Human Rights First Human Rights First

Responding to Facebook on Privacy Controls

7-20-2011

By Gabriel Nichols
for Business and Human Rights Initiative

Last week after I wrote about Google’s new social networking service and the strength of its security model compared to its competitors’, Facebook’s Simon Axten responded:

Hi Gabriel,

Thanks for your post. I work for Facebook and thought I’d drop in to make a few points. First, we don’t share information with advertisers, and we explain this clearly on our privacy “Learn More” page, which is accessible from any Facebook page:https://www.facebook.com/privacy/explanation.php. Instead, our ad system works by pairing a message with an audience, so, for example, a store in San Francisco that sells running gear can choose to show ads to people who have indicated on their profile that they live in San Francisco and are interested in running. The advertiser only ever receives anonymous data reports about who viewed and clicked on the ad, and people who meet the criteria will see the ad no matter what privacy settings they’ve selected for their information. In other words, a person who shares with friends only (or even with a single person) is just as likely to receive an ad as one who shares more broadly.

Facebook also provides people with a couple easy ways to control their sharing on a per post basis. The first is the lock icon in the publisher (the box at the top of the profile where you post content), which, when clicked, allows you to choose an audience for your content at the time that you post it. The second is Groups, a product we launched in October of last year that allows you to build a space for important groups of people in your life and share only with those people. You can learn more about groups here:https://blog.facebook.com/blog.php?post=434700832130.

Finally, I would direct you to this blog post about the experience of one Google + user, which indicates that Google’s policy on names is actually quite consistent with ours:http://nwn.blogs.com/nwn/2011/07/google-profiles-pseudonym-avatar-names-suspension-policy.html. Like Google, we require people to use their real name on their profile, but offer an alternate name field so they can include other names people might know them by. You can add an alternate name on Facebook by going to your account settings.

Please don’t hesitate to contact us in the future if you have questions about our product or policies. You can do so at any time by emailing press@fb.com. Thanks again.

Thanks to Mr. Axten for responding –an open conversation about privacy and free speech online is a first step toward making sure the internet will be a space where the rights of users come first.  It’s encouraging that Facebook took the time to publicly consider these issues.  In his response, Mr. Axten makes two claims about Facebook’s privacy policies. The first is that Facebook doesn’t sell information to advertisers; the second is that Facebook provides users with simple methods to control who views their content.  Both could use some further examination.

On his first point: although it’s true that Facebook doesn’t directly provide user information to third parties, it allows third parties to use this information for a fee.  From Facebook’s advertising page, here’s a partial list of the kinds of information advertisers can use to target users: State/Province, Language, Age, Gender, Likes, Interests, Friend’s likes, Birthday, Relationship status, Employer. As Mr. Axten points out, even if the information isn’t shared with other users, it’s available to advertisers.  The more information users upload, the more categories they fall into, and the higher the potential auction price for displaying ads to them.  An additional consequence of users uploading more information is to make it increasingly difficult for them to then control who might see that information.

Mr. Axten’s claim that users can easily control who views their content is subject to dispute. The sharing settings are “Everyone,” “Friends of Friends”, and “Friends Only.”  Of these, “Friends of Friends,” which conjures an image of a small circle, is the most troubling.  According to Facebook, the average user has 120 friends. A person with 120 friends who uses the “Friends of Friends” setting could share information with up to 14,000 people.  A positive change that Facebook could make would be to enumerate that number when users select that choice and as they use the service.  Users who are comfortable with “Friends of Friends” might think a second time if it was followed by the five digit number of individuals those words represented.  As detailed in the New York Times, Wall Street Journal, and Congressional Privacy Caucus setting privacy options is a complex process and one that needs to be constantly revisited as Facebook changes their policies.  All told, to secure an account a user needs to move through 10 separate screens— not exactly the simplest design choice.

Mr. Axten’s final point, that there’s no difference between Facebook’s “real-name” policy and Google’s, is correct. They’re equally unfriendly to activists, where using their real name can subject them to government harassment and persecution.  I noted Google’s policy of allowing people to use a name “that you commonly go by in daily life” as their primary identifier, a policy that seemed to allow the use of pseudonyms, which human rights activists often need to use to protect themselves from persecution.  As it turns out, however, Google will, like Facebook, require users to provide their real names. In this case, my praise of Google was premature.  In any case, users will be better served when companies strive expand protections for privacy and put options under their control in simple easy-to-understand terms.

Social media have proven to be important tools for human rights activists in countries with repressive governments. And repressive governments, in turn, are using social media to try to target activists. Policies and design choices have to take into account this dynamic and companies need to build Freedom of Expression and Privacy into their products from the earliest design stages.  Neutrality isn’t an option.

 


  • onthefence

    About your second point, Facebook allows more granular sharing options than the ones you describe. Just like Google, Facebook allows you to arrange your friends into specific “lists” — then you can use the Lock icon in the publisher to specify which lists you want to see or not see the post. If you don’t want to use the lists, you can identity specific people by name — those you want to see the post or not see the post. Just click on the Lock icon, then click Custom.

  • neha

    thanxxxxxxx……..

  • Fenny

    FB lists are pretty easy to set up and use, especially if, like me, you have a friends list of only 50 people. Everything I post is by default friends only. I only ever post something public when I post to one particular FB group. Using lists just makes it easier to direct entries at certain people.

    On the other hand, I completely disliked Google+’s policy of not allowing pseudonyms. My Gmail address has my real name in it and would link to my G+ account which I don’t want under my real name. At least with FB, I can easily set up an account not under my real name and there is no link to any address that has my real name in.

    G+ also have a set up that allows other users to add you to circles without your knowledge. Much as I don’t like FB particularly, at least people have to have my permission to be friends with me and therefore to link my name to anything.

    But I guess I come from a generation of usenet users and understand the need for not sharing all my personal details by default. In years to come, there may be some people who wish they hadn’t been quite so open in what they shared. G+ is just another way of making it easier to live your life in public now and regret it later.