Advocacy groups: Facebook privacy changes not enough

Facebook's recent announcement that it had simplified and enhanced its privacy settings wasn't enough to satisfy the privacy activists that have become some of its sharpest critics.

In an open letter on Wednesday, the Electronic Frontier Foundation, the ACLU of Northern California, and the Center for Democracy and Technology urged Facebook CEO Mark Zuckerberg to make "instant personalization" opt-in by default and provide more privacy options including allowing users to "control every piece of information they can share via Facebook." Instant personalization allows selected Web sites to access a limited amount of user profile data to customize what visitors see.

To this, Facebook spokesman Andrew Noyes said the instant personalization program is "widely misunderstood" and "the only information the three partners currently in the program receive from Facebook is users' public information." He added that Facebook as made it easier for people to turn off and has imposed restrictions on how partners can use the information they receive from Facebook.

The open letter also asks Facebook to rethink the way social plug-ins including the "like" button work. CNET recently reported on the "like" button, which allows Facebook to collect the address of the Web page being visited and the Internet address of the visitor as soon as the page is loaded--clicking on the like button is not required.

During an press conference on May 26 at the company's Palo Alto, Calif., headquarters, Zuckerberg said Facebook's privacy changes were radically simplified: from 50 settings required to make all information private down to less than 15, and 10 settings on 3 pages were consolidated to 7 settings on 1 page.

He indicated that the privacy preferences of activist groups may not match what something like 500 million users actually prefer. More people remain more worried about Facebook possibly charging money than about privacy, Zuckerberg said, adding that "we've seen no meaningful changes on any of the stats" even after all the Delete-Your-Facebook-Pages campaigns.

Wednesday's letter also asks Facebook to include encrypted HTTPS connections--which is slightly more computationally expensive--to protect user traffic from being intercepted. Some companies, like Google, already offer this as an option.

In response, Facebook's Noyes said, "We are currently testing SSL access to Facebook and hope to provide it as an option in the coming months."

The letter, also signed by the Electronic Privacy Information Center and the Center for Digital Democracy, stops short of employing the incendiary rhetoric that some of the groups used in a conference call a day after Zuckerberg's announcement. (Phrases like Internet users are "victimized by Facebook," and "I don't think they really do respect the privacy of their users" were tossed around at the time.)

EFF, CDT, and the ACLU didn't participate in that call. Perhaps to convince those groups to join Wednesday's letter, it concluded with more conciliatory language: "We are committed to continuing this dialogue with you and ensuring that users can continue to be both social and private on Facebook."

More generally, Facebook spokesman Noyes said the social network "won widespread praise from users around the world and the privacy community last month for introducing simpler and more powerful controls for sharing personal information," and plans to "continue to engage these groups and others in a constructive dialogue about these important issues."