Facebook provided companies such as Apple, Amazon and Yahoo extensive access to users’ personal information, effectively exempting them from the company’s usual privacy rules, according to a New York Times report .
Facebook enabled partners to offer services that utilize Facebook accounts and features. For example, Spotify was able to offer a feature that lets a user share song lists with his or her Facebook friends. But to do that, Facebook had to provide Spotify the user’s list of Facebook friends.
Facebook says it didn’t violate its users’ privacy in doing any of this. But Facebook has shown a pattern of playing fast and loose with the word “permission.” That appears to be the case here, too.
A look at the claims:
FACEBOOK: “To be clear: none of these partnerships or features gave companies access to information without people’s permission.” — from a blog post late Tuesday by Konstantinos Papamiltiadis, the company’s director of developer platforms.
THE FACTS: In this case, the company says that its “integration partners” — such as Amazon, BlackBerry or Microsoft — were required to get authorization from people to activate these features. Users would have done this by using their Facebook account to log in to the other services, which, technically, qualified as giving permission. But people may not have understood just what they were granting permission for.
In addition, according to the Times report, Facebook from its early days established key data-sharing partnerships with companies, sometimes giving them special access to data — without asking for users’ permission.
For example, according to the report, the company used contact lists from “partners” such as Amazon, Yahoo and China’s Huawei to suggest possible Facebook friends to users. Facebook argues that its partners are essentially an extension of itself, as service providers, and thus they don’t need to get permission from users as long as they limit data use to providing Facebook-related services.
In all, the report says, more than 150 companies benefited from Facebook’s data-sharing methods. While most were technology companies, there were also automakers and media organizations. Some, the Times notes, were still ongoing this year.
The permissions issue came up earlier this year, when Facebook was found to have been collecting call and text histories from Android users. The company claimed at the time that it got permission from users to do this. Nonetheless, many users, including the New Zealand man who discovered the practice after downloading his Facebook data in March, were surprised that the company was logging this data.
According to internal emails made public as part of a lawsuit , the company knew that the Android data collection could look bad. A product manager, Michael LeBeau, wrote in a February 2015 email that the permissions feature — which prompted users to grant access to call logs and text-message history — is “a pretty high-risk thing to do from a PR perspective.” But, he added, “the growth team will charge ahead and do it.”
FACEBOOK: “Nor did they violate our 2012 settlement with the FTC,” or Federal Trade Commission. — from the same blog post.
THE FACTS: As part of the settlement, Facebook must obtain people’s “affirmative express consent” before making changes that override their privacy preferences. This could apply to sharing the content of private messages, friends’ lists and other information that Facebook gave its partners access to.
Thus, Facebook’s assertion that most of its data-sharing partnerships were exempted is on shaky ground.
The FTC’s former chief technologist, Ashkan Soltani, and three former employees of its consumer protection division told the Times that the data-sharing deals probably violated the agreement. One said the partnerships seemed to give third parties permission to harvest data without users being informed of it or giving consent.
