Facebook-Instagram deal raises new privacy worries

Facebook's mixed record on privacy has led some Instagram users to be less than enthusiastic about today's acquisition announcement.

Declan McCullagh Former Senior Writer
Declan McCullagh is the chief political correspondent for CNET. You can e-mail him or follow him on Twitter as declanm. Declan previously was a reporter for Time and the Washington bureau chief for Wired and wrote the Taking Liberties section and Other People's Money column for CBS News' Web site.
Declan McCullagh
3 min read
Instagram photos are public by default. You can change that, but few people do.
Instagram photos are public by default. You can change that, but few people do.

Facebook's planned acquisition of Instagram is already raising privacy concerns, despite chief executive Mark Zuckerberg's pledge this morning that he wouldn't simply "integrate everything" into the larger social-networking site.

Twitter has been deluged with Instagram users turned insta-quitters, who griped: "I hate Facebook and the lack of privacy now I have to remove my pics before I can't." And: "You know what Instagram was missing? Ads and privacy invasions. All it took was 1 billion dollars to make that happen." Traffic is spiking to Web sites that let you leave Instagram and take your photos with you.

"Part of the concern is that it's Facebook," says Chris Conley, an attorney at the ACLU of Northern California. "And their history of privacy and respecting user choices is mixed."

That mixed history includes Facebook's repeated changes to the default settings of user accounts to make more user data public over time -- a practice that has vexed advocacy groups, drawn charges of being overly confusing, and culminated in a settlement last fall with the Federal Trade Commission. Meanwhile, Facebook's user count has continued to grow, and now surpasses 845 million. (See more CNET coverage.)

One big -- and unanswered -- question is how tightly integrated the popular photo-sharing service will become with Facebook.

All photos shared through Instagram are public by default. But users can go to a settings menu and enable a "Photos are private" option, meaning that future (but not existing) followers of that Instagram user will require approval. Few people appear to take that extra step.

"The larger issue to me is that Facebook is adding Instagram data to its own," says Ryan Calo, a privacy researcher at Stanford University's Center for Internet and Society. "Instagram users thought they were signing up for a simple service, of relatively little utility to advertisers or government. Now that data is likely to be combined with an entire social graph. I picture the consumer happily paddling down a data rivulet only to find themselves suddenly on the open waters of the social sea."

Instagram's current policies are privacy-protective: the company pledges not to "disclose personally-identifying information" except to employees, contractors, and so on. But in what one privacy lawyer told CNET was a glaring oversight, the privacy policy doesn't actually spell out what happens in an acquisition.

"To the extent that Instagram users signed up under certain, privacy-protective terms, those terms are still valid" even after the acquisition, says Justin Brookman, director of consumer privacy at the Center for Democracy and Technology. "Of course, for new data posted to Instagram, Facebook can set new terms."

Concerns about privacy have cropped up before during corporate acquisitions. Advocacy groups raised concerns -- in retrospect, alarmist ones -- about the possibility of targeted advertising post-Time Warner-AOL. Google's purchase of DoubleClick was another.

In a 2007 decision that's binding in California, the U.S. Court of Appeals for the Ninth Circuit has ruled that users need to be notified before a terms of service modification applies to them (in other words, a silent change isn't good enough). And a California federal district court took the same approach in a 2010 decision involving an E-Trade account maintenance fee.

Says David Jacobs, a consumer protection fellow at the Electronic Privacy Information Center: "Neither case dealt explicitly with changes to privacy policies, but the principles might be applicable" to Facebook-Instagram.