Facebook’s privacy storm
February 18th, 2009 | by jz | Published in Book, Facebook, Future of the Internet, Web 2.0 platforms | 12 Comments
Some thoughts on the Facebook terms of service privacy storm:
Facebook and other social networks have an especially tricky time in this zone, since so much user data is relational. You upload a photo of you and me; I tag it with your name. I leave Facebook — does your name disappear from the photo since I was the one who originally tagged it? Should all traces of someone vanish from everyone’s news feed, or is the alert that X posted a photo (along with a thumbnail of the photo) a different contribution than … posting the photo? Facebook possibly thought to avoid these issues — or at least retain maximum flexibility to answer them — by including the sweeping clauses about being able to retain our data forever.
One lesson is that plain English (and its other-language counterparts!) works better these days than legalese. When talented lawyers sit down to draft something like a set of terms of service, they naturally want terms that protect their client as much as possible — both in its current practices and for any future practices it could conceivably undertake. Plus they know that courts will hold this language against them in a dispute if there’s any wiggle room, since the company itself drafted it and the users couldn’t negotiate. So the writers tend to (1) reuse terms from other companies’ agreements like old holiday fruitcakes getting passed around, since venerable terms must be good ones and (2) they write broadly and at length. But now just one hawk-eyed person scrutinizing new terms can see them get broadened and raise an alarm to everyone else, thinking of all sorts of future actions the company just permitted itself to take — the way the lawyers themselves were thinking, too. This is true even if the people running the company didn’t have anything more in mind than avoiding some class action lawsuit for using people’s data in ways that could be said to exceed the limits they’ve placed on themselves with their own terms.
Writing in plain language can better describe what the company is trying to do, and may even make a court more sympathetic if trouble arises. That trend is probably increasing — consider Google’s warning upon installing its browser toolbar, which in “advanced” mode will send every visited Web site URL back to Google so that, among other things, Google can provide an icon showing the page’s popularity as it’s visited. Google leads its privacy policy with “PLEASE READ THIS CAREFULLY — IT’S NOT THE USUAL YADA YADA.” Mark Zuckerberg’s blog entry in response to the controversy is a welcome piece of plainspeak.
So — Facebook will go back to the drawing board and come up with something new, no doubt rightly more narrowly drawn. In another post Zuckerberg said:
- More than 175 million people use Facebook. If it were a country, it would be the sixth most populated country in the world. Our terms aren’t just a document that protect our rights; it’s the governing document for how the service is used by everyone across the world. Given its importance, we need to make sure the terms reflect the principles and values of the people using the service.
Governing document is right. That brings up two bigger picture issues worth highlighting out of what otherwise might be a garden-variety dispute about privacy terms that people can have with any of the companies to who they entrust their data.
First, if Facebook is analogous to a country, how to govern it? There’s an amazing amount of energy devoted to arguing about who gets to control the top-level allocation of domain names, since they’re seen as a shared resource of the Net that can greatly affect people’s lives. (I think that’s overblown, but that’s a different discussion.) So what about a “community” like that of Facebook, where people invest their data — indeed, often their very identities. When someone’s years’-long cultivated Facebook account is terminated for alleged objectionable behavior, is that a mere customer service issue, or ought it be thought of as something broader? No one expects Facebook to be run by anyone other than its management and private owners (and perhaps someday its public shareholders), adjusting for market pressure from its users, but if the communities there are truly to flourish, perhaps it’s time to experiment with forms of self-governance. Just as online multiplayer games allow worlds of users with different rules, and some incorporate users themselves into developing those rules, Facebook could experiment with some of the same things. (So far online organizing on Facebook tends to be represented by the creation of groups with provocative titles and then a count of how quickly how many people sign up, an especially interesting metric since Facebook itself can tweak how often word of people joining a group appears in their friends’ newsfeeds.) There may be a sweet spot somewhere between the status quo — where at least we know whom to blame or sue if we disagree with a Facebook policy — and, say, Wikipedia, where governance generally takes place in ways large and small among the thousands of people who edit its articles and work through the disputes that naturally arise there.
Second, it’s amazing how much people focus on Facebook’s use of data vs. uses by fellow users on Facebook. I think “peer-to-peer” privacy violations will turn out to be the most interesting and pervasive, and that we ought to start working out how to handle these issues. Even small tweaks in how a site like Facebook operates — such as who gets to tag and untag a photo and who is notified (or asked for permission) when tagging happens — can have a huge impact on the flow of data and identity. (Facebook’s structure is highly innovative here — they’ve actually got pretty good instincts about people’s privacy preferences.) This is especially true as more and more of our “mouse droppings” end up in social networks — automatically updated telemetry about our daily travels (think Google Latitude) or changes in who we’re friends with. I’ve written a lot more about this in chapter nine of “The Future of the Internet — And How to Stop It,” available for free download, (But you’re welcome to buy it, too, newly in paperback!)
Privacy “perfect storms” are good times to think about these matters — too often people are too busy shoveling out their data to really think through the implications of what they’re doing. Now, with the pitchforks on this particular issue being mostly returned to holsters, we can debate. …JZ
February 18th, 2009 at 7:09 pm (#)
Jonathan, sorry, I think this post completely misses the point. The Facebook users were not objecting to the opacity of the modified TOS; they were objecting to the impact. Whether in plain English or in $700/hr NY lawyer English, the modified TOS was clearly an attempt to shift control of user-generated content (the photo, the status updates) from the user to the service provider. The bloggers focused on the removal of the account deletion provision in the original TOS, but more significant was the removal of the sentence at the beginning of the same paragraph that made clear that FB needs the license to enable service delivery, not to claim of the content. The modified TOS stood the original deal on its head. The FB folks figured that out. That — not “the party of the first part” — was the reason for the protest. I also happen to disagree that the “P2P” privacy violations are significant. As I’ve written elsewhere, with FB it’s all in the defaults. Throw a switch and it impacts the rights of millions of users. Cheers, Marc.
February 18th, 2009 at 7:27 pm (#)
No one expects Facebook to be run by anyone other than its management and private owners [...] but if the communities there are truly to flourish, perhaps it’s time to experiment with forms of self-governance.
You’re proposing a solution in search of a problem. According to your post, FB has 175,000,000 registered users. How many of those people actually would have deleted their accounts rather than submit to the new ToS? Sure, FB upset the people who make a living by paying attention to these things, and there were a bunch of people on Digg getting all pissy about it, but so what? I saw a report yesterday that the ToS protest group picked up about 10,000 FB members in the first day. Should FB really be concerned that 0.00057% of their userbase and a bunch of smarty-pants internet policy wonks objected to the new terms?
The value of the site is in its users- but that value inures entirely to the site’s owners. As long as the owners don’t drive away significant portions of their user base, they don’t have anything to worry about… and given the switching cost, where are 175 million people going to go?
February 18th, 2009 at 8:20 pm (#)
[...] For a full discussion of this issue by Jonathan Zittrain, see this post on his blog. [...]
February 18th, 2009 at 9:31 pm (#)
I can only applaud a law professor who openy whishes for more plainspeak. I would personally prefer (CC)-style pictograms — but everybody always neglects the illiterate Facebook users.
Thank you even more for pointing out that, once again, Facebook and its bunch of nerdy Californians are not the culprit: if they want anything stalky, they probably know where to find far savvier then my party plans. I have yet to come across an issue with Facebook that isn’t instantly resolved by a little honnesty and integreity towards either a close relative a significant other or your boss — and neither deserve anyless, with or without Internet.
What they *are* about to be guilty of, however, is re-shaping social relations by trying to make explicitely coherent the contradictions that Mark Z. indicated in his post. I can imagine only mostly cumbersome standards and little possible generativity out of there — and I’m afraid that the main thing I’m neglecting is Facebook’s employee ethnocentism.
February 19th, 2009 at 3:41 pm (#)
[...] Jonathan Zittrain has a nice post looking at longer-term implications of this particular storm, now that it has passed. Like me, JZ [...]
February 20th, 2009 at 12:20 am (#)
I just can’t believe they went back on their TOS change. People are dumb if they think they are getting any privacy from Facebook or Myspace. All they are doing is voluntarily supplying valuable info to huge marketing mills. Although there are ways to communicate with privacy: anonymous sites like http://www.anonboard.com
February 20th, 2009 at 6:33 am (#)
It seems fascinating that the “great evil” that is DRM suddenly becomes desirable in this context. The user wants to be able to upload their data and yet retain control over who can copy it, when they can “un-upload” it, and so on. Maybe DRM isn’t so bad after all: it’s just a case of who’s got the rights and who’s doing the management.
February 20th, 2009 at 8:07 am (#)
The post makes several points, the second of which seems most salient and which I almost entirely agree with (see my related post, written in ignorance of this one). I’m not certain that we need to analogize FB or similar things to a country, but governance is clearly the issue.
Marc is right that defaults are key, but that doesn’t mean that P2P privacy problems are (relatively) unimportant. P2P defaults matter, too. This case just didn’t happen to present that question.
February 20th, 2009 at 6:15 pm (#)
Should we compare Facebook’s TOS to other similar SNSs to see on how Facebook would have been wider effects?
Shall we compare it to Myspace, Xanga, Bebo, Twitter, Fliker and who else?
- MySpace : users’ ownership but licence to Myspace for distributing etc… unless marked ‘private’ , After will cease distribution as soon as practicable,
“6. Proprietary Rights in Content on MySpace.
6.1 MySpace does not claim any ownership rights in the text, files, images, photos, video, sounds, musical works, works of authorship, applications, or any other materials (collectively, “Content”) that you post on or through the MySpace Services. After posting your Content to the MySpace Services, you continue to retain any such rights that you may have in your Content, subject to the limited license herein. By displaying or publishing (“posting”) any Content on or through the MySpace Services, you hereby grant to MySpace a limited license to use, modify, delete from, add to, publicly perform, publicly display, reproduce, and distribute such Content solely on or through the MySpace Services, including without limitation distributing part or all of the MySpace Website in any media formats and through any media channels, except Content marked “private” will not be distributed outside the MySpace Website. This limited license does not grant MySpace the right to sell or otherwise distribute your Content outside of the MySpace Services. After you remove your Content from the MySpace Website we will cease distribution as soon as practicable, and at such time when distribution ceases, the license will terminate. If after we have distributed your Content outside the MySpace Website you change the Content’s privacy setting to “private,” we will cease distribution of such “private” Content outside the MySpace Website as soon as practicable after you make the change.
6.2 The license you grant to MySpace is non-exclusive (meaning you are free to license your Content to anyone else in addition to MySpace), fully-paid and royalty-free (meaning that MySpace is not required to pay you for the use on the MySpace Services of the Content that you post), sublicensable (so that MySpace is able to use its affiliates, subcontractors and other partners such as Internet content delivery networks and wireless carriers to provide the MySpace Services), and worldwide (because the Internet and the MySpace Services are global in reach).
………
6.4
…MySpace hereby grants you a limited, revocable, nonsublicensable license to reproduce and display the MySpace Content …”
…
– Xanga : Ownership of the content provider + temporary licence , content license ‘shall expire either immediately or upon termination of any promotional or marketing activities ongoing at the time’
“CONTENT SUBMITTED TO XANGA.COM
(This section refers to Content that you create)
You retain all ownership rights to your Content. Except for its ownership of the collection of all content on Xanga, as described below, Xanga does not claim ownership of any Content you publish in your area of the Website (�Your Xanga Site�).
When you publish your Content on Xanga, you grant Xanga a temporary license to �rebroadcast� it. ….
By publishing Content on Your Xanga Site you grant Xanga a world-wide, royalty-free, and non-exclusive license to reproduce, modify, distribute, transmit, publicly perform and publicly display the Content (as well as permit others – including without limitation Xanga�s co-brand, content and syndication partners – to do the same) solely for the following purposes:
* Displaying, distributing and promoting Your Xanga Site
* Promoting and marketing Xanga�s products and services and general operation of the Xanga Service
* Promoting and marketing the products and services of Xanga�s partners and affiliates
* Promoting and marketing products and services related to your Content.
This license exists only for as long as the Content remains published on Your Xanga Site and only for as long you remain a Xanga member, except that you grant Xanga a continuing perpetual license and right to maintain a copy of your Xanga Site and Content for archival purposes. This archival copy is not posted publicly on the Xanga system; it is maintained solely so that Xanga may recover content and restore accounts (in case of errors or system failure) or cooperate with law enforcement in order to make the Xanga service safer. Except for this license for archival use, in the event that you remove the Content from Your Xanga Site or in the event that your membership is terminated, this license shall expire either immediately or upon termination of any promotional or marketing activities ongoing at the time.
COPYRIGHT
Content created by Xanga or its suppliers
All content created by Xanga, its partners, or its suppliers and included on Xanga, such as text, logos, graphics, images, javascript code, HTML code, and other software, is the property of Xanga, Inc. (or its partners or suppliers) and protected by U.S. and international copyright and other intellectual property laws.
Compilations of Content
Notwithstanding the provisions outlined in �Content submitted to Xanga.com� above*, the collection of all Content on this site is a collective work under the U.S. copyright laws and is the exclusive property of Xanga and protected by U.S. and international copyright laws. The Content and software on Xanga may be used as a homepage creation or web-surfing resource. Any other use, including the reproduction, modification, distribution, transmission, republication, display, or performance, of the Content on Xanga is strictly prohibited.
*Individual Contributors retain all ownership rights to their Content. Xanga does not claim ownership of any Content you publish on Your Xanga Site.”
……..
- BEBO : no ownership claimed + limited license clearly defines the after contract termination
“Proprietary Rights
Bebo does not claim any ownership rights in any Materials that you submit, post, or display on or through the Bebo Service. ……
you hereby grant to Bebo and its agents and assigns a limited license to use, modify, publicly perform, publicly display, reproduce, and distribute such Materials solely in connection with the Bebo Service or the promotion thereof.
…
This license will terminate at the time you remove your Materials from the Bebo Service, except that you agree that the license will continue solely with respect to other Members’ continued use of your Materials that are not music or videos (i.e. photos or skins); provided, however if you remove any of the Materials from the Bebo Service, Bebo reserves the right to remove all of your Materials from other Member’s pages. The license does not grant Bebo the right to sell your Materials You represent and warrant that: (i) you own the Materials posted by you on or through the Bebo Service or otherwise have the right to grant the license set forth in this section, and (ii) the posting of your Materials on or through the Bebo Service does not violate the privacy rights, publicity rights, copyrights, contract rights or any other rights of any person. You agree to pay for all royalties, fees, and any other monies owing any person by reason of any Materials posted by you to or through the Bebo Service. The hosting of certain items that you post, such as video, may require your agreement to a separate license agreement or terms of use.
Bebo, Inc. and its affiliates and licensors own and retain all rights in the Bebo Web site and Bebo Service, which contain proprietary and confidential information that is protected by applicable intellectual property and other laws, …..
We take your privacy very seriously and collection and use of personal information is governed by our Privacy Policy. Click here to review the Bebo Privacy Policy.
Information collected in connection with your use of the Bebo Service may be processed and stored in the United States, or other countries where Bebo or its parent, affiliates, subsidiaries or service providers maintain facilities. If you live outside the United States and use Bebo, you expressly consent to the transfer to the United States of the personal information you provide Bebo, or such other countries as we may disclose from time to time. Additionally, you agree that we may use your Bebo user name to authenticate you on any service provided by Bebo or its affiliates.”
- TWITTER no ownership claimed + promise that all removed after at anytime
“Copyright (What’s Yours is Yours)
1. We claim no intellectual property rights over the material you provide to the Twitter service. Your profile and materials uploaded remain yours. You can remove your profile at any time by deleting your account. This will also remove any text and images you have stored in the system.
2. We encourage users to contribute their creations to the public domain or consider progressive licensing terms.
3…….”
All these examples shows how a free service accept little liability, the service take no any liability to maintain and could disappear or be swallow at any time.
February 20th, 2009 at 8:42 pm (#)
I think the switch by Facebook is just an extension of the current governmental information grab. Sure, they changed their policy back, but for how long and will they announce it the next time. They still have the clause about changing without notification.
March 1st, 2009 at 5:33 am (#)
[...] Facebook’s privacy storm :: The Future of the Internet — And How to Stop It [...]
April 21st, 2009 at 6:42 am (#)
[...] founder, Mark Zuckerberg, responded quickly – in plainspeak rather than legalese – and I credit his view that the changes in terms of service really weren’t meant to be a stealthy way of doing [...]