【1996 Archives】

Facebook wants you to know it really does care about your privacy.

So much so that996 ArchivesMonday the company released its list of seven "privacy principles" that are meant to govern how the company deals with its 2 billion users' personal data.

These seven sentences are part of a wider PR offensive the company is pushing ahead of tougher European data protection laws that are set to go into effect this spring.

"These principles guide our work at Facebook," Erin Egan, the company's chief privacy officer, wrote. But read carefully and these supposed guiding principles do little convey anything about how the company actually makes product decisions. And they certainly don't address some of the substantive privacy issues the social network faces.

Here are five of the biggest questions we still have about Facebook's privacy policies.

1. Will users have more control over how their data is used for advertising?

Tellingly, the privacy principles make little mention of the company's multibillion dollar ad business. It only comes up once, under "we help people understand how their data is used," to note that Facebook includes ad controls in each of its ads. But it says nothing about whether it plans to give users more control over how their data is shared with the social network's legions of advertisers in the first place.

Right now, Facebook lets you review your ad settings so you can can view what type of information advertisers use to target you. It also lets you see what "categories" Facebook tells advertisers you fall into (frequent international travelers or people with birthdays in November, for example). And while you can choose to opt out of those categories, Facebook offers few controls for how their data is collected and shared with advertisers in the first place. Furthermore, the settings it does allow users to change are all turned on by default, placing the onus on users to change the settings themselves.

2. Will users be able to opt out of sharing data to other Facebook-owned services?

Similarly, Facebook makes no mention of its policies that allow your data to be shared across other Facebook-owned services, like WhatsApp or Instagram. As the Electronic Frontier Foundation has previously noted, this raises a number of privacy concerns. By integrating Facebook and WhatsApp data, for example, Facebook could learn more about your private communication habits.

3. Will it be easier to delete a Facebook account and its data forever?

Facebook users have complained about the account deletion process for more than a decade. And while the process no longer requires you to email one of its customer service reps, the process is still far from perfect.

Now, Facebook offers an online form to "request" an account deletion. But this form isn't accessible from Facebook's app, which is how the vast majority of people access the service. Furthermore, Facebook says that user data can remain on its servers for up to 90 days after you request a deletion.

4. Will anything actually change?

Facebook has promised a revamped "privacy center" that helpfully puts all the social network's privacy settings in one place. "We’re designing this based on feedback from people, policymakers and privacy experts around the world," Egan writes.

But it's unclear what, if anything, will actually change. Will Facebook turn on more stringent privacy controls (such as those used for ad targeting or facial recognition)? Will there be new privacy settings that let you lock down your data even more? We don't know, because Facebook hasn't said whether it plans to materially change its privacy settings in any way, or if this new privacy center will simply merge all its existing privacy controls into one place.

A Facebook spokesperson says they will have more details "in the coming months," but until then we have little to go on.

5. Would Facebook be making any of these changes, or posting its privacy principles, if not for impending EU regulation?

Facebook is positioning its current data privacy PR blitz as something it's doing for the benefit of users. But the fact remains that even if Facebook makes sweeping changes with its new privacy center, the company didn't take these actions until European Union regulations forced its hand.

And that's just not a good look. Even if Facebook does have a genuine interest in addressing users' concerns about privacy, it shouldn't take the involvement of regulators for the company to share a set of relatively shallow principles like "we are accountable."

“We’re giving people more information on how they can control their data and have the experience they want on Facebook," Deputy Chief Privacy Officer Rob Sherman said in a statement. "We'll keep improving our privacy tools based on what people tell us we can do better."