Facebook Sharing Too Much Personal Data With Application Developers

An anonymous reader writes "Remember the Facebook News Feed privacy uproar? What about the Beacon scandal from late last year? Privacy activists are rallying around yet another major issue at Facebook, in which the company is secretly sharing user data with third parties. Researchers from the University of Virginia recently announced that in a study of the top 150 Facebook applications, more than 90% were given access to information that was not needed to function correctly. That Scrabble or Superpoke application you really like? Its developers get access to your religion, sexuality and home town. Facebook's position was summed up by Georgetown Law Professor Dan Solove, 'They seem to be going on the assumption that if someone uses Facebook, they really have no privacy concerns.' Do Facebook users deserve privacy? "

Net

If you post it on the 'net, it's public information, no matter how secure or private the application is. One must treat his or her information on social networks this way, no exceptions.

Re:Net

Exactly. Just look at what happened with the "private" myspace pictures. If you don't want the information getting out, don't post it on the internet.

Re:

If you post it on the 'net, it's public information, no matter how secure or private the application is. One must treat his or her information on social networks this way, no exceptions.

Well put. We must run under the assumptions that whatever information we provide to websites will not remain confidential, privileged, private or otherwise secure. Sites have privacy policies for a reason, yet some users seem to get upset when something

Re:Net

No they don't. You get a 'your friend has added X, JOIN NOW' and THEN you can decide if you want to join an application you can check the box "share my data with application X"

Yes. They do.

Read the article, and if you're on Facebook, go to "privacy" -> "Applications" -> "Other Applications" and read what it says under "What Other Users Can See via the Facebook Platform" very, very carefully.

Re:Net

Well that's what I thought. But it appears that's actually not the case. If you RTFA and click through, you find a page that explicitly says that friends applications can view my data. Which presumably they can then do more or less anything with, seeing as how keeping that data is only "enforced" by the terms of service. The defaults are set such that my friends apps, any by implication anybody who can code, can view everything except my sexual preferences, basically.

That's pretty surprising, and I'm glad Ms Felt has called this out. It means that anybody who writes a moderately successful app can build a giant database of things that I never intended to be in any database other than Facebooks. Part of the reason Facebook has been successful is that it does actually have privacy controls, and people feel they can share their data with only their friends (and facebook inc, of course, but that's only one company). The fact that it's not true is a pretty gaping oversight.

What I find especially funny is the big bold sign at the top saying "Facebook does not sell your personal data". No, they give it away for free instead. Great.

Re:

So you don't do use a bank or credit card that has an optional web interface or send any email or say anything in an instant message or skype conversation that you'd prefer to keep private?

Your advice is wildly overreaching. It's like telling MADD, "if you

Re:Net

I use online banking, and I damn well expect my account to not be publicly available. Why can't I expect a social networking site to respect my privacy the same way my bank does?

I agree with you that information posted to social networks can't be considered private, but that's because they are broken, and their users have the right to complain about it.

So basically

the title of this post should read "People are sharing too much personal data with Facebook"...

The assumption is that we tell Facebook the truth

Do you really think I'm a Pastafarian?

Now, true, half my friends post pics of their drunken parties (yo! Aislinn and Katelyn! love the pics!), but so far I'm not in any of the pics, and I happen to know some of my friends are not the people they say they are ...

Nobody trusts the man, man. We all realize you're all pervs.

Wow

I haven't seen a company this determined to shoot themselves in the foot with bad policy since Real Networks [wikipedia.org]. You'd think they would think Facebook might have realized at least some people actually do care about balancing utility with privacy.

Don't supply it in the first place!

I work in Higher Education and we're just starting to get on the ball with recruiting via Social Networking (we're always years behind the curve -- I'm surprised we're this current actually) and just as with anything that you provide to a third party, you should really think about what that group needs to have from you in order for you to get what you need in return.

Higher Education is still generally based on paper marketing. Yes, we have a mass of information available on the web but it's not enough honestly and from some Noell-Levitz studies it has been found that the majority of students still want to be communicated by traditional mail marketing in addition to everything else. In fact, in the focus groups I have conducted on the topic, 89% of those that responded (pool of ~350) wanted no communication other than direct mail -- that was shocking to me, especially because they were traditional aged students (18 - 24). I have found that most students will give you their name and address (which is more than I normally will give anyone until I actually apply to the college) and not much else (no birthdate, prior education, and especially no phone number or e-mail address).

So, why are these people giving it to Facebook? Why would they trust that site more than an institution of higher education that is actually mandated by law to protect the privacy of those it deals with? I can't turn around and release any part of a student database to any third party unless its cleansed and has no identifiable information.

Personally, while Facebook is the "new big thing" in Higher Education, it's not worth it for our institution to spend all that much time recruiting by it. Our traditional data works just fine to increase enrollment through the traditional mail, phone and e-communication programs I have developed and redeveloped. That said, I really do believe that people should be very careful about what they put out on any social networking site. Contrary to the belief that there are no automated programs allowed to scour the site, they do and the data that comes back is some really interesting stuff to wade through.

Automaticly install applications?

Wait, last time I checked Facebook doesn't automaticly install apps you have to do it and confirm you are allowing this app to acccess some of your information. They don't give third parties your info, you do.

Re:Automaticly install applications?

Wait, last time I checked Facebook doesn't automaticly install apps you have to do it and confirm you are allowing this app to acccess some of your information. They don't give third parties your info, you do.

RTFA (and I quote:)

To restate things--if you set your profile to private, and one of your friends adds an application, most of your profile information that is visible to your friend is also available to the application developer--even if you yourself have not installed the application.

It seems that they do give my info to third parties - third parties being all the stupid applications that my friends installed. I keep very minimal info on my facebook account and don't install any apps because they require full access to my profile, but I still went and turned this sharing off just now. WTF, why did I just learn that every application that any of the 60 of my networked friends has installed could have been happily roaming through my account without my knowledge?

Deserve or expect privacy?

Deserve? Yes, everyone deserves the right to keep their personal lives private. Should they expect privacy? Not likely. There's no free lunch in life, online or offline: why would Facebook spend many millions of dollars maintaining a social network without milking every last bit of profit out of their user base? They're going to do whatever they can get away with, period. I don't know why people find this so hard to grasp: it's like when I try to explain to people that those "free emoticons" they so fondly install are filling up somebody's offshore server with their personal information and filling their monitor with pop-up advertisements.

So why is this news again...?

Maybe I'm just that suspicious, but the first time I went to look at one of those "applications" on facebook, the first checkbox in a list of a half dozen you can select before you hit "go" was a riff on "Allow this application to access my personal info" ---I automatically assumed that meant ALL my info, and promptly cancelled whatever it was.

Did anyone ever really have the assumption that that information was needed to make the app function, and not just a way of tricking users into giving up demographic info to third parties?

Personally I'm not sure Facebook is in the wrong on this one. It's up in big letters that you're giving whatever application it is access to your personal info--and all those things are OPTIONAL to place in your profile. I don't know that it should their fault that users don't think it through and then become surprised/outraged when they find out what it really means.

It's an API

Dude, what is so hard here? It is an API. Do people typically customize an API for every user (as in application using the API) to limit the available calls only to what is needed? It is an interface. The data available in said interface is CLEARLY DOCUMENTED. Yes, technically Scrabble has access to the religion of its users. Yes, it could be storing this.

Seriously, what is confusing here? You have to agree when you add an application that it will be able to access your profile data. When you say 'yes, allow this', why would you be surprised that the application is then allowed to do what you just allowed?

http://developers.facebook.com/documentation.php?doc=fql [facebook.com]

Re:It's an API

You're right, of course. The fact is that Facebook provides a uniform, generic API. It's up to application developers which bits of information are relevant to their application.

But that's not to say this is the only way to do it. It would be possible, for instance, to have the API set such that the application initially makes a request for which database fields it will need to use. Then the application is only allowed to use those fields; all others are invisible. When a user installs an app, it clearly shows which fields the app will be using. This would allow users to make informed choices about which apps to install. If "SuperPoke" says it will access your friends list, that's fine. If it says it will access your address and phone number, that's suspicious.

My point is that Facebook decided to implement a binary security model: either you don't install the app, or you give it access to everything. This doesn't seem like the best model. As a general security rule, an application should be given access to the absolute minimum breadth of resources/data needed to do its job properly.

This is why I don't install Facebook apps: there is no mechanism for controlling the security or even establishing a chain of trust for the application developer.

Re:It's an API

Yes, technically Scrabble has access to the religion of its users. Yes, it could be storing this.

Actually, the developer terms of service explicitly prohibit storing anything other than ids (pretty much):

http://developers.facebook.com/documentation.php?v=1.0&doc=misc [facebook.com]

Yes and no

I have never bought into the argument that communicating online should always be legally regarded as the equivalent of having a conversation in public. People frequently put access controls and encryption on information sent over the Internet, and it's not like every person on the Internet has the ability to listen in on what you're saying in an IM conversation, emails, etc. There should be a reasonable basis to assume privacy in certain contexts, such as email and IM. IMO, the law should sanction people who eavesdrop on such communications without a good reason.

With Facebook, it all depends on the context. They should be required to show what information they are passing onto their application developers, but there should be no legal protection beyond that. People should be able to sell off their personal information in exchange for something they want. The only reasonable issue here is when the user is not able to reasonably find out and consent to the sharing of the information.

Personally, I am a lot more concerned with things like the FBI's latest attempts to get carte blanche access to email. If there is any institution that will destroy privacy in America, it's the federal government. Every major information/privacy issue that comes back to haunt the average person stems from the law or law enforcement agencies. The reason we worry about identity theft on the financial side of things is that the **law** does not put the onus on the lender to verify the identity of their customer. Why should it be my responsibility to ensure that someone isn't signing up in my name for credit cards? You worry about devastating legal decisions for privacy? The precedents are being set by the DoJ, not corporate America.

If You Want It Private Keep It Private

> They seem to be going on the assumption that if someone uses Facebook, they really have
> no privacy concerns.

Sounds like a reasonable assumption to me.

> Do Facebook users deserve privacy?

Sure. And they can have it. All they need to do is keep the stuff that they want to remain private off Facebook.

I don't use any of the applications

I got burned once too many times by crappy idiotic third rate nonsense "applications" on facebook. Someone sent me a kiss, so I sent one back, but I had a bunch of windows open and didn't notice that I had just sent a kiss to EVERYONE. Now they all know I love them, that's no big deal, but it's the assumption of broadcasting and the will to spam itself that I find offensive about facebook.

So, one day, I just sat down and yanked most of the applications out. so, if you send me something on the Funwall, sorry - I won't be seeing it. And if you have some dorky movie compatibility quiz, I won't be playing the game. If you want to contact me, there's a facility for sending messages and comments. If you can't get put enough words together to do that, then you're probably not one of my friends, anyway.

Facebook has outlived its usefulness.

Perhaps something like allvoices.com [allvoices.com] will be the next big thing because there, you have to do something - contribution to the data matters more than just being a consuming node for a data mine.

RS

Facebook Developer

I'm a newbie Facebook app developer.

Here's the info I can see for any user that adds my app and clicks the box:

          uid*, first_name, last_name, name*, pic_small, pic_big, pic_square, pic, affiliations, profile_update_time, timezone, religion, birthday, sex, hometown_location, meeting_sex, meeting_for, relationship_status, significant_other_id, political, current_location, activities, interests, is_app_user, music, tv, movies, books, quotes, about_me, hs_info, education_history, work_history, notes_count, wall_count, status, has_added_app

(More info on the already-linked http://developers.facebook.com/documentation.php?doc=fql [facebook.com] )

To me this seems like way, way too much. I haven't told our marketing people we can get all this.

Re:Information sharing is optional

Yeah and if you un-check that box ZERO of the applications will work.

Re:

of course the deserve privacy, everybody does.

Perhaps they shouldn't expect it, but that's different.

Re:Translated Quote...

You are clearly asked if this is okay when you install the application, so facebook is not doing anything unethical. It's all above the board...

It's mostly above board. The part that isn't is that even if you don't install any Facebook applications, if one of your friends (who can see your private profile) decides to install an application, that app now has access to your profile. As TFA explains [news.com]:

Many Facebook users set their profiles to private, which stops anyone but their friends from seeing their profile details. This is a great privacy feature that can protect users from cyberstalkers and is completely gutted by the application system. To restate things--if you set your profile to private, and one of your friends adds an application, most of your profile information that is visible to your friend is also available to the application developer--even if you yourself have not installed the application.

(Emphasis in original.)

You can disable this loophole in Facebook's settings (go to Privacy > Applications > Other Applications and set it to "do not share"), but it isn't made very clear that by default your private details are nevertheless accessible to third-party apps through your friends list. Facebook should make this much more explicit (or perhaps have this setting default to "do not share" for anyone who sets their main profile to private?).