Facebook Privacy Changes Break the Law, Privacy Groups Tell FTC

A coalition of privacy groups asked regulators Thursday to investigate controversial new privacy settings on Facebook, saying recent changes in how the massive social networking site treats customer data violate federal consumer protection laws.

The complaint, filed by the Electronic Privacy Information Center (EPIC), says the changes significantly cut back customer privacy controls by forcing into the public eye certain information that they could previously restrict. Under the new policy, a user’s profile picture, current city, gender and friend and fan page lists are automatically public for all users, with little option to limit who is able to see this information. Additionally, Facebook set more defaults to its public setting, hoping users will start sharing information, such as their status updates, with the entire internet rather than limited sets of hand selected family members or friends — a clear effort to compete with Twitter by serving more real time customer data.

The changes “violate user expectations, diminish user privacy, and contradict. Facebook’s own representations,” EPIC charges (.pdf). The complaint asks the Federal Trade Commission to “determine the extent of the harm to consumer privacy and safety, require Facebook to restore privacy settings that were previously available…, require Facebook to give users meaningful control over personal information, and seek appropriate injunctive and compensatory relief.”

The challenge raises the stakes for Facebook, the world’s largest social-networking site, which has been trying to ride out a vocal backlash against what some see as a blatant attempt to push users into sharing publicly and often. It will also serve as a test case for the FTC under the Obama Administration, forcing the agency to show whether it will remain focused on scams with provable harms, or become a more interventionist player in the market as the FCC has become with telecommunications companies.

EPIC was joined in its complaint by a coalition of interest groups, including the Center for Digital Democracy, the American Library Association and the Privacy Rights Clearinghouse.

EPIC’s director Marc Rotenberg described the complaint as the most significant one facing the FTC, which is now headed by Jon Leibowitz. He is considered to be more sympathetic to privacy issues, and the FTC just signaled as much by holding a series of open-ended privacy hearings earlier this month.

“More than 100 million people in the United States subscribe to the Facebook service,” Rotenberg said. “The company should not be allowed to turn down the privacy dial on so many American consumers.”

But Facebook spokesman Andrew Noyes says the company discussed the changes with the FTC, privacy groups and the public ahead of time.

“We’ve had productive discussions with dozens of organizations around the world about the recent changes and we¹re disappointed that EPIC has chosen to share their concerns with the FTC while refusing to talk to us about them,” said Noyes, a longtime DC tech policy reporter who joined Facebook this fall. “The new tools offer users the opportunity to decide on privacy with every photo, link or status update they wish to post, so the process of personalizing privacy on Facebook will continue.”

The complaint comes just a day after privacy groups had a behind-the-scenes briefing with Facebook lawyers. Those included Tim Sparapani, who joined Facebook in the spring after working for several years as the ACLU’s top lobbyist battling government spying bills.

In the presentation, Facebook told the groups that as of Monday 220 million users had used its privacy settings transition wizard. Of those, about 40 percent are changing the defaults settings, while about 50 percent are opting to stick with Facebook’s new, more public default choices.

The Center for Digital Democracy’s Jeff Chester called Facebook’s definition of privacy “self-serving and narrow” and that the company’s intention is to get users to share as much as possible, in part to allow for more targeted advertising.

“They don’t disclose that consumer data is being used for very sophisticated marketing and targeting,” Chester said. “The Obama administration will have to be the cop on the beat.”

While the Electronic Frontier Foundation did not sign onto the complaint, EFF lawyer Kevin Bankston described his group’s concerns as similar.

“The complaint raises important questions about Facebook’s privacy practices that echo EFF’s own concerns, and I expect that the FTC will seriously consider opening an investigation,” Bankston said.

Bankston wrote an influential critique of the changes last week, but his concerns were largely dismissed by a Facebook spokesman who called Bankston part of a tiny minority who used a feature blocking third-party developers from accessing any of their data when a friend installs an application.

But Bankston is hardly alone in his criticism.

Facebook’s own posts on the privacy changes have more than 2,000 comments, most negative. Meanwhile, purely grassroots protest groups such as “Against The New Facebook Privacy Settings!” and “Facebook! Fix the Privacy Settings” have formed inside Facebook, demanding that Facebook roll back the changes.

While the FTC is a complaint-driven agency, it does not disclose when or if it opens investigations. A previous FTC complaint by EPIC regarding the data marketing industry led to record fines.

A Facebook spokesman did not return a call seeking comment by press time