Facebooks

New Privacy Changes Violate Section 5 of the FTC Act

Amir Zonozi Georgetown University Communication, Culture & Technology Program Marketing, Advertising & Public Policy Prof. Adonis Hoffman, Esq. Fall 2012

Facebook Violates FTC | Zonozi

Introduction
As of September 2012, Facebook announced it has over 1 billion users. The social networking service that launched in 2004 has stated their mission is to make the world more open and connected, and while they are certainly accomplishing that, it is important to ask but at what cost? I argue that Facebooks proposed updates in Site Governance, Data Use Policy, and Statement of Rights are considered in violation of Section 5 of the FTC Act and are considered unfair practices. Facebook Facebook is the worlds largest social networking service, with over 1 billion users. Mark Zuckerberg founded Facebook in 2004 along with Eduardo Saverin, Dustin Moskovitz, Andrew McCollum and Chris Huges while at Harvard University. The company is now arguably one of the most important and powerful websites on the Internet, setting the industry standard for social media networking user rights and responsibilities. Facebook went public in 2012 and had a valuation of about $100 billion, making it one of the largest tech IPOs in history1. Facebook recently made a settlement with the Federal Trade Commission (FTC) in November 20112 requiring 1 http://mashable.com/category/facebook-ipo/ 2 http://allfacebook.com/facebook-ftc-privacy_b68550 2

Facebook Violates FTC | Zonozi Facebook to warn consumers about privacy changes and to get their permission before sharing information more broadly. Facebook agreed by taking several measure to promote more privacy controls and a open and transparent system with what Facebook does with user data and information. FTC The FTC has two primary functions; one, to preserve competition in trade and commerce, and two, to protect consumers from unfair and deceptive trade practices. Facebooks privacy policy issues fall under the second primary function, consumer protection. The FTC enforces consumer protection in three ways; one, clear mandate to protect consumers against unfair, deceptive, fraudulent practices; two, enforces consumer protection laws passed by Congress; and three, enforces trade regulation rules issued by commission. The FTC is granted this statutory authority through the FTC Act, (15 USC 43 et seq.) broad powers which include gathering, and compiling information to investigate from time to time organizations, business, conduct, practices and management engaged in or whose business affects commerce. This is why the FTC

Facebook Violates FTC | Zonozi

Factual Overview
On November 21, 20123 Elliot Schrage, Vice President of Communications, Public Policy and Marketing at Facebook announced proposed changes to Facebooks Data Use Policy and Statement of Rights (SRR). The proposed restructure affected: the site governance process and tools for privacy. These proposed updated caused great concern for many Facebook users. Facebook Proposed Changes On December 3, 2012 Facebook responded and offered users a chance to vote on these proposed updates, with results advisory unless more than 30% of users vote.4 They also included more information on the changes and on affiliates, content ownership and advertising policies. The site governance process changes proposed, abolishes the voting mechanism granted to users allowing them the opportunity to shape policies with feedback through voting, and replacing it with a facilitated direct discussion with the Chief Privacy Officer. The affiliate information explains to Facebook users which affiliates Facebook is sharing data their with. Facebook new updates in privacy controls provide more clarity and in-context education, they also clarify and confirm users 3 http://newsroom.fb.com/News/535/Proposed-Updates-to-our-Governing- Documents 4 https://www.facebook.com/notes/facebook-site-governance/our-site- governance-vote/10152304778295301 4

Facebook Violates FTC | Zonozi have ownership over their own content, and made clear on their advertising policies. The Vote On December 11, 2012, Elliot Schrage, Vice President of Communications, Public Policy and Marketing at Facebook announced social network has concluded its seven-day site governance vote on proposed updates to the Statement of Rights and Responsibilities and Data Use Policy. A total of 668,872 users voted, with 589,141 voting against the proposed updates5, however with one billion users, the results were significantly less than 30% of Facebook users. Facebook used the minimal participation as more reason to implement its proposed changes in site governance. Changes On December 12, 2012 Facebook revised its privacy policy6 with updates to their Statement of Rights and Responsibilities (SRR) and Data Use Policy. Facebooks attempt with the changes is to help users better understand and manage their activity and content by providing them with simple powerful tools. Facebook made three updates in three categories of product features: control, education and tools. 5 https://www.facebook.com/notes/facebook-site-governance/our-site- governance-vote/10152304778295301 6 http://newsroom.fb.com/News/547/Better-Controls-for-Managing-Your-Content 5

Facebook Violates FTC | Zonozi Control The Privacy Shortcuts is the most disruptive updated feature, providing users direct access to their privacy settings on the top of their Facebook toolbar7 located on every page, as opposed to accessing it under settings. The shortcuts will allow users to manage who is available to contact them and who can view their photos and timeline posts. This will also gives users the ability block specific people easily. Facebook has revamped how it allows applications to ask for your data, by making clear permissions and control for users to be educated on what data they are making accessible with up-front privacy settings, allowing users an all-or-nothing control of their shared data to third parties. Education Facebook has added in-context notices8 throughout the social network to help users comprehend the status of their content. Facebook has also updated its Activity Log9, a designated location where users can review and manage their Facebook content. This allows users to download their Facebook data while providing a

7 http://newsroom.fb.com/News/547/Better-Controls-for-Managing-Your-Content 8 http://newsroom.fb.com/News/547/Better-Controls-for-Managing-Your-Content 9 http://newsroom.fb.com/Safety-and-Privacy 6

Facebook Violates FTC | Zonozi comprehensive outlook of their Facebook activity with filtration functionality to allow easy access to specific content. Tools Facebook has also introduced updates to Request and Removal, designed to help streamline the process by getting users to engage in conversations within their network to remove content they dont want or like on Facebook. Users will be able to detag photos and send private messages to author explaining why you detagged the photo and/or provide reasons why you would like the photo removed from Facebook. More Features On December 3, 2012 Facebook has rolled out a new Photo Sync10 option to users, a setting that will automatically upload every image taken with a mobile device to the social networks data servers.

Issues Presented
While Facebooks recent updates have presented welcomed changes to privacy control, they have also introduced new critical alterations that negate their advancement in user rights. Changes include removal of an option that allowed 10 https://www.facebook.com/help/photosync 7

Facebook Violates FTC | Zonozi users to be hidden from strangers through Facebooks search function. The Facebook privacy team believes this feature has become more a crutch than a security tool and do not believe it provides a level of security11. Facebook is enforcing that by taking away the ability to block searches, it shifts the responsibility of keeping users information private to users12. Facebooks removal of a master setting may be overwhelming to some users making them uncomfortable by forcing them to interact with increased options of privacy settings. The changes Facebook approved come after a vote in which 88% of voters opposed changing the privacy policy and abolishment of voting rights. While 589,141 Facebook users participated, making this vote Facebooks largest voter turnout in its history, however since less than 30% participation of total Facebook users (1 billion) participated, the vote carries no weight. Facebook settled with the U.S. Federal Trade Commission to resolve charges that the company made public some personal information of users after informing users that data would be kept private. The settlement requires Facebook to give consumers clear and prominent notice and obtain their express consent before sharing 11 http://news.cnet.com/8301-1023_3-57558642-93/facebook-privacy-settings- get-reworked-once-again/?ttag=fbwp 12 http://news.cnet.com/8301-1023_3-57558642-93/facebook-privacy-settings- get-reworked-once-again/?ttag=fbwp 8

Facebook Violates FTC | Zonozi information beyond their privacy settings13. The FTC also requires Facebook to maintain a comprehensive piracy program to protect consumers information and obtain privacy audits from an independent third party14. Trends of Privacy Disregard To further prove a point of Facebooks growing violations of privacy; Facebook has also rolled out a new Photo Sync option to users, a setting that will automatically upload every image taken with a mobile device to the social networks data servers15. Recent figures estimate Facebooks mobile app is used by 200 million people each month, with 300 million images uploaded to servers everyday16. If a Facebook user has enabled the Photo Sync service, yet chooses to keep all images private, Facebook can still use the images geolocation on the image content to locate where users are based on where the image was taken17. This data can be used to connect people with where they have been and who they have been with, the issues arises when candid photos are taken without a persons knowledge, those photos are automatically uploaded to Facebooks servers without the persons permission. While the person can have the photo erased off a smart phone, the 13 http://ftc.gov/opa/2012/08/facebook.shtm 14 http://ftc.gov/opa/2012/08/facebook.shtm 15 https://www.facebook.com/help/photosync 16 http://rt.com/usa/news/facebook-mobile-privacy-sync-187/ 17 http://rt.com/usa/news/facebook-mobile-privacy-sync-187/ 9

Facebook Violates FTC | Zonozi photo remains on Facebooks servers, stripping users of any control over that content.

Policy Analysis & Discussion

The Primary Consumer Protection Statute provides consumers protection under the Section 5(a) FTC Act. The matter in question is, does Facebook violate Section 5 of the FTC Act? Yes, Facebooks proposed updates in Site Governance, Data Use Policy, and Statement of Rights are considered in violation of Section 5 of the FTC Act and are considered unfair practices. The proposed changes raise privacy risks for Facebook users that are contrary to commitments previously made to the users18 and the FTCs previous negotiated settlement with Facebook19. The complete abolishment of the voting system as a method of site governance, conflicts with Facebooks stance on openness and transparency. Facebook also contradicted its previous stance on their purchase of the photo- sharing mobile application Instagram. Originally claiming they would grow Instagram and Facebook independently, however under the proposed changes 18 https://blog.facebook.com/blog.php?post=10150378701937131 19 http://www.ftc.gov/os/caselist/0923184/index.shtm 10

Facebook Violates FTC | Zonozi under the Data Use Policy20, Facebook states it will use and share data with Instagram as an affiliate. Facebook is setting an unhealthy habit and pattern of contradicting itself and disregarding the public and its users, with continuous engagement in fraudulent practice. Facebooks removal of an opt-out search policy engages Facebook in misrepresentation of privacy, subjecting users to uncomfortable advancements from strangers, spam and unwanted contact.

Recommendations
It is my recommendation the FTC provides administrative proceedings with the threat of judicial enforcement through adjudication. The FTC has reason to believe violations in unfair practices can lead to a negotiation in an updated settlement (consent decree) between Facebook and the FTC over users privacy rights with the threats of payment for damages and a cease and desist. The goal of this is to remedy privacy violations for users industry-wide on all social media networks by setting a standard with Facebook. It is my recommendation Facebook returns to its commitment of transparency with information stored and control on privacy and retains its site governance policy 20 https://www.facebook.com/full_data_use_policy 11

Facebook Violates FTC | Zonozi with adaptations. Facebooks previous voting process21 would begin with a proposed change by Facebook, if the post received over 7,000 comments, the post will be subjected to a 10 day vote, if 30% of Facebooks audience votes, the results will be instated. If less than 7,000 comments were made, or if the vote received less than 30% of Facebooks population, then Facebook moves forward with proposed changes. The issue lies in that Facebooks process was too difficult, 30% of a billion is too large of a number. Achieving 300 million votes, questions whether this system is really a democracy, or just a faade of one. My recommendation is that the vote should be based on the participation by those that vote as the total audience, this way those that engage have vested interests in their opinion and feel strongly about the way they vote. As an example the vote over site governance was the largest vote in Facebooks history, yet it still could not reach 30%, and an overwhelming 88%22 voted against the proposed changes. A system that ignores 88% of its user opinions is obviously flawed and there needs to be some rectification. 21 https://www.facebook.com/fbsitegovernance 22 http://techcrunch.com/2012/12/09/vote-on-facebook-changes/ 12

Facebook Violates FTC | Zonozi

Conclusion
On November 21, 2012 Facebook announced updates and changes to its Site Governance, Data Use Policy, and Statement of Rights, changes its privacy controls and settings of its users. While some changes, like in-context education and affiliation transparency and information are welcomed, Facebook also contradicts its commitments to its users and the FTC with removing opt-out policies from search and messaging, facilitating unwanted contact from strangers, abolishing a system where users feedback could be effectively implemented and created new features that pose for liability and risk of privacy and safety. I argue Facebooks changes are a step backwards in its commitments of transparency and providing better privacy controls to its users, engaging in unfair practices, violating Section 5 of the FTC Act. I recommend Facebook retracts its proposed changes and reinstate its site governance voting process, with amended rules in how proposed updates are passed and voted on. I propose Facebook change its requirement of 30% total Facebook user participation as a requirement and instead use the audience that votes as it is, and subject the proposals completely based on the vote given by that audience. This would rectify instances such as the last vote taken in that 88% of the audience opposed the change, yet Facebook still approved the proposal based on its previously instated bylaws.

13

Facebook Violates FTC | Zonozi I also recommended if Facebook refuses to negotiate that the FTC should threaten Facebook with violation fines and subject them to a judicial process, in that they violated their previously agreed settlement, and engaged in unfair practices that positions them contrary to law and in violation of Section 5 of The FTC Act.

14