Google, Facebook & Privacy

While people are busy attacking Google over privacy and calling for the breakup of the company, Facebook could later emerge as the real privacy villain of our Internet story.

Om Malik details the anticipated announcements at today’s F8 Facebook developer event, one of which will involve location. More broadly Facebook is stepping up its plan to insinuate itself into every corner of the Internet. Facebook Connect, which is now a foundation stone of many sites (e.g., Buzz.com), is only the beginning. 

In defense of some of the company’s moves, Facebook CEO Mark Zuckerberg has been widely quoted saying that privacy was no longer a “social norm”:

Talking in San Francisco over the weekend at the Crunchie Awards, which recognise technological achievements, the 25 year-old web entrepreneur said: “People have really gotten comfortable not only sharing more information and different kinds, but more openly and with more people.”

He went on to say that privacy was no longer a ‘social norm’ and had just evolved over time.

Giving him the benefit of the doubt, Zuckerberg may not have meant that privacy was gone but that privacy expectations had changed. While certainly true in some respects that statement emerges as more aspirational than descriptive of the current reality. The truth is more complex: people share information online but they may not be aware of the full implications of that sharing. If they were they might not share quite as much. 

The privacy furor over Google Buzz, Facebook’s past privacy battles and recent data argue that privacy is very much still alive. As I wrote on Monday:

A very new study, based on a 2009 telephone survey with 1,000 younger and older US adults, shows that younger users do in fact care about privacy. The authors of the report wrote, “We conclude then that that young-adult Americans have an aspiration for increased privacy even while they participate in an online reality that is optimized to increase their revelation of personal data.”

The AP summarized the findings at a high level:

• 88 percent of people of all ages said they have refused to give out information to a business because they thought it was too personal or unnecessary. Among young adults, 82 percent have refused, compared with 85 percent of those over 65.
• 86 percent believe that anyone who posts a photo or video of them on the Internet should get their permission first, even if that photo was taken in public. Among young adults 18 to 24, 84 percent agreed — not far from the 90 percent among those 45 to 54.
• 40 percent of adults ages 18 to 24 believe executives should face jail time if their company uses someone’s personal information illegally — the same as the response among those 35 to 44 years old.

Moreover, yesterday it was reported that WhatApp.org, a site that rates “privacy, openness and security,” gave Facebook a “2 out of 5,” essentially a failing grade according to Forbes: 

The new site, which was co-created by Stanford University Law fellow Ryan Calo last year and went into beta in March, has rated Facebook’s privacy significantly lower than that of other platforms like Twitter and the iPhone.

Data is being used more and more aggressively by ad networks, publishers and others in ad targeting and profiling. It’s always said by companies that provide and use the data that there’s no personally identifiable information and that profiles and behavior are aggregated anonymously.

Part of Facebook’s ambition (as with Beacon at one time) is likely to provide its user data to third party sites to improve targeting. There is a scenario wherein Facebook becomes the equivalent of an Internet-wide ad network with demographic, location and interest-based targeting data available to third parties. 

I wouldn’t go so far as to argue that Facebook is being “evil” but the company is aggressively pushing the boundaries of privacy in its own self interest and toward new business models. Witness, as one example, the recent move to make all default settings public — a move partly designed to compete with Twitter. 

As Facebook has grown and become more dominant it has become somewhat “intoxicated” (perhaps like Google or Microsoft before it) with its own plans and power. It is quite possible (and I’m hopeful) that Facebook will be very careful as it pushes into this next phase of development and make everything opt-in with full disclosures to users. But it’s also possible that it won’t do those things and will rely partly on users’ inaction, inattention or lack of complete understanding about what’s being done with their data. 

If the “devil” (rather than the angel) on Facebook’s shoulder wins then it will be necessary for third parties, privacy advocates and perhaps the FTC to push back and keep the site from crossing too many privacy boundaries. Indeed, if the devil wins then privacy advocates may find that their current complaints and objections to Google and its policies look quaint in retrospect.