesn’t sell information to advertisers; the second is that Facebook provides users with simple methods to control who views their content. Both could use some further examination. On his first point: although it’s true that Facebook doesn’t directly provide user information to third parties, it allows third parties to use this information for a fee. From Facebook’s advertising page, here’s a partial list of the kinds of information advertisers can use to target users: State/Province, Language, Age, Gender, Likes, Interests, Friend’s likes, Birthday, Relationship status, Employer. As Mr. Axten points out, even if the information isn’t shared with other users, it’s available to advertisers. The more information users upload, the more categories they fall into, and the higher the potential auction price for displaying ads to them.  An additional consequence of users uploading more information is to make it increasingly difficult for them to then control who might see that information. Mr. Axten’s claim that users can easily control who views their content is subject to dispute. The sharing settings are “Everyone,” “Friends of Friends”, and “Friends Only.”  Of these, “Friends of Friends,” which conjures an image of a small circle, is the most troubling. According to Facebook, the average user has 120 friends. A person with 120 friends who uses the “Friends of Friends” setting could share information with up to 14,000 people. A positive change that Facebook could make would be to enumerate that number when users select that choice and as they use the service.  Users who are comfortable with “Friends of Friends” might think a second time if it was followed by the five digit number of individuals those words represented. As detailed in the New York Times, Wall Street Journal, and Congressional Privacy Caucus setting privacy options is a complex process and one that needs to be constantly revisited as Facebook changes their policies. All told, to secure an account a user needs to move through 10 separate screens— not exactly the simplest design choice. Mr. Axten’s final point, that there’s no difference between Facebook’s “real-name” policy and Google’s, is correct. They’re equally unfriendly to activists, where using their real name can subject them to government harassment and persecution. I noted Google’s policy of allowing people to use a name “that you commonly go by in daily life” as their primary identifier, a policy that seemed to allow the use of pseudonyms, which human rights activists often need to use to protect themselves from persecution. As it turns out, however, Google will, like Facebook, require users to provide their real names. In this case, my praise of Google was premature. In any case, users will be better served when companies strive expand protections for privacy and put options under their control in simple easy-to-understand terms. Social media have proven to be important tools for human rights activists in countries with repressive governments. And repressive governments, in turn, are using social media to try to target activists. Policies and design choices have to take into account this dynamic and companies need to build Freedom of Expression and Privacy into their products from the earliest design stages. Neutrality isn’t an option.