Electronic Retailer - February 2012 - 14

INDUSTRY REPORTS

FTC Forum

Where the FTC Says Facebook Went Wrong
BY LESLEY FAIR It’s no surprise the FTC’s proposed privacy settlement with Facebook has attracted industry attention. The terms of a particular order apply only to the company in question, of course. But savvy retailers use FTC cases as compliance checklists to help them stay off the law enforcement radar screen. Where did Facebook go wrong, and what tips can your business take from the case? The FTC’s complaint charges eight separate violations of the law. According to the FTC, Facebook falsely promised that people could restrict their information to a limited audience, but then went ahead and shared it with users’ friends’ apps. In addition, the FTC says that when Facebook changed its privacy practices in December 2009, it overrode users’ existing privacy choices in a way that was both deceptive and unfair. What’s more, says the FTC, Facebook deceived people about how much of their information was shared with apps they used. What about Facebook’s promise that “We don’t share your information with advertisers unless you tell us to”? The FTC says that in many instances, Facebook shared with advertisers the user ID of people who clicked on ads. The complaint also charges that before awarding apps the company’s “Verified App” seal, Facebook promised to put them through a “detailed review process.” But according to the FTC, Facebook really didn’t do anything different to check out the security of those apps. The FTC also says Facebook made deceptive claims about its photo and video deletion policy. “When you delete an account, it is permanently deleted from Facebook,” the company claimed. But even after users followed Facebook’s procedure for deactivating or deleting an account, Facebook still served up their photos and videos to anyone who accessed them via the content URL.

According to the FTC, Facebook falsely promised that people could restrict their information to a limited audience, but then went ahead and shared it with users’ friends’ apps.

Electronic retailers who do business in Europe understand the significance of Facebook’s promise that it complied with U.S.-EU Safe Harbor Framework, a mechanism by which American companies can transfer data consistent with European law. But according to the FTC, Facebook’s pledge wasn’t truthful. What does the future look like for Facebook’s privacy practices? The order includes a broad ban on deception and a violation kicks in substantial financial penalties. Furthermore, when Facebook offers privacy settings on its site, it has to honor them. What if Facebook wants to share certain broad classes of information in a way that exceeds the privacy settings a user has already chosen? Facebook will have to clearly and prominently disclose what it wants to do and then get each user’s affirmative express consent. What about just changing the privacy policy? No dice. That’s not “clear and prominent” under the order. The company also has agreed to a comprehensive overhaul of its privacy practices, including regular audits by independent outsiders for the next 20 years. The program has to address privacy risks posed by existing products and new ones that right now are just a fleeting thought in a Facebook developer’s imagination. To ensure compliance, the order imposes strict monitoring and reporting requirements. Looking for tips to help keep your company on the right side of the law? Visit the Privacy & Security portal at business.ftc.gov. Lesley Fair is an attorney with the FTC’s Bureau of Consumer Protection.

electronicRETAILER | February 2012

Electronic Retailer - February 2012

Table of Contents for the Digital Edition of Electronic Retailer - February 2012