8 ms·

A lot of the terms of the settlement deal with organizational changes, but when you look at the very specific privacy restrictions that Facebook agreed to, it's

by jawns 7y ago

A lot of the terms of the settlement deal with organizational changes, but when you look at the very specific privacy restrictions that Facebook agreed to, it's really, really problematic stuff: * Facebook is prohibited from using telephone numbers obtained to enable a security feature (e.g., two-factor authentication) for advertising; * Facebook must provide clear and conspicuous notice of its use of facial recognition technology, and obtain affirmative express user consent prior to any use that materially exceeds its prior disclosures to users; * Facebook is prohibited from asking for email passwords to other services when consumers sign up for its services. This might, at first blush, seem like a win for users, but consider it from a different perspective. When a settlement involves promising not to do a bunch of really, really bad stuff, that typically means the settlement doesn't have much bite. It's comparatively easy for a company to agree not to do egregiously bad things, and comparatively harder for it to agree not to do things that are still problematic, but less egregious. These things that Facebook has agreed to not do are way outside the boundaries of ethical privacy practices -- but there's still a ton of gray area that remains unaddressed. So from Facebook's perspective, this is probably a big win. The settlement allows the company to give the appearance of taking concrete steps to respect users' privacy. But what it might actually mean is that there were many other less egregious privacy violations that it was able to slip past the FTC's judgment.

cooljacob204 7y ago
>Facebook is prohibited from using telephone numbers obtained to enable a security feature This is exactly what made me quit Facebook a while back. Started to spam me with notifications when I only wanted to add a backup number.
- flattone 7y ago
  pushier than a drug dealer. oh wait theyre dealing ankind of drugs too . .
mtgx 7y ago
It seems like a pretty big repeat of the 2011 settlement. That's also when big statements such as "Facebook's privacy practices will be monitored for the next 20 years by the FTC" proved to be absolutely meaningless. Whatever privacy review Facebook was undergoing like once a year was done by a private firm that Facebook could pick and then have to pay. So is it any wonder that those so-called privacy auditors have found nothing wrong with Facebook so far in 8 years? (even as the privacy scandals and Facebook's apologizing perpetuated in the media). These types of settlements are a joke. There's zero doubt in my mind Facebook already has a plan for how to work around these restrictions and do 90% of what it's already been doing anyway. As a side-note, does anyone still believe Facebook was genuine about getting Facebook female users' naked pictures "to protect them from revenge porn" genuine? They've already lied about collecting the phone numbers and facial recognition as being used for security. And those were obvious lies to me from day one, too. Pretty much every new feature Facebook launches that seems good for users has an undertone of "...and this is how we'll track you now."
- throwaway2048 7y ago
  There is a lot of misunderstanding about how the FTC regulatory process works in cases like this, outside of securities and other financial instruments, the FTC has very little power to force legally binding fines upon companies. What they do is issue settlements, Facebook agreed to this fine, and to the conditions surrounding it, because if they didn't they might face hard, law based regulation from Congress. The issue here is, the FTC process relies on good faith from the companies it settles with, and Facebook has repeatedly shown to be a bad faith actor in this regard (which is why its a 5 billion dollar fine to begin with) The only way this is going to end is with very onerous regulation from Congress.
maxerickson 7y ago
There's the pesky implication that Facebook was perhaps doing all that stuff. Making them stop is a win for users.
- apocalyptic0n3 7y ago
  It definitely was. - Asking for email password: https://arstechnica.com/information-technology/2019/04/facebook-asked-some-users-for-their-email-passwords-because-why-not/ https://arstechnica.com/information-technology/2019/04/faceb... - Targeting ads using phone numbers obtained through two-factor authentication: https://www.engadget.com/2018/09/28/facebook-two-factor-phone-numbers-ads/ https://www.engadget.com/2018/09/28/facebook-two-factor-phon... - Improper use of facial recognition: https://www.npr.org/sections/thetwo-way/2018/04/16/603056662/facebook-faces-class-action-lawsuit-challenging-its-use-of-facial-recognition-da https://www.npr.org/sections/thetwo-way/2018/04/16/603056662...
- throwawaylolx 7y ago
  It's not an implication; it's mentioned in the article: >the FTC alleges that Facebook violated the FTC Act’s prohibition against deceptive practices when it told users it would collect their phone numbers to enable a security feature, but did not disclose that it also used those numbers for advertising purposes. >The FTC also alleges that Facebook misrepresented users’ ability to control the use of facial recognition technology with their accounts. According to the complaint, Facebook’s data policy, updated in April 2018, was deceptive to tens of millions of users who have Facebook’s facial recognition setting called “Tag Suggestions” because that setting was turned on by default, and the updated data policy suggested that users would need to opt-in to having facial recognition enabled for their accounts.
morley 7y ago
Some of the organizational changes are substantial. Having an independent privacy force review all existing and new product features for privacy implications can be a huge drain on velocity, especially if they demand a lot of changes. But really, this is how organizations should be run: there should be a user-privacy-focused resource inside the company that can work with product to guide how features get implemented. (The same goes for accessibility, technical feasibility, and other things that product people aren't necessarily measured against.)
- flattone 7y ago
  good f fb
deleted 7y ago
[deleted]
baq 7y ago
So basically a defanged, company-specific halfway-there poor man’s GDPR. Still a win though.
indiandragon 7y ago
> prohibited from using telephone numbers obtained to enable a security feature (e.g., two-factor authentication) for advertising Facebook is not alone in misuse or wrongful use of phone number given for 2FA. LinkedIn explicitly requires phone number to be added on the profile to enable 2FA and makes the phone number visible by default to all the contacts, if you don't want your phone number visible; you'll have to loose 2FA as LinkedIn doesn't support authenticator or other alternate 2FA means(FB does). I came to know this as after I enabled 2FA on LinkedIn, I started receiving messages from random people on WhatsApp whom I later found to be my LinkedIn contacts.
- yomly 7y ago
  Omg this is gross. I definitely do not want random recruiters having my phone number...
- mtgx 7y ago
  Definitely not. Google does (did?) it, too. It may have stopped when GDPR went into effect.
  - indiandragon 7y ago
    Did Google show the phone number to contacts when 2FA was added?
- rgharris 7y ago
  Your comment prompted me to check my LinkedIn 2FA and it turns out that they now support TOTP apps (they list Authenticator App as the option). I believe it is very new though.
  - Sargos 7y ago
    Where do you see that? I still only see the option for SMS 2FA.
    - rgharris 7y ago
djsumdog 7y ago
> So from Facebook's perspective, this is probably a big win. $5 billion is a lot, but Facebook is huge. Even considering, it's probably not pocket change for them, but they are getting a benefit from it for sure. They are buying public opinion. "Look at us..we took a big fine and agreed to respect your privacy .. you can trust us now." It's essentially a very expensive ad, used to rebuild trust with their cattle; I mean users.
- throwaway2048 7y ago
  The biggest thing that makes the 5 billion fine a bargin: The FTC settlement indemnifies Facebook for "any and all claims prior to June 12, 2019"
  - thfuran 7y ago
    Does that mean claims already raised by then or claims pertaining to actions earlier than then? The former seems like a bad idea and the latter seems like it shouldn't even be possible.
- almost_usual 7y ago
  The independent party for privacy review is a much bigger deal than the fine. This out of Mark Zuckerberg's control now, they will be audited constantly for any product changes they make. "As part of Facebook’s order-mandated privacy program, which covers WhatsApp and Instagram, Facebook must conduct a privacy review of every new or modified product, service, or practice before it is implemented, and document its decisions about user privacy. The designated compliance officers must generate a quarterly privacy review report, which they must share with the CEO and the independent assessor, as well as with the FTC upon request by the agency."
  - jiveturkey 7y ago
    At FB level, this is already a requirement for GDPR. The only difference is that it must be shared with an independent assessor rather than held strictly internally.
supercanuck 7y ago
Seems like this is a win for consumers too if they adhere to the conditions, no? If they agree to not do bad things, then do the bad things, seems then we have a bad actor. I doubt that any individual or lawsuit could affect this kind of change.
deleted 7y ago
[deleted]
tssva 7y ago
The main goal of the settlement is to limit future egregious acts by the organizational changes and not by specific prohibitions. The FTC knows that specific prohibitions will never cover all past and possible future acts. The only reasons these specific prohibitions are spelled out is because Facebook is known to have specifically performed these acts in the past.
simonh 7y ago
It's completely ridiculous that the FTC is in a position where it has to impose restrictions like this in an ad-hoc case-by-case basis. In this case specifically to Facebook. Maybe I'm being naive, but if these activities are violations, there should be no need for facebook to agree to abide by them. They would have to anyway. Alternatively if these are specific restrictions on facebook, doesn't it imply it's ok for other services to do them? The GDPR has it's flaws, but at last Europe has bitten the bullet and faced up to their responsibility to protect consumers and reign in privacy abuses. It's about time US lawmakers got their act together.
- deleted 7y ago
  [deleted]
- kodablah 7y ago
  We should separate what something does from its intended effect when having these discussions. Laws exist on the books, laws can be added, etc but that is unrelated to enforcement and credibility and continued sector/business growth.
tkiley 7y ago
> So from Facebook's perspective, this is probably a big win. It does feel like they confessed and repented a few spectacularly egregious sins and bought a $5 billion indulgence for the rest.
rolltiide 7y ago
I like this trend of using agency settlements to force organizational changes of companies that have no way of changing the organizational hierarchy they should get even stricter force them to relinquish the absolute control of the founder/ceo, enable voting rights and more investors are undiscerning and exchanges are not creating ultimatums for listing, so these founder privileges are only revoked after they mess up really bad which is cool
ComodoHacker 7y ago
Plus they'll continue to do all these things with users from other countries.
jiveturkey 7y ago
> So from Facebook's perspective, this is probably a big win. being fined 25% of annual profit (2018 $22.111bn) is probably not "a big win". But yeah, the business terms of the settlement are surely inspiring a champagne toast back at HQ.
badrabbit 7y ago
I agree it's not enough but it is something. They can still be fined again for less egregious things,the potential risk of an even bigger penalty still looms.

by jawns 7y ago

cooljacob204 7y ago

>Facebook is prohibited from using telephone numbers obtained to enable a security feature This is exactly what made me quit Facebook a while back. Started to spam me with notifications when I only wanted to add a backup number.

flattone 7y ago
pushier than a drug dealer. oh wait theyre dealing ankind of drugs too . .

mtgx 7y ago

It seems like a pretty big repeat of the 2011 settlement. That's also when big statements such as "Facebook's privacy practices will be monitored for the next 20 years by the FTC" proved to be absolutely meaningless. Whatever privacy review Facebook was undergoing like once a year was done by a private firm that Facebook could pick and then have to pay. So is it any wonder that those so-called privacy auditors have found nothing wrong with Facebook so far in 8 years? (even as the privacy scandals and Facebook's apologizing perpetuated in the media). These types of settlements are a joke. There's zero doubt in my mind Facebook already has a plan for how to work around these restrictions and do 90% of what it's already been doing anyway. As a side-note, does anyone still believe Facebook was genuine about getting Facebook female users' naked pictures "to protect them from revenge porn" genuine? They've already lied about collecting the phone numbers and facial recognition as being used for security. And those were obvious lies to me from day one, too. Pretty much every new feature Facebook launches that seems good for users has an undertone of "...and this is how we'll track you now."

throwaway2048 7y ago
There is a lot of misunderstanding about how the FTC regulatory process works in cases like this, outside of securities and other financial instruments, the FTC has very little power to force legally binding fines upon companies. What they do is issue settlements, Facebook agreed to this fine, and to the conditions surrounding it, because if they didn't they might face hard, law based regulation from Congress. The issue here is, the FTC process relies on good faith from the companies it settles with, and Facebook has repeatedly shown to be a bad faith actor in this regard (which is why its a 5 billion dollar fine to begin with) The only way this is going to end is with very onerous regulation from Congress.

maxerickson 7y ago

There's the pesky implication that Facebook was perhaps doing all that stuff. Making them stop is a win for users.

apocalyptic0n3 7y ago
It definitely was. - Asking for email password: https://arstechnica.com/information-technology/2019/04/facebook-asked-some-users-for-their-email-passwords-because-why-not/ https://arstechnica.com/information-technology/2019/04/faceb... - Targeting ads using phone numbers obtained through two-factor authentication: https://www.engadget.com/2018/09/28/facebook-two-factor-phone-numbers-ads/ https://www.engadget.com/2018/09/28/facebook-two-factor-phon... - Improper use of facial recognition: https://www.npr.org/sections/thetwo-way/2018/04/16/603056662/facebook-faces-class-action-lawsuit-challenging-its-use-of-facial-recognition-da https://www.npr.org/sections/thetwo-way/2018/04/16/603056662...
throwawaylolx 7y ago
It's not an implication; it's mentioned in the article: >the FTC alleges that Facebook violated the FTC Act’s prohibition against deceptive practices when it told users it would collect their phone numbers to enable a security feature, but did not disclose that it also used those numbers for advertising purposes. >The FTC also alleges that Facebook misrepresented users’ ability to control the use of facial recognition technology with their accounts. According to the complaint, Facebook’s data policy, updated in April 2018, was deceptive to tens of millions of users who have Facebook’s facial recognition setting called “Tag Suggestions” because that setting was turned on by default, and the updated data policy suggested that users would need to opt-in to having facial recognition enabled for their accounts.

morley 7y ago

Some of the organizational changes are substantial. Having an independent privacy force review all existing and new product features for privacy implications can be a huge drain on velocity, especially if they demand a lot of changes. But really, this is how organizations should be run: there should be a user-privacy-focused resource inside the company that can work with product to guide how features get implemented. (The same goes for accessibility, technical feasibility, and other things that product people aren't necessarily measured against.)

flattone 7y ago
good f fb

deleted 7y ago

[deleted]

baq 7y ago

So basically a defanged, company-specific halfway-there poor man’s GDPR. Still a win though.

indiandragon 7y ago

> prohibited from using telephone numbers obtained to enable a security feature (e.g., two-factor authentication) for advertising Facebook is not alone in misuse or wrongful use of phone number given for 2FA. LinkedIn explicitly requires phone number to be added on the profile to enable 2FA and makes the phone number visible by default to all the contacts, if you don't want your phone number visible; you'll have to loose 2FA as LinkedIn doesn't support authenticator or other alternate 2FA means(FB does). I came to know this as after I enabled 2FA on LinkedIn, I started receiving messages from random people on WhatsApp whom I later found to be my LinkedIn contacts.

yomly 7y ago
Omg this is gross. I definitely do not want random recruiters having my phone number...
mtgx 7y ago
Definitely not. Google does (did?) it, too. It may have stopped when GDPR went into effect.
- indiandragon 7y ago
  Did Google show the phone number to contacts when 2FA was added?
rgharris 7y ago
Your comment prompted me to check my LinkedIn 2FA and it turns out that they now support TOTP apps (they list Authenticator App as the option). I believe it is very new though.
- Sargos 7y ago
  Where do you see that? I still only see the option for SMS 2FA.
  - rgharris 7y ago

djsumdog 7y ago

> So from Facebook's perspective, this is probably a big win. $5 billion is a lot, but Facebook is huge. Even considering, it's probably not pocket change for them, but they are getting a benefit from it for sure. They are buying public opinion. "Look at us..we took a big fine and agreed to respect your privacy .. you can trust us now." It's essentially a very expensive ad, used to rebuild trust with their cattle; I mean users.

throwaway2048 7y ago
The biggest thing that makes the 5 billion fine a bargin: The FTC settlement indemnifies Facebook for "any and all claims prior to June 12, 2019"
- thfuran 7y ago
  Does that mean claims already raised by then or claims pertaining to actions earlier than then? The former seems like a bad idea and the latter seems like it shouldn't even be possible.
almost_usual 7y ago
The independent party for privacy review is a much bigger deal than the fine. This out of Mark Zuckerberg's control now, they will be audited constantly for any product changes they make. "As part of Facebook’s order-mandated privacy program, which covers WhatsApp and Instagram, Facebook must conduct a privacy review of every new or modified product, service, or practice before it is implemented, and document its decisions about user privacy. The designated compliance officers must generate a quarterly privacy review report, which they must share with the CEO and the independent assessor, as well as with the FTC upon request by the agency."
- jiveturkey 7y ago
  At FB level, this is already a requirement for GDPR. The only difference is that it must be shared with an independent assessor rather than held strictly internally.

supercanuck 7y ago

Seems like this is a win for consumers too if they adhere to the conditions, no? If they agree to not do bad things, then do the bad things, seems then we have a bad actor. I doubt that any individual or lawsuit could affect this kind of change.

deleted 7y ago

[deleted]

tssva 7y ago

The main goal of the settlement is to limit future egregious acts by the organizational changes and not by specific prohibitions. The FTC knows that specific prohibitions will never cover all past and possible future acts. The only reasons these specific prohibitions are spelled out is because Facebook is known to have specifically performed these acts in the past.

simonh 7y ago

It's completely ridiculous that the FTC is in a position where it has to impose restrictions like this in an ad-hoc case-by-case basis. In this case specifically to Facebook. Maybe I'm being naive, but if these activities are violations, there should be no need for facebook to agree to abide by them. They would have to anyway. Alternatively if these are specific restrictions on facebook, doesn't it imply it's ok for other services to do them? The GDPR has it's flaws, but at last Europe has bitten the bullet and faced up to their responsibility to protect consumers and reign in privacy abuses. It's about time US lawmakers got their act together.

deleted 7y ago
[deleted]
kodablah 7y ago
We should separate what something does from its intended effect when having these discussions. Laws exist on the books, laws can be added, etc but that is unrelated to enforcement and credibility and continued sector/business growth.

tkiley 7y ago

> So from Facebook's perspective, this is probably a big win. It does feel like they confessed and repented a few spectacularly egregious sins and bought a $5 billion indulgence for the rest.

rolltiide 7y ago

I like this trend of using agency settlements to force organizational changes of companies that have no way of changing the organizational hierarchy they should get even stricter force them to relinquish the absolute control of the founder/ceo, enable voting rights and more investors are undiscerning and exchanges are not creating ultimatums for listing, so these founder privileges are only revoked after they mess up really bad which is cool

ComodoHacker 7y ago

Plus they'll continue to do all these things with users from other countries.

jiveturkey 7y ago

> So from Facebook's perspective, this is probably a big win. being fined 25% of annual profit (2018 $22.111bn) is probably not "a big win". But yeah, the business terms of the settlement are surely inspiring a champagne toast back at HQ.

badrabbit 7y ago

I agree it's not enough but it is something. They can still be fined again for less egregious things,the potential risk of an even bigger penalty still looms.