In re Facebook II
- EPIC Calls for Greater FTC Enforcement: In advance of a Senate Commerce hearing on consumer privacy, EPIC called for more action by the Federal Trade Commission to protect American consumers. In a statement for the Committee, EPIC said that "the FTC is simply not doing enough to safeguard the personal data of American consumers." EPIC explained that "the FTC's privacy framework - based largely on 'notice and choice' - is simply not working." EPIC also warned that consumers "face unprecedented threats of identity theft, financial fraud, and security breach." EPIC has fought for consumer privacy rights at the FTC for more than two decades, filing landmark complaints about privacy violations by Uber, Microsoft, Facebook, Google, and even suing the Commission when it has failed to enforce its own orders. (Sep. 28, 2017)
- EPIC Urges Public Comments on FTC Settlement with Uber: EPIC is urging the public to comment on the proposed FTC settlement with Uber regarding consumer privacy. (Federal Register Notice). The FTC settlement follows EPIC's 2015 complaint, which detailed Uber's secretive tracking of customers and surreptitious collection of user data. The proposed settlement requires regular privacy audits of Uber by third parties but fails to make substantial changes in the companies business practices or require the company to delete the personal data that was wrongfully obtained. The deadline to file a comment with the FTC is September 15, 2017. The FTC is required to consider public comments before finalizing a proposed settlement. EPIC has previously pursued FTC complaints concerning Google, Facebook, WhatsApp, and Snapchat. EPIC also recently filed an FTC complaint to stop Google from tracking in-store purchases. (Sep. 6, 2017)
- Following EPIC Complaint, Uber Agrees To Stop Tracking Riders: Uber has ended the practice of tracking customers before and after they are picked up. In 2015, Uber announced the company would track the location of riders from the time they ordered a ride until after they had reached their destination. EPIC promptly filed a complaint with the FTC and stated that "This collection of user's information far exceeds what customers expect from the transportation service." The end to Uber's tracking of riders comes two weeks after Uber entered into a consent agreement with the FTC following a complaint filed EPIC that highlighted Uber's history of misusing customer data. But EPIC said the FTC settlement does not go far enough. "The FTC should have imposed stronger sanctions on Uber, required the company to disgorge the personal data it had unlawfully obtained, and required the company to restore the original privacy settings," said EPIC President Marc Rotenberg. EPIC has previously pursued FTC complaints concerning Google, Facebook, WhatsApp, and Snapchat. EPIC recently filed an FTC complaint to stop Google from tracking in-store purchases. (Aug. 29, 2017)
- After EPIC Privacy Complaint, Uber Settles with FTC: After an EPIC complaint about Uber's privacy practices, Uber has entered into a consent agreement with the FTC. The agreement prohibits Uber from misrepresenting how it monitors or secures consumer information. As with most FTC privacy settlements, the agreement also requires Uber to implement a comprehensive privacy program and obtain periodic independent third-party audits. In 2015, EPIC filed a complaint with the Federal Trade Commission charging that Uber's plan to track users and gather contact details was an unlawful and deceptive trade practice. EPIC cited Uber's history of misusing customer data as one of many reasons the Commission should act. EPIC has previously pursued successful FTC complaints concerning Google, Facebook, WhatsApp, and Snapchat. EPIC recently filed an FTC complaint to stop Google from tracking in-store purchases. (Aug. 15, 2017)
- Rep. Blackburn Proposes Online Privacy Bill, Would Preempt Stronger State Protections: Rep. Marsha Blackburn (R-TN) has introduced the The Browser Act, H.R. 2520, aimed at protecting online privacy. The Browser Act would apply to Internet ISPs as well as Internet companies, such, as Google and Facebook, and would generally require "opt-in" consent before sensitive information could be collected or disclosed. However, the bill lacks a private right of action or a remedy for violations. The bill gives enforcement authority to the FTC which has mostly failed to protect consumers online privacy. The bill lacks data breach notification, and would overwrite stronger state privacy laws that protect consumers. In comments to the FCC and elsewhere, EPIC has set out a comprehensive framework for online privacy. (May. 19, 2017)
- EPIC, CDD Charge WhatsApp Policy Change Unlawful, Urge FTC to Act: EPIC and the Center for Digital Democracy have filed a complaint with the FTC concerning WhatsApp’s plan to transfer user data, including personal phone numbers, to Facebook. This reversal contradicts WhatsApp’s previous promises to users that their personal information would not be disclosed and would not be used for marketing purposes. EPIC said that WhatsApp change in business practices is unlawful and that the FTC is obligated to act. EPIC previously filed a complaint with the FTC over Facebook’s acquisition of WhatsApp in 2014. In response, the FTC warned the two companies they must honor their privacy promises to users. The FTC has said "When companies tell consumers they will safeguard their personal information, the FTC can and does take law enforcement action to make sure that companies live up these promises." (Aug. 29, 2016)
- With New Policy Changes, Facebook Tracks Users Across the Web: Over the objections of consumer privacy organizations, Facebook has implemented policy changes that allow the company to track users across the web without consent. The Dutch data protection commissioner launched an investigation after the original announcement. This week the a German privacy agency announced a similar investigation. Last year, EPIC and a coalition of consumer privacy groups urged the FTC to halt Facebook's plan to collect web-browsing information from its users. Facebook is already under a 20 year consent decree for changing users' privacy settings. The consent decree resulted from complaints brought by EPIC and others in 2009 and 2010. (Feb. 4, 2015)
- Facebook Responds to EPIC Complaint About "Emotions Study": Facebook has announced revised guidelines concerning user data the company discloses to researchers. In 2012, Facebook subjected 700,000 users to an "emotional" test by manipulating their News Feeds. Facebook did not get users' permission to conduct this study or notify users that their data would be disclosed to researchers. In response, EPIC filed a formal complaint to the Federal Trade Commission. "The company purposefully messed with people's minds," states the EPIC complaint. EPIC has also asked the FTC to require that Facebook make public the News Feed algorithm. Facebook is also currently under a 20 year consent decree from the FTC that requires Facebook to protect user privacy, as a result of complaints brought by EPIC and a coalition of consumer privacy organizations in 2009 and 2010. The new guidelines have improved Facebook's research process, but they still raise questions about human subject testing by advertising companies. EPIC still believes the NewsFeed algorithm should be made public. For more information, see EPIC: In re: Facebook (Psychological Study) and EPIC: Federal Trade Commission. (Oct. 2, 2014)
- European Facebook Users Privacy Lawsuit Moves Forward: A group of over 25,000 European Facebook users may proceed with their lawsuit against Facebook. The users, led by privacy activist Max Schrems, sued Facebook in a court in Vienna. The users charge Facebook with violating EU privacy law by improperly handling users' data. Now that the court has approved the class action suit, Facebook must respond to the complaints. In 2011, Schrems brought a similar lawsuit against Facebook in an Irish court. In the same year, Facebook signed a consent order with the Federal Trade Commission, following a complaint filed by EPIC and a group of American consumer privacy organizations. EPIC has also filed an amicus brief in a federal class action lawsuit, opposing Facebook's use of children's images for advertising purposes. In 2013, EPIC gave the International Privacy Champion Award to Max Schrems, calling him "an innovative and effective spokesperson for the right to privacy." For more information, see EPIC: In re Facebook. (Aug. 26, 2014)
In the complaint, EPIC asks the FTC to open an investigation into Facebook, to compel Facebook to allow users to choose whether to link and publicly disclose personal information, to compel Facebook to restore its previous requirement that developers retain user information for no more than 24 hours, and to compel Facebook to make its data collection practices clearer and more comprehensible. The following organizations signed onto the complaint:
- The Electronic Privacy Information Center
- The Bill of Rights Defense Committee
- The Center for Digital Democracy
- The Center for Financial Privacy and Human Rights
- Center for Media and Democracy
- Consumer Federation of America
- Consumer Task Force for Automotive Issues
- Consumer Watchdog
- FoolProof Financial Education
- Patient Privacy Rights
- Privacy Activism
- Privacy Journal
- The Privacy Rights Clearinghouse
- The U.S. Bill of Rights Foundation
- U.S. PIRG
Facebook is a social networking site founded in 2004 by Harvard student Mark Zuckerberg. The site “connects people with friends and others who work, study and live around them.” As of December 2009, Facebook has nearly 150 million users in the United States.
Facebook and Privacy
Facebook has had a controversial history with respect to privacy. In 2006, Facebook launched a feature called “News Feed” which allowed users to track their friends’ Facebook updates and activity in real time. Within 24 hours, hundreds of thousands of the site’s users protested the feature. One Facebook group, “Students against Facebook News Feed” grew to 284,000 members within just a few days. As a result of the widespread protest, Mark Zuckerberg wrote an open letter to Facebook users, apologizing for doing a “bad job of explaining what the new features were and an even worse job of giving you control of them." Facebook then updated its privacy settings to allow for more user control over the News Feed Feature.
In 2007, Facebook launched Facebook Beacon, which allowed a Facebook user’s purchases to be publicized on their friends’ News Feed after transacting with third-party sites. Users were unaware that such features were being tracked, and the privacy settings originally did not allow users to opt out. As a result of widespread criticism, Facebook Beacon was shut down in 2009.
In February 2009, Facebook changed its Terms of Service. The new TOS allowed Facebook to use anything a user uploads to the site for any purpose, at any time, even after the user ceased to use Facebook. Further, the TOS did not provide for a way that users could completely close their account. Rather, users could “deactivate” their account, but all the information would be retained by Facebook, rather than deleted. EPIC planned to file an FTC complaint, alleging that the new Terms of Service violated the FTC Act Section 5, and constituted “unfair and deceptive trade practices.” In response to this planned complaint, and user criticism, Facebook returned to its previous Terms of Service.
EPIC's Previous Facebook Complaint
EPIC filed a supplemental complaint regarding several Facebook services, including Facebook Connect and iPhone syncing. EPIC alleged that Facebook's representations regarding Facebook Connect and iPhone syncing were unfair and deceptive because users who employ the services are not informed beforehand that they will no longer have control over their information.
To date, the FTC has failed to take any action regarding these complaints.
EPIC’s FTC complaint is signed by a number of other organizations, including the Bill of Rights Defense Committee, the Center for Digital Democracy, the Center for Financial Privacy and Human Rights, the Center for Media and Democracy, the Consumer Federation of America, the Consumer Task Force for Automotive Issues, Consumer Watchdog, FoolProof Financial Education, Patient Privacy Rights, Privacy Activism, Privacy Journal, the Privacy Rights Clearinghouse, the U.S. Bill of Rights Foundation, and U.S. PIRG.
The complaint highlights several aspects of Facebook’s most recent changes that threaten its users’ privacy. The complaint focuses on Facebook's unfair and deceptive trade practice of sharing of user information with the public and with third-party application developers. First, the complaint argues that Facebooks decision to force users to make previously protected information "publicly available" is an unfair practice. Second, the complaint argues that Facebook’s new social plugins and instant personalization are misleading and deceptive. Third, Facebook deceives users by not clearly informing them about cookies which Facebook uses to track users' internet activity. Fourth, Facebook's decision to allow developers to maintain user information indefinitely contradicts its previous policies and assurances to users.
Facebook now requires mandatory disclosure of even more information, including users' music, film, television, and literature preferences, employment information, educational information, current city, hometown, activities, interests, and likes and dislikes. Facebook forced users to convert information that had previously been protected under privacy settings into "links," which are "publicly available" information. Users were not given a choice to opt-out of this process. Users could either convert profile information into "links" or Facebook would remove the information from that user's profile. These changes contradict earlier assurances made by the company that users would be empowered to protect their information because, as Facebook stated, "you may not want everyone in the world to have the information you share on Facebook.”
The changes also contradict users' reasonable expectation about their privacy. Facebook allows users to adjust their privacy settings, but these adjustments have no practical effect on the public availability of information such as pages, links, employment information, and film and music preferences. Even if a user adjusts her settings so this information is limited to "friends only," the information may not be visible on the user's profile, but it is still publicly available elsewhere.
EPIC's complaint also alleges that Facebook's social plugin program is unfair and deceptive. Facebook has also developed a social plugin program that encourages users to interact with websites across the internet. “Social plugins” are buttons or boxes that appear on third party websites that prompt a Facebook user to click on or comment on items of interest. For example, is a user chooses to "Like" a news article by clicking on a "Like" button, this action is displayed on the third party website, disclosed to the user's friends and appears on the user's Facebook profile. This interaction results in user information being shared with those websites and the user's interaction being published to her friends on her "news feed." This sharing of information is not apparent to users, though, because all that users see when they navigate to a social plugin site is a small "like" or "recommend" button. There is nothing about the button which indicates the vast underlying exchange of information that occurs when a user clicks on it.
Facebook has also changed its developer data retention rule in a way that profoundly affects users, without ever gaining users' consent. Previously, Facebook had limited developers data retention by mandating that developers delete user information after 24 hours. That rule was abolished to allow developers to maintain user information indefinitely.
These changes together amount to a massive disclosure of user information that had previously been protected under users' privacy settings. This information has now been disclosed to third parties and can be retained indefinitely.
The FTC's primary enforcement authority with regards to privacy is derived from 15 U.S.C. § 45, commonly known as section 5 of the Federal Trade Commission Act (FTCA). Section 5 of the FTCA allows the FTC to investigate "unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce." This law provides a legal basis for the FTC to regulate business activities that threaten consumer privacy.
- EPIC's FTC Complaint in In re Facebook (filed May 5, 2010).
- EPIC's Previous FTC Complaint in In re Facebook (filed December 17, 2009).
- EPIC's Previous Supplemental Complaint in In re Facebook (filed January 14, 2010).
- Federal Trade Commission, LifeLock Will Pay $12 Million to Settle Charges by the FTC and 35 States That Identity Theft Prevention and Data Security Claims Were False (March 9, 2010).
- Federal Trade Commission, ChoicePoint Settles Data Security Breach Charges; to Pay $10 Million in Civil Penalties, $5 Million for Consumer Redress (December 6, 2006).
- United States v. ChoicePoint, No. 06-CV-0198 (N.D. Ga. Feb. 10, 2006).
- Federal Trade Commission, Microsoft Settles FTC Charges alleging False Security and Privacy Provisions (August 8, 2002).
- In re Microsoft Corp. (Fed. Trade Comm'n Dec. 20, 2002).
- Federal Trade Commission: Section 5 Enforcement Actions
- Ryan Singel, Privacy Flare-Up Prompts Facebook Meetings with Congress, Employees, Wired (May 13, 2010).
- Christopher Breen, Why I Left Facebook, PC World (May 13, 2010).
- Ian Paul, Facebook Plans a Privacy Summit, PC World (May 13, 2010).
- Mike Pearson, European Authorities Join Facebook Privacy Dogpile, Tech News World (May 12, 2010).
- Nick O'Neill, Facebook Calls All Hands Meeting on Privacy All Facebook (May 12, 2010).
- Facebook Executive Answers Readers Questions, The New York Times Blog (May 11, 2010).
- Lee Goessi, Facebook prepares to defend privacy policies: Several Facebook complaints filed with FTC, Helium (May 11, 2010).
- Nicholas Carlson, Facebook Users' Names, Email, Location, And Photos Exposed On Yelp, San Francisco Chronicle (May 11, 2010).
- Ki Mae Heussner, Quitting Facebook: What Happens When You Deactivate, ABC (May 11, 2010).
- Dylan Tynan, How Facebook Pulled a Privacy Bait and Switch, PC World (May 11, 2010).
- How to Put Facebook on a Privacy Lockdown, San Francisco Chronicle (May 11, 2010).
- Chloe Albanesius, Facebook Denies Hiring Former FTC Chief Muris, PC Magazine (May 10, 2010).
- Scott M. Fulton, III, Facebook to Fight Privacy Complaint with Help of Former FTC Chairman, Beta News (May 10, 2010).
- Steve O'Hear, Facebook’s Byzantine Privacy Controls Produce More Confusion,Tech Crunch (May 10, 2010).
- Avanti Kumar, Facebook's International Users Share Privacy Concerns, PC World (May 9, 2010).
- By Jennifer Valentino-DeVries, Visualizing Your Privacy on Facebook, The Wall Street Journal (May 7, 2010).
- Privacy groups take Facebook complaint to US regulators, AFP (May 7, 2010).
- Jacqui Cheng, Privacy Groups Complain to FTC over Facebook Privacy Tweaks, Ars Technica (May 7, 2010).
- Congress Asked to Push Facebook Probe, UPI.com (May 7, 2010).
- Mark Hachman, Facebook Targeted by New FTC Complaint, PC Magazine (May 7, 2010).
- Alison Diana, Facebook Faces FTC Complaint, Information Week (May 7, 2010).
- Ian Paul, Facebook Privacy Complaint, A Complete Breakdown, PC World (May 6, 2010).
- Douglas MacMillan, Facebook Policies Draw Criticism From Privacy Groups, Business Week (May 6, 2010).
- Wendy Davis, EPIC Files Complaint About New Facebook Features, Media Post (May 5, 2010).
- Jenna Wortham, Facebook Glitch Brings New Privacy Worries, New York Times (May 5, 2010).
- Dan Yoder, 10 Reasons To Delete Your Facebook Account, Business Insider (May 3, 2010).
- Caroline McCarthy, Activist Groups Launch New Facebook Offensive, CNET (Apr. 30, 2010)
- Mike Swift, Facebook Slammed Over Privacy Concerns, Mercury News (Apr. 28, 2010).
- Riva Richmond, Facebook Stirs Privacy Concerns Again, New York Times (Apr. 27, 2010).
- Michael Liedtke, Senators See Privacy Problem in Facebook Expansion, The Sydney Morning Herald (Apr. 27, 2010).
- Gerrick D. Kennedy Senators Urge Facebook to Protect User Privacy, Los Angeles Times, Comments Blog (Apr. 27, 2010).
- Ben Elowitz, Facebook's Like Button: A Force Powerful Enough to Save Media from Google Search Huffington Post (Apr. 27, 2010).
- Irene North, People concerned over more Facebook privacy changes, The Daily Censored (Apr. 26, 2010).
- Chloe Albanesius, Schumer Asks FTC to Investigate Privacy of Facebook, Other Sites, PC Magazine (April 26, 2010).
- Kristin Burnham, Facebook Privacy Changes: 5 Can’t-Miss Facts, CIO (Apr. 23, 2010).
- Gina Trapani, Time to Audit Your Facebook Privacy Settings, Here’s How, Fast Company Magazine (Apr. 23, 2010).
- Rob Pegoraro, As Facebook users fret over its wider reach, Post readies opt-out, Faster Forward, The Washington Post (Apr. 23, 2010).
- Riva Richmond, How to Opt Out of Facebook’s Instant Personalization, Gadgetwise Blog, The New York Times (Apr. 23, 2010).
- Kurt Opsahl, How to Opt Out of Facebook’s Instant Personalization, Deeplink Blog (Apr. 22, 2010).
- Mathew Ingram, Your Mom’s Guide to Those Facebook Changes, and How to Block Them, Gigaom (Apr. 22, 2010.
- Kurt Opshal, How to Opt Out of Facebook’s Instant Personalization Deeplinks Blog, (Apr. 22, 2010).
- Christina Warren, Facebook Open Graph: What it Means for Privacy, Mashable (Apr. 21, 2010).
- Maurice Cacho, Toss out your privacy as Facebook becomes more stalker-ish, MSN Tech & Gadgets (Apr. 21, 2010).
Share this page:
EPIC relies on support from individual donors to pursue our work.
Subscribe to the EPIC Alert
The EPIC Alert is a biweekly newsletter highlighting emerging privacy issues.
Privacy in the Modern Age