On September 7th, 2011, Facebook changed its privacy policy, replacing the policy that was updated on December 22, 2010.

The policy’s length increased from 35 709 characters to 40 085 characters (from approximately 11 single-spaced A4 pages to 12), which shows that the complexity of the regulations increased.

Facebook continues to collect data about user behaviour from other websites.
New policy: “Sometimes we get data from our advertising partners, customers and other third parties that helps us (or them) deliver ads, understand online activity, and generally make Facebook better. For example, an advertiser may tell us how you responded to an ad on Facebook or on another site in order to measure the effectiveness of – and improve the quality of – those ads”.

Old policy: “Information from other websites. We may institute programs with advertising partners and other websites in which they share information with us:

• We may ask advertisers to tell us how our users responded to the ads we showed them (and for comparison purposes, how other users who didn’t see the ads acted on their site). This data sharing, commonly known as “conversion tracking,” helps us measure our advertising effectiveness and improve the quality of the advertisements you see.
• We may receive information about whether or not you’ve seen or interacted with certain ads on other sites in order to measure the effectiveness of those ads.“

The content of this regulation has not much changed, but Facebook now claims that it collects information about users from other websites in order to “make Facebook better”. It is intransparent to the single user, which data from which websites Facebook stores about him/her. If a lack of data storage transparency “makes Facebook better” is a question of interpretation. The question is if it makes Facebook a privacy-respecting platform or not.

The regulations about the storage of location data have been expanded, which reflects the increasing importance of mobile Internet use and therefore of mobile targeted advertising for Facebook:
New policy: “We may put together your current city with GPS and other location information we have about you to, for example, tell you and your friends about people or events nearby, or offer deals to you that you might be interested in. We may also put together data about you to serve you ads that might be more relevant to you. When we get your GPS location, we put it together with other location information we have about you (like your current city). But we only keep it until it is no longer useful to provide you services”.
Old policy: “When you access Facebook from a computer, mobile phone, or other device, we may collect information from that device about your browser type, location, and IP address, as well as the pages you visit“.

Another new quality of Facebook’s privacy policy is the “instant personalization” feature. Facebook shares certain user data with other platforms, with which it has entered business partnerships. The first time a user goes to the partner website, the platform should inform him/her that it uses Facebook information about the user. In Facebook’s privacy settings, one can turn off instant personalization for all of Facebook’s partner sites. This is, however, a opt-out solution, which shows that Facebook wants to share the information it collects about users with partner sites so that they can also use the data for targeted advertising. This circumstance is typical for the networked character of Internet commerce and shows how strongly advertising culture shapes social media and the World Wide Web (WWW). If a user at some point of time decides to deactivate instant personalization, but used a Facebook partner site that employ instant personalization before, the data that the partner site uses is not automatically deleted: “If you turn off an instant personalization site after you have been using it or visited it a few times (or after you have given it specific permission to access your data), it will not automatically delete your data. But the site is contractually required to delete your data if you ask it to”. This means that the user has to explicitly write to Facebook’s partner sites to delete personal data. Furthermore, it is not transparent to a single user, which data exactly Facebook partners store about him or her. Facebook’s instant personalization feature increases the non-transparency of data storage.

The description of how targeted advertising works on Facebook has changed, but not the content of the description. Facebook still makes use of all user data, user communication data, user browsing behaviour, and even data collected from other websites in order to sell these data as commodity to advertising clients that serve targeted ads to users. Facebook thereby makes profit, the users create value, are not paid for this work and their data becomes a commodity. I have termed this process Internet prosumer commodification (see the articles here, here and here). Facebook’s advertising settings have remained unchanged. There is no opt-in advertising and targeted advertising is always activated. The only opt-out options concern social adverts and the use of names and pictures in third-party advertisements.

Regulations about targeted advertising in the new privacy policy: “We do not share any of your information with advertisers (unless, of course, you give us permission).When an advertiser creates an ad on Facebook, they are given the opportunity to choose their audience by location, demographics, likes, keywords, and any other information we receive or can tell about you and other users. For example, an advertiser can choose to target 18 to 35 year-old women who live in the United States and like basketball. Try this tool yourself to see one of the ways advertisers target ads and what information they see at: https://www.facebook.com/ads/create/ If the advertiser chooses to run the ad (also known as placing the order), we serve the ad to people who meet the criteria the advertiser selected, but we do not tell the advertiser who any of those people are. So, for example, if a person clicks on the ad, the advertiser might infer that the person is an 18-to-35-year-old woman who lives in the US and likes basketball. But we would not tell the advertiser who that person is.
After the ad runs, we provide advertisers with reports on how their ads performed. For example we give advertisers reports telling them how many users saw or clicked on their ads. But these reports are anonymous. We do not tell advertisers who saw or clicked on their ads.
Advertisers sometimes place cookies on your computer in order to make their ads more effective. Learn more at: http://www.networkadvertising.org/managing/opt_out.asp
Sometimes we allow advertisers to target a category of user, like a “moviegoer” or a “sci-fi fan.” We do this by bundling characteristics that we believe are related to the category. For example, if a person “likes” the “Star Trek” Page and mentions “Star Wars” when they check into a movie theater, we may conclude that this person is likely to be a sci-fi fan.”

Regulations about targeted advertising in the old privacy policy: “Advertisements. Sometimes the advertisers who present ads on Facebook use technological methods to measure the effectiveness of their ads and to personalize advertising content. You may opt-out of the placement of cookies by many of these advertisers here. You may also use your browser cookie settings to limit or prevent the placement of cookies by advertising networks.  Facebook does not share personally identifiable information with advertisers unless we get your permission. [...] We don’t share your information with advertisers without your consent. (An example of consent would be if you asked us to provide your shipping address to an advertiser to receive a free sample.) We allow advertisers to choose the characteristics of users who will see their advertisements and we may use any of the non-personally identifiable attributes we have collected (including information you may have decided not to show to other users, such as your birth year or other sensitive personal information or preferences) to select the appropriate audience for those advertisements. For example, we might use your interest in soccer to show you ads for soccer equipment, but we do not tell the soccer equipment company who you are. You can see the criteria advertisers may select by visiting our advertising page. Even though we do not share your information with advertisers without your consent, when you click on or otherwise interact with an advertisement there is a possibility that the advertiser may place a cookie in your browser and note that it meets the criteria they selected“.

The policy regulation concerning deletion of an account has been changed. The major change is that Facebook now says that all information of an account will be deleted at latest 90 days after the user deleted the account, whereas the regulation in the old policy was somehow unclear, saying on the one hand that data is deleted, but on the other hand “that Facebook we may retain certain information to prevent identity theft and other misconduct even if deletion has been requested“.

New policy: “When you delete an account, it is permanently deleted from Facebook. It typically takes about one month to delete an account, but some information may remain in backup copies and logs for up to 90 days. You should only delete your account if you are sure you never want to reactivate it. You can delete your account at:
https://www.facebook.com/help/contact.php?show_form=delete_account
Old policy: “When you delete an account, it is permanently deleted from Facebook. [...] Additionally, we may retain certain information to prevent identity theft and other misconduct even if deletion has been requested. [...] Limitations on removal. Even after you remove information from your profile or delete your account, copies of that information may remain viewable elsewhere to the extent it has been shared with others, it was otherwise distributed pursuant to your privacy settings, or it was copied or stored by other users. However, your name will no longer be associated with that information on Facebook. (For example, if you post something to another user’s profile and then you delete your account, that post may remain, but be attributed to an “Anonymous Facebook User.”)  Additionally, we may retain certain information to prevent identity theft and other misconduct even if deletion has been requested. If you have given third party applications or websites access to your information, they may retain your information to the extent permitted under their terms of service or privacy policies.  But they will no longer be able to access the information through our Platform after you disconnect from them. Backup copies. Removed and deleted information may persist in backup copies for up to 90 days, but will not be available to others“.

On August 18, 2011, members of the initiative “Europe vs. Facebook” that was founded by Austrian law students filed a complaint against Facebook to the Irish Data Protection Commissioner. Facebook Europe is legally registered in Ireland. The initiative members made 16 complaint points and asked the Commissioner to check Facebook violates European data protection laws in these 16 privacy areas.

One point of complaint is that Facebook engages in excessive processing of data. One of the complainers demanded from Facebook to send him the data it stores about him. Although he had deleted his account, he received a print out with 1 200 pages of personal data stored about him by Facebook. This topic is addressed in the complaint under point 15: “After using facebook.com for 3 years, Facebook Ireland gathered more than 1.200 pages of personal information about me (in fact Facebook Ireland might hold a much bigger amount of data, see Complaint 10), even though I have deleted just about everything I could (e.g. all my posts, all messages, and many friends)”.

The Irish Data Protection Act says that data “(iii) shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they were collected or are further processed, and (iv) shall not be kept for longer than is necessary for that purpose or those purposes“ (DPA §2 (1) (c) (iii) (iv)). The EU Data Protection Directive regulates that ”Member States shall provide that personal data must be: […](c) adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed” (Directive 95/46/EC of the European Parliament, §6 (1) (c)).

Another complaint is that Facebook does not use opt-in options and thereby may breach the regulation that users have to give consensus to the processing of their personal data. This regulation is specifically important among other topics also for targeted advertising, which is organized without opt-in on Facebook. “2A. (1) Personal data shall not be processed by a data controller unless section 2 of this Act (as amended by the Act of 2003) is complied with by the data controller and at least one of the following conditions is met: (a) the data subject has given his or her consent to the processing or“ (Irish Data Protection Act, §2A (1) (a)). “Member States shall provide that personal data may be processed only if: (a) the data subject has unambiguously given his consent” (Directive 95/46/EC of the European Parliament, §7 (a)).

Facebook’s change of the data deletion regulations from rather ambiguous and unclear formulations to a clearer version may reflect the circumstance that a complaint against its privacy practices has been filed. This might be a direct reaction to the complaints filed by “Europe versus Facebook”, which were however filed on August, 18^th, 2011, whereas Facebook changed its policy on September 7^th. Therefore the old privacy policy is subject of the complaints. Furthermore it looks like many of the privacy areas addressed by the complaints have not been cleared out by the new privacy policy. “Europe versus Facebook” is not only a highly important initiative, it also shows that companies are unlikely to voluntarily protect users’ privacy, but to be only willing to do so if they feel the threat of the state’s law enforcement capacities. The profit motive is so inherent to companies that they always tend to put profit interests above users’ privacy concerns. The only two alternatives are to make use of the law for enforcing privacy protection and to support the creation of alternative non-profit platforms.

Facebook has changed the content sharing options, it is now relatively easily possible to define with whom one wants to share content and to share it only with customized users. This change is also reflected in the privacy policy (in the section titled “Control over your profile”). It is likely that it has been taken because Google in June 2011 introduced its own social networking site Google+, which poses competition to Facebook and is based on the “friend circles” concept that allows customization of content. Other new regulations include a section about tagging (“Tags”), the possibility for other websites to provide a login into their sites by enabling users to log in with their Facebook accounts (section “Logging in to another site using Facebook”), social plugins (section “About social plugins”), sponsored stories (section “Sponsored stories”), and featured content (section “Featured content”).

A new regulation is that Facebook says that it allows users to vote privacy changes under certain circumstances: “Unless we make a change for legal or administrative reasons, or to correct an inaccurate statement, we will give you seven (7) days to provide us with comments on the change. If we receive more than 7000 comments concerning a particular change, we will put the change up for a vote. The vote will be binding on us if more than 30% of all active registered users as of the date of the notice vote”.

This regulation is extremely unclear. One can interpret every imaginable privacy policy change as legal change, administrative change or change of an inaccurate statement. It is therefore arbitrary and unclear, on which changes Facebook users are able to vote or not. Furthermore no link for comments is provided. It is also unlikely that 30% of all registered users will ever engage in a vote because privacy policy matters are a complex issue. It looks like Facebook wants to respond to the criticism that users have no decision-rights about the privacy of their personal data, but at the same time wants to immunize itself against loosing control of decision making power.

We can summarize the changes of the Facebook privacy policy that took effect on September 7^th, 2011:

* The change of Facebook’s privacy policies has come shortly after members of the initiative “Europe versus Facebook” filed privacy violation complaints against Facebook to the Irish Data Protection Commissioner.
* The length and complexity of Facebook’s privacy policy has increased.
* Facebook has introduced new features like instant personalization that have increased the non-transparency of data storage. It is not clear for a user, which data Facebook stores about her/him, with whom Facebook shares user data, and which data exactly Facebook partners store.
* Facebook continues to receive data about users from other websites.
* Facebook continues to commodify user data by using targeted advertising. It does not use opt-in for advertising, targeted ads are automatically and always activated. Internet prosumer commodification continues to be Facebook’s capital accumulation model.
* Facebook has implemented a user participation mechanism in privacy decision-making that is formulated in an extremely shallow way so that this regulation seems to be an ideological pseudo-participation strategy.

Facebook founder and CEO Mark Zuckerberg is quoted saying: “The concept that the world will be better if you share more is something that’s pretty foreign to a lot of people – and it runs into all these privacy concerns”. He acknowledges that some people have “the vision of a surveillance world”. But he associates Google, not Facebook with surveillance. He says that Google’s strategy of data collection “is a little scary” and thinks that Facebook in contrast gives users control over their data. “Given that the world is moving towards more sharing of information, making sure that it happens in a bottom-up way, with people inputting the information themselves and having control over how their information interacts with the system, as opposed to a centralized way, through it being tracked in some surveillance system”.

Zuckerberg has repeatedly said that he does not care about profit, but wants to help people with Facebook’s tools and wants to create an open society. Kevin Colleran, Facebook advertising sale executive, says in the Wired story that “Mark is not motivated by money”. In a story by the Times (October 20, 2008, http://business.timesonline.co.uk/tol/business/industry_sectors/technology/article4974197.ece), Zuckerberg said: “The goal of the company is to help people to share more in order to make the world more open and to help promote understanding between people. The long-term belief is that if we can succeed in this mission then we also be able to build a pretty good business and everyone can be financially rewarded. […] The Times: Does money motivate you. Zuckerberg: No”.

Zuckerberg thinks that the only problem about Facebook surveillance is that other individuals get access to images or information of users that is not meant for being available to them. He also thinks that privacy control options will solve this problem. Facebook has tended to make ever more information available to all users as its standard setting. One cannot assume that all users are highly skilful in setting their privacy options. Zuckerberg ignores the skills divide in social networking site usage.

But the more crucial problem is that Zuckerberg fully ignores the economic power structures of the modern economy, into which Facebook is embedded. If Zuckerberg really does not care about profit, why is Facebook then not a non-commercial platform and why does it use targeted advertising? The problems of targeted advertising are that it aims at controlling and manipulating human needs, that users are normally not asked if they agree to the use of advertising on the Internet, but have to agree to advertising if they want to use commercial platforms (lack of democracy), that advertising can increase market concentration, that it is intransparent for most users what kind of information about them is used for advertising purposes, and that users are not paid for the value creation they engage in when using commercial web 2.0 platforms and uploading data. Surveillance on Facebook is not only an interpersonal process, where users view data about other individuals that might benefit or harm the latter, it is primarily economic surveillance, i.e. the collection, storage, assessment, and commodification of personal data, usage behaviour, and user-generated data for economic purposes. Facebook and other web 2.0 platforms are large advertising-based capital accumulation machines that achieve their economic aims by economic surveillance.

Facebook collects information about user behaviour on other sites for economic purposes: “We may ask advertisers to tell us how our users responded to the ads we showed them (and for comparison purposes, how other users who didn’t see the ads acted on their site). This data sharing, commonly known as ‘conversion tracking,’ helps us measure our advertising effectiveness and improve the quality of the advertisements you see. We may receive information about whether or not you’ve seen or interacted with certain ads on other sites in order to measure the effectiveness of those ads“ (Privacy Policy, April 22, 2010).

Facebook targets advertisement to individual users by surveilling their usage behaviour and interests: “We allow advertisers to choose the characteristics of users who will see their advertisements and we may use any of the non-personally identifiable attributes we have collected (including information you may have decided not to show to other users, such as your birth year or other sensitive personal information or preferences) to select the appropriate audience for those advertisements. For example, we might use your interest in soccer to show you ads for soccer equipment, but we do not tell the soccer equipment company who you are. […] We occasionally pair advertisements we serve with relevant information we have about you and your friends to make advertisements more interesting and more tailored to you and your friends. For example, if you connect with your favorite band’s page, we may display your name and profile photo next to an advertisement for that page that is displayed to your friends. We only share the personally identifiable information visible in the social ad with the friend who can see the ad. You can opt out of having your information used in social ads on this help page” (Privacy Policy, April 22, 2010).

Zuckerberg and Facebook ignore concerns about advertising settings. Facebook’s privacy policy is the living proof that Facebook is primarily about profit-generation by advertising. “The world will be better if you share more“? For whom, Mark Zuckerberg? “Sharing” on Facebook in economic terms means primarily that Facebook “shares” information with advertising clients. And “sharing” is only the euphemism for selling and commodifying data. Facebook commodifies and trades user data and user behaviour data. Facebook does not make the world a better place, it makes the world a more commercialized place, a big shopping mall without exit. It makes the world only a better place for companies interested in advertising, not for users.

Mr. Zuckerberg, if you are a man who stands by his word, and Facebook for you is really not about profit, then please abolish targeted advertising and any kind of advertising on Facebook tomorrow and transform Facebook into a non-commercial, non-profit Internet platform. Yours truly, Christian Fuchs.

Data retention was implemented in Germany (and other European countries) after the European Commission passed the Data Retention Directive (2006/24/EC) on March 15, 2006, which requires all member states to pass laws that guarantee that information and communication service providers store source, destination, and other data on a communication for at least 6 months. The data that needs to be stored includes:
“(a) data necessary to trace and identify the source of a communication (…)
(b) data necessary to identify the destination of a communication (…)
(c) data necessary to identify the date, time and duration of a communication (…)
(d) data necessary to identify the type of communication (…)
(e) data necessary to identify users’ communication equipment or what purports to be their equipment
(f) data necessary to identify the location of mobile communication equipment“ (European Data Retention Directive, Article 5).
“Member States shall ensure that the categories of data specified in Article 5 are retained for periods of not less than six months and not more than two years from the date of the communication“ (European Data Retention Directive, Article 6).

The German Federal Constitutional Court considers the following articles of German jurisdiction as unconstitutional:
* §113a (1) TKG (telecommunication act, Telekommunikationsgesetz): “Providers of publicly accessible telecommunication services are obliged according to paragraphs 2-5 to store connection data that are produced or processed in the usage of its service for six months nationally or in another member state of the European Union” („Wer öffentlich zugängliche Telekommunikationsdienste für Endnutzer erbringt, ist verpflichtet, von ihm bei der Nutzung seines Dienstes erzeugte oder verarbeitete Verkehrsdaten nach Maßgabe der Absätze 2 bis 5 sechs Monate im Inland oder in einem anderen Mitgliedstaat der Europäischen Union zu speichern“).
* §113b TKG says that telecommunication service providers are allowed to provide these connection data to law enforcement agencies, German secret services, and offices for the protection of the constitution if in the specific case an investigation is court-ordered.
* § 100g SPO (code of criminal procedure, Strafprozessordnung) says that if someone has committed a crime, tries to commit a crime, or prepares to commit a crime, especially severe crimes according to § 100a SPO, “connection data can be investigated, also without knowledge of the person concerned, insofar as this is necessary for the investigation of the statement of affairs or of the whereabouts of the defendant“ („so dürfen auch ohne Wissen des Betroffenen Verkehrsdaten (§ 96 Abs. 1, § 113a des Telekommunikationsgesetzes) erhoben werden, soweit dies für die Erforschung des Sachverhalts oder die Ermittlung des Aufenthaltsortes des Beschuldigten erforderlich ist“).

These articles in the view of the German Federal Constitutional Court violate §10 (1) of the German Basic Law (Grundgesetz), which protects the privacy of correspondence, posts and telecommunications: “The privacy of correspondence, posts and telecommunications shall be inviolable“ („Das Briefgeheimnis sowie das Post- und Fernmeldegeheimnis sind unverletzlich“).

This decision is in my view important in several respects:

* It shows that putting all citizens under general suspicion of being criminals or terrorists or of potentially planning to be criminals or terrorists and as a result storing data on their communicative connections may not be compatible with basic human rights.

* It shows the importance of constitutional laws and human rights in circumventing the rise of totalitarian surveillance societies.

* It puts an interesting perspective on the relationship of national and international jurisdiction: Directives of the European Commission are obligatory for all member states and therefore result in the creation or amendment of certain laws and paragraphs in all states. In this case international law shapes national law. But after the decision of the German Federal Constitutional Court, it is likely that the Data Retention Directive will be reconsidered at the European level, which may result in its amendment or abolishment. This shows that important national court decisions have the power to shape international laws.

The President of the German Federal Constitutional Court, Hans-Jürgen Papier, commented in an interview with Süddeutsche Zeitung: “The Federal Constitutional Court has found that the prohibition of total surveillance is part of Germany’s constitution and its principle must not be negated by European legislation“ („Das Bundesverfassungsgericht hat festgestellt, dass das Verbot einer Totalüberwachung zur Identität der Verfassung Deutschlands gehört und auch von der europäischen Gesetzgebung nicht im Grundsatz negiert werden darf“, Süddeutsche Zeitung, March 6+7, 2010, page 6, http://www.sueddeutsche.de/politik/1/505205/text/).

The German Federal Constitutional Court has expressed concerns about total surveillance in its decision. It argues that data retention allows creating personal profiles (interests, weaknesses, preferences, political and other memberships). This may cause feelings of being under surveillance and under constant threat. “Even although storage does not extend to communication contents, these data allow to draw conclusions that reach into the private sphere. Addressees, dates, time, and place of telephone conversations allow, if they are observed for a longer duration, in their combination detailed information about societal or political affiliations as well as personal preferences, affinities, and weaknesses. Depending on the usage of telecommunications, such a storage can enable the creation of significant personal profiles or profiles of movements of practically every citizen. Also the risk increases that citizens are put under further investigations without giving reasons for this themselves. Furthermore potential abuses connected with such data collections aggravate their mental stress effects. Particularly as storage and data use is not noticed, the storage of telecommunication connection data for no reason is suited to cause a diffusely threatening feeling of being under observation that can diminish an unprejudiced perception of one’s basic rights in many areas“ („Auch wenn sich die Speicherung nicht auf die Kommunikationsinhalte erstreckt, lassen sich aus diesen Daten bis in die Intimsphäre hineinreichende inhaltliche Rückschlüsse ziehen. Adressaten, Daten, Uhrzeit und Ort von Telefongesprächen erlauben, wenn sie über einen längeren Zeitraum beobachtet werden, in ihrer Kombination detaillierte Aussagen zu gesellschaftlichen oder politischen Zugehörigkeiten sowie persönlichen Vorlieben, Neigungen und Schwächen. Je nach Nutzung der Telekommunikation kann eine solche Speicherung die Erstellung aussagekräftiger Persönlichkeits und Bewegungsprofile praktisch jeden Bürgers ermöglichen. Auch steigt das Risiko von Bürgern, weiteren Ermittlungen ausgesetzt zu werden, ohne selbst hierzu Anlass gegeben zu haben. Darüber hinaus verschärfen die Missbrauchsmöglichkeiten, die mit einer solchen Datensammlung verbunden sind, deren belastende Wirkung. Zumal die Speicherung und Datenverwendung nicht bemerkt werden, ist die anlasslose Speicherung von Telekommunikationsverkehrsdaten geeignet, ein diffus bedrohliches Gefühl des Beobachtetseins hervorzurufen, das eine unbefangene Wahrnehmung der
Grundrechte in vielen Bereichen beeinträchtigen kann“, decision of the German Federal Constitutional Court, March 2, 2010, http://www.bundesverfassungsgericht.de/pressemitteilungen/bvg10-011).

The German Federal Constitutional Court’s decision gives hope that the emergence of a total European surveillance society can be circumvented.

See also connected to this topic:
Fuchs, Christian. 2009. Social Networking Sites and the Surveillance Society. A Critical Case Study of the Usage of studiVZ, Facebook, and MySpace by Students in Salzburg in the Context of Electronic Surveillance. Salzburg/Vienna: Research Group UTI. ISBN 978-3-200-01428-2.
Link

In February 2010, Google introduced a new social networking service called Buzz. Buzz is directly connected to GMail, Google’s webmail-platform. Google’s introduction of Buzz is an attempt to gain importance in the social networking sites-market that has been dominated by Facebook and Twitter. In February 2010, Facebook was ranked number 2 and Twitter number 12 in the list of the most accessed web platforms, whereas Google’s own social networking platform Orkut, which is only very popular in Brazil, was at number 52 (data source: http://alexa.com, the top 500 sites on the web, February 14, 2010). Popular social networking platforms attract millions of users, who upload and share personal information that provides data about their consumption preferences. Therefore commercial social networking sites are keen on storing, analyzing, and selling individual and aggregated data about user preferences and user behaviour to advertising clients in order to accumulate capital. Google is itself a main player in the business of online advertising. One can therefore assume that Google considers Facebook, Twitter, and other platforms that attract many users, as competitors, and that as a result of this competitive situation Google has introduced Buzz. In 2009, GMail had approximately 150 million users (see http://www.tech24hours.com/2009/09/number-of-gmail-users-worldwide-as-of.html, accessed on February 14, 2010), which explains that Google integrated Buzz into GMail in order to start from a solid foundation of potential users.

Buzz supports the following communicative functions: the creation of postings that are shared with contacts, the sharing of images and videos, commenting and evaluating others’ Buzz posts, the forwarding of Twitter messages to a Buzz account, linking and integrating images uploaded to Flickr or Picasa, videos uploaded to YouTube, and posts generated on Blogger; the usage of Buzz via mobile phones. Buzz messages can either be presented publicly or only to selected groups of followers. Each user’s Buzz profile has a list of followers. Users can select which Buzz accounts they want to follow. Buzz mobile phone messages include geo-tags that display the current location of users. Buzz posts of users who are geographically located nearby a user and information about nearby sites, shops, restaurants, etc can be displayed on mobile phones. Buzz also recommends postings by others users.

In December 2009, Google’s CEO Eric Schmidt commented about online privacy: “If you have something that you do not want anyone to know, maybe you should not be doing it in the first place” (http://www.youtube.com/watch?v=A6e7wfDHzew, accessed on February 14, 2010). This statement is an indication that Google or at least its most important managers and shareholders do not value privacy very highly. Schmidt’s statement implies that he thinks that in the online world, all uploaded information and personal data should be available publicly and should be usable by corporations for economic ends.

When first installing Buzz, the application automatically generated a list of followers for each user based on the most frequent GMail mail contacts. The standard setting was that this list of followers was automatically visible in public. This design move resulted in heavy criticism of Google in the days following the launch of Buzz. Users and civil rights advocates argued that Buzz threatens the privacy of users and makes contacts that users might want to keep private available in public. Google reacted to public criticism (see: http://gmailblog.blogspot.com/2010/02/new-buzz-start-up-experience-based-on.html, http://www.huffingtonpost.com/2010/02/13/buzz-changes-google-drops_n_461656.html, accessed on February 14, 2010) and changed some of the standard settings of Buzz on February 13, 2010. Some changes were made to the auto-follow option, so that now a dialogue is displayed that shows which users Buzz suggests as followers (see: http://gmailblog.blogspot.com/2010/02/new-buzz-start-up-experience-based-on.html, accessed on February 14, 2010). But still all suggested followers are automatically activated, which does not make this solution an opt-in version of the follow feature. Google also said that Buzz would no longer automatically connect publicly available Picasa and Google Reader items to the application. Also an options menu was announced that allows users to hide their contact list from their public Google profiles. The problem here is again that this was planned as an opt-out solution, and not as an opt-in option (see: http://gmailblog.blogspot.com/2010/02/new-buzz-start-up-experience-based-on.html, accessed on February 14, 2010). From a privacy-enhancing perspective, opt-in solutions are preferable to opt-out solutions because they give users more control over what applications are allowed to do with their data. However, it is clear that opt-in solutions are rather unpopular design options for many Internet corporations because they tend to reduce the number of potential users that are subject to advertising-oriented data surveillance.

At the Google Buzz launch event on February 9, 2010, the presenters were keen on stressing the advantages that Buzz poses for users. Bradley Horwitz, Google vice president of product marketing, spoke of Buzz as “a Google approach to sharing” and a tool that will “help you manage your attention better” (http://www.youtube.com/watch?v=JuThg91-4Nw, accessed on February 15, 2010). There was no talk about potential disadvantages. When in the question and answer section of the event, the first question that came about was about privacy issues, Buzz product manager Todd Jackson answered: “There is a lot of controls in there for users. […] There are ways to control the settings you are revealing to other people” (ibid.). Four days later, following a public discussion about the surveillance and privacy threats of Buzz, Google sounded much less optimistic. On the Google GMail blog, Todd Jackson wrote: “We’ve heard your feedback loud and clear, and since we launched Google Buzz four days ago, we’ve been working around the clock to address the concerns you’ve raised” (http://gmailblog.blogspot.com/2010/02/new-buzz-start-up-experience-based-on.html, accessed on February 15, 2010).

Google’s economic strategy is to gather data about users that utilize different Google applications in different everyday situations. The more everyday situations can be supported by Google applications, the more time users will spend online with Google, so that more user data will be available to Google, which allows the company to better analyze usage and consumer behaviour. As a result, more and more precise user data and aggregated data can be sold to advertising clients that provide the users with personalized advertising that targets them in all of these everyday situations with information about potential consumption choices. The introduction of ever more applications does primarily serve economic ends that are realized by large-scale user surveillance. As more and more people access the Internet from their mobile phones, the number of times and the time spans users are online as well as the number of access points and situations in which users are online increase. Therefore supplying applications that are attractive for users in all of these circumstances (such as waiting for the bus or the underground, travelling on the train or the airplane, going to a restaurant, concert, or movie, visiting friends, attending a business meeting, etc), promises that users spend more time online with applications supplied by specific companies such as Google, which allows these companies to present more advertisements that are more individually targeted to users, which in turn promises more profit for the companies. We can therefore say that there is a strong economic incentive for Google’s and other companies’ introduction of new Internet- and mobile Internet-applications.

Google Buzz is part of Google’s empire of economic surveillance. It gathers information about user behaviour and user interests in order to store, assess, and sell this data to advertising clients. These surveillance practices are legally guaranteed by the Buzz privacy policy, which says for example: “When you use Google Buzz, we may record information about your use of the product, such as the posts that you like or comment on and the other users who you communicate with. This is to provide you with a better experience on Buzz and other Google services and to improve the quality of Google services. […] If you use Google Buzz on a mobile device and choose to view “nearby” posts, your location will be collected by Google” (Google Buzz Privacy Policy, February 14, 2010).

Google uses DoubleClick – a commercial advertising server owned by Google since 2007 that collects and networks data about usage behaviour on various websites, sells this data, and helps providing targeted advertising – for networking the data it holds about its users with data about these users’ browsing and usage behaviour on other web platforms. There is only an opt-out option from this form of networked economic surveillance. Opt-out options are always rather unlikely to be used because in many cases they are hidden inside of long privacy and usage terms and are therefore only really accessible to knowledgeable users. Many Internet corporations avoid opt-in advertising solutions because such mechanisms drastically reduce the potential number of users participating in advertising. The Google privacy policy says in this context: “Google uses the DoubleClick advertising cookie on AdSense partner sites and certain Google services to help advertisers and publishers serve and manage ads across the web. You can view, edit, and manage your ads preferences associated with this cookie by accessing the Ads Preferences Manager. In addition, you may choose to opt out of the DoubleClick cookie at any time by using DoubleClick’s opt-out cookie” (Gogle Privacy Policy, February 14, 2010).

Google’s online product advertising for Buzz says: “The first thing we all do when we find something interesting is share it. More and more of this kind of sharing takes place online. Google Buzz is a new way to share updates, photos, videos, and more. […] When you are out in the real world, you usually want to say something about where you are. Buzz makes this easy” (Google Buzz advertising, online at http://www.google.com/buzz, February 14, 2009). Sharing information with friends and to a certain extent with the public is surely an important feature of everyday communication that allows humans to stay in touch and to make new contacts. But Google only presents potential advantages of Buzz and does not say a single word about potential disadvantages. Do people really want to share vast amounts of private data and location data not only with their friends, but also with Google? Can Google be considered as a friend of all humans, or doesn’t it rather accumulate power that can also cause great harm to humans? Do people really always want to tell others where they currently are? Are people really interested in sharing their location data not only with selected friends, but also with Google? It is a natural corporate behaviour that Google only presents potential advantages of its applications in its marketing videos, ads, and events. But by doing so, it creates a one-dimensional picture of online reality that conveys the impression that we live in a world without power structures, in which all humans always benefit from corporate practices. But the great financial crisis has made clear to many citizens that corporations cannot always be trusted and are prone to act in ways that do not benefit all, but only a small group of investors.

Buzz is not the only example of Google-enhanced surveillance. Google has developed Goggles, which is an image-recognition software that identifies objects that people take pictures of by mapping these objects with Google’s image database and provides information about these objects. If this application were linked to image data about humans, it would allow people to identify and obtain information about humans, who they see on the street by taking a picture of them and linking this image to Google in real time. This would on the one hand allow humans to intrude the privacy of others in public spaces by identifying their personality and it would allow Google to gather, assess, provide, and potentially sell real time data about the physical location of millions of people.

Why is data surveillance for economic surveillance by Google applications such as Buzz problematic? One could argue that Google provides a free service to users and that in return it should be allowed to access, store, analyze, and use personal data and Internet usage behaviour. But the problem is that the power relations between Google and its users are not symmetric. In December 2008, Google controlled 57% of the online advertising market (http://www.attributor.com/blog/google-ad-server-share-now-at-57-microhoo-less-than-15-market-share, accessed on February 15, 2010). A Google monopoly in online advertising poses several threats (for a general account of the threats of information monopolies see Fuchs 2008, 164-171):

* Ideological power threat: Online advertising presents certain realities as important to users and leaves out those realities that are non-corporate in character or that are produced by actors that do not have enough capital in order to purchase online advertisements. An online advertising monopoly therefore advances one-dimensional views of reality.

* Political power threat: In modern society, money is a form of influence on political power. The concentration of online advertising therefore gives Google huge political power.

* Control of labour standards and prices: An online advertising monopoly holds the power to set industry-wide labour standards and prices. This can pose disadvantages for workers and consumers.

* Economic centralization threat: An economic monopoly controls large market shares and thereby deprives other actors of economic opportunities.

* Surveillance threat: Targeted online advertising is based on the collection of vast amounts of personal user data and usage behaviour that is stored, analyzed, and passed on to advertising customers. Modern societies are stratified, which means that certain groups and individuals compete with others for the control of resources, consider others as their opponents, benefit from certain circumstances at the expense of others, etc. Therefore information about personal preferences and individual behaviour can cause harm to individuals if it gets into the hand of their opponents or others who might have an interest in harming them. Large-scale data gathering and surveillance in a society that is based on the principle of competition poses certain threats to the well-being of all citizens. Therefore special privacy protection mechanisms are needed. All large collections of data pose the threat of being accessed by individuals who want to harm others. If such collections are owned privately, then access to data might be sold because there is an economic interest in accumulating money. Humans who live in modern societies have an inherent interest in controlling which personal data about them is stored and is available to whom because they are facing systemic threats of being harmed by others. Large collections of personal information pose under the given modern circumstances the threat that humans can be harmed because their foes, opponents, or rivals in private or professional life can potentially gain access to such data. Since 9/11, there has been an extension and intensification of state surveillance that is based on the argument that security from terrorism is more important than privacy. But state surveillance is prone to failure, and the access of state institutions to large online collections about citizens (as for example enabled by the USA PATRIOT Act) not only poses the possibility for detecting terrorists, but also the threat that a large number of citizens is considered as potential criminals or terrorists without having committed any crimes and the threat that the state obtains a huge amount of information about the private lives of citizens that the latter consider worth protecting (as for example: political views, voting decisions, sexual preferences and relationships, friendship statuses).

Overall, the introduction of Google Buzz shows that there is an antagonism of privacy protection and economic surveillance interests on the contemporary Internet that is dominated by commercial interests. It might be time for thinking more about strengthening alternative Internet platforms and the potentials for constructing an alternative Internet.

Christian Fuchs (http://fuchs.uti.at)

Fuchs, Christian. 2008. Internet and society: social theory in the information age. New York: Routledge.

The New York Times ran an article about this new technology on February, 13, 2010:
Critics Say Google Invades Privacy With New Service

I find interesting about the NY Times article and the reactions of some users to Google Buzz that they primarily stress the danger that China, Iran, etc could use Buzz for engaging in the (political) surveillance of political oppositionists and that they label such endeavours totalitarian, while at the same time they do not provide a critique of the economic surveillance machine constituted by Google’s expanding services, its collection, storage, analysis, and commodification of personal data, and its market dominance.

Surveillance and Big Brother are not only somewhere out there in China or Iran, they are also present in the heart of capitalism itself – in the form of economic surveillance, and Google is one of its primary executors.

The Buzz privacy policy for example says:
“When you use Google Buzz, we may record information about your use of the product, such as the posts that you like or comment on and the other users who you communicate with. This is to provide you with a better experience on Buzz and other Google services and to improve the quality of Google services”
“If you use Google Buzz on a mobile device and choose to view “nearby” posts, your location will be collected by Google.”

The task for Google is to collect as much data about users as possible and to then sell this data as commodity to advertising clients. Google fears the competition by Facebook and Twitter in the social networking market, and so has set up its own service (although I doubt that I will be so successful because until now it only supports rather trivial functions).

Google uses DoubleClick for networking the data it holds about its users with data about these users’ browsing and usage behaviour on other Web platforms (see Google Privacy Policy). There is only an opt-out option from this surveillance. Opt-out options are always unlikely to be used because in many cases they are hidden inside of long privacy and usage terms and therefore only really accessible to knowledgeable users. Of course Internet corporations avoid opt-in advertising solutions because this would drastically reduce the potential number of users participating in advertising.

To only focus on the political surveillance capabilities that Buzz provides for some non-Western societies and to ignore the immanence of economic surveillance, is a form of Digital Orientalism that is ideologically blind for the forms of stratification that are at the heart of Western economies.

GOOGLE BUZZ PRIVACY POLICY
9 February 2010