Privacy groups assail Facebook changes

Facebook's new privacy changes haven't been enough to satisfy its most vocal critics.

The activist groups waging what amounts to an undeclared war against the social-networking site for the last year, complete with no fewer than three letters to federal regulators claiming Facebook's actions are illegal, said Thursday that they're hardly ready to declare a truce. (See our Q&A with CEO Mark Zuckerberg and instructions on changing your settings.)

Even the simplified options, including slicing the number of settings from 50 to around 15 and consolidating seven pages of choices into three pages, weren't enough to draw much in the way of praise from avowed critics of the Internet's second-largest Web site.

Internet users are "victimized by Facebook," said Robert Ellis Smith, publisher of Privacy Journal, on a joint conference call. "I don't think they really do respect the privacy of their users," concluded Deborah Pierce of PrivacyActivism.org. And John Simpson of California-based Consumer Watchdog charged: "It's an operating mode of: you can never ask permission. Always ask forgiveness."

Most, if not all, of the groups on the call have been lobbying for new government rules targeting social-networking sites. The Federal Trade Commission is contemplating just that, with an announcement expected late this year, and related legislation is being drafted in the House of Representatives.

"We want legislation to address this massive and stealth data collection that has emerged," said Jeff Chester of the Center for Digital Democracy.

The "massive and stealth data collection" seems to refer to the choices of nearly 500 million people to sign up for Facebook and to voluntary share portions of their personal and professional lives. Chester's primary objection to the Facebook changes is that they don't go far enough: he wants "opt-in" instead of "opt-out." He especially objects, in other words, to how the default profile settings have changed over time.

In an interview with CNET, Facebook spokesman Barry Schnitt rejected that argument: "Either sites can never change their default settings--no matter how much the user base or the world changes--and that strikes me as crazy...or people aren't aware of the changes. And to that I'd say that our efforts to educate our users have been pretty unprecedented. We required more than 350 million users to go through a process that required them to check their privacy settings."

Not all civil liberties groups believe millions of users have been "victimized" by Facebook, of course. The Electronic Frontier Foundation, for instance, said that although the "changes don't address all of our concerns, they are a great first step in what will hopefully be a more privacy-driven direction for Facebook." And the ACLU of Northern California said that, after missteps in the last few months, "Facebook is finally friending privacy again."

While the recent focus on Facebook started with its announcements in late April at the F8 developers conference, which included deeper connections with partner Web sites, criticism has been building for a while. There was the outcry over the now-defunct Beacon advertising program, Zuckerberg's remarks last December about pushing users to disclose more, and brief eruptions including last week's disclosure of Facebook sharing some data with advertisers in possible violation of its privacy policy.

Schnitt noted that although the advocacy groups characterize their correspondence to the FTC as a "complaint"--which makes it sound more official--it's really just a letter. "Anyone can send a letter to the FTC," he said. "There's not a requirement for an investigation or action. The rest of the world thinks that there's some obligation for the FTC to investigate. There isn't."

When asked whether the FTC has contacted Facebook in response to the letters, Schnitt declined to comment on any specific contact with regulators: "We're talking to them all the time. We didn't have to be contacted by them. A lot of the things that were complained about we told the (FTC) before they happened."

During Wednesday's press conference at the company's offices in Palo Alto, Calif., tucked away in a corner of a leafy residential neighborhood, Zuckerberg said the privacy feedback "really resonated" and they had developers and engineers camped out in a conference room to rework settings. But he also questioned whether the fuss was a bit overblown, saying even after all the Delete-Your-Facebook-Pages campaigns, there has been no "meaningful change" and people continue to recommend Facebook to friends.

"Users have a fair amount of control of (what) they post on their page or their friends page," said Marc Rotenberg, director of the Electronic Privacy Information Center in Washington, D.C. "What they can't control is the information about them that Facebook transfers to third parties...Those problems have not been solved."

Facebook doesn't "give personal information to advertisers--we don't sell it to anyone," replied Schnitt, the Facebook representative. He added: "The early reaction to these changes from users around the world and the broad community of privacy advocates has been overwhelmingly positive."

Update 11 a.m. PDT Friday: I heard back this morning from CDD's Jeff Chester, who took issue with Facebook's characterization of his group's requests for investigation as mere "letters" instead of the more official-sounding "complaint." Chester wrote to me: "You should have corrected the Facebook spokesperson when he said the EPIC et al FTC complaint was just a letter...Indeed, my sources tell me that Facebook made these changes because our complaint--and the letters from the senators--have made an important impact at the FTC." The relevant portion of the FTC's formal rules is 16CFR2.2, which says that "any individual, partnership, corporation, association, or organization may request the commission to institute an investigation in respect to any matter over which the commission has jurisdiction." All that's required is that the request be in the form of a "signed statement," and there is of course no requirement for the FTC to act on it. Whether it's called a "letter" or "complaint" or, according to 16CFR2.2, a "signed statement," any member of the public--not just advocacy groups -- has the right to request an investigation.