Another Facebook Exec Talks About Privacy; Another Set of Gross Misunderstandings

In an attempt to stem the rising outrage over its most recent round of privacy failures — Instant Personalization & Connections — Facebook’s vice president for public policy, Elliot Schrage, answered readers questions at The New York Times‘s Bits blog. As with other corporate expressions of Facebook’s approach to privacy, his answers reveal a continued gross misunderstanding of the nature of privacy in our (social) networked world.

Some of Schrage’s prepared remarks are utterly confounding. Lamenting his “professional frustration” over Facebook’s inability to properly communicate with users, he notes that

our extensive efforts to provide users greater control over what and how they share appear to be too confusing for some of our more than 400 million users. (italics mine)

Provide users greater control? Really? Perhaps Schrage has missed the EFF’s powerful (and strikingly simple) summary of how the (de)evolution of Facebook’s privacy policy has resulted in significantly less control granted to FB users. It seems he has also missed this elegant visualization of how Facebook’s default settings have changed over time, exposing more and more of users’ information to more and more people.

Sure, Facebook has created nifty transition tools and a complex array of settings to (purportedly) allow people the means to manage their privacy, but, over time, there has been a net decrease in the levels of user control over their personal information on the social network. Consider the following analysis of his remarks…

::

When asked why Facebook now forces certain personal information to be permanently visible and public, Schrage makes the following remark:

We study user activity. We’ve found that a few fields of information need to be shared to facilitate the kind of experience people come to Facebook to have. That’s why we require the following fields to be public: name, profile photo (if people choose to have one), gender, connections (again, if people choose to make them), and user ID number.

The problem here is that Facebook is reducing the wonderful diversity of 400 million users — each with their own reasons for joining the social network, their own contextual practices of sharing, and their own privacy preferences — into a single archetype, a singular “experience” that apparently everyone comes to Facebook to enjoy.

The notion that because their focus groups show that most like to share a certain way, then it is appropriate for Facebook to make that the default for all is illogical, and puts the privacy of millions at risk. I’ll accept that most indeed make that choice, but it is a choice, and should remain such, so the rest of us can maintain control over our information.

::

Similarly, when asked why our “Connections” are now required to be public links, Schrage responds:

It turns out that less than 20 percent of users had filled out the text fields of this information. By contrast, more than 70 percent of users have ‘liked’ Pages to be connected to these kinds of ideas, experiences and organizations. That is the primary reason we offered the transition — because it reflects the way people are using our service already.

Live above, this logic is flawed. Forcing people to turn their textual indicators of interests and histories — items they had control over who could see — into links to pages that are permanently public does not reflect the way people were using FB already. 20% of people included interests. 80% didn’t. 70% “liked” Pages. 30% didn’t. Of the 70% who did, they probably only decided to “like” certain pages, not all of their interests. Perhaps the reason was to limit the visibility of these “likes”. Perhaps not.

I don’t know the reasons why 70% “like” certain pages, and Facebook doesn’t either. I don’t know how the fact that 70% “like” certain pages can lead us to broader conclusions about people’s desire to make their interests visible, and neither does Facebook. But saying such a significant change is perfectly reasonable because it reflects some estimation of how FB is being used is simply disingenuous, if not dangerous.

::

When asked why certain other profile information is permanently public, and why users have less control over their relative visibility on Facebook, Schrage replied:

Joining Facebook is a conscious choice by vast numbers of people who have stepped forward deliberately and intentionally to connect and share. We study user activity. We’ve found that a few fields of information need to be shared to facilitate the kind of experience people come to Facebook to have. That’s why we require the following fields to be public: name, profile photo (if people choose to have one), gender, connections (again, if people choose to make them), and user ID number. Facebook provides a less satisfying experience for people who choose not to post a photo or make connections with friends or interests. But, other than name and gender, nothing requires them to complete these fields or share information they do not want to share. If you’re not comfortable sharing, don’t.

This is perhaps the most striking example of Facebook’s utter failure to understand how privacy works. I’ll grant that it is easier to find people if this information is public. And I’ll grant that many people will have a “less satisfying experience” if they don’t post photos or make connections. But, again, people used to have that choice. They could choose what to post to their profile and who can access it — they had control.

Now, it is all public. And if you have a problem with that, Facebook’s only response is essentially “don’t share it”.

To Facebook, privacy and control of information is a binary: either you share it with everyone, or you don’t share it at all. There’s no longer any space between these two poles, no way to control how these pieces of personal information are visible.

For a company who keeps insisting they care about user privacy and give people increased control of their information, statements like “If you’re not comfortable sharing, don’t” are astonishing.

::

Finally, when asked why so many of Facebook’s new features that impact user privacy are opt-out instead of opt-in, thus forcing users to participate unless they take action to remove themselves, Schrage had this to say:

Everything is opt-in on Facebook. Participating in the service is a choice. We want people to continue to choose Facebook every day. Adding information — uploading photos or posting status updates or “like” a Page — are also all opt-in. Please don’t share if you’re not comfortable.

*headdesk*

Is it really Facebook’s official position that because people decide to join (opt-in) Facebook, then anything that Facebook later decides to thrust upon its users is also opt-in, simply because of that original choice? Do they really think that essentially saying “it was your decision to be here in the first place” is a suitable argument to justify making significant changes that impact user privacy, and automatically impose them on users unless they take the steps to opt-out?

And how much of an opt-in is something like “Connections”, where if a user decides not to allow a public link to be made from their interests, those interests will disappear altogether?

And what of “Instant Personalization”, where not only is it automatically turned on, it requires multiple steps to completely turn it off. Apparently that is an “opt-in” service, since I opted to join Facebook years ago? Really, Facebook?

::

Schrage’s comments reveal a continued lack of understanding about how users experience and express privacy in our networked society. Users want control. They deserve control. Users are diverse. And Facebook should respect that diversity.

Until I see evidence that Facebook is going to really take user privacy seriously, my future on the platform remains in question.