Facebook Agrees to Settlement with FTC – But will Anything Change?

In response to the proposed settlement with the FTC over systematic privacy infringements, material omissions regarding privacy changes, and alleged fraud for charges to verified apps that were never verified, CEO Mark Zuckerberg stated “I founded Facebook on the idea that people want to share and connect with people in their lives, but to do this everyone needs complete control over who they share with at all times.”

Perhaps that is true. After all, it was the predecessor site – Facemash – that resulted in accusations of “breaching security, violating copyrights and violating individual privacy by creating the website.” Zuckerberg decided to get out of the social media arena. “Issues about violating people’s privacy don’t seem to be surmountable,” he wrote at that point. “I’m not willing to risk insulting anyone.” But that did not last long. Shortly thereafter, Facebook was born.

According to the FTC, Facebook violations included the following:

  • In December 2009, Facebook changed its website so certain information that users may have designated as private – such as their Friends List – was made public. They didn’t warn users that this change was coming, or get their approval in advance.
  • Facebook represented that third-party apps that users’ installed would have access only to user information that they needed to operate. In fact, the apps could access nearly all of users’ personal data – data the apps didn’t need.
  • Facebook told users they could restrict sharing of data to limited audiences – for example with “Friends Only.” In fact, selecting “Friends Only” did not prevent their information from being shared with third-party applications their friends used.
  • Facebook had a “Verified Apps” program & claimed it certified the security of participating apps. It didn’t.
  • Facebook promised users that it would not share their personal information with advertisers. It did.
  • Facebook claimed that when users deactivated or deleted their accounts, their photos and videos would be inaccessible. But Facebook allowed access to the content, even after users had deactivated or deleted their accounts.
  • Facebook claimed that it complied with the U.S.- EU Safe Harbor Framework that governs data transfer between the U.S. and the European Union. It didn’t.

Moreover, the EU is not finished with this issue. It has come under fire from states such as Ireland and Austria as well as the broader European Union. According to news reports, in January 2012, a new EU directive will be proposed to “ban targeted ads to users unless the user specifically allows it. If this new legislation is passed it would mean that every time Facebook doesn’t comply it would face substantial fines as well as serious legal action.” The potential EU action will go much further than the FTC.

Zuckerberg has elevated two Facebook attorneys to be responsible for privacy enforcement. Time will tell, however, whether the promotions will change the culture of a company that has a leader who sheds only crocodile tears over privacy violations.

Under the proposed settlement, the FTC will take some incremental steps. Facebook will be:

  • barred from making misrepresentations about the privacy or security of consumers’ personal information;
  • required to obtain consumers’ affirmative express consent before enacting changes that override their privacy preferences;
  • required to prevent anyone from accessing a user’s material more than 30 days after the user has deleted his or her account;
  • required to establish and maintain a comprehensive privacy program designed to address privacy risks associated with the development and management of new and existing products and services, and to protect the privacy and confidentiality of consumers’ information; and
  • required, within 180 days, and every two years after that for the next 20 years, to obtain independent, third-party audits certifying that it has a privacy program in place that meets or exceeds the requirements of the FTC order, and to ensure that the privacy of consumers’ information is protected.

A thirty day public comment period for the existing FTC consent decree has begun. The public will have an opportunity to address the scope of the FTC response, which is substantially less than the EU proposals.

Which is the better approach? Speak up.

Interested parties can submit comments online or in paper form by following the instructions in the “Invitation To Comment” part of the “Supplementary Information” section. Comments in paper form should be mailed or delivered to: Federal Trade Commission, Office of the Secretary, Room H-113 (Annex D), 600 Pennsylvania Avenue, N.W., Washington, DC 20580.


Rushdie Beats Facebook using Twitter – Regains use of Salman

Three decades ago novelist Salman Rushdie became an internationally famous author after his novel, The Satanic Verses, led to a decade in hiding, fearful of the Haraam (death penalty fatwa) pronounced on him by Iran’s spiritual leader because Iran’s leadership believed the book to insult Mohammed and the Qur’an.

After such a battle, Facebook was a minor opponent, though perhaps equally insulting, given our interconnected lives.

Facebook requires a poster to use one’s real identity unless Facebook agrees to the contrary. (It has done so, for example, to allow for animated characters to have pages as part of marketing campaigns.) So Facebook insisted that Rushdie use the name in his passport – Ahmed – rather than his middle name Salman, which he has used throughout his professional career. Worse, the page automatically made the switch.

Facebook values accountability, but that value is at odds with anonymity and pseudonymnity, both important for political and social speech. Who better than Rushdie for someone to stand for the cost of writing controversial content.

“Facebook has always been based on a real-name culture,’ Elliot Schrage, vice president of public policy at Facebook, told the New York Times. ‘We fundamentally believe this leads to greater accountability and a safer and more trusted environment for people who use the service.’

Rushdie used Twitter to light up the public and get a response to the unwanted disclosure. He tweeted that the change was “like forcing J. Edgar to become John Hoover” and noted other middle name users “Francis ‘Scot’ Fitzgerald and Edward ‘Morgan’ Forster.”

“Where are you hiding, Mark?” Rushdie demanded of Mark Zuckerberg. “Come out here and give me back my name!”

Rushdie and his thousands of followers have forced Facebook to relent, but the issue of what constitutes “real identity” is probably going to only grow as the public realizes that often a person’s real identity is not the one on the birth certificate.

Watch live this Nov. 11-12 as Georgetown streams conference on governance of social media live from DC

This Friday and Saturday, Georgetown University will be hosting the Quello Center’s Governance of Social Media Workshop. A large group of academics, policymakers, representatives from the advocacy community and industry (including Facebook and Google) will be debating the various policy issues raised by social media.

This Friday and Saturday, watch the live webcast of the Governance of Social Media Workshop. To learn more, visit the conference website. or follow on Twitter at hashtag #GSMworkshop.

Governance of Social Media: A Quello Center Workshop

November 11 & 12, 2011, Georgetown University, Washington, DC

For a large and growing portion of the population, social media of various types have become an integral part of daily life, and businesses based on social media have become a major economic force. Given their pervasive influence on institutions and society, it is time to start developing a more comprehensive framework to guide policy responses to the challenges raised by social media, which to this point have been addressed piecemeal as they become salient.

This workshop is designed to stimulate thinking on what such a framework might look like, examining:

(1) Legal and policy issues raised by the new and unique attributes of social media, and
(2) The implications of social media for attainment of traditional communications policy goals

Streaming will be available.

I am honored to have been invited to be a participant among such an impressive group of speakers. My small contribution will be available following the conference on SSRN.

Panelists will address a variety of topics relating to policy for social media including (but not limited to):

  • Competition policy
  • Privacy concerns
  • Social media analytics and targeted advertising
  • Data mining
  • Gaming and virtual worlds
  • Reputation management
  • Surveillance
  • First Amendment and free speech
  • The protection of children
  • Access
  • Media content diversity

Panelists will include:

  • Michael Altschul – CTIA
  • Marvin Ammori – New America Foundation
  • Johannes Bauer – Michigan State University
  • Ryan Calo – Stanford University
  • Adam Candeub – MSU
  • Barbara Cherry – Indiana University
  • Lorrie Faith Cranor – Carnegie Mellon University
  • Laura DeNardis – American University
  • Nicolas Economides – NYU
  • Joshua Fairfield – Washington and Lee University
  • Edward Felten (Luncheon keynote address) – FTC
  • Rob Frieden – Penn State University
  • Jon Garon – Northern Kentucky University, Chase College of Law
  • James Grimmelmann – New York Law School
  • Matt Jackson – Penn State
  • Paul Jaeger – University of Maryland
  • Greg Lastowka – Rutgers University
  • Peder Magee – FTC
  • Kathryn Montgomery – American University
  • Phil Napoli – Fordham University
  • Arvind Narayanan – Stanford University
  • Christena Nippert-Eng – Illinois Institute of Technology
  • Frank Pasquale – Seton Hall University
  • Amit Schejter – Penn State University
  • Ashkan Soltani
  • Robert Sprague – University of Wyoming
  • Peter Swire – Ohio State
  • Adam Thierer – George Mason University
  • Eugene Volokh – University of California, Los Angeles
  • Joshua Wright – George Mason University

So What is Law & Informatics and Why Study it in Law School?

On November 4th the NKU Chase Law & Informatics Institute held our opening reception at the beautiful, new LEED certified Griffin Hall, host to the NKU College of Informatics. Well over one hundred attorneys, business leaders, faculty and students attended, including representatives of NKU and many other Tri-State universities.

Among the presentations made by NKU President, Dr. James Votruba, deans Dennis Honabach (Law) and Kevin Kirby (Informatics) was a short video directed by Informatics undergraduate student Kyle Breitenstein.

You can see the video here:

We are very grateful for the time and effort from everyone who worked on the event and attended the event.

As you watch the short video, I hope you find the answers to the questions of this post. Please let me know.

What is Law & Informatics? Visit YouTube to learn more: http://www.youtube.com/watch?v=Muk5n1aDX0k

Expanding Crowdfunding

In September, Representative Patrick McHenry introduced proposed legislation to make the process of raising capital through crowdfunding exempt from federal securities laws.The Entrepreneurial Access to Capital Act, HR 2930, has received house panel support. His proposal is actually quite straight forward. Under the proposal, the Securities Act of 1933 (15 U.S.C. 77d) would be amended by the addition of a new section 4(6) to provide that individuals can purchase up to the lower of $10,000 or 10 percent of the investor’s annual income (based on the investor’s own declaration of income) for investments up to $5 million.

More importantly, the crowdfunding provisions exempt the offering from state filing obligations. The law does not, in fact, require actual crowdfunding. While IndieGoGo and KickStarter provide tools to raise donations, sales and even funding, the law is not limited and could create a new business for Facebook, Google and other social media sites.

The Wall Street Journal has recently identified analysts both in favor and against the proposal, but when it is unlinked from the crowdfunding projects of independent artists, the provision has great promise.

The antifraud provisions of state and federal law do not go away. Swindlers offering promises that they cannot keep or designed to steal are committing fraud and will be subject to both civil and criminal laws. Undoubtedly, it will be a bit easier to float the fraudulent proposals among the legitimate – but unsuccessful – attempts of other businesses, but criminals are already busy. This might change some criminal strategy but it is unlikely to create new criminals.

The greater threat to the economy is the lack of capital for high-risk small businesses and creative enterprises. Currently, opportunities for high-risk economic participation exist only at the top of the pyramid. Many of these fail; others succeed. Most investors believe in the goals more than they expect economic rewards. A paternalistic law that dramatically increases the financial costs of raising low amounts of money is not really helping the investors, the economy or the creative culture in America. The proposal is simple. It is a stimulus everyone can support.