FACEBOOK PRIVACY CASE STUDY

O
ver the course of less than a decade, Facebook has morphed from a small, niche
networking site for mostly Ivy League college students into a publicly traded
company with a market worth of $148 billion in 2014 (up from $59 billion in 2013).
Facebook boasts that it is free to join and always will be, so where’s the money coming
from to service 1 billion worldwide subscribers? Just like its fellow tech titan and rival
Google, Facebook’s revenue comes almost entirely from advertising. Facebook does not
have a diverse array of hot new gadgets, a countrywide network of brick-and-mortar
retail outlets, or a full inventory of software for sale; instead, it has your personal infor-
mation,
and the information of hundreds of millions of others with Facebook accounts.

Advertisers have long understood the expected to

value of Facebook’s unprecedented trove
of personal information. They can serve
ads using highly specific details, like
relationship status, location, employment
status, favorite books, movies, or TV
shows, and a host of other categories.
For example, an Atlanta woman who
posts that she has become engaged might
be offered an ad for a wedding
photographer on her Facebook page.
When advertisements are served to finely
targeted subsets of users, the response is
much more successful than traditional
types of advertising.

A growing number of companies both

big and small have taken notice: In 2014,
Facebook generated $7.8 billion in
revenue, 88 percent of which ($7 billion)
was from selling ads, and the remainder
from selling games, and virtual goods.
Facebook’s ad revenues

in 2012 grew by 63 percent over the

previous year, driven mostly by adding
new users. Existing users are not clicking
on more ads.

That was good news for Facebook,

which launched its IPO (initial public
stock offering) in May 2012, and is
1
continue to increase its revenue in
coming years. But is it good news for
you, the Facebook user? More than ever,
companies like Facebook and Google,
which made approximately $55 billion
in advertising revenue in 2013, are using
your online activity to develop a
frighteningly accu- rate picture of your
life. Facebook’s goal is to serve
advertisements that are more relevant to
you than anywhere else on the Web, but
the personal informa- tion they gather
about you both with and without your
consent can also be used against you in
other ways.

Facebook has a diverse array of

compelling and useful features.
Facebook’s partnership with the
Department of Labor helps to connect
job seek- ers and employers; Facebook
has helped families find lost pets after
natural disasters, such as when
tornadoes hit the Midwest in 2012;
Facebook allows active-duty soldiers to
stay in touch with their fami- lies; it
gives smaller companies a chance to
further their e- commerce efforts and
larger companies a chance to solidify
their brands; and, perhaps most
obviously, Facebook allows you to
more easily keep in touch with

2
Part One Organizations, Management, and the Networked Enterprise

your friends. These are the reasons why on this knowledge. Law enforcement
so many people are on Facebook agencies use social networks to gather
evidence on tax evaders, and other
However, Facebook’s goal is to get its criminals; employers use social networks
users to share as much data as possible, to make decisions about prospective
because the more Facebook knows about candidates for jobs; and data aggregators
you, the more accurately it can serve are gathering as much information about
relevant advertisements to you. you as they can sell to the highest bidder.
Facebook CEO Mark Zuckerberg often
says that people want the world to be In a recent study, Consumer Reports
more open found that of 150 million Americans on
and connected. It’s unclear whether that Facebook everyday, at least 4.8 million
is truly the case, but it is certainly true are willingly sharing information that
that Facebook wants the world to be could be used against them in some way.
more open and connected, because it That includes plans to travel on a
stands to make more money in that particular day, which burglars could use
world. Critics of Facebook are concerned to time robberies, or Liking a page about
that the existence of a repository of per- a particular health condition or treatment,
sonal data of the size that Facebook has which insurers could use to deny
amassed requires protections and privacy coverage. Thirteen million users have
controls that extend far beyond those that never adjusted Facebook’s privacy
Facebook currently offers. controls, which allow friends using
Facebook applica- tions to unwittingly
Facebook wanting to make more money transfer your data to a third party without
is not a bad thing, but the company has a your knowledge. Credit card companies
checkered past of privacy violations and and other similar organizations have
missteps that raise doubts about whether begun engaging in “weblining”, taken
it should be responsible for the personal from the phrase redlining, by alter- ing
data of hundreds of millions of people. their treatment of you based on the
There are no laws in the United States actions of other people with profiles
that give consumers the right to know similar to yours.
what data companies like Facebook have
compiled. You can challenge Ninety-three percent of people polled
information in credit reports, but you believe that Internet companies should
can’t even see what data Facebook has be forced to ask for permission before
gathered about you, let alone try to using your personal informa- tion, and 72
change it. It’s different in Europe: you percent want the ability to opt out of
can request Facebook to turn over a online tracking. Why, then, do so many
report of all the information it has about people share sensitive details of their life
you. More than ever, your every move, on Facebook? Often it’s because users do
every click, on social networks is being not realize that their data are being
used by outside entities to assess your
collected and transmitted in this way. A
inter- ests, and behavior, and then pitch
you an ad based

3
Facebook user’s friends are not notified then repeatedly allowing it to be shared
if information about them is collected by and made public. Facebook agreed to
that user’s applications. Many of obtain user consent before making any
Facebook’s features and services are change to that user’s privacy preferences,
enabled by default when they are and to sub- mit to bi-annual privacy
launched without notify- ing users. And audits by an independent firm for the
a study by Siegel+Gale found that next 20 years. Privacy advocate groups
Facebook’s privacy policy is more like the Electronic Privacy Information
difficult to comprehend than government Center
notices or typical bank credit card
agreements, which are notoriously dense. (EPIC) want Facebook to restore its
Next time you visit Facebook, click on more robust pri- vacy settings from 2009,
Privacy Settings, and see if you can as well as to offer complete access to all
understand your options. data it keeps about its users. Facebook
has also come under fire from EPIC for
Facebook’s value and growth potential is collecting information about users who
deter- mined by how effectively it can are not even logged into Facebook or
leverage the per- sonal data it aggregated may not even have accounts on
about its users to attract advertisers. Facebook. Facebook keeps track of
Facebook also stands to gain from man- activity on other sites that have Like
aging and avoiding the privacy concerns buttons or “recommendations” widgets,
raised by its users and government and records the time of your visit and
regulators. For Facebook users that value your IP address when you visit a site
the privacy of their personal data, this with those features, regardless of
situation appears grim. But there are whether or not you click on them.
some signs that Facebook might become
more responsible with its data collection While U.S. Facebook users have little
processes, whether by its own volition or recourse to access data that Facebook has
because it is forced to do so. As a collected on them, users from other
publicly traded company, Facebook now countries have made inroads in this
invites more scrutiny from investors and regard. An Austrian law student was able
regulators because, unlike in the past, to get a full copy of his personal
their balance sheets, assets, and financial information from Facebook’s Dublin
reporting documents are readily available. office, due to the more stringent
consumer privacy protections in Ireland.
In August 2012, Facebook settled a The full document was 1,222 pages long
lawsuit with the FTC in which they were and covered three years of activity on the
barred from misrepre- senting the site, including deleted Wall posts and
privacy or security of users’ personal messages with sensitive personal
information. Facebook was charged with informa- tion and deleted e-mail
deceiving its users by telling them they addresses. In Europe, 40,000 Facebook
could keep their infor- mation on users have already requested their data,
Facebook private, but and European law requires that Facebook
respond to these requests within 40 days.

4
Part One Organizations, Management, and the Networked Enterprise

It isn’t just text-based data that Facebook many law- suits, attempted settlements,
is stock- piling, either. Facebook is also and criticism from pri- vacy groups, the
compiling a biometric database of FTC, and annoyed parents whose
unprecedented size. The company stores children’s photos were being used
more than 60 billion photos on its servers throughout Facebook to sell products. In
and that number grows by 250 million August 2013, Facebook had agreed to a
each day. A recent fea- ture launched by settlement in a class action lawsuit
Facebook called Tag Suggest scans brought by parents of teenagers caught
photographs using facial recognition up in the Facebook information machine.
technology. When Tag Suggest was Every time their children liked a product
launched, it was enabled for many users on Facebook, their photos were used to
without opting in. This database has promote the product not just to their
value to law enforcement and other friends, but to everyone on Facebook
organizations looking to compile profiles who poten- tially might be interested.
of users for use in advertising. EPIC also The legal settlement only enraged
has demanded that Facebook stop privacy advocates and Congress, leading
creating facial recognition profiles to Facebook’s abandonment of
without user consent. Sponsored Stories.
In 2012, as part of the settlement of While Facebook has shut down one of its
another class-action lawsuit, Facebook more egregious privacy-invading
agreed to allow users to opt in to its features, the company’s Data Use
Sponsored Stories service, which serves policies make it very clear that, as a
advertisements in the user’s News condi- tion of using the service, users
Feed that highlight products and grant the company wide latitude in using
businesses that your Facebook friends their information in adver- tising. This
are using. This allowed users to control includes a person’s name, photo, com-
which of their actions on Facebook gen- ments, and other information.
erate advertisements that their friends Facebook’s existing policies make clear
will see. Sponsored Stories are one of the that users are required to grant the
most effective forms of advertising on company wide permission to use their
Facebook because they don’t seem like personal information in advertising as a
advertisements at all to most users. condition of using the service. This
Facebook had previously argued that includes “social advertising” where your
users were giving “implied consent” personal information is broadcast to your
every time they clicked a Like button on friends, and indeed, the entire Facebook
a page. Despite this earlier settle- ment, service if the company sees fit. While
in January 2014, Facebook closed down users can limit some uses, an advanced
its Sponsored Stories feature entirely, degree in Facebook data features is
after required.

5
Despite consumer protests and government scru- tiny, Facebook continues to challenge
its customers’ sense of control over their personal information. In January 2013,
Facebook launched its Graph Search program, a social network search engine intended to
rival Google but based on a totally different approach. Rather than scour the Internet for
information related to a user’s search term, Graph Search responds to user queries with
information produced by all Facebook users on their personal pages, and their friends
per- sonal pages. For instance, Graph Search, without consent of the user, allows any
Facebook user to type in your name, and click the link “Photos of...” which appears
underneath the search bar. Complete strang- ers can find pictures of you. The person
searched may not be able to control who sees personal photos: it depends on the privacy
settings of other users with whom the photos were shared. If you shared your photos with
friends who had less strict privacy set- tings, then those lesser settings determine who will
have access to your photos. Graph Search results in new pages being created that contain
the search results. These pages present Facebook with additional opportunities to sell ads,
and to monetize the activities and information of its users. The future of Facebook as a
private corporation, and its stock price, will depend on its ability to monetize its most
valuable asset: personal, private information.

6
 APPENDIX 1

Facebook Usage
80

70 67
64 63
62 62 61 61
60 58 58
54
51
50

41
40

30

20 18

10 8

0
2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 2021

% Total US Population 12+ Using Facebook