Managing Facebook Privacy Settings (round 2)

On October 26, 2009, I wrote “Managing Facebook Privacy Settings” in response to a reader’s query: “Could ProfHacker do a piece on how to manage Facebook accounts so that I could remember how to keep my privacy settings up to date? I keep losing track of how to shield chat and newsfeed.” In that post, I noted the number of times Facebook has made a significant change to their service, and that you can usually tell when Facebook changes something because a) it will be big news and b) some people will be ticked off about it.

It has happened again, and the response was no different—Facebook once again announced a change to their service, this time asking all 350 million of its users to personalize their privacy settings.

In the previous post on this topic, I said that Facebook does give you the tools to manage the security of your profile. That is still true. However, the extent to which your data is ever secure is now questionable, and the way in which Facebook has gone about the transition to their new security settings is, to put it mildly, frustrating some users.

As Facebook races to get in on real-time search (and Twitterfication), it is pushing its users to participate more openly producing the content that makes real-time search relevant. In other words, Facebook wants your status messages, comments, and conversations to be part of the real-time search, and it has stripped away prior privacy barriers on its way to making privacy defaults the opposite of private.

If you’re not paying attention, your information is now more likely to be consumed by strangers.

If you have logged into Facebook since December 9th, you face the Transition Tool—an interface to the Facebook privacy settings. According to the Facebook press release, “Users will be presented with two options: preserving their old settings or accepting recommendations from Facebook.” For me, the defaults selection for all settings that existed before was “old settings.” I have always kept a close eye on privacy settings and had a custom set of settings that I used. I kept “old settings” for everything, and chose very restrictive settings for anything that was new. At some point I might go back into the Settings and loosen those up.

Many users were confused as to what “old settings” meant in the first place. Apparently if you moused over the radio button in the form, it explained what your old settings were (I didn’t do this because I knew what my old settings were, because I set them). I can see where this would cause confusion if users had never explicitly set privacy settings before (thus “old settings” would have been “old recommendations by Facebook”). If a user had not customized their settings before, the “old settings” option wasn’t the default selection—Facebook recommendations were the default, and that default is now more open than before. Users who have not worked with their privacy settings before, and are not concerned with looking into what the new privacy settings mean (instead, accepting the Facebook recommendations because hey! it’s Facebook! why would they do anything bad to me?) will find their information in further corners of the Internet than before.

While I still hold firm in my belief that you should take an active role in managing your own identity and information online, and if you don’t want the world to see/read something, don’t put it on the Internet in the first place, Facebook is making some pretty bold moves that are bordering on irresponsible. The ever-shifting definitions of “privacy” and “everyone” and changes to the tools and methods used to manage personal information on Facebook are enough to drive people away simply because managing information about Facebook managing your information is too much for people to deal with; is playing MafiaWars and FarmVille worth the hassle?

The security firm Sophos has said “These could be the most important clicks you ever make on Facebook,” and have made a screencast for the benefit of all. It’s an illuminating 4.5 minutes:

Still, for many (many many many) others, these privacy issues are of little concern. It is incredibly troubling for me to know just how few of my own students even know what a privacy setting is, let alone how to use it, or how Facebook uses their information. In the ReadWriteWeb article on this topic, “The Day Has Come: Facebook Pushes People to Go Public,” Facebook spokesman Barry Schnitt is quoted as saying that the privacy changes (to an “open” recommendation) reflects “the way the world is moving.” RWW counters that by asking isn’t Facebook, as the largest social network in the world, the entity that effects these kinds of changes? Sure, if you can get 300 million of the 350 million Facebook users to ignore or blindly accept recommendations for information sharing, the world is going to move that way because that’s a pretty big chunk of the world. That doesn’t make it right.

The Electronic Frontier Foundation has come out with a detailed response to the new Facebook privacy changes, concluding

These new “privacy” changes are clearly intended to push Facebook users to publicly share even more information than before. Even worse, the changes will actually reduce the amount of control that users have over some of their personal data.

Not to say that many of the changes aren’t good for privacy. But other changes are bad, while a few are just plain ugly.

The entire article is an important read; if you’re reading this and therefore are even remotely interested in matters of privacy and Facebook, you should immediately read the EFF commentary, “Facebook’s New Privacy Changes: The Good, The Bad, and The Ugly”. The main points:

• The Good: Simpler Privacy Settings and Per-Post Privacy Options
• The Bad: EFF Doesn’t Recommend Facebook’s “Recommended” Privacy Settings
• The Ugly: Information That You Used to Control Is Now Treated as “Publicly Available,” and You Can’t Opt Out of The “Sharing” of Your Information with Facebook Apps

Chew on the last one for a moment. It’s a doozy.

As I was writing this post, Brian McNely asked on Twitter, “Do the new FB privacy settings mean I can actually see public profiles, walls, and posts without being a member?”

I responded that potentially yes—if a user has elected for openness, the information is shareable and that wall between Facebook member and non-member could crumble just as easily as the wall between Facebook friend and non-friend (in which both are members of Facebook but not friends with each other). I haven’t seen anything that says that real-time information made available to everyone will still be limited by the Facebook login cookie. In fact, the Facebook Privacy Policy is pretty clear on the definition of “everyone”:

“Everyone” Privacy Setting. Information set to “everyone” is publicly available information, may be accessed by everyone on the Internet (including people not logged into Facebook), is subject to indexing by third party search engines, may be associated with you outside of Facebook (such as when you visit other sites on the internet), and may be imported and exported by us and others without privacy limitations. The default privacy setting for certain types of information you post on Facebook is set to “everyone.” You can review and change the default settings in your privacy settings. If you delete “everyone” content that you posted on Facebook, we will remove it from your Facebook profile, but have no control over its use outside of Facebook.

Spend some time considering how you want your information protected, and whether or not you can achieve that level of protection with Facebook. I also recommend spending some time reading the information in “How to Cross-Check Your Facebook Privacy Settings” at the popular (and trustworthy) Digital Inspiration blog.

Good luck to you.

Updated to add: After Criticism, Facebook Tweaks Friends List Privacy Options. Apparently the Facebook beta tester group is 350M large.

[Image at the beginning of this post from Flickr user JPDaigle. Creative Commons license.]