03:00 PM
Connect Directly

Facebook Settles FTC Charges, Admits Mistakes

CEO Mark Zuckerberg promises to make Facebook a privacy leader.

Top 15 Facebook Apps For Business
(click image for larger view)
Slideshow: Top 15 Facebook Apps For Business
Facebook has agreed to settle Federal Trade Commission charges that it deceived consumers by telling them they could keep their personal information private while allowing that information to be shared and made public.

The proposed settlement requires Facebook to provide consumers with clear notice and to obtain consent when sharing information beyond the guidelines established by consumers' privacy settings. As with Google and its recent privacy settlement with the FTC, Facebook has agreed to have its privacy practices audited for the next 20 years.

Facebook has long insisted, "We take privacy very seriously," and even has gone as far as to insist that it takes privacy "very, very seriously." Now, the company, which earlier this year proposed re-branding privacy policies as data use policies, will face pressure to take privacy very, very, very seriously.

CEO Mark Zuckerberg, in an effort to get out in front of yet another privacy controversy, Tuesday posted a contrite blog post in which he promises to make Facebook "the leader in transparency and control around privacy."

Insisting that Facebook has "a good history of providing transparency and control over who can see your information," Zuckerberg acknowledges his company's missteps.

[Find out about how Facebook fumbled its roll-out of facial recognition technology.]

"I'm the first to admit that we've made a bunch of mistakes," he wrote in his post. "In particular, I think that a small number of high profile mistakes, like Beacon four years ago and poor execution as we transitioned our privacy model two years ago, have often overshadowed much of the good work we've done."

As examples of that work, Zuckerberg cited 20 new tools and resources introduced in the past 18 months that have been designed to give users more control over the Facebook experience.

Of course it's not Facebook's good work that got the attention of the FTC. The FTC's complaint cites a series of promises about privacy that Facebook did not keep.

The broken promises include: a December 2009 website change that exposed information, such as Friends Lists, that had been designated private; Facebook's assertion that third-party apps would have only necessary information to operate, when in fact the apps had access to almost all of users' personal data; Facebook's assertion that users could restrict sharing to limited audiences, even though friends could share that information more broadly through third-party apps; Facebook's assertion that it would not share personal information with advertisers, which it nonetheless did; Facebook's claim that photos and videos from deleted accounts could not be accessed, which wasn't true; and Facebook's claim that it complied with the US-EU Safe Harbor Framework governing data transfers between the United States and Europe, with which it did not actually comply.

"Facebook is obligated to keep the promises about privacy that it makes to its hundreds of millions of users," said FTC chairman Jon Leibowitz in a statement. "Facebook's innovation does not have to come at the expense of consumer privacy. The FTC action will ensure it will not."

Maybe. The FTC's requirements will do nothing to prevent Facebook users from sharing without considering the implications; the FTC is powerless to protect users from themselves. But the agency has prompted Facebook to create two new privacy officer positions: chief privacy officer for policy, and chief privacy officer for products.

Zuckerberg insists that these two positions will help ensure that Facebook develops products and policies with privacy in mind.

Of course, merely creating a position does not guarantee that that position will have real power to affect important corporate decisions, or even that Facebook's conception of privacy will match consumer expectations.

Google's global privacy counsel Peter Fleischer last week noted on his personal blog that European privacy laws are likely soon to be amended to require that companies have a data protection officer. "This will be a practical step forward for privacy," he notes. "But at the same time, it will be important to define what we're accountable for, internally and externally, especially in a field where the very notion of 'privacy' is highly subjective, and where the visions of what a privacy leader is supposed to do diverge dramatically, by country, by industry, and by function."

Facebook may well take privacy seriously, but like Google it also takes advertising revenue seriously. And as privacy advocate Christopher Soghoian recently noted, the business models of online advertising services are inherently in conflict with user privacy.

The Enterprise Connect conference program covers the full range of platforms, services, and applications that comprise modern communications and collaboration systems. It happens March 25-29 in Orlando, Fla. Find out more.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
11/30/2011 | 8:52:53 PM
re: Facebook Settles FTC Charges, Admits Mistakes
Hi Brian,

In response, I've come to understand that the only way to protect your privacy on Facebook is to not use Facebook. I also don't believe that Facebook will take steps to finally protect it's users privacy. There's no incentive for them to. If anything, introducing privacy settings that actually work would harm Facebooks digital advertising sales.

Sure, the FTC might be auditing Facebooks privacy things for the next 20 years (I wonder if Facebook is saving money as a result of that ruling somehow) and that sounds great on paper but, this is the FTC we're talking about and it's about as efficient as the rest of the government. I actually like the idea of the FTC controlling my privacy on Facebook even less than I like the idea of Facebook controlling it.

tl;dr - I don't believe anything Facebook says and don't trust the government/FTC to make better decisions than FB.
User Rank: Apprentice
11/30/2011 | 2:21:53 AM
re: Facebook Settles FTC Charges, Admits Mistakes
Bprince, in response to your comment... I still grade it pretty low. B at best...It's great that they've protected us inside of facebook, but there is still a big piece missing...This does noting to protect us against being tracked OUTSIDE of facebook. If interested I think this may be a good read for you http://www.abine.com/wordpress...
User Rank: Ninja
11/30/2011 | 1:52:19 AM
re: Facebook Settles FTC Charges, Admits Mistakes
How does everyone grade Facebook privacy at this point? Any changes you would like to see made?
Brian Prince, InformationWeek/Dark Reading Comment Moderator
Want Your Daughter to Succeed in Cyber? Call Her John
John De Santis, CEO, HyTrust,  5/16/2018
Don't Roll the Dice When Prioritizing Vulnerability Fixes
Ericka Chickowski, Contributing Writer, Dark Reading,  5/15/2018
New Mexico Man Sentenced on DDoS, Gun Charges
Dark Reading Staff 5/18/2018
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Security through obscurity"
Current Issue
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2018-05-21
jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes (SECURITY-382). Jenkins allows plugins to annotate build logs, adding new content or changing the presentation of existing content while the build is running. Malicious Jenkins users...
PUBLISHED: 2018-05-21
kernel drivers before version 4.17-rc1 are vulnerable to a weakness in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated.
PUBLISHED: 2018-05-21
An issue was discovered in Pluck before 4.7.6. There is authenticated stored XSS because the character set for filenames is not properly restricted.
PUBLISHED: 2018-05-21
An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filetypes for uploads in missing some applicable ones such as .phtml and .htaccess.
PUBLISHED: 2018-05-21
The Micro Focus Client for OES before version 2 SP4 IR8a has a vulnerability that could allow a local attacker to elevate privileges via a buffer overflow in ncfsd.sys.