Facebook's Privacy Policy is History

Privacy Policy = Data Policy?

The emphasis has been removed from the hypersensitive issue of users’ privacy by changing “privacy policy” to “data policy.” (But note that the URL still is “about/privacy/”) “Data” is not a word that gets people’s emotions stirred up. There’s nothing personal about it.

Seriously, this is how the “geniuses” at Facebook and other Silicon Valley geek hives think! Of course, that thought is not true if the data is about your finances, health, religion, politics, where you are, where you go (online or offline), what you buy, etc.

Your privacy isn’t even mentioned in the Data Policy’s introduction: “This policy describes the information we process to support Facebook, Instagram, Messenger and other products and features offered by Facebook…” Apparently, poor Zuck is tired of everybody else whining about their privacy needs and now wishes to talk about his needs for your data. And talk he does, at tedious length.

Things start to get interesting for privacy seekers in Data Policy section 5, “How can I manage or delete information about me?”

Here we learn that when you delete your Facebook account, everything that you have posted actually gets erased. There is also a “deactivate account” option, which retains all of your data in case you ever want to return to Facebook. In the past, Facebook was criticized for telling users they were “deleting” their accounts when, in fact, the accounts were merely deactivated temporarily. That “misunderstanding” seems to be corrected now.

Your search queries in Facebook’s search function can be deleted from your browser history, but Facebook’s logs of your queries persist for six months. Such logs are Facebook’s property, created by it not you, so the 4th Amendment does not protect users against warrantless searches and seizures. Facebook can and does voluntarily share its own data about specified users with law enforcement, but only to prevent imminent harm such as a murder, suicide, mass shooting, etc. Generally, Facebook will require a search warrant, subpoena, or other court order before turning over its records of users’ activity.

If Facebook makes you upload a scan of your driver’s license or other documents to verify your identity, that image gets deleted after 30 days. But whether the biometric data that can be extracted from a facial photo is retained and added to Facebook’s facial recognition database is unclarified. Such data includes measurements of distances between facial landmarks, i. e., between eye pupils, between ends of lips, nose to chin, etc.

Facebook claims that its logs of your activity on Facebook are the company’s property and do not need to be deleted at your request. Biometric data derived from scanned images may also be company property. It’s questionable whether there is a practical difference between keeping your facial image and keeping its biometric data; either can be used to identify you.

Data, Big Data, and More Data

“Data! Data! Data!” he cried impatiently. “I can't make bricks without clay.” Sherlock Holmes, the fictional detective created by Arthur Conan Doyle, understood the value of data. And so does Facebook.

Facebook collects every scrap of data about you that it can, even posts or messages that you begin but decide not to finish. Your current location and past travels are collected, even if you have location services and GPS disabled on your mobile device; your carrier has to know where you are at all times to provide service, and all four major carriers sell that data to anyone who will pay, we learned just last week. (See my article Everyone Knows Where You Are for that story.) Facebook can afford to pay, and its greed for data about you is insatiable.

Data about you may come from other sites that use Facebook as a registration authentication option, or that employ the “like us on Facebook” button provided by Facebook. Even if you avoid registering with your Facebook account or clicking on the “like us” button, Facebook still gets the data that you were on a given page of a given site. Finally, Facebook buys data about what you do offline from data brokers, even if you have never had a Facebook account!

In other words, Facebook is the nosiest neighbor that everyone in the world has ever had.

What Facebook does with all this data about us is also explained in the Data Policy. Innocuous uses like “product research and development” are side-by-side with creepy things like “face recognition.” Of course, the overarching use of all data collected by Facebook is “to sell more ads to advertisers.”

Facebook will not provide an advertiser with your personally identifiable information such as name, address, phone number, Social Security Number, etc. Facebook can profit only by remaining an intermediary between you and advertisers. So advertisers get to specify the demographics of the people they want to reach with their ads, and Facebook makes sure those people see the ads. Advertisers only learn who saw the ads if and when viewers respond to them.

But Wait... There's More!

If that was all Facebook did with the data it collects, we might be able to live with it. After all, in exchange for our data we get free stuff, and lots of it. (Too much, many are starting to realize.) We get communications with loved ones and like-minded people worldwide, business opportunities and endless new things to buy, useful information and mindless entertainment, and more. But matching ads with audiences is not all that Facebook does.

App and game developers get access to data about you and your friends when you download, play, or otherwise interact with such software products. Facebook says it’s entirely up to you whether you share your list of friends with an app. But we know that nefarious scammers are adept at social engineering - wheedling such permissions from users of all online communications media. The fact that it’s possible to give up your friends to an app is the fundamental reason so many malware infections and account hijackings sweep through Facebook like wildfire.

Facebook says in its new Data Policy: “We are in the process of restricting developers’ data access even further to help prevent abuse. For example, we will remove developers' access to your Facebook and Instagram data if you haven't used their app in 3 months, and we are changing Login, so that in the next version, we will reduce the data that an app can request without app review to include only name, Instagram username and bio, profile photo and email address. Requesting any other data will require our approval.”

It’s scary to wonder what else apps were able to access without being vetted by anyone right now and in the past 14 years since Facebook was founded.

It's All Academic

Sometimes it’s the shortest explanations that set off my loudest alarms. Here’s a good example: “We share information about you with companies that aggregate it to provide analytics and measurement reports to our partners.” That’s all Facebook has to say about its “measurement partners.”

To me, it says these anonymous companies get my personally identifiable information and then aggregate it into databases that do not contain personally identifiable information. But who are these measurement companies? What are their security capabilities? Where are their privacy policies? What else are they doing with my personally identifiable information? If the answers to these questions boded well for Facebook, I’m sure they would be right there after the sentence I quoted.

“Researchers and academics” are another group that gets access to our data. Remember, the Cambridge Analytica scandal started with an academic researcher who vastly exceeded the amount and kinds of data that Facebook thought he was collecting. Researchers need adult supervision, too.

There are endless points to ponder in Facebook’s new Data Policy. The biggest takeaway, for me, is that privacy is no longer worth talking about, according to this Data Policy. Your data is out there in Facebook’s hands, and it is going to be used. You only get to know how it’s being used, and probably not all of that story. Resistance is futile. Or is it?

Your thoughts on this topic are welcome. Post your comment or question below...