6 ms·

Facebook’s entire business model is under fire in the EU

60 points by ukdm 15y ago

zalew 15y ago
why not link to the original article http://www.telegraph.co.uk/technology/facebook/8917836/Facebook-faces-a-crackdown-on-selling-users-secrets-to-advertisers.html http://www.telegraph.co.uk/technology/facebook/8917836/Faceb...
peterhunt 15y ago
Hmm... http://www.privacyparrot.com/privacy-policy-for-facebook.com http://www.privacyparrot.com/privacy-policy-for-facebook.com
guimarin 15y ago
One thing that strikes me as interesting is that Facebook repeatedly states that they do not sell personal information to third parties. Yet, I've never read or heard it stated plainly that this behavior is forbidden by applications running on the Facebook platform. In fact, at one point I remember that friends applications had access to my personal information, even if I did not authorize said application. I dont' know whether that is still the case, but the idea behind it is troubling. I would also like to follow-up that people are dissimilar enough that de-anonymizing is not that difficult. I do not know why, yet, an advertiser would want to explicitly de-anonymize its data, but it is certainly possible.
- nchuhoai 15y ago
  Under Privacy -> Apps -> How people bring your info to apps they use you can set what data your friends can use in their applications.
- nroman 15y ago
  I don't think you looked very hard. This is quite plainly stated in the developers policy. You don't have to be a lawyer to understand this: From https://developers.facebook.com/policy/ https://developers.facebook.com/policy/ 6. You will not directly or indirectly transfer any data you receive from us, including user data or Facebook User IDs, to (or use such data in connection with) any ad network, ad exchange, data broker, or other advertising or monetization related toolset, even if a user consents to such transfer or use. By indirectly we mean you cannot, for example, transfer data to a third party who then transfers the data to an ad network. By any data we mean all data obtained through use of the Facebook Platform (API, Social Plugins, etc.), including aggregate, anonymous or derivative data.
- deleted 15y ago
  [deleted]
jphackworth 15y ago
Saying their "entire business model is under fire" seems too extreme. From the article: The EC is planning to ban such activity unless users themselves specifically agree to it. Okay, so, at worst Facebook just has to make users specifically agree to this before they can continue using Facebook. I'm sure some people wouldn't agree, but it's not a big enough deal that Facebook would change their business model.
- 101010010101 15y ago
  Change their business model to what?
  - viscanti 15y ago
    The current data sales business model doesn't support their sky-high valuation. Most investors assume that Facebook will "figure out" a better way to monazite their audience. Facebook commerce and credits sales for the Facebook platform look to be their most promising options. Facebook isn't all-in on data mining. They're certainly hedging their bets. Obviously nothing is guaranteed, and I personally believe that they'll have trouble finding anything that justifies their valuation. But a lot of smart people think they'll figure it out, and are putting their money where their mouths are. They have some options, but we'll just have to wait and see how those actually progress.
    - 101010010101 15y ago
      In your opinion, do you think they should proceed with an IPO even if they have yet to "figure out a better way to monetise their audience"? Perhaps the key word is "better".
      - viscanti 15y ago
        Better for whom? They'll have trouble justifying their valuation indefinitely, which normally would mean that they're better off going public sooner rather than later. But Facebook stock seems to be a rather liquid investment right now on the Secondary Market. So for the average employee or investor, they can pretty much get out whenever they'd like, mitigating one of the big benefits of going public. For FB as a company, they're probably better off delaying their IPO as long as they can. As a private company, they don't have to make their books public, and can continue to "figure it out" without extra scrutiny. Delaying the IPO also lets them promote themselves as a pre-IPO "startup", while I don't personally see the growth potential, and I think they've got a lot to do to even meet their current valuation, it could help sway some developers. They've got a long way to go to justify their valuation, and they can use all the developer talent they can get, so any little thing can help.
DanBC 15y ago
See also (http://news.ycombinator.com/item?id=3285466 http://news.ycombinator.com/item?id=3285466)
flyt 15y ago
Is the EU also going to require Google to get user permission before collecting data they turn around and use for selling ads?
nextparadigms 15y ago
With how much Facebook are doing behind the scenes with the user tracking, it's hard to blame the EU officials trying to stop them. Facebook tried to bite more than they can chew, and they've been warned about going too far with all the privacy invasion for 2 years now, and they still didn't care, and went ahead anyway.
reso 15y ago
Factually incorrect article. >First, let’s have a primer on how Facebook makes money: The company gets you to willingly enter all kinds of demographic and behavioral information into a massive database. Advertisers, big brands and Facebook’s sales team call it “data.” You call it your profile, your likes, your checkins, your comments and everything else you do on the site. Facebook then sells that data — in an aggregated, anonymized form, of course — to brands and advertising agencies so they know how, when, where and to whom to market their wares. Data is not "sold". Data only leaves Facebook's servers when you ask for it. Facebook makes money by targeting ads on facebook.com. This is constantly misstated and it frustrates the hell out of me. EDIT: I tweeted at the author and she made the language much less ambiguous. Journalism points to Jolie O'Dell.
- hack_edu 15y ago
  Then it sounds to me like the legal battleground here is the word 'sold.'
  - reso 15y ago
    Agreed. For a certain definition of the word, Facebook does "sell" data to advertisers, but not by my intuitive definition of "sell". To me, they "sell" targeted ad space.
- Silhouette 15y ago
  > Data only leaves Facebook's servers when you ask for it. That's a fascinating comment, particularly when read immediately after this one (the top comment from the top HN thread, as I write this): http://news.ycombinator.com/item?id=3287480 http://news.ycombinator.com/item?id=3287480 Apparently "asking for it" can be as simple as having ever used the almost-ubiquitous Facebook OAuth integration on a site, for example.
law 15y ago
However, Facebook maintains that users prefer seeing ads that are linked to their interests and lifestyles. Also, the company reminds us that private information stays private, even when data is used to sell ads, because information is collected in aggregate and is anonymized. This troubles me, because information being collected and 'anonymized' is somewhat of a misnomer. I think many would contest any assertion that data capable of disassembly into its constituent parts (assuming each constituent part to be a unique combination of variables represented in the aggregate) comports with anonymity. I'm generally not one to praise governmental regulatory agencies for their technological prowess, but the U.S. Department of Health & Human Services really "got it" with HIPAA's de-identification standard. HHS understands the importance of aggregating healthcare data and conducting statistical research, and does not let HIPAA preclude this from occurring. Instead, HIPAA outlines a "safe harbor" approach that limits a covered entity's criminal/civil liability in the event of a breach if and only if the covered entity removes 18 identifiers and has no actual knowledge that the remaining information could identify the individual. These identifiers include names, dates, geolocational codes covering populations less than 20,000, etc. Alternatively, covered entities may opt to use a 'statistical' approach by hiring a qualified statistician (or other scientific expert) who can use acceptable analytic techniques to conclude that the risk of identifying the person from the disclosed information is very, very small.[1] A safe harbor approach to large-scale data privacy would be absolutely wonderful. Using statistics to prove the anonymity of data being collected/used by Facebook is nonsensical, since by default, we've given them a non-exclusive, transferable, sub-licensable, royalty-free, worldwide license to 'use' anything we submit to them. Contracts of adhesion, in my opinion, are more of the problem since there's no good way to 'make change' for the information that you submit. For example, someone very active on Facebook might arguably be 'worth more' to the company than someone who isn't, but both receive the same product. EDIT: A safe harbor approach to large-scale data privacy isn't even unknown. See COPPA[2], for example. [1] http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&rgn=div8&view=text&node=45:1.0.1.3.77.5.27.9&idno=45 http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&rgn... 45 CFR 164.514(b)(1)--(2). [2] http://en.wikipedia.org/wiki/Childrens_Online_Privacy_Protection_Act http://en.wikipedia.org/wiki/Childrens_Online_Privacy_Protec...
- Silhouette 15y ago

60 points by ukdm 15y ago

zalew 15y ago

why not link to the original article http://www.telegraph.co.uk/technology/facebook/8917836/Facebook-faces-a-crackdown-on-selling-users-secrets-to-advertisers.html http://www.telegraph.co.uk/technology/facebook/8917836/Faceb...

peterhunt 15y ago

Hmm... http://www.privacyparrot.com/privacy-policy-for-facebook.com http://www.privacyparrot.com/privacy-policy-for-facebook.com

guimarin 15y ago

One thing that strikes me as interesting is that Facebook repeatedly states that they do not sell personal information to third parties. Yet, I've never read or heard it stated plainly that this behavior is forbidden by applications running on the Facebook platform. In fact, at one point I remember that friends applications had access to my personal information, even if I did not authorize said application. I dont' know whether that is still the case, but the idea behind it is troubling. I would also like to follow-up that people are dissimilar enough that de-anonymizing is not that difficult. I do not know why, yet, an advertiser would want to explicitly de-anonymize its data, but it is certainly possible.

nchuhoai 15y ago
Under Privacy -> Apps -> How people bring your info to apps they use you can set what data your friends can use in their applications.
nroman 15y ago
I don't think you looked very hard. This is quite plainly stated in the developers policy. You don't have to be a lawyer to understand this: From https://developers.facebook.com/policy/ https://developers.facebook.com/policy/ 6. You will not directly or indirectly transfer any data you receive from us, including user data or Facebook User IDs, to (or use such data in connection with) any ad network, ad exchange, data broker, or other advertising or monetization related toolset, even if a user consents to such transfer or use. By indirectly we mean you cannot, for example, transfer data to a third party who then transfers the data to an ad network. By any data we mean all data obtained through use of the Facebook Platform (API, Social Plugins, etc.), including aggregate, anonymous or derivative data.
deleted 15y ago
[deleted]

jphackworth 15y ago

Saying their "entire business model is under fire" seems too extreme. From the article: The EC is planning to ban such activity unless users themselves specifically agree to it. Okay, so, at worst Facebook just has to make users specifically agree to this before they can continue using Facebook. I'm sure some people wouldn't agree, but it's not a big enough deal that Facebook would change their business model.

101010010101 15y ago
Change their business model to what?
- viscanti 15y ago
  The current data sales business model doesn't support their sky-high valuation. Most investors assume that Facebook will "figure out" a better way to monazite their audience. Facebook commerce and credits sales for the Facebook platform look to be their most promising options. Facebook isn't all-in on data mining. They're certainly hedging their bets. Obviously nothing is guaranteed, and I personally believe that they'll have trouble finding anything that justifies their valuation. But a lot of smart people think they'll figure it out, and are putting their money where their mouths are. They have some options, but we'll just have to wait and see how those actually progress.
  - 101010010101 15y ago
    In your opinion, do you think they should proceed with an IPO even if they have yet to "figure out a better way to monetise their audience"? Perhaps the key word is "better".
    - viscanti 15y ago
      Better for whom? They'll have trouble justifying their valuation indefinitely, which normally would mean that they're better off going public sooner rather than later. But Facebook stock seems to be a rather liquid investment right now on the Secondary Market. So for the average employee or investor, they can pretty much get out whenever they'd like, mitigating one of the big benefits of going public. For FB as a company, they're probably better off delaying their IPO as long as they can. As a private company, they don't have to make their books public, and can continue to "figure it out" without extra scrutiny. Delaying the IPO also lets them promote themselves as a pre-IPO "startup", while I don't personally see the growth potential, and I think they've got a lot to do to even meet their current valuation, it could help sway some developers. They've got a long way to go to justify their valuation, and they can use all the developer talent they can get, so any little thing can help.

DanBC 15y ago

See also (http://news.ycombinator.com/item?id=3285466 http://news.ycombinator.com/item?id=3285466)

flyt 15y ago

Is the EU also going to require Google to get user permission before collecting data they turn around and use for selling ads?

nextparadigms 15y ago

With how much Facebook are doing behind the scenes with the user tracking, it's hard to blame the EU officials trying to stop them. Facebook tried to bite more than they can chew, and they've been warned about going too far with all the privacy invasion for 2 years now, and they still didn't care, and went ahead anyway.

reso 15y ago

Factually incorrect article. >First, let’s have a primer on how Facebook makes money: The company gets you to willingly enter all kinds of demographic and behavioral information into a massive database. Advertisers, big brands and Facebook’s sales team call it “data.” You call it your profile, your likes, your checkins, your comments and everything else you do on the site. Facebook then sells that data — in an aggregated, anonymized form, of course — to brands and advertising agencies so they know how, when, where and to whom to market their wares. Data is not "sold". Data only leaves Facebook's servers when you ask for it. Facebook makes money by targeting ads on facebook.com. This is constantly misstated and it frustrates the hell out of me. EDIT: I tweeted at the author and she made the language much less ambiguous. Journalism points to Jolie O'Dell.

hack_edu 15y ago
Then it sounds to me like the legal battleground here is the word 'sold.'
- reso 15y ago
  Agreed. For a certain definition of the word, Facebook does "sell" data to advertisers, but not by my intuitive definition of "sell". To me, they "sell" targeted ad space.
Silhouette 15y ago
> Data only leaves Facebook's servers when you ask for it. That's a fascinating comment, particularly when read immediately after this one (the top comment from the top HN thread, as I write this): http://news.ycombinator.com/item?id=3287480 http://news.ycombinator.com/item?id=3287480 Apparently "asking for it" can be as simple as having ever used the almost-ubiquitous Facebook OAuth integration on a site, for example.

law 15y ago

However, Facebook maintains that users prefer seeing ads that are linked to their interests and lifestyles. Also, the company reminds us that private information stays private, even when data is used to sell ads, because information is collected in aggregate and is anonymized. This troubles me, because information being collected and 'anonymized' is somewhat of a misnomer. I think many would contest any assertion that data capable of disassembly into its constituent parts (assuming each constituent part to be a unique combination of variables represented in the aggregate) comports with anonymity. I'm generally not one to praise governmental regulatory agencies for their technological prowess, but the U.S. Department of Health & Human Services really "got it" with HIPAA's de-identification standard. HHS understands the importance of aggregating healthcare data and conducting statistical research, and does not let HIPAA preclude this from occurring. Instead, HIPAA outlines a "safe harbor" approach that limits a covered entity's criminal/civil liability in the event of a breach if and only if the covered entity removes 18 identifiers and has no actual knowledge that the remaining information could identify the individual. These identifiers include names, dates, geolocational codes covering populations less than 20,000, etc. Alternatively, covered entities may opt to use a 'statistical' approach by hiring a qualified statistician (or other scientific expert) who can use acceptable analytic techniques to conclude that the risk of identifying the person from the disclosed information is very, very small.[1] A safe harbor approach to large-scale data privacy would be absolutely wonderful. Using statistics to prove the anonymity of data being collected/used by Facebook is nonsensical, since by default, we've given them a non-exclusive, transferable, sub-licensable, royalty-free, worldwide license to 'use' anything we submit to them. Contracts of adhesion, in my opinion, are more of the problem since there's no good way to 'make change' for the information that you submit. For example, someone very active on Facebook might arguably be 'worth more' to the company than someone who isn't, but both receive the same product. EDIT: A safe harbor approach to large-scale data privacy isn't even unknown. See COPPA[2], for example. [1] http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&rgn=div8&view=text&node=45:1.0.1.3.77.5.27.9&idno=45 http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&rgn... 45 CFR 164.514(b)(1)--(2). [2] http://en.wikipedia.org/wiki/Childrens_Online_Privacy_Protection_Act http://en.wikipedia.org/wiki/Childrens_Online_Privacy_Protec...

Silhouette 15y ago