Facebook Sharing Too Much Personal Data With Application Developers

An anonymous reader writes "Remember the Facebook News Feed privacy uproar? What about the Beacon scandal from late last year? Privacy activists are rallying around yet another major issue at Facebook, in which the company is secretly sharing user data with third parties. Researchers from the University of Virginia recently announced that in a study of the top 150 Facebook applications, more than 90% were given access to information that was not needed to function correctly. That Scrabble or Superpoke application you really like? Its developers get access to your religion, sexuality and home town. Facebook's position was summed up by Georgetown Law Professor Dan Solove, 'They seem to be going on the assumption that if someone uses Facebook, they really have no privacy concerns.' Do Facebook users deserve privacy? "

Comments

Net

[Rinisari]

If you post it on the 'net, it's public information, no matter how secure or private the application is. One must treat his or her information on social networks this way, no exceptions.

Re:Net

[CastrTroy]

Exactly. Just look at what happened with the "private" myspace pictures. If you don't want the information getting out, don't post it on the internet.

Re:Net

[heinzkunz]

I use online banking, and I damn well expect my account to not be publicly available. Why can't I expect a social networking site to respect my privacy the same way my bank does?

I agree with you that information posted to social networks can't be considered private, but that's because they are broken, and their users have the right to complain about it.

Re:Net

[IamTheRealMike]

Well that's what I thought. But it appears that's actually not the case. If you RTFA and click through, you find a page that explicitly says that friends applications can view my data. Which presumably they can then do more or less anything with, seeing as how keeping that data is only "enforced" by the terms of service. The defaults are set such that my friends apps, any by implication anybody who can code, can view everything except my sexual preferences, basically.

That's pretty surprising, and I'm glad Ms Felt has called this out. It means that anybody who writes a moderately successful app can build a giant database of things that I never intended to be in any database other than Facebooks. Part of the reason Facebook has been successful is that it does actually have privacy controls, and people feel they can share their data with only their friends (and facebook inc, of course, but that's only one company). The fact that it's not true is a pretty gaping oversight.

What I find especially funny is the big bold sign at the top saying "Facebook does not sell your personal data". No, they give it away for free instead. Great.

Automaticly install applications?

[zbend]

Wait, last time I checked Facebook doesn't automaticly install apps you have to do it and confirm you are allowing this app to acccess some of your information. They don't give third parties your info, you do.

Deserve or expect privacy?

[gravyface]

Deserve? Yes, everyone deserves the right to keep their personal lives private. Should they expect privacy? Not likely. There's no free lunch in life, online or offline: why would Facebook spend many millions of dollars maintaining a social network without milking every last bit of profit out of their user base? They're going to do whatever they can get away with, period. I don't know why people find this so hard to grasp: it's like when I try to explain to people that those "free emoticons" they so fondly install are filling up somebody's offshore server with their personal information and filling their monitor with pop-up advertisements.

So why is this news again...?

[NeoSkandranon]

Maybe I'm just that suspicious, but the first time I went to look at one of those "applications" on facebook, the first checkbox in a list of a half dozen you can select before you hit "go" was a riff on "Allow this application to access my personal info" ---I automatically assumed that meant ALL my info, and promptly cancelled whatever it was.

Did anyone ever really have the assumption that that information was needed to make the app function, and not just a way of tricking users into giving up demographic info to third parties?

Personally I'm not sure Facebook is in the wrong on this one. It's up in big letters that you're giving whatever application it is access to your personal info--and all those things are OPTIONAL to place in your profile. I don't know that it should their fault that users don't think it through and then become surprised/outraged when they find out what it really means.

It's an API

[mattwarden]

Dude, what is so hard here? It is an API. Do people typically customize an API for every user (as in application using the API) to limit the available calls only to what is needed? It is an interface. The data available in said interface is CLEARLY DOCUMENTED. Yes, technically Scrabble has access to the religion of its users. Yes, it could be storing this.

Seriously, what is confusing here? You have to agree when you add an application that it will be able to access your profile data. When you say 'yes, allow this', why would you be surprised that the application is then allowed to do what you just allowed?

http://developers.facebook.com/documentation.php?doc=fql

Facebook Developer

[justfred]

I'm a newbie Facebook app developer.

Here's the info I can see for any user that adds my app and clicks the box:

          uid*, first_name, last_name, name*, pic_small, pic_big, pic_square, pic, affiliations, profile_update_time, timezone, religion, birthday, sex, hometown_location, meeting_sex, meeting_for, relationship_status, significant_other_id, political, current_location, activities, interests, is_app_user, music, tv, movies, books, quotes, about_me, hs_info, education_history, work_history, notes_count, wall_count, status, has_added_app

(More info on the already-linked http://developers.facebook.com/documentation.php?doc=fql )

To me this seems like way, way too much. I haven't told our marketing people we can get all this.