Facebook, Others Giving User Private Data To Advertisers

superapecommando sends along a Wall Street Journal report that indicates that Facebook's privacy troubles may be just beginning. "Facebook, MySpace, and several other social networking sites have been sending data to advertising companies that could be used to find consumers' names and other personal details, despite promises they don't share such information without consent. The practice, which most of the companies defended, sends user names or ID numbers tied to personal profiles being viewed when users click on ads. After questions were raised by The Wall Street Journal, Facebook and MySpace moved to make changes. By Thursday morning Facebook had rewritten some of the offending computer code. ... Several large advertising companies ... including Google Inc.'s DoubleClick and Yahoo Inc.'s Right Media, said they were unaware of the data being sent to them from the social networking sites, and said they haven't made use of it. ... The sites may have been breaching their own privacy policies as well as industry standards. ... Those policies have been put forward by advertising and Internet companies in arguments against the need for government regulation."

Comments

Oh Shit

[joepress99]

Guess the Journal forgot Rupert also owns MySpace.

Re:Oh Shit

[lennier1]

You expect people on /. to RTFA?

Re:Oh Shit

[Transaction7]

Right! If you believe Google, Yahoo, or either of our purchased and perverted political parties' protestations of innocence about this, which remind me of Shakespeare's "Methinks thou dost protest too much!!," I would like to talk to you about a great deal on a bridge in Brooklyn. I depend upon a lot of ad-supported Internet content, so can't complain about ads, and it is only natural that the advertisers want to target them to users more likely to buy their stuff, so acertain degree of targeting and the data collection necessary for that must be expected. It doesn't bother me if I look up new cars and get ads from Ford and Toyota instead of Purina Puppy Chow, while I get puppy food ads when I look up the specifications for a fence for a Jack Russell, computer-related ads if I go to Dell or Microsoft sites, etc., provided, and only provided, that they do not save or pass on such data ina form that can identify me. This gets a whole lot more troublesome if, in the course ofmy law practice or other research, I happen to be researching medical or mental health issues, child sexual abuse and STDs which uexpectedly came to figure in my law practice and other privileged and confidentil relationships, erectile dysfunction, or specific legal issues and strategies for an upcoming case against the government or a big company. I quit using one site geenrally regarded as reputable on sexual and other medical issues because, when I went there to check some data on sexually-related matters, I quickly started getting a lot of spam for fake viagra and the like telling me, falsely, that my wife, whose name and less common spelling thereof they guessed right, had said, in gutter language she never would have used anywhere, that I was no good in bed, etc. My wife has a separate user page on this computer and separate Email accounts, user accounts and "handles" for various sites, etc., and on her cell phone. Members of Congress and Presidential candidates of both parties have repeatedly assured us that they have already passed effective legilslation dealing with spam, phishimg, computer and ohter privacy, child sexual abuse including child porn, etc., not to mention health insurance for small businesses like mine before I retired, and that they and only they would promptly catch Osama Bin Laden and bring about prosperity and world peace when eelcted. . Both candidates promised in their 2008 campaigns to pass one law that they had bragged to me about haing passed alrady years earlier. Obama VP Joe Biden and McCain both introduced separate bills to protect children from abuse during the 2008 campaign cycle, shortly after passing the comprehensive Adam Walsh Act that was supposed to cover that subject. OK, I do want the authorities to be bel to investigagte and enforce ourlawsagianst terrorism, child sexual exploitation including but not limited to child porn, and malware distribution, and to be able to do what is necessary to deal with the use of the Ingternet to accomplish that. Nobody I know wants eihter the government or business firms ["leviathon and Leviathom, Inc., as one perceptive writer put it] to be allowed to collect or disseminate detailed profiles on individuals, even to enforce a lot of the literally innumerable laws, rules, and regulations on the books. I need to know if a prospective employee is a thief or a spy, but it is essential to freedom and democracy, and the exericse of our fundamental, unalienable, God-given rights, that we must be free to post our thoughts in our own names or anonymously, and to make a fool ofourselves now iand then which is perhaps the most essential right guaranteed by teh First Amendment and certainly the one most people are mostlikely to exercise, without exposing oursleves to unfair and ilelgal discrimination in employment, etc., inevitable when employers nad prospective employers go into our political speech, disclosures of ourrace, sex, age, religious or political affiliations or beliefs, juvenile indiscretions, and credit scores, etc. Just as with the pending financia

Re:Oh Shit

[riT-k0MA]

Summary, anyone? >.>

Unused

[Thanshin]

they were unaware of the data being sent to them from the social-networking sites, and said they haven't made use of it

Ahh, they didn't use it. Then it's all right.

Nothing to see here.

I wonder if TPB could use the same defense. "Wait what? You can SEE the downloaded movies? Whoa!"

Re:Unused

[Anonymous Coward]

the article in now way says that the data not being used absolves Facebook, they're saying that to some degree, if true, it absolves DoubleClick and RightMedia, who can hardly be blamed for being sent data they were unaware of and didn't ask for.

Re:Unused

[commodore64_love]

Ha! Funnny.

I honestly don't care if advertisers learn that I like collecting old computers and other hobbies. I'm more concerned about the info leaking to people with REAL power over me. Like a prospective employer (hmmm, he is pro-gun - don't wanna hire him), or the US government (this guy sold Final Fantasy 7 for $150 and didn't pay taxes).

Re:Unused

[sopssa]

While I've "closed" my Facebook (seriously, why there isn't a true close account option?) for privacy reasons, lets look at it on technical terms. It's a problem with the referrer field being sent by browsers, nothing intentional on Facebook's part. If you have referrer sending disabled you aren't affected by this.

It's a bad combination of browsers sending referrer, Facebook using real names for everything and Facebook not providing enough privacy options to hide your profile, and Facebook not using https or iframing the ad box (in that case referrer would just show something like http://www.facebook.com/ads/ ).

I guess those ad networks don't actually have something that gets the personal info for clicks, but it's a possibility and I bet the referrer is saved, at least in logs and statistics.

Of course, majority of people don't care so business will continue as usual.

Re:Unused

[FreakyGreenLeaky]

Similar to Google's "accidental" sniffing of public wifi -- they didn't use it, so that makes it all right.

Bloody criminals.

Re:Unused

[Sockatume]

I don't think they'd argue that it was okay - the fact that they apologised speaks otherwise. However it's a mitigating factor. You would hardly argue that a company that did use data scraped this way was no worse.

Re:Unused

[alphax45]

There is a true "close" option: http://www.wikihow.com/Permanently-Delete-a-Facebook-Account

Re:Unused

[rhp997]

"I didn't inhale"

Re:Unused

[JerkBoB]

While I've "closed" my Facebook (seriously, why there isn't a true close account option?)

https://ssl.facebook.com/help/contact.php?show_form=delete_account

Re:Unused

[Anonymous Coward]

Don't you get it? You can't trust *anyone* with too much information. People say they don't care if marketers know all about them, but if it is allowed to get to the point that advertisers have complete profiles on people for marketing purposes (and things like facebook are very near to making that possible) then what stops them from sharing that info with the government, or selling it to employers checking on an employees private life, etc, etc. Do you think the advertisers would turn down the extra money? Do you think they would decline to do it because it's unethical? We're you born yesterday??

Re:Unused

[Archangel Michael]

"Similar to Google's "accidental" sniffing of public wifi -- they didn't use it, so that makes it all right."

I don't get this one. WHY is it wrong? Didn't we /.ers love the stories of wardriving years ago, when people posted the location of open WiFis so we could leach off them?

Look, if you don't want Google Doing it, because they are "BIG CORP", then don't do it yourself. There is no difference between the idea of wardriving individually, and Google doing, except for scale.

I don't have a problem with Google Wardriving. NONE.

Also, Internet is NOT secure. There is no privacy on the internet. NONE. Everything that makes the internet useful to you, is a way to make it easier to track you.

What you put up on the internet is there for everyone else to see, forever. Even if it "delete" it, it probably lives somewhere on some server or another.

We might as well get used to this paradigm and either not do anything on the internet, or just learn to be careful knowing the whole time that we can't be careful enough.

I'm not all that concerned with what is on my facebook, as it is all public info anyways. And I don't fear stalkers, they should fear me. ;)

Re:Unused

[Requiem18th]

They'll find out when the gun sites you visit tell facebook, remember the bacon fiasco? One must be careful it doesn't happen again, mainly by complaining about it.

Re:Unused

[Tamran]

Thanks for the link JerkBoB.

Re:Unused

[soppsa]

How did you make all those facebook friends posting on slashdot for 8 hours a day from your mum's basement about how much America is inferior to Europe???

Re:Unused

[Tarsir]

Look, if you don't want Google Doing it, because they are "BIG CORP", then don't do it yourself. There is no difference between the idea of wardriving individually, and Google doing, except for scale.

I'm not sure about this particular instance, but a difference in scale can be much more significant that you imply. Consider someone who doesn't usually shred or burn his bills before throwing them out. He just tosses them in the trash. There is a small risk that someone could go through his trash, find these bills, and use the information on them to open a bank account in his name, or perform some other fraud. It's small though, because rooting through dumpsters is a lot of work for relatively few potential victims.

Change the scale, though, and suddenly this becomes profitable--if you get access to a database of millions of people's address, names, and account numbers, you can make decent money even if only 1% of those records pan out into a successful fraud.

Re:Unused

[bigngamer92]

remember the bacon fiasco?

No. Tell me more! It sounds like a juicy story.

Re:Unused

[FreakyGreenLeaky]

I think they'd argue anything to protect their "do no evil" image -- an image which was already tarnished before this "accident".

I think they considered a public apology to be the lesser damaging -- the other being a possible damaging disclosure by a whistle-blower with them caught holding their peepee.

Re:Unused

[FreakyGreenLeaky]

WHY is it wrong

I think you have serious trust issues, and not in the way you think.

Somehow, because it's Do-No-Evil-Google, it's not wrong. If it was your gov, you'd be pissing in your pants.

I'm afraid you seem to fall in the "people" category of your sig, no offence.

Re:Unused

[Archangel Michael]

I'm not the one clammering for fake security at airports, nor pretending that all is safe in the world.

Actually, if you READ my post with any understanding, you'll no doubt run into this quote: "just learn to be careful knowing the whole time that we can't be careful enough."

You see that? RIGHT THERE? That means something to me. You can't steal my identity and have it be useful, because I've lived a life without a single credit card, or debt. NONE. So Stealing my ID gets you ... nothing.

I don't have issue with APPLE or Microsoft either. I shop at Walmar, Costco and also at local shops and farmer's markets. I pay cash for most things, and therefore not trackable.

I'm an IT guy, doing this for nearly 30 years now, so I've been long aware of what it means to be tracked by computers. I help do it. I also know that certain things are inevitable and the only thing we can do, is simply realize that it is never going to be perfect; we cannot be careful enough.

If you're scared of "BIG CORP", then I suggest you stop Patronizing them altogether, and that you go live off the grid in a stone house you built yourself, because that is the only way to be 100% sure that no big company is going to not screw you when you do business with them.

Re:Unused

[FreakyGreenLeaky]

You'd be surprised how many people who lurk around here also have almost 30 years in the IT industry.

When you start your post with I don't get this one. WHY is it wrong? then there really isn't much need to read the rest of your post, is there? If you fail to understand why it's wrong, then I'm afraid you remind me of these religious zealots -- just no reasoning with them.

You'd be surprised in how many countries around the world it's illegal to go around sniffing networks (how is this behaviour any different to going around trying doors until you find one unlocked -- or lurking around at night around your mother's home looking for an open curtain so a wanker can have a peep at her shaving?). You don't get a get-out-of-jail-free card just because you said sorry. ...and what's up with your Google-cock-sucking? You work there or something?

Cue

[Anonymous Coward]

Cue the "privacy is dead" asshats, who for some reason are determined to purge the natural human desire for privacy that has existed since the dawn of human evolution.

Re:Cue

[sakdoctor]

Yes I never understood those asshats. It's like a false "monochotomy".
I don't have a facebook account, and I don't have any idiot farmville playing friends, that would violate my privacy. Therefore I have opted out of facebook. Hey, that wasn't hard.

Oh and I'm using the friend 1.0 definition, ie: people I know with mutual trust, as opposed to the friend 2.0 definition of linked social networking profiles who have poked and bitten each other in the last 6 months.

Re:Cue

[Anonymous Coward]

Some people learn in momentary bursts of insight. They LOVE the Barbary Coast attitude of the Internet because is it's like manhandling a pinball machine. They don't always like the lack of law and order but it seems that they only do something about it when they get a tilt penalty. All in all, this is a pretty White discussion.

Re:Cue

[dyingtolive]

I don't believe privacy exists really anymore, but I wouldn't say that privacy is dead, it's more like it was just given away freely and irrevocably without a second thought as to the long term ramifications. I refused to use facebook for the longest time, but I've personally given up. My friends use it and it's their primary means of communication, above and beyond simpler and "better" things such as email. I just try to keep as much actual honest information about myself off there as possible and keep my head down to limit damage as much as possible. The moment someone comes up with an alternative solution that I can talk even the laziest person into migrating to, let me know. Until then, I'm living with the subpar solution for lack of a better.

Also, "privacy is dead" is the bumper sticker slogan those people go by. I've never heard anyone outside of corporations and governments (hard to tell the difference anymore) saying that it is. They're not determined to purge the world of privacy, but merely to illustrate to people just how privacy-free it's become.

With regard to the "news" itself, color me completely unsurprised.

Re:Cue

[dyingtolive]

I've never heard anyone outside of corporations and governments (hard to tell the difference anymore) saying that it is [a good thing].

Fixed that for myself. Brain moves faster than the hands sometimes.

Re:Cue

[siloko]

who for some reason are determined to purge the natural human desire for privacy that has existed since the dawn of human evolution

mmm maybe privacy meant something different back then but I'm sure in all those 'caveman' films the dudes were walking around in the buff . . .

Re:Cue

[tpstigers]

Don't be stupid. Privacy isn't dead. It just that privacy is - and has always been - up to the individual. The issue we keep running into here is that people expect someone else to protect their privacy. If you want real privacy, it's up to you to secure it and maintain it.

Re:Cue

[Jeng]

I always thought it was pretty stupid to put all of your personal information online then complain about people being able to see all of your personal information.

Of course privacy is dead, when you give your privacy away.

Re:Cue

[u-235-sentinel]

Cue the "privacy is dead" asshats, who for some reason are determined to purge the natural human desire for privacy that has existed since the dawn of human evolution.

You are presuming the "Privacy is dead" crowd have evolved? ;-)

Re:Cue

[Abcd1234]

I don't have a facebook account, and I don't have any idiot farmville playing friends

Are you sure? For all you know, right now, a friend or relative of yours is posting pictures of you on Facebook, and there's absolutely nothing you can do about it. It's a brave new world.

Re:Cue

[sakdoctor]

Yes I'm sure, otherwise I wouldn't have posted it.

Believe it or not, many non-geeks have an intuition for online privacy. Not everyone is a fucktard click-monkey, despite the existence of facebook proving that most people are.

Re:Cue

[Abcd1234]

Yes I'm sure

No. That's impossible.

Are you vetting every photo any of your friends or family has every taken? Monitoring their online activies? Are you vetting all photos taken by other people at, say, social events (weddings, etc)? Are you vetting their online activities? No? Then you can *never* be sure if someone isn't posting information about you, somewhere. Well, unless you just hide in a basement with no friends or family to speak of, in which case privacy is the least of your problems.

Re:Cue

[interkin3tic]

the natural human desire for privacy that has existed since the dawn of human evolution.

Getting a funny mental image of Adam and Eve detagging all their facebook photos with naughty bits in them after eating the apple.

News Feed:

Eve and The Serpent are now friends
Adam and Eve became fans of "Eating from the tree of knowledge" and "If one more person posts their cave drawings, I'll quit facebook"
Adam "LOL, apples R so GOOD"
Eve --> Adam: "where u at? Bring as many fig leafs as you can ASAP!"
Eve changed her profile picture
Adam and eve left "Garden of Eden" network.
Adam is OMFG PAIN SUCKS!!! I MISS THE PORN BUSH!!
Adam and Eve joined the group "2 strong for getting Adam and Eve back into the Garden of Eden"

Re:Cue

[improfane]

I am completely with you! If you want privacy now you have to work for it now which is definitely wrong. If you use FireFox then I recommend these extensions:

  - No Referrer - removes the referrer
  - NoScript - kill the scripts that are the source of vulnerabilities
  - Cs Lite - block the cookies that track you
  - Refresh Blocker - prevents annoying meta refreshes
  - Ad Hacker - shows what networks are being used for ads or tracking
  - Redirect Cleaner - cleans URLs with embedded URLs to remove tracking such as SERPs
  - AdBLocker - should pick up same-domain ads that Request Policy omits if I temporary allow to get website looking okay
  - Request Policy - avoid loading junk

I think this is pretty well rounded but the biggest weakness is JS revealing everything by default which is annoyng because there are no extensions for this yet.

If it's on Facebook..

[goldfishbrains]

..it's not private. Came across this yesterday http://youropenbook.org/, It made me laugh.

Re:If it's on Facebook..

[s.bots]

There's also the open source privacy scanner:

http://www.reclaimprivacy.org/facebook

Double click

[Anonymous Coward]

How quaint. The domain every geek has blocked since 1996.

With all this facebook detritus littering the web, are there some facebook domains and subdomains that need to be blocked, because they are being used for tracking?

Re:Double click

[Culture20]

How quaint. The domain every geek has blocked since 1996.

FYI, TFA says the data was shared, not that doubleclick was contacted by end users' browsers. Block doubleclick all you want, but unless you can block doubleclick from Facebook, the sharing still likely happened.

Re:Double click

[Sockatume]

The sharing only happens when you actually click on an ad, because it's an issue with referral URLs.

Re:Double click

[Sockatume]

You clearly didn't read TFA very well.

The real news to me...

[orthancstone]

People still click on ads?

Re:The real news to me...

[Bigbutt]

Of course. Otherwise how would they get malware installed?

I have been having fun clicking the 'x' on the Facebook ads to remove them. "Why are you deleting this ad? x Uninteresting"

Yep, they're all uninteresting. :)

[John]

Re:The real news to me...

[gbjbaanb]

People still click on ads?

People still *see* ads?

Re:The real news to me...

[orthancstone]

I suppose that would've been the better way to put it. Well said.

Re:The real news to me...

[ElKry]

You know, I do that too - and so does my wife. Except I go for "Offensive" and she goes for "Repetitive". Team work, you know.

surprise, surprise

[Tom]

Is anyone surprised? As soon as companies grow so big that consumers can not easily vote with their wallet anymore, or their offers are non-monetary for the end-user (who is the product, instead of the consumer), there's no reason they would take privacy seriously. I'm pretty sure the bad PR is the only reason they worry about it at all.

In advertisement, all commercial participants conspire against the consumer.

I'm not a friend of government (especially our current one here in Germany, a bunch of monkies could do a better job) - but I don't see which other organisation could regulate these commercial big players anymore. Certainly not the consumers, who despite Internet and all theoretical options of banding together simply have 1000 other things in their lives to worry about, so finding a sufficiently large group of people who care about this particular thing enough to make a difference is as hard as ever.

Re:surprise, surprise

[CFBMoo1]

I didn't vote with a wallet per say but I did vote with an account delete on Facebook a few days ago. Assuming of course they honor my request.

How to do it if your curious:
http://www.wikihow.com/Permanently-Delete-a-Facebook-Account

Re:surprise, surprise

[AnonymousClown]

I think most people don't even think about it or don't think they have anything to hide - until their identity gets stolen or they get fired for a post on their Facebook page.

Unfortunately, throughout the Western World, we have worried so much about government trampling our rights that we completely ignored the private sector.

To head off the "well, just don't do business with them!" posts, I'd like to point out that Facebook stated in their policies that they wouldn't do this and secondly that every service, whether it's cell phones or internet sites, has a little statement buried in their terms that states they can change the terms anytime they want.

I really hope Facebook gets sued over this a loses and a precedent is set over internet website policies - in the consumer's favor.

Re:surprise, surprise

[sakdoctor]

simply have 1000 other things in their lives

ONLY because of facebook! Sell your friends, write "cool story bro" on someone's wall, decline a bunch of people, post pics of yourself passed out drunk in the bath.

Without facebook they would have nothing to do in their lives, and would therefore have time for political activism. And philosophy.

Re:surprise, surprise

[Sockatume]

There's no conspiracy. RTFA: as difficult as it may be to get your slashbrain around it, the privacy issue is a technical accident.

Re:surprise, surprise

[sakdoctor]

You missed the boat. There was a time when deleting your account would, more or less, delete your account.
Now days it doesn't.

Today you should disband and pollute your data over a matter of months, and delete your account.
Then change your name, sex, nationality, and fake your own death.
Then finally change your name, sex, and nationality again.

Re:surprise, surprise

[pooh666]

Yes, we need a bloodlyfingduh tag.

Re:surprise, surprise

[rtb61]

There are better alternatives. First alternative work hard at undermining the popularity of the social networking site that hhad all you data, mined all your associations and monitored all your clicks. Do a good enough job and the revenue drops squeezing down hard on the costs of hoarding all that private data, eventually shutting them down, of course all that data then gets sold at the bankruptcy auction forcing you to repeat the exercise until companies decide all that privacy invasion ain't really all that profitable.

Second alternative, seek changes to the law, force stricter privacy requirements, what information companies can keep on private individuals, stricter protections for minors, deletion of information requirements, data correction requirements, data mining restrictions and, random privacy audits with criminal penalties for invasions of privacy.

I personally prefer the regulation and prosecution route, although I can protect my privacy as much as I choose to, I am still concerned about the current younger generation getting caught out with long term psycho analysis, known marketing vulnerabilities, known subconscious triggers and permanent limitations upon future career opportunities.

Re:surprise, surprise

[dkleinsc]

See, the basic business cycle of a social networking website goes like this:
1. Site attracts core group of users with good privacy protection, features, and general usefulness that is superior to their competitors.
2. Everyone who wasn't attracted in step 1 signs up to new site, because they want to be on the same network as their friends.
3. Site locks the users in by having the user's social life revolve around the social networking site, rather than real life.
4. Company that created the site "monetizes" the customers by selling their eyeballs for ads and their information to marketing companies. They also start charging for some of the niftier bells and whistles, and eventually for the stuff that used to be free. If possible, the founders make a huge bundle from stupid investors.
5. Because of the practices in step 4, the good privacy protection, features, and general usefulness of the website drops.
6. Users get fed up, find some other social networking site that provides good privacy protection, features, and usefulness.

This cycle has happened at least twice (LiveJournal, MySpace). Facebook has been at step 4 for a while, and is getting closer to step 5 or 6. And steps 3-4 are why I refuse to sign up for these sites.

Re:surprise, surprise

[Tom]

conspire != conspiracy

In the literal meaning of the word, all the participants - the website you're visiting, the ad agency, the ad network, their customers - all work together against you. There's no reason to be dramatic, but it's a simple fact that they are all trying to coerce/convince/manipulate/whateveryouwanttocallit to split with some of your money into their direction, which then feeds them all.

Re:surprise, surprise

[Sockatume]

A group colluding against someone is a reliable definition of a conspiracy.

Re:surprise, surprise

[John Hasler]

> First alternative...
> ...
> Second alternative...
> ...

Zeroeth alternative: don't use it if you don't like it, or at least don't post your secrets.

> ...I am still concerned about the current younger generation getting
> caught out with long term psycho analysis, known marketing
> vulnerabilities, known subconscious triggers and permanent limitations upon future career opportunities.

Then tell them. If they choose to ignore you that's their right. If by "the current younger generation" you mean children, tell their parents.

Re:surprise, surprise

[John Hasler]

> ...a little statement buried in their terms that states they can change the > terms anytime they want.

It's there, isn't it? And if you read the "TOS" you'd know about it. In any case, they cannot change the terms retroactively (not even if the TOS clains that they can). The terms that are in effect at the time you use the service are the ones that apply to that transaction.

Re:surprise, surprise

[Golddess]

Facebook I'll agree, but if you're a telecommuter and Comcast is the only player in town?

Re:surprise, surprise

[Tom]

I'm not a native english speaker, but in my conception, a conspiracy requires some temporal consistency, i.e. it should endure over some time. In this case, the members of the "conspiracy" are constantly changing, and everyone is colluding with everyone else. It doesn't fit the common definition of a conspiracy which is more like a small group of people giggling madly in the corner.

But that's just words. Call it whatever you want.

Re:surprise, surprise

[rtb61]

For those who are more aware of the consequences to ignore their knowledge and allow others to fall victim to those who would exploit them, makes them nearly but not quite as bad as the exploiters. The exploiters who make use of their knowledge and the lack of understanding of the less intellectually abled in order to deceive and exploit them, well tough, the karmic reward I (and of course many, many others) feel I gain from working to disrupt greed and deceit more than makes up for the presumed deflation of bloated ego the exploiters suffer when they can no longer prey upon the ignorance of others.

There is more fun in working for the overall balance of a better, healthier and happier society then endless quest for exclusivity, having moving and forcing less upon others. Just as mature adults protect minors from exploitation by deviants, so the more intellectual aware should protect the less knowledgeable from exploitation by misanthropes and, psychopaths ie. the insatiably greedy (in the case your typical data mining corporate executive privacy invasive deviant).

I'm shocked! SHOCKED!

[$RANDOMLUSER]

I'm not shocked by the breach of posted privacy policies, but by:

Several large advertising companies... including Google Inc.'s DoubleClick and Yahoo Inc.'s Right Media, said they were unaware of the data being sent to them from the social-networking sites, and said they haven't made use of it

So Facebook and MySpace were just doing this out of the goodness of their hearts, not making any extra money from Google & Yahoo?

Re:I'm shocked! SHOCKED!

[AnonymousClown]

It seems to show more incompetence than malicious intent,...

Facebook? The hottest thing on the Internet since the 90s and has the choice of the best of the best of the best web developers - made a mistake like that?

Re:I'm shocked! SHOCKED!

[Sockatume]

If you RTFA, they were doing it by simple technical accident. Unless the advertisers thought to scrape referrer URLs for usernames, they didn't get shit.

Re:I'm shocked! SHOCKED!

[$RANDOMLUSER]

Yeah, I get that. Meanwhile, the user pages have already been spidered, so it's just a case of attaching one to the other.

Re:I'm shocked! SHOCKED!

[Sockatume]

The possibility of an exploit is not evidence of exploitation, the wrongdoing that you claim.

Re:I'm shocked! SHOCKED!

[Anonymous Coward]

It seems to show more incompetence than malicious intent,...

Facebook? The hottest thing on the Internet since the 90s and has the choice of the best of the best of the best web developers - made a mistake like that?

Are you kidding me? Have you ever even looked at Facebook? From a purely technical point of view, it's a half-assed slapped together with duct tape piece of shit. It's only technical merit is that it's not nearly as horrifyingly amateur as MySpace.

Facebook may be "all the rage", but the best of the best work for Google and Microsoft, not Facebook.

Re:I'm shocked! SHOCKED!

[PopeRatzo]

I don't think Facebook was doing this on purpose

Of course not. Why would they give the advertisers that provide them with revenue something that they desperately want?

It's not like they're in the fucking business of sharing people's information after all, right?

Re:I'm shocked! SHOCKED!

[PopeRatzo]

Unless the advertisers thought to scrape referrer URLs for usernames, they didn't get shit.

And we all know that advertisers would never do anything as underhanded as mine information from a data stream, because that would be wrong.

Re:I'm shocked! SHOCKED!

[Sockatume]

They might if it doesn't even occur to them. It's a pretty obscure issue.

Re:I'm shocked! SHOCKED!

[Abcd1234]

So Facebook and MySpace were just doing this out of the goodness of their hearts

Or it could just be a bug.

Don't attribute to malice what could easily be explained by sheer incompetence...

Re:I'm shocked! SHOCKED!

[Abcd1234]

Maybe you should try calming down a little. The world isn't out to get you, and big bad Google and Facebook aren't stalking you while you're walking home at night.

People make mistakes. It happens. In the case of organizations that deal in sensitive information, those mistakes can often mean nasty, high-profile bugs like this. But that doesn't change the fact that they're simple mistakes, and not, in fact, a vast conspiracy to share your personal information with all those big, evil corporations.

Re:I'm shocked! SHOCKED!

[Anamelech]

Maybe you should try calming down a little. The world isn't out to get you, and big bad Google and Facebook aren't stalking you while you're walking home at night.

You're absolutely right. They follow you during broad daylight.

Topical..

[Zerak-Tul]

http://xkcd.com/743/

Re:Topical..

[phyrexianshaw.ca]

that's exactly what I was just thinking. personally, I have no issue with the information I give to a site like that going anywhere the owner's want it to. that's why it's on the internet in the first place

Re:Topical..

[BitZtream]

Except ... that comic is compare two unrelating things like if doing one would have affected the other, which it wouldn't.

The first 2 panes are spot on with a major 'geek' problem. People don't give a shit about nerd turf wars over document formats, what they have WORKS for them and everyone else, geeks included. No one has told everyone they aren't allowed to do what they want with their Word docs. When they do, then you can make this argument. Until then any format you propose is effectively the same for anyone except a true hacker which can go and write a parser for some open format after its no longer relevant to anyone. Which excludes about 99% of slashdot.

The implication here is just retarded is so wrong.

Re:Topical..

[Andorin]

Except ... that comic is compare two unrelating things like if doing one would have affected the other, which it wouldn't.

You're missing the point. Beardy McNerdy is the sort of guy who reads Slashdot and worries about these sorts of things: open standards in the case of the .doc part, and 3vil social networking sites abusing their power and position. Sticky non Techie, on the other hand, is your average condescending person who sees all of it as pointless and just wants to read about the new iPhone release. The comparison is between two forms of 3vil perpetrated by a corporation: the former is Microsoft's strategy of locking users into their products by disallowing open standards, and the latter is Facebook's recent big privacy fuck-ups. (Could also be argued that Facebook employs vendor lock-in by keeping their platform closed and not allowing others to facilitate communication through it. Yes, this doesn't apply to IM, so I refer to profiles/groups/everything else.)

In both cases, Beardy McNerdy is your average geek, trying to warn others about the perils of big corporations in the online and personal computer worlds. The irony is that in one case, Sticky non Techie is fine with the 3vil, but in the other, he's actually running to Beardy McNerdy with the news, alarmed.

People don't give a shit about nerd turf wars over document formats, what they have WORKS for them and everyone else

Except when people get macro viruses from .doc files.

Re:Topical..

[phyrexianshaw.ca]

Here here. It's funny that you'd respond to the exact type of person that the comic was referring to.

I noticed my old myspace appeared after years...

[Anonymous Coward]

I often search for my name in a futile attempt to remove myself from the internet. I just checked the other day and noticed some person search company, intellius or something has aquired my myspace profile, pics of my friends etc. I have had myspace account closed for at least 3 years if not longer. When I attempted to figure out what was going on by logging into myspace I couldn't even get in... my account was closed. All I know is I'm giving my kids a helping hand when it comes to their first entrance onto the web. Bunch of information vampires out there.

Referrer URL is the issue

[Sockatume]

My reading of the WSJ article is that the sites were (perhaps inevitably) passing a referrer URL along when the user clicked the ad. This URL is, naturally, one of the user's pages, and will explicitly or implicitly identify the user. The advertiser can then identify the user's page on the social networking site and retrieve any public information there. The WSJ makes it clear that the information is not passed on directly, which goes some way to explaining why the advertisers claim never to have used it.

Re:Referrer URL is the issue

[gzipped_tar]

Meh, trusting the client's Referer is futile at best. Any self-respecting geek already uses spoofed Referer headers.

Re:Referrer URL is the issue

[Sockatume]

Furthermore, the headline is inaccurate. Personal data is could potentially be retrieved by advertisers, but it is public data.

Re:Referrer URL is the issue

[PopeRatzo]

Meh, trusting the client's Referer is futile at best. Any self-respecting geek already uses spoofed Referer headers.

We're not worried about geeks, because they are already using carefully created false identities which they have bought on the black market from Bulgarian ex-secret police. Plus, nobody wants their fucking data anyway.

We're worried about regular humans who don't have a clue and put their lives on the internet because the biggest corporations in the world have told them that it's perfectly OK and "the thing to do".

Re:Referrer URL is the issue

[Sockatume]

I think it's time for us to decide whether the ability for a site to request its referrer is worth the potential privacy issues. Should it not be opt-in? It's not like a cookie, you don't explicitly elect to provide the site with the information in question.

Oh, REALLY?

[Millennium]

If this is true, then Facebook is committing fraud. Shut them down.

Hanlon's razor?

[mcgrew]

Some people use it as an out; "Oh, I'm sorry, I didn't know!"

Never attribute to malice that which can be explained by incompetance? Yes, that applies, unless it crosses "never attribute to incompetence that which can be explained by greedy self-interest". That's the razor that applies here; if your "mistake" benefits you, only a fool will believe it's a mistake.

Mr. Brin, I love your search engine, but please change your lying motto.

Re:Hanlon's razor?

[Sockatume]

Except, this didn't benefit anyone. The ad providers would have to figure out that they were being given personally-identifying referrer URLs for clickthroughs, scrape the username part, and visit the user's (public) profile to retreive any personal information. From the sounds of things that conceptual leap didn't actually occur.

Re:Hanlon's razor?

[Sir_Lewk]

Sufficiently advanced incompetence is indistinguishable from malice.

Re:Hanlon's razor?

[John Hasler]

> The ad providers would have to figure out that they were being given
> personally-identifying referrer URLs...

In other words, they were being given this "personal" information by the user, not by Facebook. The referrer is recorded and handed over to the referred site by the browser, not by the referring site.

> the user's (public) profile to retreive any personal information.

No, to retrieve public information. It's a public profile, remember?

So (yet again) I must ask

[Jawnn]

Why would I want to use Facebook at all if I value my privacy? And a follow up which is probably more to the point, with all the shit Facebook has pulled, why are you bitching about it if you're still a user?

Re:So (yet again) I must ask

[Rob the Bold]

Why would I want to use Facebook at all if I value my privacy? And a follow up which is probably more to the point, with all the shit Facebook has pulled, why are you bitching about it if you're still a user?

Maybe you do value your privacy with some (strangers, employers) more than with others (friends, family). I think that privacy, like intimacy is not a binary thing. There are people whose hand you wouldn't even shake, folks you would hug in public and people who've seen you naked, right? (I'm being rhetorical here, you don't need to answer that.)

I take your point about facebook, though. They don't act trustworthy and do act too capriciously. Nevertheless, people would like to expose some of themselves, just not all of it and just not to everybody. Facebook happens to be extremely popular: many of your friends are there. Bitching about facebook's crap is actually quite reasonable. You'd like them to change to avoid the hassle of finding another alternative. They probably won't, given their history, but they certainly won't if no one says anything.

Re:So (yet again) I must ask

[phyrexianshaw.ca]

by exposing these private details even to somebody that you think you trust, you're still giving them away. what that person does with them is up to them.

I respectfully disagree though, privacy is a very binary thing. unless you want to go live in a cave and stop using modern systems, it's time to get over it.

Privacy should have died years ago.

Re:So (yet again) I must ask

[izomiac]

For the same reason one might go to a social gathering at a restaurant that you're not particularly fond of. It's a cost/benefit calculation. If you want privacy at the expense of everything else, go live in the forest or on a deserted island. OTOH, basically everyone values privacy (albeit to differing extents), so it's all optimization. Personally, I'd like it if Facebook didn't have such a high privacy cost.

Government Regulations

[Anonymous Coward]

That final quote is clearly implying that this evidence is proof that we need government intervention. We should strenuously oppose this, and we need to be aware of the subtle messages to try to persuade us to change our minds. Don't give into the manipulation!

In fact, this entire episode is strong and conclusive evidence that we do not need government regulations in this area. The private sector exposed the problem and the companies made the appropriate changes. This is how it should be done. If we don't like a product or service, then we should take our business elsewhere. Facebook is not a right. It is not an entitlement. It is a website, people, and you are free to go and use a different website if you choose. Perhaps if more people did, Facebook would clean up their act. We need to regulate the Internet not the government. I would rather keep the government as far from the Internet as possible for my own peace of mind. They have enough power to be corrupted without giving them more.

How can putting a corrupt and greedy government in charge of regulating the Internet possibly be a good thing?

Re:Government Regulations

[John Hasler]

> Perhaps if more people did, Facebook would clean up their act.

And the fact that few people do means that few people care. The fact that few people care means that there is no need for more laws (except, of course, as yet another excuse for bigger, more intrusive, and more centralized government).

Advertisements pay their bills

[realsilly]

So you join a Free Social Networking site, that is maintained and updated all the time. How do you think this shit is paid for? Advertisements! How best to make Advertisements work then to target them to the audience. Of course they're sharing this data, the Ad Agencies want it and are willing to pay for it. The Privacy concerns are the issues for Facebook, not the Ad Agencies. The only way to go after them is if they bought data that was illegal to sell or share. As much as I'm not a fan of this reality, there is nothing private on the internet.

Google

[jvkjvk]

Somehow, I don't buy it, and it makes me sad that Google has gone this far down the path of Corporatism.

Now, they lie to us to our faces. I find it impossible to believe that Google did not know what was in the strings being sent to it.

Google is trying to tell us that they are so incompetent that they did not realize what all that information in the strings that were sent to it actually signified.

Right.

Either their hiring practices scrape the bottom of the barrel (which we know is not true), or they knew exactly what information was in all those strings, since that's their job. Collecting and analyzing information (of which those URLs are a subset).

Oh, I know. Since we are in a free market economy you can just not use Google at all! And any site that has adwords, or google analytics, or youtube, or refuse email of anyone that sends you email from a gmail address, or...

If enough people do this, we can show Google the error their ways. /sarcasm

Re:Google

[jvkjvk]

Oh, so TFA must have no references or quotes by Google in it, and must possibly not be connected at all.

Hmm. Sorry, nope. Google made a statement and it was in the article, therefore it's fair game.

The article was about the situation, and it appears that Google is indeed involved.

Want to take some shots at Microsoft next?

Nah, rather take some at you.

I'm sorry that you identify so much with Google that you need to defend them this way. Do you disagree with anything I said? Or are you just upset that your precious company is becoming just another faceless corp and I pointed it out?

Perhaps that's why you decided to be an anonymous coward. YOu ahve no point to make and the point you (appear to) wish to make shows you a sniveling corporate lap dog.

Regards.

About time

[shoptroll]

About time my alma mater got some recognition on here for something other than an MP3 playing Xmas Tree ;)

you should not be surprised by this

[bl8n8r]

anytime an entity has control over a large dataset of demographic data, sales droids will not stop trying trying to turn that into revenue.

Re:you should not be surprised by this

[Fritz T. Coyote]

Yes... and even if geeks and privacy fans manage to avoid being in the particular set of data, who cares... there are plenty of folks (one borne every minute) who have happily posted lots of stuff on FB, etc... It's a gold-mine of demographic data, only an idiot (or someone with ethics) would pass up the chance to use that data to Make Money Fast.

Time to Update Barnum's Philosophy for the 21st Century: 'It is morally wrong to allow a sucker to keep their money or their privacy'

XMPP

[sakdoctor]

I don't believe privacy exists really anymore

That is the same as "privacy is dead", making you one of the asshats that AC was talking about.

Are your facebook friends so lazy that they wouldn't reply, if you sent them a good old fashioned email? I hope not, but just in case, there is a secret weapon.
Federated XMPP. Your backdoor into facebook's walled garden, without actually having to give in and be their bitch.

Re:XMPP

[dyingtolive]

Oh, they'd reply, if/when they checked actually their email. I did not realize that Facebook supported XMPP. Thanks for giving me something to go off of.

Join "Adblock Plus" fan page on Facebook

[kyriosdelis]

And let's see if advertisers will continue to be interested in your personal info after that... Hopefully sometime in the near future, when this or similar fan pages will grow large enough, advertisers will start excluding people that belong to them.

Re:Join "Adblock Plus" fan page on Facebook

[shoptroll]

They'll still be interested. Demographic information is worth money. If they don't use it on Facebook (or the web) they'll use it in other places.

"Unaware" Bullshit

[Anonymous Coward]

> Google Inc.'s DoubleClick and Yahoo Inc.'s Right Media, said they were unaware of the data being sent to them from the social-networking sites, and said they haven't made use of it.

Yeah, right.

If you look closely at Google/Yahoo advertising tags - they are proactively trying to catch (via Javascript) and log (in GET parameters to their server) current URL to which their ads are served. Unless you fake referer AND use NoScript extension, you're giving them this data. And I have a strong diesbelief that they do not store this data.

Yahoo and Google are logging huge part of your Web browsing history this way.

I guess they've coded it by accident?

It's called a SOCIAL SITE

[scottwilkins]

When are people going to get a clue and figure out the Facebook is a social web site, not a private web site? They think they can hide a black eye in the middle of a large party? If you don't want the World to see it, don't bring it to the party. DUH!

...retrieve any public information there.

[John Hasler]

Public information? So why is this a problem?

Re: ...retrieve any public information there.

[Sockatume]

The user's ad-clicking habits are identified, and correlated with their public information on that site (and possibly others by correlating other ones). It's an in-principle and not in-practice thing at this stage but it is a cause for concern.

Um...

[f3rret]

Is it really that big of a surprise? I mean seriously it's been pretty clear for a while now (at least according to /.) that Facebook is pretty much handing out private user data to whoever asks.

OOhhh

[EvilBudMan]

Not Again, I told everyone NOT to take that RED pill.

Forget Advertisers, Dummy!

[MarkvW]

Think politicians!

People will soon be polled with questions that are specifically targeted to THEM!

Voters will become infinitely more manipulable--to the politicians backed by rich people.

Not pretty.

Re:I've said it before...

[Low Ranked Craig]

How is this flamebait? If you publish your date of birth, full name, place of residence and other personal details on the web you deserve every bad thing that could happen to you as a result of that. I would never do such a stupid thing, but hey, if it makes you feel good about yourself go right ahead, just don't complain when someone successfully opens a line of credit in your name...

123 Fake Street

[DarthVain]

I hope they enjoy wasting money advertising to Mr. Guy Incognito, 123 Fake Street, Fakesville, USA and emailing tons of stuff to an temporary webmail address that only POP3 fwd email to another webmail account, until I decide to drop it and delete it whenever I like.

If you don't want to share your personal information, don't share it. I am pretty sure my "friends" know where I live and what my email address is anyway. And hey, if it gets so bad that you can't use it anymore to connect with people, then Facebook will learn about what happens to Myspace when a new, better, player comes to town. Enjoy your money while you can, and might I suggest investing in something else while you still can.

News at 11

[Anonymous Coward]

Social media sites that make money by selling the information you give them actually sell the information you give them...
News at 11

Free Market is Fail

[calderra]

Wait, what's that? The invisible hand of the markets actually doesn't police itself? Man, it's almost like I've heard this somewhere before. It's on the tip of my tongue. C'mon, what was it? Enron? Exxon Valdez? Goldman-Sachs? Bear Sterns? GM? Massey? No, that's not quite right... BP? I hate it when this happens!

Re:Yeah right

[ColdWetDog]

OK little modlets - lets try something. Go look the definition of 'sarcasm' and the Slashdot definition of 'troll'. (Actual work left as exercise to the reader). Then look up Venn Diagrams, the concept of 'null set'- think about it for a while and see if this helps with the quality of your moderation.

Sound of ....

[Dark Coder]

There's a sad sort of leaking
From Facebook on your wall
And the info on your profile, too
And out to the advertise
An absurd little Zuckerburg... See More
Is popping out to say boo-hoo
(boo-hoo, boo-hoo)

boo-hoo Regretfully they tell us
boo-hoo But firmly they compel us
to be a dumb fuck
boo-hoo
To you

So long, farewell
Auf Wiedersehen, goodnight
I hate to go and leave this pretty site

(Children)
So long, farewell
Auf Wiedersehen, adieu
(Zuckerburg)
What's new, what's new
To you and you and you

(chorus)
Who care, farewell
Au revoir, Auf Weidersehen

I'd like to stay
And play my first farmville
(talking to my boss) yes?
(boss) no!

(chorus)
So long, farewell
Auf Weidersehen, goodbye

I leave and heave
A sigh and say goodbye
Goodbye

I'm glad to go
I cannot tell a lie

I flit, I float
I fleetly flee, I fly

Your Privacy's gone
Back to Reality, so must I

(chorus)So long, farewell
Auf Weidersehen, goodbye
Goodbye
Goodbye
Goodbye

Goodbye

ObXKCD

[npsimons]

We warned you. You didn't listen. Here's your fucking violin.