danah boyd puts a lot of personal information about herself online, and has been known to criticise the Facebook privacy policy. (To be fair, I don’t know whether she has refused to use Facebook on this basis, but I don’t think this changes the underlying point.)

She personally elects to lead a public life. How does that invalidate her criticism that Facebook makes it difficult to elect whether or not one wants to do so? What is the underlying point that could be changed?

I doubt that not-Prince-anymore is someone to whom you have ever [...] had any semblance of interaction with.

I was going to say that, if I was such a person, I wouldn’t call him by his stage name. I would call him by his real first name which is… then I looked it up and was surprised to find his real first name is Prince. I didn’t know that.

Well if it’s a strawman, it’s one you provided. danah boyd puts a lot of personal information about herself online, and has been known to criticise the Facebook privacy policy.

Fair point. Not a strawman.

(To be fair, I don’t know whether she has refused to use Facebook on this basis, but I don’t think this changes the underlying point.)

At the time of writing, she has 291 friends. Have I just committed a horrible invasion of privacy??

It’s not a question of trust; it’s a question of capability.

I see. So Good Reason 18: You don’t want to include any personal information, because the Facebook authorisation model is not strong enough to control it to your desired levels.

When it comes to ANY sharing of information, or ANY tracking of a user’s habits, the practice is supposed to WITH AGREED CONSENT.

I guess I agree that that is how it should be. Part of the sign up is agreeing that you have read and agree to the Facebook privacy policy.

In response to your urgings, I read it (again?). If anything, it was more restrictive on Facebook than I had previously thought.

you are given a few vague option switches [...] which don’t all work the way you would expect.

Do you mean they are confusing (as discussed by danah boyd) or that they work differently to what the instructions and privacy statements claim?

There’s also an option to supposedly stop “your information from being shared”, yet the cookies, etc. are still planted by every 3rd party connected to every page you load

I don’t see any option claiming to prevent cookies.

The policy says:

These third party advertisers may also download cookies to your computer, or use other technologies such as JavaScript and “web beacons” (also known as “1×1 gifs”) to measure the effectiveness of their ads and to personalize advertising content. [...] Facebook does not have access to or control of the cookies that may be placed by the third party advertisers.

As I touched on in a previous comment, the use of web beacons to track you around the web is a general web phenomena, not a Facebook one. If you spend your Facebook-free time visiting other web-sites, the same tracking is happening.

That’s wrong, according to my privacy selections,

As above, I am interested which Facebook privacy selection claims to affect cookies.

according to laws in effect in Canada and the US

I suspect the privacy laws in Canada have no effect here. Facebook insist on a Californian jurisdiction.

I’ve recorded the [Cookie] activity, as have a number of others (Google’s your friend).

Do you mean the same Google who now own DoubleClick? Forget Facebook! If you are worried about tracking and cookies, there’s a company whose stringent privacy policies we are deperately relying on!

among these cookies, I still find the Beacon one, though I completely opted out of that one.

Facebook’s position on this (after controversy, protests and mis-information from one of their VPs) is that the Beacon information they receive is deleted if you haven’t opted in. [Ref]

(I believe the protests were less focussed on Facebook collecting the data, and more focussed on Facebook publishing the data within Facebook.)

I don’t know where you’re going with the “fee” thing.
If you’re saying that the sharing of personal info and/or activities is supposed to be an accepted “exchange in lieu of” a fee that’s not being paid (as it’s “free”), sorry, wrong… go to the first answer.

If that’s what you mean by the “fee”, then I think the “cost” would be “too high”, as it would mean I am supposed to forfeit a basic legal right in order to participate. Such a “term” was NOT outlined in Facebook’s policies when I joined.

Your assessment of my fee analogy was spot on. I was describing the suffering through targeted adverts and web-tracking as the unofficial/implied price I pay for the amusement provided by Facebook. I am not sure the lawyers would view it as a formal contract, but there is an exchange here of my attention for my amusement.

Privacy laws vary from jurisdiction to jurisdiction, but I am unaware of any in which web-tracking violates them. I very much doubt it violates California law, although IANACL. As for the Facebook policies, I am still missing where they are being exceeded.

To badly mutilate an old saying, I guess I am willing to give up what you consider an essential liberty to purchase a little temporary fun. I think the interesting question here is “Why should I consider privacy against web-tracking an essential liberty?”

Perhaps something changed since, but that wasn’t “renegotiated” with those who joined prior.

When did you join Facebook? We can use the Wayback Machine to look at its Privacy Policy then.

Point #1: UNSUPERVISED third-party uploads are allowed to ALL USERS.

True, but only through the normal web mechanisms (i.e. there is no Facebook ActiveX object quietly pushing unsupervised software onto your machine. It all goes through the standard browser protection mechanism.)

This comes back to Facebook’s third-party partners being no better or worse than the other parts of the web you might visit instead of it.

[...] pervasive tracking cookies.
When a user is being tracked for all their activity, whether logged in or not, that’s pervasive.

Pervasive tracking cookies sound like the same concept as web beacons. They only work when multiple web-sites co-operate (collude?) to share images/ads/whatever from the same domain. That’s one reason for DoubleClick and Google Adsense making some people a little nervous.

But, once multiple web-sites have decided to co-operate, you are already lost your essential (?) liberty. Your web usage can be tracked moderately well by IP address and User Agent, even without cookies.

Is Facebook worse than the rest of the web?

When such a cookie is placed in a folder you can’t block (because that folder is necessary to in order use the site), that forces the user to make the choice to participate or remove the account.

That seems a reasonable choice to me.

One day, a third party will dump that cookie that leads to a malware download

You lost me here. I can’t see how a cookie can lead to malware. In any case, I still claim Facebook is not worse than the rest of the web.

Anyway, this reply is getting waaay to long. (Sorry!)

Not at all. I found it very interesting, and I appreciate you sharing your views.

They have certainly got me wondering when I (someone who declines to use shopping loyalty cards, who worries about his bank’s knowledge of his credit card purchases and who skips TV ads with a video-recorder) suddenly became an apologist for the Great Marketing Machine!

I found the moniker “the dickhead formerly known as Prince” to be the most convenient.

I doubt that not-Prince-anymore is someone to whom you have ever directly addressed any utterance (in the comment section of his weblog, say), or have otherwise have had any semblance of interaction with. So that would certainly work for you.

The first is a question of whether this is a strawman. The people who decline Facebook for privacy reasons may also decline to put any similar personal information up on any web-site.

Well if it’s a strawman, it’s one you provided. danah boyd puts a lot of personal information about herself online, and has been known to criticise the Facebook privacy policy. (To be fair, I don’t know whether she has refused to use Facebook on this basis, but I don’t think this changes the underlying point.)

The second is a minor technicality about “harvestability”. I may share my mobile phone number on a For Sale sign on a public noticeboard, but not make it available on Facebook. Similarly, I may make my email address available via EmailShroud but not in clear text.

Right, and that goes to my subsequent point about personal information often being somewhere between the extremes of 100% public and 100% private.

I think this is subsumed by item 17 again.

No it isn’t.

Let’s say I have the set of all my personal information, I. And the set of all the people in the world, P. My privacy requirements can be considered as a subset of P for each item in I. The question is: can I represent these requirements using the site? Does it have the resolution to define the required subsets of P? Can access to my information be granted based on these subsets?

It’s not a question of trust; it’s a question of capability.

(ME) “Facebook still, probably more than ever, allows third parties to track you,”

(YOU) “Agreed. That (along with putting up with adverts) is the fee you pay for membership.”

Wrong.
When it comes to ANY sharing of information, or ANY tracking of a user’s habits, the practice is supposed to WITH AGREED CONSENT.

In Facebook’s case, you are given a few vague option switches to opt out of “Beacon” and “Other apps…”, which don’t all work the way you would expect.

There’s also an option to supposedly stop “your information from being shared”, yet the cookies, etc. are still planted by every 3rd party connected to every page you load, and they remain active as long as they’re on your computer, logged in or not. That’s wrong, according to my privacy selections, and according to laws in effect in Canada and the US.

I’ve even contacted Facebook directly and stated, unequivocally, that I have never agreed to this activity, and they are to stop allowing this. All I get back are boilerplate, unrelated replies. If I don’t delete the cookies, they’re at work. I’ve recorded the activity, as have a number of others (Google’s your friend).

And, among these cookies, I still find the Beacon one, though I completely opted out of that one. This is just a blatant example of a site saying one thing (“We care about your privacy, blah, blah…”) and just doing something else.

(YOU) “My question for you is: Can you give a concrete example where that fee is too high?”

I don’t know where you’re going with the “fee” thing.
If you’re saying that the sharing of personal info and/or activities is supposed to be an accepted “exchange in lieu of” a fee that’s not being paid (as it’s “free”), sorry, wrong… go to the first answer.

If that’s what you mean by the “fee”, then I think the “cost” would be “too high”, as it would mean I am supposed to forfeit a basic legal right in order to participate. Such a “term” was NOT outlined in Facebook’s policies when I joined.

(ME) “Facebook doesn’t feel there’s anything wrong with sharing the information with marketers, etc., even after informing them directly you haven’t consented.

(YOU) “…part of signing up with FaceBook is agreeing to having the information you provide being shared with marketers. The Great Marketing Machine is sponsoring your fun….”

My point above was, I DIDN’T have to agree when I joined. Perhaps something changed since, but that wasn’t “renegotiated” with those who joined prior.

I also said I had informed them directly they didn’t have my consent, to no avail. Question of “harmless display of honour” vs. “petty intent”, maybe? And, we’re all supposed to have the right, in Canada and the US, to directly ask them to stop.

(YOU) “What I am looking for is concrete examples of suffering or potential suffering caused.”

As far as “suffering” goes, I haven’t put myself in that position in the first place, so I won’t be giving you personal examples. However, having said that…

(ME) “Facebook allows 3rd parties to upload things DIRECTLY to YOUR computer…”

(YOU) Please explain what you mean by this. Do you mean malicious software or merely cookies?

Point #1: UNSUPERVISED third-party uploads are allowed to ALL USERS. THAT was the actual point, NOT necessarily what is being sent. Who’s to say what (has been / is being / will be) sent by any of these at any time. The fact is, the door has been left open for abuse. I don’t know of too many reputable sites that DON’T screen this activity.

Point #2: You divide this into malware and “merely” cookies. You need to remember there are more than one cookie design.

Most are innocent, and meant for simple “user recognition” and save having to always retype the same things. Such cookies are, of course, no threat and now have wide acceptance. There is the issue of these cookies being searched and hacked by others for log-in info or accounts, etc., but I consider that threat as a user responsibility.

Then there are tracking cookies.
Some are harmless, as they are only for tracking a user’s activity on the site itself. Such cookies are inactive when logged off.

Some tracking cookies track all your activity, until you leave the site.

Then there are pervasive tracking cookies.
When a user is being tracked for all their activity, whether logged in or not, that’s pervasive. Also…

When such a cookie is placed in a folder you can’t block (because that folder is necessary to in order use the site), that forces the user to make the choice to participate or remove the account.

The above 2 paragraphs describe Facebook third party tracking cookies at the present time. A year ago, that wasn’t the case.

Regardless of what cookie design we talk about, we also have the issue of WHO gets to upload them to you. Most sites like to do that themselves, both their own cookies and those of their partners. My understanding is this is simply a basic security protocol.

(YOU) “I thought paranoia over cookies had settled down over the last decade. Note: This blog also uses cookies.”

“Paranoia” is the act of being unjustly afraid.
That is certainly the wrong word for me. I’ve been very involved in computers since their inception, and my work (and life, sometimes) is still built around them. Knowing what’s “out there” and the reasons to be concerned is being SMART, not paranoid.

I’m not the least bit concerned over the cookies you use, as they are what they should be. (I always have a look at these things whenever I use any new site.) The ones I get from Facebook, are not.

All the failed attempts to get honest, straight answers from FB about that, coupled with their complacency in allowing 3rd parties direct access to my drive, does concern me.

It’s not always “intent” that is cause for worry.
Sometimes, you need to examine the “behaviour” and “attitude” that lead up to the intent. Facebook’s behaviour has not demonstrated the “intentions” they continually say they have.

Fair is fair. There are countless people who will knowingly share the info the marketers are looking for. It’s not necessary for EVERYONE to participate, whether they like it or not. That’s not good PR. Making such a thing completely voluntary would also yield more reliable data on their side.

I will be removing my Facebook profile soon, for these reasons, and others. The only reason I’ve kept my FB profile active is to be able to witness when the inevitable happens: One day, a third party will dump that cookie that leads to a malware download – all in the name of “better targeting” sales.

When this happens, I’m willing to wager that FB will try (again) to fall back on “posted policies” to escape blame. Either way, I will not be part of the collateral damage.

Anyway, this reply is getting waaay to long. (Sorry!)

The privacy guarantees on Facebook are necessarily better than those provided on the Internet at large (ie none). Which makes it hard to understand why anyone would refuse to use Facebook on the basis of inadequate privacy protection, but then post personal information on a public website.

I have two responses to this.

The first is a question of whether this is a strawman. The people who decline Facebook for privacy reasons may also decline to put any similar personal information up on any web-site.

The second is a minor technicality about “harvestability”. I may share my mobile phone number on a For Sale sign on a public noticeboard, but not make it available on Facebook. Similarly, I may make my email address available via EmailShroud but not in clear text.

Of course the thing about personal information is that it’s not easy to separate into public and private; there are many intermediate positions between the two extremes. For example: I am quite happy to post pictures of my children online, as long as only my friends can see them.

After Devil Advocate’s point, that should read: as long as only my friends and marketers can see them.

Being undecided is a good reason not to post personal information online at Facebook or any other site for that matter.

Agreed, but I am decided that my name and friend information is not private, so I can enjoy Facebook. I am undecided about how private my religious views are, so I haven’t posted that.

In other words Julian’s Good Reason in comment #2 above assumes that the site in question can in fact make the desired guarantees on access of personal information.

I think this is subsumed by item 17 again.

Julian, you’re being facetious with that “good reason,” aren’t you.

Only a little. It was worse before I toned it down.

“Facebook systematically imposes extra effort on users wanting to ensure that information is not inappropriately shared, which makes me disinclined to enter the information in the first place. But an empty profile is pointless to begin with, so why bother?”

I would argue that a profile with no sensitive personal info still has social networking value. If you consider who your acquaintances are as being sensitive, then I retract that claim, but am interested in your reasons.

“Facebook has a track record of disrespecting users’ privacy as a company, so I’m disinclined to give them any information at all.”

Sounds like a good reason, but I think that is similar enough to item 17 to be covered.

As for danah boyd’s preferences about the capitalisation of her name

Here’s her take on it.

When Prince changed his stage name to something awkward, I didn’t feel the need to respect that; I found the moniker “the dickhead formerly known as Prince” to be the most convenient.

I am still in two minds about DB. Mainly, I don’t think she warrants a whole entry in my style guide. On the other hand, I have no problem with “van der Bilt”, for example.

Devil’s Advocate warns:

That only fixes the problem of who, LOGGED ON TO FACEBOOK, has access to components of your account. What it doesn’t fix is the fact that your information is STILL SHARED.

Agreed, and that is an important point. It is one thing to protect your privacy from your enemies and random members of the public. It is another to protect your privacy from random developers. As someone who has written exactly one Facebook application with exactly one user, I know there is little vetting involved.

However, Facebook’s changes do go some way towards addressing the issue that danah boyd raised.

Facebook still, probably more than ever, allows third parties to track you,

Agreed. That (along with putting up with adverts) is the fee you pay for membership. My question for you is: Can you give a concrete example where that fee is too high?

upload things DIRECTLY to YOUR computer

Please explain what you mean by this. Do you mean malicious software or merely cookies?

If you are concerned about the former, FaceBook is no worse than the rest of the web – the same precautions are required as you should take when visiting this blog.

If you are concerned about the cookies, you need to justify it. I thought paranoia over cookies had settled down over the last decade. Note: This blog also uses cookies.

And it has been proven that the tracking continues even after you’ve LOGGED OFF.

I am not sure what you are referring to. If you mean that sites can co-operate to track your visiting patterns, then Facebook is again no better or worse than the rest of the web.

[Facebook] doesn’t feel there’s anything wrong with sharing the information with marketers, etc., even after informing them directly you haven’t consented.

I don’t know the details here, but part of signing up with FaceBook is agreeing to having the information you provide being shared with marketers. The Great Marketing Machine is sponsoring your fun. What I am looking for is concrete examples of suffering or potential suffering caused.

Facebook won’t even let you directly DELETE your account once it’s established. (Not without some contact with them.) Even then, it’s still on their server for a while.

It gets worse. Even once it is deleted from the server, it is probably still on a backup tape! And possibly Google caches. And the Wayback Machine. It is very hard to unleak data from the web.

The same goes for anything that contains your personal info. The question is, simply “Do I want to join, and can I do it without sharing anything I don’t want to?” If you’re going to participate, you have to avoid putting anything into that account you don’t want getting out in any way. If this isn’t possible, you need to think about not joining.

That is absolutely correct. I avoid putting moderately-to-highly sensitive information into Facebook, or any web application. I should probably take the same level of care in protecting my email and my snailmail!

I’m still missing something here.

Marketers can find out who my friends are, and “what character from Princess Bride” I am. They can use that to target their adverts… In exchange, Facebook offers me a service of telling me who my friends are and which Princess Bride character I am. Seems a fair payment to me. Of course, you are welcome to disagree (see item 4.)

If they can do something more sinister than that, please give an example, remembering I don’t publish my phone number, I use a disposable email address and I don’t upload photos of myself partaking in sexual role-playing in fetish costumes.

Perhaps there is something more sinister possible and I simply don’t have the imagination to think of it. Then again, if you saw those photos you wouldn’t question my imagination!