{"id":6180,"date":"2019-03-08T18:33:44","date_gmt":"2019-03-08T22:33:44","guid":{"rendered":"http:\/\/ncjolt.org\/?p=6180"},"modified":"2020-06-04T20:52:26","modified_gmt":"2020-06-04T20:52:26","slug":"how-we-got-here-looking-at-facebooks-failure-to-protect-user-privacy-as-it-negotiates-billion-dollar-settlement-with-the-ftc","status":"publish","type":"post","link":"https:\/\/journals.law.unc.edu\/ncjolt\/blogs\/how-we-got-here-looking-at-facebooks-failure-to-protect-user-privacy-as-it-negotiates-billion-dollar-settlement-with-the-ftc\/","title":{"rendered":"How We Got Here: Looking at Facebook's Failure to Protect User Privacy as It Negotiates Billion-Dollar Settlement with the FTC"},"content":{"rendered":"\n

Reports\nemerged<\/a> on February 14 that Facebook and the FTC were nearing a\nsettlement over the Cambridge Analytica data breach and the social media\ncompany\u2019s privacy policies. It is anticipated that Facebook will ultimately\nagree to pay a multi-billion\ndollar fine<\/a> \u2013 \u201cthe largest the [FTC] has ever\nimposed on a technology company.\u201d \nHowever, Facebook\u2019s data privacy problems did not begin with Cambridge\nAnalytica and likely will not end there. <\/p>\n\n\n

The FTC began\ncommunicating<\/a> with Facebook about protecting user\nprivacy as early as December of 2007, when the company launched its \u201csocial\nadvertising\u201d plan<\/a>. The plan allowed\nusers<\/a>, if they chose, to show their Facebook friends their\npurchases and product recommendations. At the time, the plan received mixed\nreviews<\/a> from privacy experts. Some commended<\/a>\nFacebook for allowing users to choose whether or not to share product\nrecommendations with their social network. However, others \u201cexpressed\nconcern<\/a> that Facebook might one day change its policy of not\nsharing data with marketers.\u201d Specifically, there was concern over \u201cshifting\npromises<\/a>,\u201d worry that Facebook would eventually market users\u2019 brand\nand product preferences without their permission. <\/p>\n\n\n

In 2011<\/a>, these predictions came true. Facebook was charged by the FTC<\/a> in an eight-count complaint with failing to protect user data and failing to keep promises regarding user privacy. One of the promises<\/a> Facebook was found to have broken was its promise to not share users\u2019 personal information with advertisers without their permission. One of the conditions<\/a> of the 2011 settlement was the requirement that Facebook obtain \u201cindependent, third-party audits\u201d every two years for a period of 20 years \u201cto ensure that the privacy of consumers\u2019 information [was] protected.\u201d <\/p>\n\n\n

Facebook\u2019s data privacy problems did not begin with Cambridge Analytica and likely will not end there. <\/p><\/blockquote>\n\n\n

The most bizarre privacy scandal in Facebook\u2019s 15-year\nhistory was its \u201cmood-manipulation\nexperiment<\/a>\u201d in 2014 where over half a million\nusers had their news feeds manipulated to show either more positive or more negative\nposts. This attempt to measure the influence of social media on peoples\u2019\nemotions was widely\ncriticized<\/a> as unethical.<\/p>\n\n\n

In early 2018, the FTC began an\ninvestigation<\/a> into \u201cwhether Facebook violated\nterms of [the] 2011 settlement when data of up to 50 million users was\ntransferred to [Cambridge Analytica],\u201d a firm \u201ctied to President Donald Trump\u2019s\ncampaign.\u201d The crisis that has unfolded over the last year \u201chas\nits roots<\/a>\u201d in the company\u2019s 2007 decision to\nlaunch it social advertising scheme.<\/p>\n\n\n

The core\nweakness<\/a> in Facebook\u2019s privacy protection was the ability of mobile\napp developers to access user data by creating apps \u201cthat plugged into\nFacebook\u2019s platform.\u201d That\nplatform<\/a> provided access not only to the data of people that used\nthe app, but also the private data of each app user\u2019s Facebook friends. Facebook\nattempted\nto remedy<\/a> this privacy issue in 2015 by\nchanging the rules for app developers with access to its platform. <\/p>\n\n\n

However, the new rules had no\nretroactive effect<\/a> and Facebook had no control over or\nability to \u201ckeep track of how developers used previously downloaded data.\u201d\nAlso, in 2015, Facebook became\naware<\/a> of authorized sharing of the data that was later \u201callegedly\nused by Cambridge Analytica\u201d during the 2016 election. Facebook\nordered<\/a> the involved parties to delete that data a year prior to\nthe election, but learned in 2018 that the data had been kept. A former platform-operations\nmanager<\/a> at Facebook who held the role from 2011-2012 professed that\nthe company had a history of ineffective data protection: \u201cThe main enforcement\nmechanism was call them and yell at them.\u201d<\/p>\n\n\n

Amid the backlash over the Cambridge Analytica scandal, Mark Zuckerberg himself came forward<\/a> to make three renewed promises regarding steps Facebook would take to ensure protection of user privacy. The three changes<\/a> included an investigation into apps that had access to user data prior to 2014 when Facebook became aware of its platform weaknesses, new limitations on the kind of data accessible to apps on the platform, and the creation of a tool that would allow users to view and manage which apps have access to their data. The only problem with this plan is that Facebook has a long history of breaking promises on user privacy. The last few months have seen new allegations<\/a> leveled against Facebook for allowing companies like Netflix and Spotify to have virtually unfettered access to user data, including private messages. No matter the outcome of the anticipated settlement with the FTC, it appears that the controversies surrounding Facebook\u2019s efforts, or lack thereof, to protect user privacy are far from over. <\/p>\n\n\n

Samantha Taylor, 18 February 2019<\/p>\n","protected":false},"excerpt":{"rendered":"

Reports emerged on February 14 that Facebook and the FTC were nearing a settlement over the Cambridge Analytica data breach and the social media company\u2019s privacy policies. It is anticipated that Facebook will ultimately agree to pay a multi-billion dollar fine \u2013 \u201cthe largest the [FTC] has ever imposed on a technology company.\u201d  However, Facebook\u2019s …<\/a><\/p>\n","protected":false},"author":1,"featured_media":6181,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[51],"tags":[],"_links":{"self":[{"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/posts\/6180"}],"collection":[{"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/comments?post=6180"}],"version-history":[{"count":1,"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/posts\/6180\/revisions"}],"predecessor-version":[{"id":6845,"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/posts\/6180\/revisions\/6845"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/media\/6181"}],"wp:attachment":[{"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/media?parent=6180"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/categories?post=6180"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/tags?post=6180"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}