Slashdot Mirror
Facebook Sharing Too Much Personal Data With Application Developers
An anonymous reader writes "Remember the Facebook News Feed privacy uproar? What about the Beacon scandal from late last year? Privacy activists are rallying around yet another major issue at Facebook, in which the company is secretly sharing user data with third parties. Researchers from the University of Virginia recently announced that in a study of the top 150 Facebook applications, more than 90% were given access to information that was not needed to function correctly. That Scrabble or Superpoke application you really like? Its developers get access to your religion, sexuality and home town. Facebook's position was summed up by Georgetown Law Professor Dan Solove, 'They seem to be going on the assumption that if someone uses Facebook, they really have no privacy concerns.' Do Facebook users deserve privacy? "
If you post it on the 'net, it's public information, no matter how secure or private the application is. One must treat his or her information on social networks this way, no exceptions.
Colin Dean Go a year without DRM
Do you really think I'm a Pastafarian?
...
Now, true, half my friends post pics of their drunken parties (yo! Aislinn and Katelyn! love the pics!), but so far I'm not in any of the pics, and I happen to know some of my friends are not the people they say they are
Nobody trusts the man, man. We all realize you're all pervs.
-- Tigger warning: This post may contain tiggers! --
At this point, I'd say no.
Personally, given their abysmal track record so far, I'd say that anyone using them at this point should assume they have no privacy at all. To some extent facebook is guilty of false advertising, by seeming to allow you to restrict other users from seeing some of your information. But why anyone who put anything on Facebook would expect any privacy at all, is a mystery to me.
It's not wasting time, I'm educating myself.
I haven't seen a company this determined to shoot themselves in the foot with bad policy since Real Networks. You'd think they would think Facebook might have realized at least some people actually do care about balancing utility with privacy.
When you add an application, it asks you quite clearly:
[ ] Know who I am and access my information.
It's the first checkbox.
Or, even better: you don't need to use applications! Hell, you don't even need to use Facebook! There are services like Hushmail for people who want privacy in their communications.
I work in Higher Education and we're just starting to get on the ball with recruiting via Social Networking (we're always years behind the curve -- I'm surprised we're this current actually) and just as with anything that you provide to a third party, you should really think about what that group needs to have from you in order for you to get what you need in return.
Higher Education is still generally based on paper marketing. Yes, we have a mass of information available on the web but it's not enough honestly and from some Noell-Levitz studies it has been found that the majority of students still want to be communicated by traditional mail marketing in addition to everything else. In fact, in the focus groups I have conducted on the topic, 89% of those that responded (pool of ~350) wanted no communication other than direct mail -- that was shocking to me, especially because they were traditional aged students (18 - 24). I have found that most students will give you their name and address (which is more than I normally will give anyone until I actually apply to the college) and not much else (no birthdate, prior education, and especially no phone number or e-mail address).
So, why are these people giving it to Facebook? Why would they trust that site more than an institution of higher education that is actually mandated by law to protect the privacy of those it deals with? I can't turn around and release any part of a student database to any third party unless its cleansed and has no identifiable information.
Personally, while Facebook is the "new big thing" in Higher Education, it's not worth it for our institution to spend all that much time recruiting by it. Our traditional data works just fine to increase enrollment through the traditional mail, phone and e-communication programs I have developed and redeveloped. That said, I really do believe that people should be very careful about what they put out on any social networking site. Contrary to the belief that there are no automated programs allowed to scour the site, they do and the data that comes back is some really interesting stuff to wade through.
Wait, last time I checked Facebook doesn't automaticly install apps you have to do it and confirm you are allowing this app to acccess some of your information. They don't give third parties your info, you do.
Deserve? Yes, everyone deserves the right to keep their personal lives private. Should they expect privacy? Not likely. There's no free lunch in life, online or offline: why would Facebook spend many millions of dollars maintaining a social network without milking every last bit of profit out of their user base? They're going to do whatever they can get away with, period. I don't know why people find this so hard to grasp: it's like when I try to explain to people that those "free emoticons" they so fondly install are filling up somebody's offshore server with their personal information and filling their monitor with pop-up advertisements.
body massage!
Maybe I'm just that suspicious, but the first time I went to look at one of those "applications" on facebook, the first checkbox in a list of a half dozen you can select before you hit "go" was a riff on "Allow this application to access my personal info" ---I automatically assumed that meant ALL my info, and promptly cancelled whatever it was.
Did anyone ever really have the assumption that that information was needed to make the app function, and not just a way of tricking users into giving up demographic info to third parties?
Personally I'm not sure Facebook is in the wrong on this one. It's up in big letters that you're giving whatever application it is access to your personal info--and all those things are OPTIONAL to place in your profile. I don't know that it should their fault that users don't think it through and then become surprised/outraged when they find out what it really means.
If you can't see the value in jet powered ants you should turn in your nerd card. - Dunbal (464142)
Facebook's position was summed up by Georgetown Law Professor Dan Solove, 'They seem to be going on the assumption that if someone
uses Facebook, they really have no privacy concerns.'
"They seem to assume that people who post their name, address, sexual orientation and gender on giant roadside billboards don't care if strangers know their name, address, sexual orientation and gender! It's like they think that people who go out into the crowded streets don't care who knows what shirt they're wearing!"
Dude, what is so hard here? It is an API. Do people typically customize an API for every user (as in application using the API) to limit the available calls only to what is needed? It is an interface. The data available in said interface is CLEARLY DOCUMENTED. Yes, technically Scrabble has access to the religion of its users. Yes, it could be storing this.
Seriously, what is confusing here? You have to agree when you add an application that it will be able to access your profile data. When you say 'yes, allow this', why would you be surprised that the application is then allowed to do what you just allowed?
http://developers.facebook.com/documentation.php?doc=fql
I have never bought into the argument that communicating online should always be legally regarded as the equivalent of having a conversation in public. People frequently put access controls and encryption on information sent over the Internet, and it's not like every person on the Internet has the ability to listen in on what you're saying in an IM conversation, emails, etc. There should be a reasonable basis to assume privacy in certain contexts, such as email and IM. IMO, the law should sanction people who eavesdrop on such communications without a good reason.
With Facebook, it all depends on the context. They should be required to show what information they are passing onto their application developers, but there should be no legal protection beyond that. People should be able to sell off their personal information in exchange for something they want. The only reasonable issue here is when the user is not able to reasonably find out and consent to the sharing of the information.
Personally, I am a lot more concerned with things like the FBI's latest attempts to get carte blanche access to email. If there is any institution that will destroy privacy in America, it's the federal government. Every major information/privacy issue that comes back to haunt the average person stems from the law or law enforcement agencies. The reason we worry about identity theft on the financial side of things is that the **law** does not put the onus on the lender to verify the identity of their customer. Why should it be my responsibility to ensure that someone isn't signing up in my name for credit cards? You worry about devastating legal decisions for privacy? The precedents are being set by the DoJ, not corporate America.
> They seem to be going on the assumption that if someone uses Facebook, they really have
> no privacy concerns.
Sounds like a reasonable assumption to me.
> Do Facebook users deserve privacy?
Sure. And they can have it. All they need to do is keep the stuff that they want to remain private off Facebook.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
It's been a wild success: the most poopular Facebook applications have around 24 million users[...]
That's just it: no one who adds the applications gives a crap about their privacy. When you add an application, there are several checkboxes, and you don't have to have them ALL checked in order to add an application, but the only one you DO have to have checked is the "Allow this application to know who I am and to access my information" box. If you uncheck that and try to add the application, Facebook tells you that you need to have this checked, and if you don't feel safe about that, don't add the application. Therefore, IMHO, Facebook gives plenty of warning to those adding applications.
However, I have very few applications on my Facebook - I don't care about the OC, or Dawson's Creek Quotes, or Hot Or Not. I find that the demographic of people that add those kinds of applications don't give two shits about their privacy, and they never read the fine print. They just want to show their friends how much they like the OC or Dawson's Creek. It's just natural selection, internet-style.
So, one day, I just sat down and yanked most of the applications out. so, if you send me something on the Funwall, sorry - I won't be seeing it. And if you have some dorky movie compatibility quiz, I won't be playing the game. If you want to contact me, there's a facility for sending messages and comments. If you can't get put enough words together to do that, then you're probably not one of my friends, anyway.
Facebook has outlived its usefulness.
Perhaps something like allvoices.com will be the next big thing because there, you have to do something - contribution to the data matters more than just being a consuming node for a data mine.
RS
Shoes for Industry. Shoes for the Dead.
As you know, IQ doesn't necessarily correlate positively with the hours in front of a computer. It may have been true in the 50s, 60s, 70s, and 80s, and to some extent the 90s, but surely not for this decade... The undeniable charm of the Internet destroyed that. :)
-
I have a friend who thought that the check box "Allow this application to know who I am and access my information" meant:
Allow it to know my name. Allow it to 'know' the info I put into the application itself. Ie, what I type INTO the funwall. She didn't know that it meant 'access my PROFILE information'.
I think this should be clarified to: "know who I am and access all of my profile information."
I don't see how this is a big secret. When you add an application there is a checkbox that says (and I quote), "Allow this application to... Know who I am and access my information." If you uncheck this box Facebook tells you "Granting access to information is REQUIRED to add applications. If you are not willing to grant access to your information, DO NOT ADD THIS APPLICATION."
I saw this the first time I went to add a Facebook app, and thought "hey, I don't want that, so I'm not going to add it."
Facebook is an advertising platform just like everyone else, so either I'm missing something (which, I'll admit is entirely possible--I recognize that I make mistakes all the time), or is there really a story here?
BTW, just read the terms of service for each application--if it doesn't say what they will do with your data, don't add the app. Then it isn't a whole lot different than putting the same data into any other web application. Also, being aware that this can happen, don't put data on your facebook profile you don't want the rest of the world seeing. It's not rocket science-just common sense.
I'm a newbie Facebook app developer.
Here's the info I can see for any user that adds my app and clicks the box:
uid*, first_name, last_name, name*, pic_small, pic_big, pic_square, pic, affiliations, profile_update_time, timezone, religion, birthday, sex, hometown_location, meeting_sex, meeting_for, relationship_status, significant_other_id, political, current_location, activities, interests, is_app_user, music, tv, movies, books, quotes, about_me, hs_info, education_history, work_history, notes_count, wall_count, status, has_added_app
(More info on the already-linked http://developers.facebook.com/documentation.php?doc=fql )
To me this seems like way, way too much. I haven't told our marketing people we can get all this.
Why is the application not treated as-if it were another user? From what I understand, there is a reasonable granularity of privacy settings for users. Let each app be a unique user, and you automatically get these benefits.
Or are the apps client-based, so that my Facebook on machine X can use apps and on machine Y it cannot, because of how it was set up? In this case, I suppose that I understand (since an app running as "me" only restricts "my" privacy as a favor, and cannot be compelled or punished, except by deletion).
the title of this post should read "People are sharing too much personal data with Facebook"...
Even pictures you didn't know existed get posted on the Internet and become essentially public information tied to you through facebook due to your meddling friends. This is how my privacy was breached: I accepted a friend's invitation to join Facebook. I input my real name, username and a password. That's it, I added no other details because I didn't really want an account, I just wanted to see pictures in his profile. Little did I know that I'd be subsequently deluged with requests from various acquaintances to reconnect after a dozen or more years -- I graciously accepted connect invitations, but refused to add any applications at all. Then a number of my friends who snap pictures at bars we hang out at or football game we go to, started identifying me in various snapshots, and these pictures are forever tied to my account. No I'm not happy about this, but serves me right for even signing up in the first place.