Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

11/29/2011
03:00 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Facebook Settles FTC Charges, Admits Mistakes

CEO Mark Zuckerberg promises to make Facebook a privacy leader.

Top 15 Facebook Apps For Business
(click image for larger view)
Slideshow: Top 15 Facebook Apps For Business
Facebook has agreed to settle Federal Trade Commission charges that it deceived consumers by telling them they could keep their personal information private while allowing that information to be shared and made public.

The proposed settlement requires Facebook to provide consumers with clear notice and to obtain consent when sharing information beyond the guidelines established by consumers' privacy settings. As with Google and its recent privacy settlement with the FTC, Facebook has agreed to have its privacy practices audited for the next 20 years.

Facebook has long insisted, "We take privacy very seriously," and even has gone as far as to insist that it takes privacy "very, very seriously." Now, the company, which earlier this year proposed re-branding privacy policies as data use policies, will face pressure to take privacy very, very, very seriously.

CEO Mark Zuckerberg, in an effort to get out in front of yet another privacy controversy, Tuesday posted a contrite blog post in which he promises to make Facebook "the leader in transparency and control around privacy."

Insisting that Facebook has "a good history of providing transparency and control over who can see your information," Zuckerberg acknowledges his company's missteps.

[Find out about how Facebook fumbled its roll-out of facial recognition technology.]

"I'm the first to admit that we've made a bunch of mistakes," he wrote in his post. "In particular, I think that a small number of high profile mistakes, like Beacon four years ago and poor execution as we transitioned our privacy model two years ago, have often overshadowed much of the good work we've done."

As examples of that work, Zuckerberg cited 20 new tools and resources introduced in the past 18 months that have been designed to give users more control over the Facebook experience.

Of course it's not Facebook's good work that got the attention of the FTC. The FTC's complaint cites a series of promises about privacy that Facebook did not keep.

The broken promises include: a December 2009 website change that exposed information, such as Friends Lists, that had been designated private; Facebook's assertion that third-party apps would have only necessary information to operate, when in fact the apps had access to almost all of users' personal data; Facebook's assertion that users could restrict sharing to limited audiences, even though friends could share that information more broadly through third-party apps; Facebook's assertion that it would not share personal information with advertisers, which it nonetheless did; Facebook's claim that photos and videos from deleted accounts could not be accessed, which wasn't true; and Facebook's claim that it complied with the US-EU Safe Harbor Framework governing data transfers between the United States and Europe, with which it did not actually comply.

"Facebook is obligated to keep the promises about privacy that it makes to its hundreds of millions of users," said FTC chairman Jon Leibowitz in a statement. "Facebook's innovation does not have to come at the expense of consumer privacy. The FTC action will ensure it will not."

Maybe. The FTC's requirements will do nothing to prevent Facebook users from sharing without considering the implications; the FTC is powerless to protect users from themselves. But the agency has prompted Facebook to create two new privacy officer positions: chief privacy officer for policy, and chief privacy officer for products.

Zuckerberg insists that these two positions will help ensure that Facebook develops products and policies with privacy in mind.

Of course, merely creating a position does not guarantee that that position will have real power to affect important corporate decisions, or even that Facebook's conception of privacy will match consumer expectations.

Google's global privacy counsel Peter Fleischer last week noted on his personal blog that European privacy laws are likely soon to be amended to require that companies have a data protection officer. "This will be a practical step forward for privacy," he notes. "But at the same time, it will be important to define what we're accountable for, internally and externally, especially in a field where the very notion of 'privacy' is highly subjective, and where the visions of what a privacy leader is supposed to do diverge dramatically, by country, by industry, and by function."

Facebook may well take privacy seriously, but like Google it also takes advertising revenue seriously. And as privacy advocate Christopher Soghoian recently noted, the business models of online advertising services are inherently in conflict with user privacy.

The Enterprise Connect conference program covers the full range of platforms, services, and applications that comprise modern communications and collaboration systems. It happens March 25-29 in Orlando, Fla. Find out more.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
herman_munster
50%
50%
herman_munster,
User Rank: Apprentice
11/30/2011 | 8:52:53 PM
re: Facebook Settles FTC Charges, Admits Mistakes
Hi Brian,

In response, I've come to understand that the only way to protect your privacy on Facebook is to not use Facebook. I also don't believe that Facebook will take steps to finally protect it's users privacy. There's no incentive for them to. If anything, introducing privacy settings that actually work would harm Facebooks digital advertising sales.

Sure, the FTC might be auditing Facebooks privacy things for the next 20 years (I wonder if Facebook is saving money as a result of that ruling somehow) and that sounds great on paper but, this is the FTC we're talking about and it's about as efficient as the rest of the government. I actually like the idea of the FTC controlling my privacy on Facebook even less than I like the idea of Facebook controlling it.

tl;dr - I don't believe anything Facebook says and don't trust the government/FTC to make better decisions than FB.
ericabritt
50%
50%
ericabritt,
User Rank: Apprentice
11/30/2011 | 2:21:53 AM
re: Facebook Settles FTC Charges, Admits Mistakes
Bprince, in response to your comment... I still grade it pretty low. B at best...It's great that they've protected us inside of facebook, but there is still a big piece missing...This does noting to protect us against being tracked OUTSIDE of facebook. If interested I think this may be a good read for you http://www.abine.com/wordpress...
Bprince
50%
50%
Bprince,
User Rank: Ninja
11/30/2011 | 1:52:19 AM
re: Facebook Settles FTC Charges, Admits Mistakes
How does everyone grade Facebook privacy at this point? Any changes you would like to see made?
Brian Prince, InformationWeek/Dark Reading Comment Moderator
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "He's too shy to invite me out face to face!"
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16680
PUBLISHED: 2019-09-21
An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive, possibly overwriting a file during extraction.
CVE-2019-16681
PUBLISHED: 2019-09-21
The Traveloka application 3.14.0 for Android exports com.traveloka.android.activity.common.WebViewActivity, leading to file disclosure and XSS.
CVE-2019-16677
PUBLISHED: 2019-09-21
An issue was discovered in idreamsoft iCMS V7.0. admincp.php?app=members&do=del allows CSRF.
CVE-2019-16678
PUBLISHED: 2019-09-21
admin/urlrule/add.html in YzmCMS 5.3 allows CSRF with a resultant denial of service by adding a superseding route.
CVE-2019-16679
PUBLISHED: 2019-09-21
Gila CMS before 1.11.1 allows admin/fm/?f=../ directory traversal, leading to Local File Inclusion.