EPIC: Facebook Timeline Violates FTC Settlement

Posted by · January 6, 2012 4:31 pm

Back in November, Facebook reached a settlement with the Federal Trade Commission in light of rising concerns of privacy issues with the social media site. Although the settlement was officially composed of five separate terms, the essence of the toothless agreement served to reinforce one thing: Facebook must abide by the privacy rules that Facebook itself created.

That seems simple enough, right? Well, maybe not.

Calling for the FTC to launch yet another investigation into the popular social networking site, the widely known public interest group EPIC (Electronic Privacy Information Center) is accusing Facebook of violating that settlement with the implementation of its new Timeline feature.

In an open letter sent to the FCC on December 28th, EPIC urged the regulatory group to examine whether the new profile feature was consistent with the recently reached settlement:

Facebook is changing the privacy settings of its users in a way that gives the company far greater ability to disclose their personal information that in the past. With Timeline, Facebook has once again taken control over the user’s data from the user and has now made information that was essentially archived and inaccessible widely available without the consent of the user.

If this accusations turn out to be true, Facebook would be in violation of the second provision of the FTC settlement. This term established that Facebook is “required to obtain consumers’ affirmative express consent before enacting changes that override their privacy preferences.”

Specifically at issue in this accusation by EPIC is that the “7-Day Review Period” Facebook granted new Timeline users to review what’s on their timeline before anyone else can view it. Because of the term’s automatic nature—pushing the new Timelines live as soon as the seventh day expires—EPIC argues that such a provision is inconsistent with the concept of “affirmative express consent.”

Responding to the accusations, a Facebook spokesperson told VentureBeat that “Timeline doesn’t change the privacy of any content.” The statement continued:

Everything is accessible to the same people who could or likely had seen it already in their News Feed sometime in the past. In addition, Timeline offers a number of new, simpler, more effective ways for people to control their information, including activity log, the most comprehensive control tool we’ve ever developed. We think these innovations are things privacy advocates should be applauding.

The question, then, is rather simple: Does the transition to Facebook Timeline expose any private information that is therefore subject to the FTC settlement’s “affirmative express consent” provision?

If so, the seven-day review period violates the agreement on its face. After all, a simple way to translate “affirmative express consent” would be to call it “active consent.” That is, the user must be the one that actively enables the use of the once-private information. Facebook’s current review period relies only on the passive consent of the user, which automatically pushes one’s Timeline live after the time period expires. No questions asked.

On the other hand, if no new information is exposed by changing to Timeline, EPIC is going to have a hard time making its case.

According to a ZDNet report, however, Facebook may not be so lucky.

Although the social networking giant provides new Timeline users with options to adjust the new privacy settings, there are a few things that change if the user does nothing in the review period (and by default will also happen when all remaining Facebook users are forced to switch to Timeline).

“[W]ithout making those tweaks, for example, a user’s cell phone number would be exposed publicly,” contributor John Fontana added. “And posts, photo galleries, and comments that were once only available to friends would be exposed to anyone.”

Moreover, Fontana provided three other “bits of information” that are made public automatically by Facebook Timeline: all “public” events a user RSVP’d to, the start date of the user’s page, and the dates that a user used individual Facebook applications.

For those of us who didn’t realize what was happening when we switched to the latest Facebook layout, all hope is not lost. But it is severely hindered. Once the review period expires, there are only two options: delete your account or delete each and every individual post that the new interface chose to make public regardless of how you originally shared it.

Now 800 million users strong—many of which are undoubtedly witnessing this continuing controversy—Facebook is not putting its best foot forward to begin the year that it plans to go public.

Do you think the Facebook Timeline switch satisfies the “affirmative express consent” requirement? Share your perspective in the comments below.