Social Networking Privacy

• Background |
• News |
• Resources |
• Previous Top News

Latest News/Events

• White House Explores Social Media "Bias": The White House is today hosting a social media summit to examine allegations of bias and censorship. EPIC objected to an earlier White House survey on this topic, noting that the White House failed to protect the privacy of respondents. EPIC told the White House that "this data collection is unlawful, unconstitutional, and itself a violation of the First Amendment." The White House has since disabled the survey. To address concerns about bias, EPIC supports algorithmic transparency and has urged federal agencies and Congress to mandate algorithmic transparency. In 2007, EPIC explained to Congress that after Google acquired YouTube, Google substituted its own subjective algorithm based on "relevance" for objective criteria, such as number of hits and user ratings. The practical consequence was to elevate the rankings of Google's own web pages and to demote the ranking of other web pages, including EPIC's. Senator Josh Hawley (R-MO) recently introduced the "Ending Support for Internet Censorship Act," which would require tech companies to submit to an external audit that proves that their algorithms and content-removal practices are politically neutral. (Jul. 11, 2019)
• New Study Shows Public Does Not Trust Social Media Privacy, Supports Stronger Privacy Laws: A new survey supported by the Craig Newmark Foundation shows that while 80% of Americans use social media daily, 96% do not trust social networks to protect their privacy. The survey found that only 7% of millennials trust these sites to protect their data. A majority of Americans surveyed also expressed concern about the lack of safety online, including fears over identity theft, email hacking, and non-consensual online tracking. Many Americans think privacy laws are too weak. Among all groups, millennials are increasingly aware of the need for stronger privacy laws. EPIC maintains a webpage devoted to Privacy and Public Opinion and has launched the Data Protection 2016 campaign to highlight privacy protection in the 2016 election. (Oct. 19, 2016)
• With New Policy Changes, Facebook Tracks Users Across the Web: Over the objections of consumer privacy organizations, Facebook has implemented policy changes that allow the company to track users across the web without consent. The Dutch data protection commissioner launched an investigation after the original announcement. This week the a German privacy agency announced a similar investigation. Last year, EPIC and a coalition of consumer privacy groups urged the FTC to halt Facebook's plan to collect web-browsing information from its users. Facebook is already under a 20 year consent decree for changing users' privacy settings. The consent decree resulted from complaints brought by EPIC and others in 2009 and 2010. (Feb. 4, 2015)
• White House Updates Privacy Policy, Maintains Anonymous Access But Also Data Retention: A revised privacy policy for the White House will go into effect on April 18, 2014. Users will continue to be able to access information posted on the White House web site anonymously, though personal information will be required for some services. The data retention practice has not changed nor has the policy for the disclosure of personal data to other entities. According to the White House privacy policy, "Information you choose to share with the White House (directly and via third party sites) may be treated as public information." The White House had previously proposed a "Plan to Protect Privacy in the Internet Age by Adopting a Consumer Privacy Bill of Rights", though the policy does not reflect this approach. In the first report ever published on online privacy, "Surfer Beware: Personal Privacy and the Internet," EPIC said web sites should "support anonymity while developing policies and practices to protect information privacy." EPIC had also urged the White House to establish Privacy Act safeguard for the use of social media services. EPIC For more information, see EPIC: Privacy and Government Contracts with Social Media Companies. (Mar. 24, 2014)
• WhatsApp Founder Responds to EPIC Privacy Complaint: Following Facebook's announced plan to purchase WhatsApp, a popular pro-privacy messaging services, EPIC urged the FTC to block the acquisition. EPIC explained to the Commission that Facebook incorporates user data from companies it acquires, and that WhatsApp users objected to the acquisition. WhatsApp founder Jan Koum has now published a blog post in response to the EPIC Complaint. Koum wrote, "Above all else, I want to make sure you understand how deeply I value the principle of private communication. For me, this is very personal." He added, "Make no mistake: our future partnership with Facebook will not compromise the vision that brought us to this point." For more information, see EPIC: In re WhatsApp, EPIC: Federal Trade Commission, and EPIC: In re Facebook. (Mar. 18, 2014)
• Federal Court Awards EPIC $30,000 in Social Media Monitoring Case: EPIC has prevailed in a fee dispute with the Department of Homeland Security in an open government case concerning the government’s monitoring of social media. EPIC filed a FOIA request after the agency announced plans to gather information from "online forums, blogs, public websites, and message boards." After the DHS refused to produce documents, EPIC filed suit and obtained more than 500 pages describing the agency program. When the agency subsequently moved to dismiss the case, a federal judge ruled that EPIC had "substantially prevailed." And when the DHS sought to give EPIC a token amount in settlement, the court had harsh words for the agency. The court described EPIC's work in the case as "the sort of public benefit that FOIA was designed to promote." The case is EPIC v. DHS, No. 11-2261 (D.D.C. Nov. 15, 2013). For more information, see EPIC v. DHS: Social Media Monitoring. (Nov. 20, 2013)
• Supreme Court Lets Stand Contested Facebook Settlement, But Chief Justice Cautions About Future Cases: The Supreme Court has denied a petition for review in Marek v. Lane, a decision upholding the class action settlement of Facebook’s controversial "Beacon" Program. The settlement provided substantial fees to attorneys, no benefits to class members, and established a funding entity, controlled in part by Facebook "Cy press" ("as near as possible") is a legal doctrine that allows courts to allocate funds to protect the interests of individuals when there is a class action settlement, but concerns have been raised about the misuse of cy pres procedures. Chief Justice Roberts, focusing on the "unusual" allocation of funds in the Facebook matter, suggested that the Supreme Court would eventually need to address "fundamental concerns surrounding the use of such remedies in class action litigation" including "how to assess its fairness as a general matter; whether new entities may be established as part of such relief; if not, how existing entities should be selected; what the respective roles of the judge and parties are in shaping a cy pres remedy; [and] how closely the goals of any enlisted organization must correspond to the interests of the class." EPIC and other consumer privacy organizations have routinely raised similar concerns about abuse of the class action process. For more information, see EPIC: Fraley v. Facebook, EPIC: Lane v. Facebook, and EPIC: In re: Google Buzz. (Nov. 4, 2013)
• Pew Survey Finds that Vast Majority of Americans Take Steps to Maintain Privacy Online: A recent survey by the Pew Research Center's Internet Project has discovered that 86 percent of Americans take steps to conceal their actions or identities while online. The survey also found that 21 percent had an email or social networking account compromised or taken over by someone else without permission. Furthermore, the majority of respondents believe that "current laws are not good enough in protecting people's privacy online." Other Pew surveys have found that most teens were taking steps to protect their privacy, that a majority of parents were concerned about their children's online privacy, and that users were becoming more active in managing their social media accounts. For more information, see EPIC: Public Opinion on Privacy. (Sep. 6, 2013)
• Pew Survey Finds Teens Using Privacy Controls on Social Media: A survey by the Pew Internet and American Life Project and the Berkman Center for Internet and Society found that while teens are disclosing more personal information on social media, the vast majority are actively taking steps to protect their privacy. 60 percent of teen Facebook users keep their profiles private and visible only to a select group of friends, and 56 percent felt confident in their ability to manage Facebook’s privacy settings. Most teens also reported deleting or blocking users on social media sites, or obscuring the content of their messages through inside or coded references. Other polls by Pew have found that a majority of parents were concerned about their children’s online privacy and that users were becoming more active in managing their social media accounts. For more information, see EPIC: Public Opinion on Privacy. (May. 21, 2013)
• EPIC Asks FTC to Investigate Snapchat: EPIC filed a complaint with the Federal Trade Commission against Snapchat, the publisher of a mobile app that encourages user to share intimate photos and videos. The company represents that users can make photos and videos "disappear forever." In fact, the photos can be retrieved by others after they should have vanished. The EPIC complaint implicates Privacy Enhancing Technologies, which if properly implemented would minimize or eliminate the collection of personally identifiable information. The FTC described similar methods in a 2012 privacy report. Previously, EPIC filed a complaint at the FTC against AskEraser, which falsely represented that search queries would be deleted when in fact they were retained by the company and made available to law enforcement agencies. For more information, see EPIC: Federal Trade Commission. (May. 17, 2013)
• International Privacy Officials Recommend Social Networking Privacy Safeguards. The International Working Group On Data Protection in Telecommunications has released a report and guidance (pdf) on privacy in social networking services. The report identifies risks to privacy and security, and provides guidance to regulators, service operators and users to counter these risks. Risks include the large amount of data collection; the misuse of profile data by third parties; insecure infrastructure and application programming interfaces. Regulators should ensure openness, and oblige data breach notification. Providers must be transparent; live up to promises made to users; and use privacy friendly defaults. Privacy and consumer groups are also recommended to raise the awareness of regulators, providers and the general public. (Apr. 17, 2008)
• Facebook Caves to Privacy Demands, Adopts Limited Opt-In. Social networking site Facebook.com significantly modified the privacy features of its new "Beacon" advertising system. Facebook users found their purchases on third party sites were being broadcast to their Facebook friends. Users had only limited options for opting out of the broadcast. In response to complaints from EPIC, the Center for Digital Democracy, Moveon.org, and thousands of users, Facebook will now ask that users opt-in before broadcasting their details. Facebook will continue to collect information from third party sites and will continue to ask for opt-ins until the user consents. See also EPIC's Facebook Privacy Page. (Nov 30, 2007)
• Facebook to Collect, Distribute User Interactions With Third Party Sites. Social networking website Facebook.com introduced its "Beacon" feature to much controversy. Facebook users who shop at third party websites will have their purchases broadcast to their friends via Facebook. Facebook receives this third party information and shares it unless user opt-out during a brief pop-up window at the third party site. Interest group MoveOn.org has started a petition campaign and Facebook group against this feature. The MoveOn petition and Facebook group demand that Facebook share user information only with explicit opt-in permission. Facebook considered, but did not adopt, a blanket opt-out for the beacon feature. (Nov 28, 2007)
• Facebook Unveils New "Social Ads." Social networking site Facebook.com unveiled "social ads," a new advertising product. Marketers create Facebook profiles and purchase advertising targeting other users profile information. Further, a users name and picture will be shown to their friends in promotion of a product after that user interacts with the marketer in some way. A law professor has questioned whether this violates the privacy tort prohibiting commercial appropriation of name and likeness. Facebook's privacy settings do not currently allow one to opt out of receiving marketing or being used in it. (Nov. 14, 2008)

Background

Social networking Web sites, such as Facebook, MySpace, Twitter, Google Buzz, LinkedIn and Friendster have become established forums for keeping in contact with old acquaintances and meeting new ones, for sharing personal information, and for establishing mobile communication capabilities. Users can create their own Web page and post details about themselves: where they went to school, their favorite movie titles, and their relationship status. They can link to friends on the same site, whose photos, names, and perhaps a brief description, will also appear on the Web page. They can communicate with friends and establish business contacts. While these Web sites are useful tools for exchanging information, there has been growing concern over breaches in privacy caused by these social networking services. Many users feel that their personal details are being circulated far more widely than they would like.

Who Gets Access?

Social networking sites give their users an easy way to share information about themselves. However, many users are quickly finding that the information they intend to share with their friends can all too easily find its way into the hands of the authorities, strangers, the press, and the public at large. For example, job recruiters are looking to these sites as well as performing more traditional background checks on potential employees. Performing a search using these sites may result in retrieving a substantial amount of personally identifiable information about a person.

Many sites restrict who can join a site, and therefore access a user's information. Many Web sites include age stipulations in their terms of use. Friendster, for example, requires that all its users be over 16, and this requirement is flagged on the registration form. Facebook and MySpace both require that users by 13 years of age. Other Web sites, like LinkedIn and Orkut, require that users be part of a particular, in this case professional, community before they join and users are therefore only accepted by invitation. Facebook is now open to anyone who wants to register but still requires a user to show that he or she is a member of a given community before adding them to that network of users. However, the ease with which digital information can be copied and distributed means that anyone within the authorized group may still pass the information along to others. Also, Web sites are routinely sharing user information with third parties for advertising purposes.

Facebook has more limited search features than MySpace. As of May 2010, Facebook users can control whether their profiles are available to those who enter a user’s name into a public search engine. By default, this public search function is enabled; however, users have the ability to disable this function through a series of links starting on the main privacy settings page. Facebook users who are registered with the site, by contrast, can use the site to conduct a search of those already on their list of contacts, or those users who make their information to every Facebook user.

Facebook has undergone many changes to its privacy policy since 2006, many of which resulting in less user control over who gets access to their personal information. EPIC filed two complaints with the Federal Trade Commission (FTC) focusing on Facebook's unfair and deceptive trade practice of sharing of user information with the public and with third-party application developers. The first complaint, In re Facebook (December 17, 2009) and Supplemental Complaint (January 14, 2010), focuses on Facebook's unfair and deceptive trade practice of sharing of user information with the public and with third-party application developers. First, the complaint argues that Facebooks decision to force users to make previously protected information "publicly available" is an unfair practice. Second, the complaint argues that Facebook’s new social plugins and instant personalization are misleading and deceptive. Third, Facebook deceives users by not clearly informing them about cookies which Facebook uses to track users' internet activity. Fourth, Facebook's decision to allow developers to maintain user information indefinitely contradicts its previous policies and assurances to users.

EPIC’s second complaintagainst Facebook to the FTC, filed on May 5, 2010, focuses on Facebook's unfair and deceptive trade practice of sharing of user information with the public and with third-party application developers. First, the complaint argues that Facebooks decision to force users to make previously protected information "publicly available" is an unfair practice. Second, the complaint argues that Facebook’s new social plugins and instant personalization are misleading and deceptive. Third, Facebook deceives users by not clearly informing them about cookies which Facebook uses to track users' internet activity. Fourth, Facebook's decision to allow developers to maintain user information indefinitely contradicts its previous policies and assurances to users.

After EPIC’s second FTC complaint against Facebook, and public criticism of Facebook’s privacy policies, Facebook again altered its privacy policy. As of the latest round of changes to its privacy settings in May 2010, users have the ability to control access to most of their personal information, including Basic Information (friend lists, education and work, current city and hometown, interests and Pages), bio, status, photos, posts, religious and political views, relationships, birthday, email address, phone number, and address. Users also have the ability to disable participation in platform applications, games, and third-party websites, thereby preventing such third parties to have access to their personal data. However, like the public search option, users must opt-out of disclosing their personal information to platform applications, games, and websites.

Also, a number of privacy issues raised in EPIC’s FTC complaints remain unresolved as of the latest Facebook privacy changes. Facebook still allows developers to maintain user information indefinitely. Facebook has also failed to be transparent regarding its use of cookies. Facebook uses cookies to track users across the internet, destroying their ability to surf the internet anonymously. EPICs complaint argues that the use of cookies is not obvious to Facebook users or controllable under the privacy settings.

These changes together amount to a massive disclosure of user information that had previously been protected under users' privacy settings. This information has now been disclosed to third parties and can be retained indefinitely.

Most recently, Google launched their own social networking service. On February 9, 2010, Google introduced Buzz, a social networking service linked to Gmail, Google’s email service. There are currently over 37 million Gmail users in the United States. Google Buzz is an opt-out service that compiles a Gmail user’s social networking list based on address book and Gchat list contacts. When users checked their email through Gmail on February 9th, they were confronted with a screen introducing the new service as “Gmail + buzz.” Whether the user clicked on “Sweet! Check out Buzz” or “Nah, go to my inbox,” Google Buzz was activated, and a list of followers and “people who you follow” were already populated using frequent contacts. These lists were publicly viewable by other Gmail users, and if a user had a Google profile, this information was publicly indexed by search engines.

Google experienced a strong backlash from users who were unhappy that their Gmail address books were essentially published for all to see. Address book contacts routinely contain deeply personal information, including the names and email addresses of estranged spouses, current lovers, attorneys and doctors. In response to user outcry, Google made several changes to its Google Buzz service. Despite these changes, Google still compiled social networking lists based on address book contacts without first notifying users, and allowed such information to be publicly indexed by search engines without clearly notifying users.

Google users were still not satisfied, and on February 13, 2010, Google made additional changes to the Google Buzz service. Rather than using an auto-follow structure for the “people who you follow” list, Google now uses an auto-suggest model, where users can pre-screen who they follow. However, the auto-follow model is still in place for the “followers” list, or list of “people who follow you.” The burden remains on users to constantly check and block their followers.

MySpace also entered the Facebook and Google Buzz privacy debates in May 2010. However, while MySpace seems to have simplified their privacy controls, the default privacy settings for users as well as the amount of information available to non-users via search functions remains the same. MySpace allows the general public to search its database of members by display name, full name, MySpace URL, or email. This search can be filtered by gender, age, city, state, or zip code, country, and users who display photos or display name and photos. If users have not changed their privacy settings from the default level, searchers can view users’ whole profiles. These profiles may include personal information such as occupation, hometown, sexual orientation, ethnicity, and religion, as well as photos of users, their family, and their friends.

Friendster, the predecessor to Facebook, MySpace, and Google Buzz, also restricts searches to members. However, members can view other users' full profiles, whether they are on the member's contact list or not. Notably, if the person searched for does not turn up in the Friendster database, the Friendster search engine provides a direct link to a data broker, which offers to search for the person.

Users who expect their information to be viewed only by people they know may be dismayed to realize how broadly their personal data is disseminated. Once it is published online, they retain little control over it. While a person's real-world friends may not all have the same level of access to that person's personal information, the hundreds of "friends" on a social networking profile all have the same status, and access to everything posted online.

Default privacy settings on individual accounts allow a great deal of information to be displayed to anyone who views a profile; personal features such as blogs and comments would be accessed by anyone viewing a profile page. If the default settings were set at a higher level, users would immediately have more control. A user who did not want every detail of his or her profile available to those outside their network of friends, or who did not want to allow photographs on his or her profile page to be downloaded, for example, would not automatically be consenting to these actions as soon as he or she set up a profile page.

Hand in hand with this fact goes the possibility that any one of a user's several hundred "friends" can download this information and use it wherever and however they wish.  In fact, access can extend beyond friends and members. Users need to realize that prospective employers, job recruitment agencies, law enforcement, and members of academic staff, can gain access to photographs, comments and information posted on profile pages, whether or not this information comports with the image you would like to portray to the world outside the network.

Control of Information: The Means of Dissemination Matters

More than other social networking services, Facebook has had a controversial history with respect to privacy and the means of disseminating personal user information. In September 2006, a change made by Facebook to how it distributed information caused an uproar among users. The change involved the introduction of a News Feed feature that gathered information on the actions of all of a user's contacts and compiled it into a chronological list on the user's home page. In response to the new feature, a grassroots movement began among Facebook's users. Students Against Facebook News Feed, one of many groups that petitioned against the new feature claimed in its' mission statement that Facebook "went a bit too far this time." Thousands of users voiced their complaints about the News Feed. "[Before,] you could make silly Facebook groups without having to worry about who might find out…It's starting to feel like there's too many tags on you. It's like you have to cover your tracks," one user said.

Many groups were set up on Facebook to campaign against this feature. According to one group, "any user of this Web site may and often does have 'friends' who they barely know, if at all. Some people have friend counts in the four, five, and six hundreds. Is it right for Facebook to automatically broadcast a break up with a boyfriend or a denied friendship-add to all those most peripheral of relationships?" The comments of those who joined the various groups echoed the general dissatisfaction among users. "The new features are almost like it's trying to make me be a stalker even though I don't want to," said one user.

Although they had already published information on their sites, the protesting Facebook users recognized that privacy can be incorporated in the ways that information is distributed, and not just in who is permitted to see the information. In response to the negative reaction to News Feed, Facebook apologized. "Somehow we missed (the) point with News Feed and Mini-Feed and we didn't build in the proper privacy controls right away," Mark Zuckerberg, CEO of Facebook, said.

Users also objected to the fact that Facebook allowed News Feed to begin distributing their information without any warning. Users had no notice of the new feature and, more importantly, were not given the opportunity to decide whether they wanted their information to be shared in this way.

In 2007, Facebook launched Facebook Beacon, which allowed a Facebook user’s purchases to be publicized on their friends’ News Feed after transacting with third-party sites. Users were unaware that such features were being tracked, and the privacy settings originally did not allow users to opt out. As a result of widespread criticism, Facebook Beacon was shut down in 2009.

In February 2009, Facebook changed its Terms of Service. The new TOS allowed Facebook to use anything a user uploads to the site for any purpose, at any time, even after the user ceased to use Facebook. Further, the TOS did not provide for a way that users could completely close their account. Rather, users could “deactivate” their account, but all the information would be retained by Facebook, rather than deleted. EPIC planned to file an FTC complaint, alleging that the new Terms of Service violated the FTC Act Section 5, and constituted “unfair and deceptive trade practices.” In response to this planned complaint, and user criticism, Facebook returned to its previous Terms of Service.

In late 2009, Facebook rolled out another round of changes which required mandatory disclosure of profile information that had previously been protected by users' privacy settings. The site automatically made some user information, including users' names, profile pictures, friends lists, fan pages, gender, and networks, available to the public, including to third-party developers, without offering users a choice to opt-out. The new Facebook privacy policy stated that “certain categories of information . . . are considered publicly available to everyone, including Facebook-enhanced applications, and therefore do not have privacy settings.” Consequently, users could no longer control who views certain types of information and could not prevent third-party applications from viewing certain types of information. EPIC, along with several other organizations, filed a complaint and supplemental complaint, with the FTC, citing "unfair and deceptive trade practices," and urging the agency to investigate.

EPIC filed a supplemental complaint regarding several Facebook services, including Facebook Connect and iPhone syncing. EPIC alleged that Facebook's representations regarding Facebook Connect and iPhone syncing were unfair and deceptive because users who employ the services are not informed beforehand that they will no longer have control over their information.

To date, the FTC has failed to take any action regarding these complaints. However, the FTC did take action against Twitter. On June 24, 2010, the Federal Trade Commission (FTC) announced a significant enforcement action. The Commission's complaint against Twitter charged that "serious lapses in the company's data security allowed hackers to obtain administrative control of Twitter." The FTC found that the lax practices allowed access to nonpublic tweets even though the company assured users in its privacy policy that it was "very concerned about safeguarding the confidentiality of your personally identifiable information." Under the terms of the settlement, "Twitter will be barred for 20 years from misleading consumers about the extent to which it maintains and protects the security, privacy, and confidentiality of nonpublic consumer information."

Facebook’s privacy policies illustrate the problems that may result from using an opt-out system. Opt-out systems assume consent in the absence of an affirmative act by the user, and so are less preferable to opt-in systems. An opt-in system gives the user more control, by allowing users to flag the specific disclosures they wish to activate. An opt-out system, on the other hand, allows widespread sharing of information, sometimes unknown to the user. This forces users to take the time to find and deactivate each disclosure in turn, to attain their desired level of security. 

The privacy controls enabled by Facebook are more opt-out than opt-in. Default settings still disseminate most profile changes to all of a user's contacts. Facebook's solution still allows for those who do not bother to read through the "my privacy" section, located on the left hand side of the profile page, to end up sharing more than they expect.

In addition to problems with opt-out privacy protections, Google Buzz illustrates the privacy protections when one kind of internet service—email—is transformed into another kind of service—social networking—without user consent. EPIC filed a complaintwith the FTC on February 16, 2010 arguing that that Google’s change in business practices and service terms violated user privacy expectations, diminished user privacy, contradicted Google’s own privacy policy, and may have also violated federal wiretap laws.

EPIC’s complaint begins by stressing the importance of email privacy. While email senders and recipients always have an opportunity to disclose email-related information to third parties, email service providers have a particular responsibility to safeguard the personal information that subscribers provide. Improper disclosure of even a limited amount of subscriber information by an email service provider can be a violation of both state and federal law. As an email service provider, Google’s attempt to convert the personal information of all of its customers into a separate service raises far-reaching concerns for subscribers and implicates both consumer and personal privacy interests.

The complaint goes on to describe Google Buzz and Google’s disclosure of users’ email contacts. Gmail contact lists routinely include deeply personal information, including the names and email addresses of estranged spouses, current lovers, attorneys and doctors. The frequency with which a user communicates with a given contact is also deeply personal and demonstrates the closeness of the user’s relationship with that contact. The activation of Buzz disclosed not only portions of users’ contact lists, but more specifically disclosed the contacts with whom users communicate most often. The fact that the auto-following lists were composed of users’ most common Gmail contacts was widely known and publicized, as well as easily deduced by individual users. As such, anyone looking at a newly-activated Buzz user’s “following” list would know that the list indicated which people that user communicated with most often.

Privacy Policies

Like many Web sites that collect user information, the aforementioned social networking Web sites have privacy policies. However, there are some problems. These policies are disclaimers produced by a Web site, that become waivers once the user accepts them. By accepting the terms of the policy, the user volunteers to relinquish some known right or privilege they may have. If a user felt the Web site had broken promises it made in the privacy policy, it is doubtful that the user could sue the Web site for breach of contract on the basis of the policy. These policies also contain loopholes. Problems with these policies include a lack of visibility, insufficient information on how the Web sites change their policies, the lack of independent reviewers to monitor these Web sites, and unspecific details of whom the Web sites share user information.  

One problem is that these policies are difficult for users to find and read. Although reading these policies is part of the registration process, they may not be specified on the registration form. The privacy policy may just be mentioned in the Terms of Use of a Web site. Providing users with a box to tick to indicate they have read and accepted a privacy policy is not enough. All three Web sites should make their privacy policies more obvious and users need should be encouraged by the Web sites to actively read through what they are agreeing to.

Another problem with privacy policies is that they are fluid, and may be altered by the Web site. All of these Web sites state that from time to time changes may be made to their privacy policies, which will be posted on the site. It is never specified how long these changes would be posted for, or where. Notice alone is not enough. The changes should be explained to users, along with any specific results the changes incur. Another manifestation of this problem is that not only can terms change, but Web sites can also reset user preferences, and place them back at default level.

The only one of these sites to overtly use a third party to review its privacy policy is Facebook. Facebook pays to be a licensee of the TRUSTe Privacy Program. However, TRUSTe's program suffers several flaws. In the past, TRUSTe has not punished their licensees who have, in TRUSTe's own opinion, compromised consumer trust and privacy. TRUSTe has even been described as untrustworthy by certain commentators.

These policies are also unclear about the terms by which users' details are shared with third parties. Facebook, MySpace and Friendster affirm that the user can choose to share information with marketers through sponsored groups or other on-site offers, such as competitions or sweepstakes. The Web sites reserve the right to transfer personal information to a successor in interest that acquires rights to that information as a result of the sale of the Web site. They state that they will not share users' contact information with marketers without your permission. Facebook and MySpace assert that the user can tell when another company is involved in any store or service provided, and they establish that they may share customer information with that company in connection with the member's use of that store or service. However, they do not specify how it would be so clear to the user when another company is involved. MySpace may transfer personal information to certain ad partners, if the user has explicitly requested to receive information from these ad partners. How a user would go about doing this is vague though. The Web sites do not elaborate on what information they provide to advertisers in aggregate usage information, nor do they note the potential for third parties to disaggregate the information.

Privacy policies, like all agreements, should be clear and easy to follow, so that users have a firm grasp on what they are signing-up to. Unfortunately, Web sites' privacy policies, and terms of use often seem overly cross-referenced. Users need to do a great deal of switching between the two in order to get all the details, and definitions. This makes the task of reading through the information more difficult than it needs to be.

News

• The social networking landscape in 2010: Facebook, Twitter … and Google Me?, Latest Gadgets, Aug. 5, 2010
• Wave cancellation: Google gives up on next-gen messaging platform, Latest Gadgets, Aug. 5, 2010
• Nicholas Carlson, Facebook Users' Names, Email, Location, And Photos Exposed On Yelp, San Francisco Chronicle (May 11, 2010).
• Ki Mae Heussner, Quitting Facebook: What Happens When You Deactivate, ABC (May 11, 2010).
• Dylan Tynan, How Facebook Pulled a Privacy Bait and Switch, PC World (May 11, 2010).
• Google Develops a Facebook Rival, The Wall Street Journal, July 28, 2010
• Douglas MacMillan, Facebook Policies Draw Criticism From Privacy Groups, Business Week (May 6, 2010).
• Wendy Davis, EPIC Files Complaint About New Facebook Features, Media Post (May 5, 2010).
• Jenna Wortham, Facebook Glitch Brings New Privacy Worries, New York Times (May 5, 2010).
• Google switches on Buzz firehose, Register, July 20, 2010
• Caroline McCarthy, Activist Groups Launch New Facebook Offensive, CNET (Apr. 30, 2010)
• Kurt Opsahl, Facebook's Eroding Privacy Policy: A Timeline, Electronic Frontier Foundation (Apr. 28, 2010).
• Facebook, MySpace Confront Privacy Loophole, The Wall Street Journal, May 21, 2010
• Google: U.S. Demanded User Info 3,500 Times in 6 Months, Wired, April 20, 2010
• Google Discloses Requests on Users , The Wall Street Journal, April 20, 2010
• Martin J. Young, Partnership Buzz, Asia Times (February 27, 2010).
• Jessica Guynn, Google Buzz poses a major privacy risk for kids, analyst (and parent) says, LA Times (February 22, 2010).
• Project ‘Gaydar’, Boston Globe, Sept. 20, 2009
• Doug Hanchard, EPIC explains their FTC complaint about Buzz, ZDNet (February 20, 2010).
• Jeff Cormier, Google Buzz lawsuit and privacy problems persist, Examiner.com (February 20, 2010).
• Update on Terms, Press Release, Facebook, Feb. 18, 2009
• Facebook 'withdraws' data changes, BBC, Feb. 18, 2009
• Facebook retains terms of service after users voice concerns, USA Today, Feb. 18, 2009
• How Does Facebook's TOS Compare To Other Social Networking Sites?, The Consumerist, Feb. 17, 2009
• Facebook backs down on privacy terms, Cnet, Feb. 17, 2009
• EPIC readying federal complaint over Facebook privacy policy, Cnet, Feb. 17, 2009
• Facebook Privacy Change Sparks Federal Complaint, PC World, Feb. 17, 2009
• Facebook's New Terms Of Service: "We Can Do Anything We Want With Your Content. Forever." The Consumerist, Feb. 15, 2009
• Miguel Helft, Google Alters Buzz to Tackle Privacy Flaws, N.Y. Times Bits (February 13, 2010).
• Jason Kinkaid, Google Buzz Abandons Auto-following Amid Privacy Concerns,,
• Charles Arthur, Google Buzz's Open Approach Leads to Stalking Threat, Guardian (February 12, 2010).
• F*ck You Google, Gizmodo (February 12, 2010).
• Laurie Sullivan, Google Buzz Publicly Airs Privacy Confusion, MediaPost (February 12, 2010).
• Richard Waters, Google Seeks to Quell Buzz Privacy Outcry, Financial Times (February 12, 2010).
• Robin Wauters, Google Buzz Privacy Issues have Real Life Implications, TechCrunch (February 12, 2010).
• Molly Wood, Google Buzz: Privacy Nightmare, CNET News (February 10, 2010).
• Project ‘Gaydar’, Boston Globe, Sept. 20, 2009
• Online Friends at What Price?, Marc Rotenberg, Sacramento Bee, July 20, 2008.
• Online Games Can Lead to Identity Theft, ABC News, July 16, 2008.
• A Flashy Facebook Page, at a Cost to Privacy, Washington Post, June 12, 2008
• Blockbuster Sued For Participating In Facebook's Beacon Program, Online Media Daily, April 17, 2008.
• Report: Facebook Security Lapse Exposes Photos, ComputerWorld, March 25, 2008.
• Plea to Ban Employers Trawling Facebook, TimesOnline, March 25, 2008. |
• More Privacy Options, The Facebook Blog, March 19, 2008.
• Facebook Denies Role in Morocco Arrest, Wall Street Journal, February 29, 2008.
• Taxman Admits to Facebook 'Trawl', Independent.ie, February 25, 2008.
• What Facebook Knows That You Don't, Washington Post, February 23, 2008.
• Hackers Exploiting Facebook, MySpace Plug-ins, Washington Post, February 23, 2008.
• Quitting Facebook Gets Easier, New York Times, February 13, 2008.
• How Sticky Is Membership on Facebook? Just Try Breaking Free, New York Times, February 11, 2008. Discusses difficulties with account deletion on Facebook.
• Exclusive: The Next Facebook Privacy Scandal, C|Net, January, 23, 2008. Discusses privacy issues with Facebook's third party application providers.
• Facebook Questioned Over Data Protection, Telegraph, January 21, 2008. The UK information commissioner's office is questioning Facebook's practice of retaining data instead of deleting it.
• Facebook, Google And Plaxo Join The DataPortability Workgroup, TechCrunch, January 8, 2008. The DataPortability working group is at www.dataportability.org.
• Facebook Blocks Secret Crush Over Adware Row, The Register, January 8, 2008. "Facebook has blocked the "Secret Crush" widget for violation of its terms of service, following a row about the use of the application to dupe users into downloading adware onto their PCs."
• Social networks: Bait for cybercrime. CNN Money, Oct. 4, 2006.
• Security Warning For MySpace. Facebook Users, CBS, Oct. 3, 2006.
• Facebook's feeds cause privacy concerns. The Amherst Student, Oct. 3, 2006.
• $1 Billion for Facebook? LOL!. Slate, Sept. 28, 2006.
• Open Facebook. Forbes. Sept. 11, 2006.
• Saying It 'Messed Up,' Facebook Modifies Controversial Feature. The Washington Post, Sept. 7, 2006 .

Resources

• EPIC: Facebook Privacy Page.
• EPIC: In re Google Buzz.
• EPIC: Online Guide to Practical Privacy Tools.
• Federal Trade Commission: Social Networking Sites: A Parents Guide and Social Networking Sites: Safety Tips for Tweens and Teens.
• Privacy Rights Clearinghouse: Fact Sheet 18 Privacy and the Internet: Traveling in Cyberspace Safely.
• Canadian Privacy Commisison video on Privacy and Social Networks.
• The Privacy Jungle: On the Market for Data Protection in Social Networks.

Previous Top News

• EPIC Pursues Public Release of Facebook and MySpace Privacy Reports: EPIC has submitted Freedom of Information Act requests for the release of the privacy assessments of Facebook and MySpace submitted to the Federal Trade Commission. As a result of privacy violations, both companies are required to implement comprehensive privacy programs and submit to independent, biennial evaluations for 20 years. Previously, EPIC obtained a copy of Google's initial privacy assessment that redacted information about the standards by which the assessment was completed, the test procedures used to assess the effectiveness of Google's privacy controls, the procedures Google uses to identify privacy risks, and the types of personal data Google collects from users. The FTC settlements with Facebook and Google arose from complaints brought by EPIC and other consumer organizations. In comments to the agency on the proposed settlements, EPIC recommended that the privacy assessments be publicly available. For more information, see EPIC: Federal Trade Commission and EPIC: Open Government. (Apr. 26, 2013)
• Instagram Retreats on Changes to Terms of Service, Cites User Opposition: Instagram announced that it would withdraw proposed changes to its terms of service announced earlier this week. Instagram backed off a plan to use the names, images, and photos of users for advertising purposes, pleading instead to "complete our plans, and then come back to our users and explain how we would like for our advertising business to work." Instagram's parent company, Facebook, is bound by the terms of a settlement with the Federal Trade Commission, initiated in 2009 by EPIC and other consumer privacy organizations, that prohibits the company from changing privacy settings without the affirmative consent of users or misrepresenting the privacy or security of users' personal information. A recent letter to Facebook CEO Mark Zuckerberg from EPIC and the Center for Digital Democracy warned that Facebook's proposed changes would adversely affect Instagram users. For more information, see EPIC: Facebook, EPIC: In re Facebook, and EPIC: FTC. (Dec. 21, 2012)
• Instagram Privacy Change Raises Legal Questions: Instagram recently announced several changes to the terms of service that will allow the company to use pictures in advertisements without notifying or compensating users, and to disclose user data to Facebook and to advertisers. Instagram also proposed that the parents of minors implicitly consent to the use of their childrens' images for advertising purposes. The changes The changes will take effect January 16, 2013, and will not apply to pictures uploaded before that date. Instagram’s parent company, Facebook, is under a 2011 consent order with the Federal Trade Commission that that prohibits the company from changing privacy settings without the affirmative consent of users or misrepresenting the privacy or security of users’ personal information. Using an individual’s name or likeness for commercial purposes without consent is also prohibited in most states. EPIC had recently urged Facebook users to vote for "Existing Documents," warning that under the changed terms of service, Facebook would loosen privacy controls and that would impact Instagram. For more information, see EPIC: Facebook and EPIC: FTC. (Dec. 18, 2012)
• Facebook Updates Privacy Controls, Removes Profiles Safeguard: Facebook announced changes to its privacy controls and the privacy settings of its users. The changes include settings that allow users to choose which information apps can access and disclose, and a privacy shortcuts menu. But Facebook also removed an option that allowed users to hide themselves from strangers through Facebook’s search function. The changes follow an election conducted by Facebook in which 88 percent of voters opposed changing the privacy policy and voting rights of users. EPIC previously wrote to the Federal Trade Commission regarding the blanket disclosure features of certain apps and the proposal to end the voting part of the site governance process Facebook. Facebook is currently subject to a settlement with the FTC over privacy violations. For more information, see EPIC: Facebook and EPIC: In re Facebook. (Dec. 13, 2012)
• 88% of Facebook Users Oppose Changes to Privacy Policy and Voting Rights, EPIC Urges FB to Withdraw Proposal: Preliminary results from the recent Facebook Site Governance Vote, indicate that 589,141 Facebook users voted to keep the existing Statement of Rights and Responsibilities and Privacy Policy. Only 79,731 voted for the proposed changes. In the largest vote in Facebook history, approximately 88% of users who voted favored the existing documents. EPIC and the Center for Digital Democracy earlier wrote FB CEO Mark Zuckerberg, recommending that the proposal be withdrawn. In 2009, Facebook withdrew proposed changes to the Terms of Service after 150,000 users formed a group "FB Users Against the New TOS." In 2007, FB backed off "Beacon," a controversial marketing technique, when 50,000 users signed a petition. Facebook is currently under a consent order with the US Federal Trade Commission. For more information, see EPIC: Facebook. (Dec. 10, 2012)
• EPIC Urges Vote for EXISTING Facebook Documents: Facebook has proposed changes to its policies that would (1) end user voting, (2) remove spam blocking, and (3) share FB user data with affiliates without user consent. EPIC and others are urging Faceboook users to participate in the Facebook Governance Vote and to vote for EXISTING documents. Anyone with a Facebook account can VOTE HERE. #existingdocuments (Dec. 4, 2012)
• Facebook Ceases Facial Recognition in European Union: The Irish Data Protection Commissioner issued a report finding that Facebook has implemented many of the Commissioner’s recommendations, such as halting the automatic use of facial recognition through "tag suggestions." Facebook has agreed to give users the choice over the use of facial recognition, to grant users access to their facial recognition template, and to delete the facial recognition data of EU citizens by October 15. The report also found that Facebook had implemented recommendations for improving transparency, enhancing the ability for users to delete data, and allowing users to access their data. On recommendations concerning user education, data deletion, and as targeting based on sensitive terms, the report found that "full implementation has not yet been achieved but is planned to be achieved by a specific deadline." The Federal Trade Commission recently adopted a proposed settlement with Facebook that prohibits Facebook from changing privacy settings without the affirmative consent of users or misrepresenting the privacy or security of users' personal information. In November 2011, EPIC recommended that the FTC prevent Facebook from creating facial recognition profiles without users' consent. In February 2012. EPIC recommended "the suspension of facial recognition technology deployment until adequate safeguards and privacy standards are established." For more information, see EPIC: Federal Trade Commission and EPIC: Facebook and Facial Recognition. (Sep. 21, 2012)
• FTC Finalizes Settlement with Myspace: The Federal Trade Commission has finalized the terms of a settlement with Myspace. The settlement follows from allegations that Myspace allowed advertisers to access personally-identifying information after promising to keep such information private. The settlement requires Myspace to implement a comprehensive privacy program, submit to independent audits, and refrain from privacy misrepresentations. EPIC commented on the settlement, recommending that the FTC make the settlement at least as protective as a previous settlement with Facebook. Additionally, EPIC said, the FTC should require Myspace to implement practices consistent with the White House’s Consumer Privacy Bill of Rights. In response to EPIC’s comments, the FTC decided to accept the proposed settlement without modification but said that “the privacy program mandated under the consent order will require Myspace to address many of the consumer protections discussed in your comment.” For more information, see EPIC: Federal Trade Commission and EPIC: Social Networking Privacy. (Sep. 11, 2012)
• Judge Rejects Settlement in Facebook "Sponsored Stories" Case: A federal judge has rejected a proposed settlement in a class-action lawsuit about Facebook's unapproved use of user images for advertising purposes. The judge, who had previously expressed skepticism about the terms of the settlement, wrote that the plaintiffs had not justified the lack of direct monetary payments to Facebook users, nor had they explained how users will receive an economic benefit from being able to opt out of future endorsements. EPIC and several consumer privacy organizations opposed the settlement, saying that there was little benefit to Facebook users and that the cy pres allocation was not aligned with the interests of the class. In 2009 and 2010 EPIC and a coalition of consumer privacy organizations brought a successful complaint to the Federal Trade Commission that resulted in a significant consent order. In a letter to the court following the recent court order, EPIC explained that the FTC settlement had produced far greater benefits for Facebook users. For more information, see EPIC: In re Facebook. (Aug. 21, 2012)
• Illinois Becomes Third State to Prohibit Employers from Demanding Facebook Information: Illinois Governor Pat Quinn has signed a bill that will prohibit employers from seeking the social network usernames and passwords of others. The Right to Privacy in the Workplace Act takes effect on January 1, 2013, and will result in Illinois joining Maryland and Delaware as the third state that protects the social network privacy of employees and job applicants. For more information, see EPIC: Workplace Privacy and EPIC: Facebook Privacy. (Aug. 2, 2012)
• EPIC Objects to Facebook Settlement, Cites Failure to Benefit Class Members: EPIC has asked a federal judge to reject a pending class action settlement concerning Facebook, stating that it does not actually benefit Facebook users. In one letter to the court, EPIC explained that the settlement does not fix the problem with "Sponsored Stories." In a second letter, joined by consumer, privacy, and academic organizations, EPIC said that "cy pres" funds should be distributed according to objective criteria, as courts have done in other similar cases. (Cy pres allows courts to allocate funds in class action settlements.) In 2009, EPIC led a coalition of consumer and privacy organizations that was responsible for the FTC's privacy settlement with Facebook.] And EPIC has routinely represented the interests of Facbeook users. For more information, see EPIC: Facebook Privacy. (Jul. 13, 2012)
• EPIC Calls On FTC to Investigate Facebook Email Changes: EPIC has asked the Federal Trade Commission to review Facebook's decision to change the default email address of Facebook users. The company recently removed email addresses, selected by users, with a @facebook.com address assigned by Facebook. EPIC asked the FTC to review this practice as it finalizes the terms of a settlement with Facebook. "Facebook's willingness to disregard user choice . . . raise[s] important questions about the company's ability to comply with the terms of the proposed Consent Order," EPIC wrote. EPIC also said that the change is a deceptive business practice because Facebook did not tell users that their preferred email address could be removed by the company. And EPIC noted that the change would result in user email being sent to Facebook's servers that would otherwise have gone to the user's email service. The FTC's settlement with Facebook follows from complaints filed by EPIC and other consumer and privacy organizations in 2009 and 2010. The settlement would bar Facebook from changing privacy settings without the affirmative consent of users or misrepresenting the privacy or security of users' personal information. For more information, see EPIC: Facebook Privacy, and EPIC: FTC Facebook Settlement. (Jun. 27, 2012)
• Facebook Acquires Facial Recognition Company Face.com: Facebook announced the acquisition of Face.com, a facial recognition technology company and long-time business partner of Facebook. Facebook uses an automatic facial recognition system, called "tag suggestions," to create a database of users' biometric information. Last year, EPIC filed a complaint with the Federal Trade Commission, stating that Facebook created biometric profiles of users without their explicit consent, failed to provide a clear mechanism for the deletion of these profiles, and failed to take adequate safeguards to ensure that users' biometric information would not be accessible to government agents and other third parties. In recent comments to the FTC, EPIC recommended the suspension of facial recognition technology deployment until adequate safeguards and privacy standards are established. For more information, see EPIC: Facial Recognition and EPIC: Facebook and Facial Recognition. (Jun. 20, 2012)
• EPIC Urges FTC to Protect Privacy of Myspace Users: EPIC submitted comments to the Federal Trade Commission on a proposed settlement with Myspace. The settlement follows from allegations that Myspace allowed advertisers to access personally-identifying information after promising to keep such information private. The settlement requires Myspace to implement a comprehensive privacy program, submit to independent audits, and refrain from privacy misrepresentations. EPIC expressed support for the settlement in general, but recommended that the FTC make the settlement at least as protective as a previous settlement with Facebook. Additionally, EPIC said, the FTC should require Myspace to implement practices consistent with the White House's Consumer Privacy Bill of Rights. For more information, see EPIC: Federal Trade Commission and EPIC: Social Networking Privacy. (Jun. 8, 2012)
• Facebook Users Force Vote on Privacy Changes: Facebook users have registered enough comments on Facebook's proposed privacy changes to force a vote on the issue. A provision in Facebook’s Statement of Rights and Responsibilities states that Facebook will allow users to vote on proposed alternatives if more than 7,000 users comment on a proposed change. The vote is binding if "more than 30 percent of all active registered users as of the date of the notice vote." Facebook's Data Use Policy accumulated 10,500 comments in English. The group Europe v. Facebook generated 30,000 comments on the German version of the page. The FTC recently issued a proposed settlement with Facebook that follows from complaints filed by EPIC and other consumer and privacy organizations in 2009 and 2010. The settlement bars Facebook from changing privacy settings without the affirmative consent of users or misrepresenting the privacy or security of users' personal information. For more information, see EPIC: Facebook Privacy, and EPIC: FTC Facebook Settlement. (May. 22, 2012)
• Myspace Settles With FTC Over Deceptive Practices Complaint: The Federal Trade Commission has reached a settlement with the social networking service Myspace over charges that Myspace allowed advertisers to access personally-identifying information after promising to keep such information private. Advertisers were able to access the unique "Friend ID" of users and link this identifier to other personal information. The settlement requires Myspace to implement a comprehensive privacy program, submit to independent audits, and refrain from privacy misrepresentations. For more information, see EPIC: Federal Trade Commission and EPIC: Social Networking Privacy. (May. 8, 2012)
• Following Maryland, Congress and California Consider Bills Banning Employers From Asking for Facebook Passwords: Reps. Eliot Engel (D-NY) and Jan Schakowsky (D-IL) introduced the Social Networking Online Protection Act, a bill that would prohibit employers, colleges, universities, and K-12 schools from seeking usernames or passwords for the social media accounts of employees or students. Similar legislation was introduced in California. Maryland became the first state to ban employers from asking employees or applicants for social networking passwords. Senators Blumenthal and Schumer have asked the Equal Employment Opportunity Commission and the U.S. Department of Justice to investigate the practice. For more information, see EPIC: Workplace Privacy and EPIC: Facebook Privacy. (May. 1, 2012)
• Facebook Asks for Feedback after Policy Changes: Facebook has re-opened its Statement of Rights and Responsibilities for comment after making changes to the original document. Although users’ personal data can still be accessed by the apps of their friends, Facebook clarified that users could prevent this by changing the “Apps and Websites” settings. Facebook also deleted a provision reserving the right to “exclude or limit the provision of any service or feature in our sole discretion” in certain geographic areas after users raised concerns about censorship. The FTC recently issued a proposed settlement with Facebook after finding that Facebook "deceived consumers by telling them they could keep their information on Facebook private, and then repeatedly allowing it to be shared and made public." The settlement follows from complaints filed by EPIC and other consumer and privacy organizations in 2009 and 2010 and bars Facebook from changing privacy settings without the affirmative consent of users or misrepresenting the privacy or security of users' personal information. In comments filed with the FTC, EPIC recommended that Facebook restore the privacy settings that users had in place when the violations occurred. In response to Facebook's prior policy change, EPIC noted that the data-disclosure practices of applications implicated issues that led the creation of the consent order. For more information, see EPIC: Facebook Privacy, and EPIC: FTC Facebook Settlement. (Apr. 23, 2012)
• Facebook Offers Revised “Download Your Information” Option: The New York Times reported that Facebook would provide users with a downloadable archive containing many types of data that the company stores about users. Although the new archive contains more user information than Facebook first offered in 2010, Max Schrems, the German law student and founder of Europe v. Facebook, said that Facebook is still only providing 39 of 84 data categories. EPIC called on Facebook to give users full access to all of the data that the company keeps about them through EPIC’s Know What They Know campaign. In comments on a settlement between Facebook and the Federal Trade Commission, EPIC recommended that the FTC require Facebook to give users full access to their data. For more information, see EPIC: Facebook Privacy and EPIC: Know What They Know. (Apr. 12, 2012)
• Maryland Passes Bill Banning Employers from Demanding Facebook Information: The Maryland legislature passed the first bill banning employers from asking employees or applicants for social networking passwords. The bill was introduced after Robert Collins, an employee at the Department of Public Safety and Correctional Services, was asked to turn over his Facebook password as part the process of being reinstated as a corrections officer. Recently, Senators Blumenthal and Schumer asked the Equal Employment Opportunity Commission and the U.S. Department of Justice to investigate the practice of employers asking job applicants to surrender user names and passwords for social networking sites like Facebook. For more information, see EPIC: Workplace Privacy and EPIC: Facebook Privacy. (Apr. 11, 2012)
• Senators Call for Investigation into Employer Demands for Facebook Passwords: Senators Blumenthal and Schumer asked the Equal Employment Opportunity Commission and the Department of Justice to investigate the practice of employers asking job applicants to surrender Facebook user names and passwords. The Senators pointed out that accessing an applicant's profile could reveal sensitive information that employers are not permitted to ask about or base hiring decisions on. Thus, employers could be violating the Civil Rights Act and other federal laws, including the Stored Communication Act and the Computer Fraud and Abuse Act, which prohibit "unauthorized access" to electronic information. “Requiring applicants to provide login credentials to secure social media websites and then using those credentials to access private information stored on those sites may be unduly coercive and therefore constitute unauthorized access under both [Acts]," the letter states. For more information, see EPIC: Workplace Privacy and EPIC: Facebook Privacy. (Mar. 26, 2012)
• Facebook Policy Changes Raises Questions About Compliance with 2011 Consent Order: Facebook has begun to review comments on changes to its Statement of Rights and Responsibilities. Among other changes, Facebook now states that a user's information is disclosed to apps used by his or her friends, that Facebook software or plugins that users download may automatically download updates, upgrades, and additional features, and that users may not tag others who do not wish to be tagged. The FTC recently issued a proposed settlement with Facebook after finding that Facebook "deceived consumers by telling them they could keep their information on Facebook private, and then repeatedly allowing it to be shared and made public." In particular, the FTC found that Facebook had misled users about the extent to which their personal information would be made available to apps used by their friends. The settlement follows from complaints filed by EPIC and other consumer and privacy organizations in 2009 and 2010 and bars Facebook from changing privacy settings without the affirmative consent of users or misrepresenting the privacy or security of users' personal information. In comments filed with the FTC, EPIC said that the settlement is "insufficient to address the concerns originally identified by EPIC and the consumer coalition, as well as those findings established by the Commission." For more information, see EPIC: Facebook Privacy, and EPIC: FTC Facebook Settlement. (Mar. 23, 2012)
• Pew Study: Social Media Users Active in Protecting Privacy: A Pew study found that users are becoming more active in managing their social media accounts. Compared to 2009, a higher percentage of users reported deleting people from their “friends” lists, deleting comments made by others on their profile, and removing their names from photos in which they were tagged. The report also found that women and young users were the most active in protecting their privacy. The Federal Trade Commission is currently finalizing a consent order with Facebook over charges that the company changed users' privacy settings to make personal information more available to the public and to Facebook's business partners. For more information, see EPIC: Social Networking Privacy, EPIC: Facebook Privacy, and EPIC: Public Opinion and Privacy. (Feb. 27, 2012)
• Congress to Hold Hearing on Department of Homeland Security Social Network Monitoring: On February 16, 2012, the House Committee on Homeland Security will hold a hearing on "DHS Monitoring of Social Networking and Media: Enhancing Intelligence Gathering and Ensuring Privacy." The hearing was called after EPIC obtained nearly 300 pages of documents, as a result of a Freedom of Information Act lawsuit, detailing the Department of Homeland Security's monitoring of social networks and media organizations. The documents included guidelines from DHS instructing General Dynamics to monitor for media reports that "reflect adversely" on the agency or the federal government. For more information see: EPIC v. Department of Homeland Security: Media Monitoring. (Feb. 6, 2012)
• EPIC Calls for Moratorium on Facial Recognition Technology: In detailed comments to the Federal Trade Commission, EPIC today recommended the suspension of facial recognition technology deployment until adequate safeguards and privacy standards are established. EPIC said that facial recognition is often used by strangers to determine a person's actual identity and that this poses a risk to privacy and personal security. EPIC also noted that some companies have adopted techniques that are more favorable to privacy as they allow users to control the image database while others undermine privacy, as the image database is centrally maintained. EPIC previously submitted a complaint to the FTC about Facebook's use of facial recognition technology to build a secret database of users' biometric data and allowing the company to automatically tag users in photos. The comments follow an FTC workshop exploring the privacy and security issues raised of facial recognition technology. For more information, see EPIC: Federal Trade Commission, EPIC: Face Recognition, and EPIC: Facebook and Face Recognition. (Feb. 1, 2012)
• EPIC Urges FTC Investigation into Facebook Timeline: EPIC sent a letter requesting that the Federal Trade Commission determine whether changes Facebook has made to the profiles of its users are consistent with the terms of a settlement reached between Facebook and the FTC. EPIC's letter states that "with Timeline, Facebook has once again taken control over the user's data from the user and has now made information that was essentially archived and inaccessible widely available without the consent of the user." The settlement requires Facebook to give users clear and prominent notice and obtain users' express consent before changing their privacy settings. EPIC sent a similar letter to the FTC about Timeline and the secret tracking of users in September 2011. For more information, see EPIC: Facebook Privacy, and EPIC: FTC Facebook Settlement. (Dec. 28, 2011)
• EPIC Submits Comments on FTC Facebook Privacy Settlement: EPIC submitted comments to the FTC on a proposed settlement with Facebook. The settlement follows from complaints filed by EPIC and other consumer and privacy organizations in 2009 and 2010 over Facebook’s decision to change its users' privacy settings in a way that made users' personal information more widely available to the public and to Facebook's business partners. The settlement bars Facebook from changing privacy settings without the affirmative consent of users or misrepresenting the privacy or security of users' personal information. However, EPIC said that the settlement is "insufficient to address the concerns originally identified by EPIC and the consumer coalition, as well as those findings established by the Commission." In order to address the issues raised by the complaints, respond to recent changes in Facebook's business practices like Timeline, and fulfill the FTC's duty to act in the public interest, EPIC recommended that the settlement be improved. Specifically, EPIC recommended that the FTC require Facebook to restore the privacy settings users had in 2009; give users access to all of the data that Facebook keeps about them; stop making facial recognition profiles without users' consent; make the results of the government privacy audits public; and stop secretly tracking users across the web. For more information, see EPIC: Facebook Privacy, and EPIC: FTC Facebook Settlement. (Dec. 28, 2011)
• EPIC Sues DHS Over Covert Surveillance of Facebook and Twitter : EPIC has filed a Freedom of information Act lawsuit against the Department of Homeland Security to force disclosure of the details of the agency's social network monitoring program. In news reports and a Federal Register notice, the DHS has stated that it will routinely monitor the public postings of users on Twitter and Facebook. The agency plans to create fictitious user accounts and scan posts of users for key terms. User data will be stored for five years and shared with other government agencies.The legal authority for the DHS program remains unclear. EPIC filed the lawsuit after the DHS failed to reply to an April 2011 FOIA request. For more information, see EPIC: Social Networking Privacy. (Dec. 20, 2011)
• Facebook Timeline Changes User Privacy Settings. Again.: Without user consent, Facebook announced today that it would post archived user information, making old posts available under Facebook's current downgraded privacy settings. Users have just a week to clean up their history before Timeline goes live. The surprising announcement follows a recent decision by the Federal Trade Commission which found that the company had engaged in "unfair and deceptive" trade practices when it changed the privacy settings of its users. EPIC initiated that complaint and is now urging FB users to submit comments to strengthen the proposed settlement. For more information, see EPIC - In Re Facebook and EPIC - Facebook and Privacy. (Dec. 15, 2011)
• EPIC Launches Campaign Urging Public Comment on Facebook Privacy Settlement: EPIC launched the "Fix FB Privacy Fail" campaign to encourage the public to support improvements to a settlement between Facebook and the FTC. The settlement follows from complaints filed by EPIC and other consumer and privacy organizations in 2009 and 2010 over Facebook’s decision to change its users' privacy settings in a way that made users' personal information more widely available to the public and to Facebook's business partners. Although the proposed settlement is far-reaching, there are several ways in which it could be improved. EPIC has recommended that the FTC require Facebook to restore the privacy settings users had in 2009; give users access to all of the data that Facebook keeps about them; stop making facial recognition profiles without users' consent; make the results of the government privacy audits public; and stop secretly tracking users across the web. The period for public comment on the proposed settlement ends on December 30. The campaign also allows users to sign on to the petition without using Facebook. For more information, see EPIC: FTC Facebook Settlement. (Dec. 13, 2011)
• Federal Trade Commission Announces Settlement in EPIC Facebook Privacy Complaint: The Federal Trade Commission has announced an agreement with Facebook that follows from complaints filed by EPIC and other consumer and privacy organizations in 2009 and 2010. In 2009, the EPIC first asked the FTC to investigate Facebook's decision to change its users' privacy settings in a way that made users' personal information, such as Friend lists and application usage data, more widely available to the public and to Facebook’s business partners. The violations are also detailed in the FTC’s 8-count complaint against the company. The proposed settlement agreement bars Facebook from making future changes privacy settings without the affirmative consent of users and requires the company to implement a comprehensive privacy protection program and submit to independent privacy audits for 20 years. The settlement does not adopt EPIC's recommendation that Facebook restore users' privacy settings to pre-2009 levels. Facebook CEO Mark Zuckerberg reacted to the settlement in a post on Facebook's blog, saying that he was "first to admit that we've made a bunch of mistakes." For more information, see EPIC: In re Facebook, and EPIC: Federal Trade Commission. (Nov. 29, 2011)
• Federal Trade Commission to Announce Settlement in EPIC Facebook Privacy Complaint: The Federal Trade Commission has scheduled a 1:00 pm EDT press conference to announce a privacy settlement with Facebook, following a complaint that was filed by EPIC and other consumer and privacy organizations. More news to follow. (Nov. 29, 2011)
• Federal Judge Orders Twitter to Turn Over Information About Wikileaks Supporters: A federal district judge in Virginia has ordered Twitter to make available to the Justice Department the personal information - including IP addresses, session times, and relationships between other Twitter users - of people who may have supported Wikileaks. In reaching this decision, Judge O'Grady relied on a revised version of Twitter's privacy policy, which was not in place when the users signed up. Under the Court's order the Department of Justice may obtain the data with a warrant under the Stored Communications Act. The targets of the Department of Justice's investigation are the WikiLeaks' Twitter account, and the accounts of three people connected to the group: Seattle coder and activist Jacob Appelbaum; Birgitta Jonsdottir, a member of Iceland's parliament; and Dutch businessman Rop Gonggrijp. EPIC has several FOIA requests pending with US federal agencies concerning the investigation of Wikileaks. For more information see EPIC: Social Networking Privacy. (Nov. 17, 2011)
• WSJ: Facebook Close to Settlement with FTC over EPIC Complaint : The Wall Street Journal reports that the Federal Trade Commission is finalizing a settlement with Facebook that follows from a complaint from EPIC and a coalition of US consumer and privacy organizations. In 2009, the organizations urged the Commission to investigate Facebook's decision to change its users' privacy settings which made the personal information of Facebook users more widely available to Facebook's business partners and the public. According to the Wall Street Journal, the settlement would require Facebook to obtain "express affirmative consent" if Facebook makes "material retroactive changes," and to submit to independent privacy audits for 20 years. For more information, see EPIC: In re Facebook, EPIC: Facebook Privacy and EPIC: Federal Trade Commission. (Nov. 10, 2011)
• Congress, #KWTK Presses Facebook to Disclose Secret Profiles: Lawmakers in Washington have sent a letter to Mark Zuckerberg, Facebook's CEO, asking questions about the company's data retention practices, following a news report that a single European Facebook user obtained more than 1,200 pages of his own personal data from the company, including information that he had previously deleted. Following an effort of privacy advocates in Europe, EPIC has launched the KWTK (Know What They Know) campaign and is urging Facebook users to obtain their complete "data dossier" from the company. For more information, see EPIC: Facebook Privacy and EPIC:#kwtk. (Oct. 31, 2011)
• Sen. Rockefeller Requests FTC Report on Facial Recognition Technology: Senator John D. Rockefeller (D-WV) sent a letter requesting that the Federal Trade Commission assess the use of facial recognition technology and recommend legislation to protect privacy. Facial recognition technology is being used by technology firms and also police agencies, which has raised civil liberties concerns. The letter cited mobile applications such as SceneTap, which "tracks the male/female ratio and age mix of the crowd [in bars]" and digital advertising at the Venetian Resort in Las Vegas that tailors ads to the person standing in front of the display based on recognition of that person’s age and gender. The FTC will hold a workshop on facial recognition technology on December 8, 2011. EPIC's complaint regarding Facebook's facial recognition is still pending before the FTC. For more information, see EPIC: In re Facebook, and EPIC: Facial Recognition. (Oct. 20, 2011)
• Facebook Makes Some Changes, Privacy Complaints Still Pending: In response to several complaints filed by EPIC with the Federal Trade Commission, Facebook announced that it would make some changes in its business practices, including providing more accurate information about the disclosure of user data to others and new safeguards for photo tagging. EPIC, along with several privacy organizations, filed several complaints with the FTC about FB's automated tagging of users, changes in Privacy settings, and transfers of personal data, stating that Facebook's practices were "unfair and deceptive." Facebook's recent actions address some but not all of the issues raised by the consumer organizations. The complaint at the FTC are still pending. For more information see EPIC: Facebook Privacy. (Aug. 29, 2011)
• Twitter Adopts Privacy Enhancing Technique, Defaults to HTTPS: Twitter has joined the ranks of Gmail with a decision to implement HTTPS functionality by default for all users in order to encrypt data and protect privacy. The change stems from several security problems in early 2011, including two incidents where hackers gained administrative control of the popular service and led to a settlement with the Federal Trade Commission requiring Twitter to adopt stronger security measures. Earlier, EPIC had pointed out the importance of HTTPS by default in a complaint to the Commission regarding Google and Cloud Computing Services. For more information, see EPIC: Social Networking Privacy and EPIC: In re Google and Cloud Computing. (Aug. 24, 2011)
• Government Accountability Office: Agencies Must Improve Social Networking Privacy, Security: An independent report recommends that federal agencies "improve their development and implementation of policies and procedures for managing and protecting information associated with social media use." The Government Accountability Office, an independent, nonpartisan agency, surveyed twenty-three agencies concerning privacy and security policies. Only half of the agencies have updated their privacy policies to take account of personal information collected through social media monitoring. Only a quarter conducted privacy impact assessments of agency social media activities. The GAO also noted that only seven of the surveyed agencies have identified and documented social-media security risks. In March, EPIC filed comments regarding DHS's Social Media Monitoring and Situational Awareness Initiative, identifying substantial privacy and security risks. For more information, see EPIC: Social Networking Privacy. (Aug. 2, 2011)
• Facebook Makes Changes to Facial Recognition; Still Relying on Opt-Out: In response to a letter from the Connecticut Attorney General, Facebook agreed to run ads that link users to their privacy settings and show them how to opt-out of Facebook's facial recognition program. The ads are new, but Facebook has failed to implement an opt-in model for its facial recognition technology. EPIC, along with several other organizations, filed a complaint with the Federal Trade Commission concerning Facebook's unfair and deceptive trade practices regarding biometric data collection. EPIC urged the FTC to require Facebook to suspend the program pending a full investigation. EPIC also urged the Commission to require Facebook to establish stronger privacy safeguards and an opt-in regime for the facial recognition scheme. For more information, see EPIC: In re Facebook and the Facial Identification of Users. (Jul. 27, 2011)
• Congressman Markey Commends EPIC, Privacy Groups for Filing Facebook Complaint: Congressman Ed Markey today expressed support for the complaint filed last week by EPIC and privacy groups concerning Facebook's new scheme for online tagging. In a published statement, Congressman Markey said, "The Federal Trade Commission should investigate this important privacy matter, and I commend the consumer groups for their filing. When it comes to users’ privacy, Facebook’s policy should be: 'Ask for permission, don’t assume it.' Rather than facial recognition, there should be a Facebook recognition that changing privacy settings without permission is wrong. I encourage the FTC to probe this issue and will continue to closely monitor this issue." EPIC and consumer groups now have several complaints regarding Facebook pending at the FTC. For more information, see EPIC - In re Facebook and EPIC - In re Facebook II, and EPIC - Facebook and Privacy. (Jun. 14, 2011)
• Facebook Resumes Plan to Disclose User Home Addresses and Mobile Phone Numbers: Facebook indicated in a letter to Rep. Markey (D-MA) and Rep. Barton (R-TX) that it will go forward with a proposal to provide users' addresses and mobile phone numbers to third-party application developers. The Congressman earlier expressed concern about the proposal. Facebook also wrote that it may disclose the home addresses and mobile numbers of minors who use the social networking service. Facebook suspended the plan after EPIC and others objected. EPIC and several consumer organizations have complaints pending at the Federal Trade Commission concerning Facebook's earlier changes to users' privacy settings. For more information, see EPIC: In re Facebook, EPIC: In re Facebook II, and EPIC: Facebook Privacy. (Mar. 2, 2011)
• Chairman Leahy Announces New Subcommittee on Privacy and Technology: Sen. Patrick Leahy (D-VT), Chairman of the Senate Judiciary Committee, has established a new Subcommittee on Privacy, Technology and the Law as part of his commitment to protecting “Americans’ privacy in the digital age.” Sen. Al Franken (D-MN) will chair the subcommittee, which will will cover privacy laws and policies, new business practices, social networking sites, privacy standards, and the privacy implications of emerging technologies. For related information, see EPIC: Social Networking Privacy, EPIC: Cloud Computing. (Feb. 16, 2011)
• Facebook Enables Full-Session Encryption: Facebook will now allow full-session HTTPS. The switch to encrypted cloud-based computing promotes privacy and security, particularly when users access Facebook from public Internet access points. Previously, Facebook only used HTTPS when users’ passwords were being sent to the site. Third party applications currently do not support HTTPS. Users can opt into HTTPS through their “Account Settings;” however, HTTPS is not yet the default. Facebook will use "social authentication, rather than traditional CAPTCHA," to deter hackers. EPIC has previously recommended the adoption of strong privacy techniques for cloud-based services. In 2009, EPIC filed a complaint with the Federal Trade Commission, urging an investigation into Google’s cloud computing services to determine the adequacy of privacy and security safeguards. Google subsequently established HTTPS by default for Gmail. For related information, see EPIC: Facebook, EPIC: Cloud Computing, and EPIC: Social Networking Privacy. (Feb. 7, 2011)
• Facebook Drops Plan to Disclose Users' Home Addresses and Personal Phone Numbers: Facebook has retreated from its decision to allow third-party access to users home addresses and phone numbers. Facebook backed off after criticism of the new policy, but said it would go forward once it has made further changes. EPIC Executive Director Marc Rotenberg said "Facebook is trying to blur the line between public and private information. And the request for permission does not make clear to the user why the information is needed or how it will be used." EPIC, and several consumer organizations, have complaints pending at the Federal Trade Commission concerning Facebook's earlier changes to users' privacy settings. For more information, see EPIC: In Re Facebook, EPIC: In Re Facebook II, and EPIC: Facebook Privacy. (Jan. 18, 2011)
• Labor Relations Board Files Complaint against Company over Facebook Post: The National Labor Relations Board has issued a complaint against American Medical Response of Connecticut for firing an employee who complained about her supervisor on Facebook. The company claimed that it fired the employee for violating its policy against depicting the company on a social media site. The NLRB's complaint states that the company's blogging and internet posting policy is overly broad; the company illegally denied union representation during the investigation; and that the firing violated an employee's right to engage in concerted activities. The National Labor Relations Act protects an employee's right to engage in group activities, such as discussing work-related issues, to improve workplace conditions. A hearing is scheduled for January 25, 2011. For related information, see EPIC: Workplace Privacy and EPIC: Social Networking Privacy. (Nov. 9, 2010)
• New Social Networking Privacy Poll Released, Kids Privacy Campaign Launched: According to a national poll from Common Sense Media, three out of four parents believe that social network services do not adequately protect children's online privacy. The Common Sense Media "Protect Our Privacy - Protect Our Kids" campaign calls for opt-in consent, clear and simple privacy statements, updated privacy laws, and a prohibition on behavioral marketing for kids. EPIC filed comments with the Federal Trade Commission aimed at improving the Children's Online Privacy Protection Act (COPPA). EPIC President Marc Rotenberg testified before the Senate Commerce Committee earlier this year, and urged Congress to extend COPPA to cover social networks and teens. For more information, see EPIC: COPPA. (Oct. 12, 2010)
• Facebook Uses RFID to Track Users' Locations for Advertising Promotion: At the Coca-Cola Village Amusement Park in Israel, visitors were recently issued bracelets with RFID chips that linked to their Facebook accounts, according to Adland. RFID readers scattered throughout the park updated the users' Facebook pages when the bracelets were scanned. On-site photographers also posted photos that were automatically tagged with the users' identities. Facebook had previously tested the use of RFID for location tracking at the f8 Developer Conference in April. Facebook has also just launched Places, which is designed to make users' location information widely available. For more information, see EPIC Facebook Privacy, EPIC Facebook Places. (Aug. 25, 2010)
• Facebook "Places" Embeds Privacy Risks, Complicated and Ephemeral Opt-Out Unfair to Users: The recently announced Facebook service Places makes user location data routinely available to others, including Facebook business partners, regardless of whether users wish to disclose their location. There is no single opt-out to avoid location tracking; users must change several different privacy settings to restore their privacy status quo. For users who do not want location information revealed to others, EPIC recommends that Facebook users: (1) disable "Friends can check me in to Places," (2) customize "Places I Check In," (3) disable "People Here Now," and (4) uncheck "Places I've Visited." EPIC, joined by many consumer and privacy organizations, has two complaints pending at the Federal Trade Commission concerning Facebook's unfair and deceptive trade practices, which are frequently associated with new product announcements. For more information, see EPIC In Re Facebook, EPIC In Re Facebook II, and EPIC Facebook Privacy. (Aug. 19, 2010)
• EPIC to Urge Congress to Strengthen Privacy Laws for Facebook Users: In prepared testimony (PDF) for a Congressional hearing on "Online Privacy, Social Networking and Crime Vicitimization," EPIC Executive Director Marc Rotenberg urged lawmakers to update federal law to protect the privacy of Facebook users. Mr. Rotenberg said that Facebook's constant changes to the privacy settings of users have made it virtually impossible for users to control who gets access to their personal information. He also said that the failure of the Federal Trade Commission to investigate Facebook's business practices means that Congress must now amend the federal privacy law to limit the ability of Social Network companies to disclose user information to third parties without informed and explicit consent. Also testifying at the hearing are witnesses from the FBI, the Secret Service, Symantec, and Facebook. For more information, see EPIC Social Networking Privacy, EPIC Facebook, and EPIC In re Google Buzz. (Jul. 28, 2010)
• Facebook Scores Low on Consumer Satisfaction: In a recent study by Foresee Results and the University of Michigan, Facebook has scored extremely low in the area of customer satisfaction. The 2010 American Customer Satisfaction Index E-Business Report included social networking companies for the first time, and Facebook scored a 64, putting it "in the bottom 5% of all measured private sector companies and in the same range as airlines and cable companies." The polling company attributed Facebook's low scores to "privacy concerns, frequent changes to the website, and commercialization and advertising." For more information, see EPIC Facebook Privacy and EPIC Public Opinion on Privacy. (Jul. 22, 2010)
• FTC Invites Public Comment on Twitter Settlement: The FTC is calling for public comments on the recent Twitter Settlement. The Commission's complaint against Twitter charged that "serious lapses in the company's data security allowed hackers to obtain administrative control of Twitter." The FTC found that the lax practices allowed access to nonpublic tweets even though the company assured users in its privacy policy that it was "very concerned about safeguarding the confidentiality of your personally identifiable information." Under the terms of the settlement, "Twitter will be barred for 20 years from misleading consumers about the extent to which it maintains and protects the security, privacy, and confidentiality of nonpublic consumer information." Comments are due on July 26, 2009, and may be submitted electronically or in paper form. For more information, see EPIC: Social Networking Privacy. (Jul. 2, 2010)
• White House Adopts Weird Opt-Out Privacy Policy for Public Access to Government Web Sites: The White House has announced a new "Clear Notice and Personal Choice" policy for the use of Web Measurement and Customization Technologies for government web sites. The policy is remarkable in that there does not appear to be any legal basis to allow federal agencies to routinely disclose personal information of citizens to private companies. The policy is accompanied by new Guidance for Agency Use of Third-Party Websites and Applications. The White House also announced a National Strategy for Trusted Identities in Cyberspace. EPIC had urged the White House to uphold Privacy Act obligations in use of web 2.0 services. For more information, see EPIC - Privacy and Government Contracts with Social Media Companies. (Jun. 28, 2010)
• Federal Trade Commission Takes Action Against Twitter, Social Network Service Settles Charges It Deceived Consumers: The FTC announced a significant enforcement action today. The Commission's complaint against Twitter charged that "serious lapses in the company's data security allowed hackers to obtain administrative control of Twitter." The FTC found that the lax practices allowed access to nonpublic tweets even though the company assured users in its privacy policy that it was "very concerned about safeguarding the confidentiality of your personally identifiable information." Under the terms of the settlement, "Twitter will be barred for 20 years from misleading consumers about the extent to which it maintains and protects the security, privacy, and confidentiality of nonpublic consumer information." EPIC has two complaints currently pending at the FTC concerning similar practices by Facebook, another social networking service. For more information, see EPIC - Facebook Privacy, EPIC - In re Facebook I, and EPIC - In re Facebook II. (Jun. 24, 2010)
• Privacy Conference Attendees Set Out Social Networking Bill of Rights: Participants at the 2010 Conference on Computers, Freedom, and Privacy have prepared a Social Network Users' Bill of Rights. The Bill of Rights sets out principles for providers of  social network services, including clarity of policies, empowerment of users, freedom of speech, data minimization, and user control. For more information, follow #billofrights and see EPIC: Social Networking Privacy and EPIC: Facebook Privacy. (Jun. 23, 2010)
• EPIC, Privacy Groups Recommend Further Changes for Facebook: EPIC has joined a letter, organized by the ACLU of Northern California, calling for Facebook to fix ongoing privacy problems with the social network service. The letter, signed by several privacy organizations, recommends that Facebook make "Instant Personalization" opt-in, limit data retention, give users greater control over their information, and allow users to export their content from Facebook. EPIC has a complaint currently pending at the Federal Trade Commission, charging that Facebook has engaged in unfair and deceptive trade practices. For more information, see EPIC Facebook Privacy. (Jun. 16, 2010)
• Privacy Issue Attracts Fire in California Attorney General Race: Facebook privacy has become a hot topic in the California race for Attorney General. In the Democratic primary, Kamala Harris has attacked former Facebook Chief Privacy Officer Chris Kelly over the company's privacy practices. But Kelley has recently criticized some of the Facebook changes and said that "instant personalization" should be opt-in. Kelly has also supported a Moveon Facebook campaign though some bloggers have doubts. During the last election cycle, EPIC launched PRIVACY08 to encourage candidates to debate privacy issues. Also see EPIC Facebook Privacy. (Jun. 7, 2010)
• Congress Pursues Investigation of Google and Facebook's Business Practices: Following similar letters from other Congressional leaders, the head of the House Judiciary Committee has asked Google Inc. and Facebook to cooperate with government inquiries into privacy practices at both companies. Rep. Conyers (D-MI) noted that Google's collection of user data "may be the subject of federal and state investigations" and asked Google to retain the data until "such time as review of this matter is complete." Rep. Conyers also asked Facebook to provide a detailed explanation regarding its collection and sharing of user information. The House Judiciary Committee is expected to hold hearings on electronic privacy later this year. For more information, see EPIC: Facebook Privacy, EPIC: In re Facebook II, and EPIC: Search Engine Privacy. (Jun. 1, 2010)
• New Study Shows Young Americans Value Privacy: A new study from the Pew Internet and American Life Project has found that "[r]eputation management has now become a defining feature of online life for many internet users, especially the young." The Pew study Reputation Management and Social Media found that young adults are far more likely than their older counterparts to take steps to maintain control over their digital identities, including changing their privacy settings, restricting access to their data, and removing their names from tagged photographs. The report also found that these privacy-protecting activities have become considerably more common across all age groups than they were when a similar study was conducted in 2006. For more information, see EPIC Public Opinion on Privacy. (May. 27, 2010)
• Facebook Expected to Announce Privacy Changes: Following a recent column in the Washington Post by Facebook CEO Mark Zuckerberg, the company is expected to announce new, simplified privacy settings this week.  EPIC objected to the last several rounds of changes that Facebook made, filing a complaint with the FTC in December when the company reclassified much of users' data as "publicly available information," a supplement to that complaint in January, and another complaint this month when Facebook forced users' profile information to become publicly available links instead of private data.  For more information, see EPIC: Facebook, EPIC: In re Facebook, and EPIC: In re Facebook II. (May. 25, 2010)
• New Facebook Privacy Complaint Filed with Trade Commission: Today, EPIC and 14 privacy and consumer protection organizations filed a complaint with the Federal Trade Commission, charging that Facebook has engaged in unfair and deceptive trade practices in violation of consumer protection law. The complaint states that changes to user profile information and the disclosure of user data to third parties without consent "violate user expectations, diminish user privacy, and contradict Facebook’s own representations." The complaint also cites widespread opposition from Facebook users, Senators, bloggers, and news organizations. In a letter to Congress, EPIC urged the Senate and House Committees with jurisdiction over the FTC to monitor closely the Commission's investigation. The letter noted the FTC's failure to act on several pending consumer privacy complaints. For more information, see EPIC: Facebook Privacy. (May. 5, 2010)
• Senators Oppose Facebook Changes, Schumer Urges Trade Commission to Regulate Social Network Services: Senators Charles Schumer (D-NY), Michael Bennet (D-CO), Mark Begich (D-AK), and Al Franken (D-MI) have sent a letter to Facebook CEO Mark Zuckerberg to express concern about "recent changes to the Facebook privacy policy and the use of personal data by third-party websites." Senator Schumer has also asked the Federal Trade Commission to establish guidelines for social networking sites. The Senators' statements came after Facebook announced it would disclose user data to websites without consent. Senator Schumer stated "Previously, users had the ability to determine what information they chose to share and what information they wanted to keep private." EPIC has filed a complaint and with the FTC about the recent changes to Facebook's privacy settings. For more information, see EPIC: Facebook Privacy and EPIC: In re Facebook. (Apr. 27, 2010)
• Facebook's Data Grab: New Policies Transfer Control of User Data to Facebook: Facebook announced significant changes at F8 this week that will integrate Facebook with many web sites, but also make it more difficult for Facebook users to limit the disclosure of personal information. The announcement follows recent changes to Facebook privacy settings and privacy policies. "Instant personalization" will give Facebook's business partners access to users' likes, interests, friends, and other details, unless users opt-out. Facebook has also removed a key privacy safeguard and will allow third parties to store user data indefinitely. EPIC has a complaint pending at the FTC concerning recent changes to Facebook's privacy settings. For more information, see EPIC: Facebook Privacy and EPIC's Previous FTC Complaint regarding Facebook, EPIC: In re Facebook. (Apr. 22, 2010)
• Lawmakers Urge FTC to Investigate Google Buzz: Ten House Members have asked the Federal Trade Commission to pursue an investigation into the Google social networking service Buzz, given "Google's practice of automatically using consumers' e-mail address books to create contact lists for Buzz and then publicly disclosing the names of those private contacts" online. The lawmakers also asked the Commission to consider the privacy implications of Google's proposed acquisition of AdMob, the mobile phone advertising company. EPIC has filed a complaint with the FTC, asking the Commission to investigate Google Buzz. Previously, EPIC recommended that the FTC block Google's acquisition of Doubleclick, the banner advertising firm, because of the privacy implications. For more information, see EPIC: In re Google Buzz. (Mar. 29, 2010)
• EPIC Recommends Effective Consumer Privacy Standards, Calls Notice and Choice a "Failed Experiment": At the third FTC Privacy Roundtable, EPIC senior counsel John Verdi will recommend that the Commission push forward with effective and meaningful privacy safeguards for American consumers. Mr. Verdi will say that the "notice and choice" approach has failed, and will recommend that the FTC enforce Fair Information Practices, such as the OECD Privacy Guidelines. The discussion can be viewed via webcast. Additional information on the FTC roundtable event can be found here. For more information, see EPIC In re Google Buzz, EPIC In re Facebook, and EPIC In re Google and Cloud Computing. (Mar. 17, 2010)
• Judge Waits to Decide on Proposed Settlement in Facebook Privacy Case: Following a hearing last week, U.S. District Court Judge Seeborg reserved decision about the approval of Facebook’s proposed 9.5 million dollar settlement in a case involving Facebook Beacon. According to the settlement terms, Facebook would contribute about $6 million to the establishment of a privacy organization. Facebook, however, would maintain control over this organization, as Facebook's top lobbyist would become co-President and all significant decisions would require a unanimous vote. EPIC and several other privacy organizations, including the Consumer Federation of America and the Privacy Rights Clearinghouse, have written a letter to Judge Seeborg, ask him to reject the settlement as proposed. For more information, see EPIC: Facebook Privacy. (Mar. 1, 2010)
• Study Ranks Top 20 Companies for Privacy in 2010, Facebook Drops Off List: Ponemon Institute released its annual study identifying the top twenty companies that are most trusted for privacy. American Express was ranked first, earning the Most Trusted for Privacy distinction for the fifth year in a row. Facebook suffered several privacy missteps over the last year, including a recent change in privacy settings at the end of 2009, and as a result, failed to make the 2010 list. Google, however, returned to the Top 20, ranked at 13. The survey also produced significant findings regarding consumer attitudes towards privacy, including the finding that consumers feel they are losing control over their personal information. Further, the responses revealed that consumers’ fear of identity theft is the main factor for brand trust diminishment, while a company’s implementation of privacy features contribute to brand trust. Other significant positive factors were limits on the collection of personal information and online anonymity. (Feb. 26, 2010)
• Facebook Users Object to Beacon Settlement: Facebook users filed papers in federal court objecting to a proposed deal that would extinguish the company's liability for disclosing personal information in violation of federal law. Users criticized the class action settlement, stating "the class receives no meaningful relief." Other objectors alleged "in effect, Facebook is paying itself the benefit but class members are releasing their individual privacy claims." EPIC previously submitted a letter to the judge hearing the case. EPIC's letter opposes the settlement and proposes alternatives that would enable stronger privacy safeguards for Facebook users in the future. For more information, see EPIC Facebook Privacy, EPIC Harris v. Blockbuster. (Feb. 2, 2010)
• EPIC, Privacy Groups Oppose Facebook Settlement: EPIC and other privacy groups sent a letter to the federal judge overseeing a class-action settlement against Facebook in California, opposing the settlement as unfair and unreasonable. As proposed, the settlement does not provide any benefit for Facebook users whose private data was illegally exposed by Facebook "Beacon." Instead, the deal would create a new "privacy foundation" subject to Facebook's influence. Fair settlements typically provide compensation to class members or a remedy that addresses the underlying harm, which in this case was a violation of federal privacy law. The letter from EPIC proposes alternatives that would enable stronger privacy safeguards for Facebook users in the future. For more information, see EPIC Facebook Privacy, EPIC Harris v. Blockbuster. (Jan. 19, 2010)
• Canadian Privacy Commission to Investigate Facebook: Canada’s Privacy Commissioner Jennifer Stoddart has launched an investigation into the information collection and use practices of online social networking sites. This investigation is being conducted as the Parliament prepares to review the Personal Information Protection and Electronic Documents Act. Stoddart plans to examine “issues that we feel pose a serious challenge to the privacy of consumers, now and in the near future,” and to foster discussions about "the impact of these technological developments on privacy." This is not the first time the Commissioner has investigated the information practices of Facebook. In August 2009, Facebook made several changes to its privacy policy, following recommendations by the Commissioner and a complaint filed by the Canadian Internet Policy and Public Interest Clinic. For more information, see EPIC: Facebook Privacy and EPIC: Social Networking Privacy. (Jan. 19, 2010)
• EPIC Defends Privacy of Facebook Users: Files Complaint with the Federal Trade Commission: EPIC has filed a complaint with the Federal Trade Commission, urging the FTC to open an investigation into Facebook’s revised privacy settings. The EPIC complaint, signed by nine other privacy and consumer organizations, states that the  "changes violate user expectations, diminish user privacy, and contradict Facebook’s own representations." EPIC cites widespread opposition from Facebook users, security experts, bloggers, and news organizations. A previous EPIC complaint to the FTC, concerning the data broker industry, produced the largest settlement in the FTC's history.  For more information, see EPIC: In re Facebook, Frequently Asked Questions Regarding EPIC's Facebook Complaint, and EPIC Facebook Privacy. EPIC PRESS RELEASE. (Dec. 17, 2009)
• Facebook to Drop Regional Networks, Change Privacy Settings: Facebook announced that it intends to eliminate regional networks, which allow users to restrict information shared with others based geography. The social networking service will also modify the site's privacy settings and require users to update the rules governing who can access their data. In February, revisions to Facebook's terms of service prompted users to revolt and Facebook to rescind the changes hours before EPIC planned to file a complaint with the Federal Trade Commission. Prior changes to the service resulted in disclosure of Facebook users' video rental records without their permission, prompting federal lawsuits. For more, see EPIC Facebook Privacy and Social Networking Privacy (Dec. 4, 2009)
• Facebook to End Beacon, Establish Privacy Foundation: Facebook has entered into a proposed agreement to end Beacon, the controversial advertising technique that broadcast user purchases in their public profile. EPIC and other privacy advocates objected to Beacon’s privacy implications and successfully persuaded Facebook to adopt opt-in for the service. Under the terms of a class-action lawsuit in California, Facebook will now terminate Beacon and contribute $9.5 million towards the creation of a foundation dedicated to protecting online privacy. A class-action lawsuit concerning Beacon is also pending in Texas. For more information, see EPIC Facebook Privacy and EPIC Testimony on the "Impact and Policy Implications of Spyware on Consumers and Businesses." (Sep. 22, 2009)
• Following Canadian Investigation, Facebook Upgrades Privacy: The Canadian Privacy Commissioner issued a report last month raising concerns over Facebook business practices. The Office asked the social networking firm to cease the sharing of user information with application developers, clarify the policy on deactivation and deletion of accounts, protect the personal information of non-users, and "memorialize" the account of deceased users. In complying with the Commissioner's report, Facebook will include new notifications, update its Privacy Policy, and implement technical changes to enable more user control over information accessed by third-party applications. EPIC had previously raised similar concerns about the use of Facebook data by application developers. See also EPIC Facebook and EPIC Social Network Privacy. (Aug. 28, 2009)
• Canadian Privacy Commissioner's Deadline for Facebook Arrives, Some Changes are Made at the Social Network Company: In mid-July, the Canadian Privacy Commissioner released a report recommending several changes to Facebook's business practices. The Commissioner's Office advised the social networking firm to limit application developers' access to user information, and inform users specifically about the nature and use of shared information. The Office also said that deactivated account information should be deleted, and that the privacy policy be amended to include all intended uses of personal information. Facebook was given 30 days. Facebook updated its privacy policy last week and has asked application developers to respect user privacy settings. See also EPIC Facebook and EPIC Social Network Privacy. (Aug. 17, 2009)
• EPIC Forces Disclosure of Government Contracts with Social Media Companies, Privacy Terms Missing: In response to an EPIC Freedom of Information Act Request, the Government Services Administration released several contracts between the federal government and web 2.0 companies, including agreements with Blip.tv, Blist, Google (YouTube), Yahoo (Flickr), and MySpace. EPIC also obtained amendments to agreements with Facebook, Slideshare.net, Vimeo.com, and AddThis.com. The contracts do not address the privacy obligations of social media companies. The GSA letter to EPIC explained that “no specific Web 2.0 guidance currently exists,” but provided EPIC with Training Slides that raise privacy issues. The GSA Agreement with Google actually states that, “to the extent any rules or guidelines exist prohibiting the use of persistent cookies in connection with Provider Content applies to Google, Provider expressly waives those rules or guidelines as they may apply to Google.” Some of the agreements also permit companies to track users of government web sites for advertising purposes. For more information see EPIC Social Network Privacy, EPIC Facebook, and EPIC Cloud Computing. (Aug. 12, 2009)
• Canadian Privacy Commissioner Holds that Facebook Must Strengthen Privacy Safeguards: The Office of the Privacy Commissioner of Canada today released a Report of Findings into the Complaint Filed by the Canadian Internet Policy and Public Interest Clinic against Facebook Inc. The complaint, filed under the Personal Information Protection and Electronic Documents Act, contained twenty-four allegations concerning a range of Facebook business practices, including Default Privacy Settings, Advertising, and Third-Party Applications. The Commissioner found that Facebook has taken some steps to address privacy, but that more safeguards are necessary. Facebook has 30 days to respond. See EPIC Facebook Privacy and EPIC Social Networking Privacy. (Jul. 16, 2009)
• EPIC LiveTweeting Sotomayor Hearing: EPIC Executive Director Marc Rotenberg, a former counsel to the Senate Judiciary Committee, is tweeting the Sotomayor nomination hearing this week. The tweets cover #privacy #sotomayor and #scotus. Recap and updates available at @privacy140. EPIC has prepared an extensive background page on Judge Sotomayor. See EPIC Nomination of Judge Sotomayor. (Jul. 16, 2009)
• Facebook to Change User Privacy Settings: Facebook announced planned changes to user privacy controls today. Chris Kelly, Facebook's Chief Privacy Officer, stated that the new policy will promote "control, simplicity and connection" for user data. The announcement states there will be no changes in term of "the information Facebook provides to advertisers" but does not address concerns about the information provided by Facebook to app developers. In June, European Privacy Commissioners warned about the secondary use of personal data collected by social network services. The officials issued an opinion requiring robust security, privacy-friendly default settings, and the application of European privacy law. In April, EPIC supported the adoption of the new Facebook Terms of Service when Facebook said that "users own and control their information." See EPIC Social Networking Privacy. (Jul. 1, 2009)
• European Advisory Group Issues Opinion on Social Networking : The European expert group on data protection and privacy issued a guidance to Social Network Service providers on measures needed to ensure compliance with EU law. The key concern of the group is the dissemination and use of information available on such networks for secondary, unintended purposes. The opinion recommended robust security and privacy-friendly default settings. Topics included processing of sensitive data and images, advertising and direct marketing, and data retention. In January, EPIC suggested regulation of Social Network Service partners, including advertisers and application developers. See EPIC's Page on Social Networking Privacy. (Jun. 17, 2009)
• EPIC Urges Privacy Protections for Government's Use of Social Media: The DHS Privacy Office is seeking public comments on developing best practices on the government's use of social media. EPIC submitted comments on the benefits, issues and privacy best practices. EPIC recommended Privacy Act protections to the data collected, prohibit commercialization and sharing, and the use of a model certification system. See also EPIC's page on Social Networking Privacy, Network Advertising Initiative, and Deep Packet Inspection and Privacy.. (Jun. 3, 2009)
• EPIC Seeks Government Agreements with Social Networking Companies: EPIC submitted a Freedom of Information Act request to the Government Services Administration seeking agency records concerning agreements the GSA negotiated between federal agencies and social networking services, including Flickr, YouTube, Vimeo, Blip.tv, and Facebook. In the FOIA request, EPIC is asking for the public release of the contracts and any legal opinions concerning the application of the Privacy Act of 1974 and Freedom of Information Act to the services that collect information on citizens. For more information see EPIC’s pages Social Networking, Facebook, and Cloud Computing. (Apr. 30, 2009)
• Facebook Gets Ready to Adopt Terms of Service: Facebook has announced the results of the vote on site governance. The initial outcome indicates that approximately 75 percent of users voted for the new terms of service which includes the new Facebook Principles and Statement of Rights and Responsibilities. Under the new Principles, Facebook users will "own and control their information." Facebook also took steps to improve account deletion, to limit sublicenses, and to reduce data exchanges with application developers. EPIC supports the adoption of the new terms. For more information, see EPIC's page on Social Networking Privacy. (Apr. 24, 2009)
• Facebook Seeks Vote on Site Governance: In February, Facebook announced that it was opening its site governance to user voting after the new Terms of Service were widely criticized, and were to be the subject of an EPIC complaint to the Federal Trade Commission. Facebook restored the old terms and sought user feedback on the new Facebook Principles and the Statement of Rights and Responsibilities. These governing documents have now been updated to reflect feedback from users and experts. The voting to adopt the new terms or to maintain the previous terms is now open till April 23, 11:59 a.m. PDT. For more, see the efforts of People Against the New Terms of Service, and EPIC's Social Networking Privacy page. (Apr. 20, 2009)
• Facebook Announces Governing Principles, Statement of Rights and Responsibilities: Today, Facebook proposed guidelines and a statement of rights and responsibilities governing its relationship with users. The social networking service called for user comment on the principles, which include "Ownership and Control of Information" and "Transparent Process." Facebook further committed to "open up Facebook so that users can participate meaningfully in our policies and our future." Facebook's announcement follows last week's abandonment of changes to its Terms of Service on the eve of an EPIC complaint to federal regulators. For more and see the efforts of People Against the New Terms of Service, and EPIC's "Social Networking Privacy" page. (Feb. 26, 2009)
• On Eve of EPIC Trade Commission Complaint, Facebook Backs Down on Revised Terms of Service: Hours before EPIC planned to file a complaint with the Federal Trade Commission regarding changes to Facebook's Terms of Service, the social network service announced that it will restore the original policy. The new Terms of Service were announced on Feb. 4, were widely criticized, and were to be the subject of the EPIC complaint. Facebook users observed that, under the revised policies, Facebook asserted broad, permanent, and retroactive rights to users' personal information - even after they deleted their accounts. The EPIC complaint was supported by more than a dozen consumer and privacy organizations. Previous EPIC Complaints at the FTC have concerned Choicepoint, Microsoft Passport, and the Google-Doubleclick merger. For more, see EPIC's "Social Networking Privacy" page. Support EPIC's efforts to maintain your privacy in the social networking world. (Feb. 18, 2009)
• European Network Security Agency Recommends Security Protections For Social Networks.The European Network and Information Security Agency (ENISA) has issued a position paper on Security Issues And Recommendations for Social Networks. The paper concludes that social networks are a clear benefit to society; however, the study warns of the danger that new face recognition or other new technologies pose in a world were there may be a false sense of intimacy created by social networks. The agency grouped security threats into 4 categories: privacy, traditional network, identity and social threats. The paper recommends government and corporate policy changes, technical and research recommendation, such as increasing transparency of data handling practices, and encouraging social networking education rather than the banning of social networking sites in schools. (Oct. 1, 2007)
• Facebook Responds to Users' Demands. In response to the negative reactions of so many of its users, Facebook put new privacy controls on the News Feed feature into operation. Mark Zuckerberg, the CEO of Facebook, published an open letter on the Web site on September 8th apologizing for not having consulted with users prior to introducing feature, which notified users of all their contacts' activities, such as profile changes from "in a relationship" to "single." However, the change is simply an opt-out and puts the burden on Facebook users to protect their privacy. Over 700,000 users signed an online petition demanding the company discontinue the feature, stating that this compromised their privacy. (Sept. 25, 2006)
• Outcry Over New Facebook Feature. When social networking Web site Facebook introduced their new News Feed feature on September 5, the company was accused of invading the privacy of its' users and facilitating stalking. The goal of the new feature was to make it easier for users to keep up to date with the latest happenings in the lives of their online friends. However, user upset at its introduction sparked debate over how much control users expect to have over the information they place on these Web sites, and also whether the means of dissemination of this information matters. (Sept. 5, 2006)