On September 7th, 2011, Facebook changed its privacy policy, replacing the policy that was updated on December 22, 2010.

The policy’s length increased from 35 709 characters to 40 085 characters (from approximately 11 single-spaced A4 pages to 12), which shows that the complexity of the regulations increased.

Facebook continues to collect data about user behaviour from other websites.
New policy: “Sometimes we get data from our advertising partners, customers and other third parties that helps us (or them) deliver ads, understand online activity, and generally make Facebook better. For example, an advertiser may tell us how you responded to an ad on Facebook or on another site in order to measure the effectiveness of – and improve the quality of – those ads”.

Old policy: “Information from other websites. We may institute programs with advertising partners and other websites in which they share information with us:

• We may ask advertisers to tell us how our users responded to the ads we showed them (and for comparison purposes, how other users who didn’t see the ads acted on their site). This data sharing, commonly known as “conversion tracking,” helps us measure our advertising effectiveness and improve the quality of the advertisements you see.
• We may receive information about whether or not you’ve seen or interacted with certain ads on other sites in order to measure the effectiveness of those ads.“

The content of this regulation has not much changed, but Facebook now claims that it collects information about users from other websites in order to “make Facebook better”. It is intransparent to the single user, which data from which websites Facebook stores about him/her. If a lack of data storage transparency “makes Facebook better” is a question of interpretation. The question is if it makes Facebook a privacy-respecting platform or not.

The regulations about the storage of location data have been expanded, which reflects the increasing importance of mobile Internet use and therefore of mobile targeted advertising for Facebook:
New policy: “We may put together your current city with GPS and other location information we have about you to, for example, tell you and your friends about people or events nearby, or offer deals to you that you might be interested in. We may also put together data about you to serve you ads that might be more relevant to you. When we get your GPS location, we put it together with other location information we have about you (like your current city). But we only keep it until it is no longer useful to provide you services”.
Old policy: “When you access Facebook from a computer, mobile phone, or other device, we may collect information from that device about your browser type, location, and IP address, as well as the pages you visit“.

Another new quality of Facebook’s privacy policy is the “instant personalization” feature. Facebook shares certain user data with other platforms, with which it has entered business partnerships. The first time a user goes to the partner website, the platform should inform him/her that it uses Facebook information about the user. In Facebook’s privacy settings, one can turn off instant personalization for all of Facebook’s partner sites. This is, however, a opt-out solution, which shows that Facebook wants to share the information it collects about users with partner sites so that they can also use the data for targeted advertising. This circumstance is typical for the networked character of Internet commerce and shows how strongly advertising culture shapes social media and the World Wide Web (WWW). If a user at some point of time decides to deactivate instant personalization, but used a Facebook partner site that employ instant personalization before, the data that the partner site uses is not automatically deleted: “If you turn off an instant personalization site after you have been using it or visited it a few times (or after you have given it specific permission to access your data), it will not automatically delete your data. But the site is contractually required to delete your data if you ask it to”. This means that the user has to explicitly write to Facebook’s partner sites to delete personal data. Furthermore, it is not transparent to a single user, which data exactly Facebook partners store about him or her. Facebook’s instant personalization feature increases the non-transparency of data storage.

The description of how targeted advertising works on Facebook has changed, but not the content of the description. Facebook still makes use of all user data, user communication data, user browsing behaviour, and even data collected from other websites in order to sell these data as commodity to advertising clients that serve targeted ads to users. Facebook thereby makes profit, the users create value, are not paid for this work and their data becomes a commodity. I have termed this process Internet prosumer commodification (see the articles here, here and here). Facebook’s advertising settings have remained unchanged. There is no opt-in advertising and targeted advertising is always activated. The only opt-out options concern social adverts and the use of names and pictures in third-party advertisements.

Regulations about targeted advertising in the new privacy policy: “We do not share any of your information with advertisers (unless, of course, you give us permission).When an advertiser creates an ad on Facebook, they are given the opportunity to choose their audience by location, demographics, likes, keywords, and any other information we receive or can tell about you and other users. For example, an advertiser can choose to target 18 to 35 year-old women who live in the United States and like basketball. Try this tool yourself to see one of the ways advertisers target ads and what information they see at: https://www.facebook.com/ads/create/ If the advertiser chooses to run the ad (also known as placing the order), we serve the ad to people who meet the criteria the advertiser selected, but we do not tell the advertiser who any of those people are. So, for example, if a person clicks on the ad, the advertiser might infer that the person is an 18-to-35-year-old woman who lives in the US and likes basketball. But we would not tell the advertiser who that person is.
After the ad runs, we provide advertisers with reports on how their ads performed. For example we give advertisers reports telling them how many users saw or clicked on their ads. But these reports are anonymous. We do not tell advertisers who saw or clicked on their ads.
Advertisers sometimes place cookies on your computer in order to make their ads more effective. Learn more at: http://www.networkadvertising.org/managing/opt_out.asp
Sometimes we allow advertisers to target a category of user, like a “moviegoer” or a “sci-fi fan.” We do this by bundling characteristics that we believe are related to the category. For example, if a person “likes” the “Star Trek” Page and mentions “Star Wars” when they check into a movie theater, we may conclude that this person is likely to be a sci-fi fan.”

Regulations about targeted advertising in the old privacy policy: “Advertisements. Sometimes the advertisers who present ads on Facebook use technological methods to measure the effectiveness of their ads and to personalize advertising content. You may opt-out of the placement of cookies by many of these advertisers here. You may also use your browser cookie settings to limit or prevent the placement of cookies by advertising networks.  Facebook does not share personally identifiable information with advertisers unless we get your permission. [...] We don’t share your information with advertisers without your consent. (An example of consent would be if you asked us to provide your shipping address to an advertiser to receive a free sample.) We allow advertisers to choose the characteristics of users who will see their advertisements and we may use any of the non-personally identifiable attributes we have collected (including information you may have decided not to show to other users, such as your birth year or other sensitive personal information or preferences) to select the appropriate audience for those advertisements. For example, we might use your interest in soccer to show you ads for soccer equipment, but we do not tell the soccer equipment company who you are. You can see the criteria advertisers may select by visiting our advertising page. Even though we do not share your information with advertisers without your consent, when you click on or otherwise interact with an advertisement there is a possibility that the advertiser may place a cookie in your browser and note that it meets the criteria they selected“.

The policy regulation concerning deletion of an account has been changed. The major change is that Facebook now says that all information of an account will be deleted at latest 90 days after the user deleted the account, whereas the regulation in the old policy was somehow unclear, saying on the one hand that data is deleted, but on the other hand “that Facebook we may retain certain information to prevent identity theft and other misconduct even if deletion has been requested“.

New policy: “When you delete an account, it is permanently deleted from Facebook. It typically takes about one month to delete an account, but some information may remain in backup copies and logs for up to 90 days. You should only delete your account if you are sure you never want to reactivate it. You can delete your account at:
https://www.facebook.com/help/contact.php?show_form=delete_account
Old policy: “When you delete an account, it is permanently deleted from Facebook. [...] Additionally, we may retain certain information to prevent identity theft and other misconduct even if deletion has been requested. [...] Limitations on removal. Even after you remove information from your profile or delete your account, copies of that information may remain viewable elsewhere to the extent it has been shared with others, it was otherwise distributed pursuant to your privacy settings, or it was copied or stored by other users. However, your name will no longer be associated with that information on Facebook. (For example, if you post something to another user’s profile and then you delete your account, that post may remain, but be attributed to an “Anonymous Facebook User.”)  Additionally, we may retain certain information to prevent identity theft and other misconduct even if deletion has been requested. If you have given third party applications or websites access to your information, they may retain your information to the extent permitted under their terms of service or privacy policies.  But they will no longer be able to access the information through our Platform after you disconnect from them. Backup copies. Removed and deleted information may persist in backup copies for up to 90 days, but will not be available to others“.

On August 18, 2011, members of the initiative “Europe vs. Facebook” that was founded by Austrian law students filed a complaint against Facebook to the Irish Data Protection Commissioner. Facebook Europe is legally registered in Ireland. The initiative members made 16 complaint points and asked the Commissioner to check Facebook violates European data protection laws in these 16 privacy areas.

One point of complaint is that Facebook engages in excessive processing of data. One of the complainers demanded from Facebook to send him the data it stores about him. Although he had deleted his account, he received a print out with 1 200 pages of personal data stored about him by Facebook. This topic is addressed in the complaint under point 15: “After using facebook.com for 3 years, Facebook Ireland gathered more than 1.200 pages of personal information about me (in fact Facebook Ireland might hold a much bigger amount of data, see Complaint 10), even though I have deleted just about everything I could (e.g. all my posts, all messages, and many friends)”.

The Irish Data Protection Act says that data “(iii) shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they were collected or are further processed, and (iv) shall not be kept for longer than is necessary for that purpose or those purposes“ (DPA §2 (1) (c) (iii) (iv)). The EU Data Protection Directive regulates that ”Member States shall provide that personal data must be: […](c) adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed” (Directive 95/46/EC of the European Parliament, §6 (1) (c)).

Another complaint is that Facebook does not use opt-in options and thereby may breach the regulation that users have to give consensus to the processing of their personal data. This regulation is specifically important among other topics also for targeted advertising, which is organized without opt-in on Facebook. “2A. (1) Personal data shall not be processed by a data controller unless section 2 of this Act (as amended by the Act of 2003) is complied with by the data controller and at least one of the following conditions is met: (a) the data subject has given his or her consent to the processing or“ (Irish Data Protection Act, §2A (1) (a)). “Member States shall provide that personal data may be processed only if: (a) the data subject has unambiguously given his consent” (Directive 95/46/EC of the European Parliament, §7 (a)).

Facebook’s change of the data deletion regulations from rather ambiguous and unclear formulations to a clearer version may reflect the circumstance that a complaint against its privacy practices has been filed. This might be a direct reaction to the complaints filed by “Europe versus Facebook”, which were however filed on August, 18^th, 2011, whereas Facebook changed its policy on September 7^th. Therefore the old privacy policy is subject of the complaints. Furthermore it looks like many of the privacy areas addressed by the complaints have not been cleared out by the new privacy policy. “Europe versus Facebook” is not only a highly important initiative, it also shows that companies are unlikely to voluntarily protect users’ privacy, but to be only willing to do so if they feel the threat of the state’s law enforcement capacities. The profit motive is so inherent to companies that they always tend to put profit interests above users’ privacy concerns. The only two alternatives are to make use of the law for enforcing privacy protection and to support the creation of alternative non-profit platforms.

Facebook has changed the content sharing options, it is now relatively easily possible to define with whom one wants to share content and to share it only with customized users. This change is also reflected in the privacy policy (in the section titled “Control over your profile”). It is likely that it has been taken because Google in June 2011 introduced its own social networking site Google+, which poses competition to Facebook and is based on the “friend circles” concept that allows customization of content. Other new regulations include a section about tagging (“Tags”), the possibility for other websites to provide a login into their sites by enabling users to log in with their Facebook accounts (section “Logging in to another site using Facebook”), social plugins (section “About social plugins”), sponsored stories (section “Sponsored stories”), and featured content (section “Featured content”).

A new regulation is that Facebook says that it allows users to vote privacy changes under certain circumstances: “Unless we make a change for legal or administrative reasons, or to correct an inaccurate statement, we will give you seven (7) days to provide us with comments on the change. If we receive more than 7000 comments concerning a particular change, we will put the change up for a vote. The vote will be binding on us if more than 30% of all active registered users as of the date of the notice vote”.

This regulation is extremely unclear. One can interpret every imaginable privacy policy change as legal change, administrative change or change of an inaccurate statement. It is therefore arbitrary and unclear, on which changes Facebook users are able to vote or not. Furthermore no link for comments is provided. It is also unlikely that 30% of all registered users will ever engage in a vote because privacy policy matters are a complex issue. It looks like Facebook wants to respond to the criticism that users have no decision-rights about the privacy of their personal data, but at the same time wants to immunize itself against loosing control of decision making power.

We can summarize the changes of the Facebook privacy policy that took effect on September 7^th, 2011:

* The change of Facebook’s privacy policies has come shortly after members of the initiative “Europe versus Facebook” filed privacy violation complaints against Facebook to the Irish Data Protection Commissioner.
* The length and complexity of Facebook’s privacy policy has increased.
* Facebook has introduced new features like instant personalization that have increased the non-transparency of data storage. It is not clear for a user, which data Facebook stores about her/him, with whom Facebook shares user data, and which data exactly Facebook partners store.
* Facebook continues to receive data about users from other websites.
* Facebook continues to commodify user data by using targeted advertising. It does not use opt-in for advertising, targeted ads are automatically and always activated. Internet prosumer commodification continues to be Facebook’s capital accumulation model.
* Facebook has implemented a user participation mechanism in privacy decision-making that is formulated in an extremely shallow way so that this regulation seems to be an ideological pseudo-participation strategy.

Facebook founder and CEO Mark Zuckerberg is quoted saying: “The concept that the world will be better if you share more is something that’s pretty foreign to a lot of people – and it runs into all these privacy concerns”. He acknowledges that some people have “the vision of a surveillance world”. But he associates Google, not Facebook with surveillance. He says that Google’s strategy of data collection “is a little scary” and thinks that Facebook in contrast gives users control over their data. “Given that the world is moving towards more sharing of information, making sure that it happens in a bottom-up way, with people inputting the information themselves and having control over how their information interacts with the system, as opposed to a centralized way, through it being tracked in some surveillance system”.

Zuckerberg has repeatedly said that he does not care about profit, but wants to help people with Facebook’s tools and wants to create an open society. Kevin Colleran, Facebook advertising sale executive, says in the Wired story that “Mark is not motivated by money”. In a story by the Times (October 20, 2008, http://business.timesonline.co.uk/tol/business/industry_sectors/technology/article4974197.ece), Zuckerberg said: “The goal of the company is to help people to share more in order to make the world more open and to help promote understanding between people. The long-term belief is that if we can succeed in this mission then we also be able to build a pretty good business and everyone can be financially rewarded. […] The Times: Does money motivate you. Zuckerberg: No”.

Zuckerberg thinks that the only problem about Facebook surveillance is that other individuals get access to images or information of users that is not meant for being available to them. He also thinks that privacy control options will solve this problem. Facebook has tended to make ever more information available to all users as its standard setting. One cannot assume that all users are highly skilful in setting their privacy options. Zuckerberg ignores the skills divide in social networking site usage.

But the more crucial problem is that Zuckerberg fully ignores the economic power structures of the modern economy, into which Facebook is embedded. If Zuckerberg really does not care about profit, why is Facebook then not a non-commercial platform and why does it use targeted advertising? The problems of targeted advertising are that it aims at controlling and manipulating human needs, that users are normally not asked if they agree to the use of advertising on the Internet, but have to agree to advertising if they want to use commercial platforms (lack of democracy), that advertising can increase market concentration, that it is intransparent for most users what kind of information about them is used for advertising purposes, and that users are not paid for the value creation they engage in when using commercial web 2.0 platforms and uploading data. Surveillance on Facebook is not only an interpersonal process, where users view data about other individuals that might benefit or harm the latter, it is primarily economic surveillance, i.e. the collection, storage, assessment, and commodification of personal data, usage behaviour, and user-generated data for economic purposes. Facebook and other web 2.0 platforms are large advertising-based capital accumulation machines that achieve their economic aims by economic surveillance.

Facebook collects information about user behaviour on other sites for economic purposes: “We may ask advertisers to tell us how our users responded to the ads we showed them (and for comparison purposes, how other users who didn’t see the ads acted on their site). This data sharing, commonly known as ‘conversion tracking,’ helps us measure our advertising effectiveness and improve the quality of the advertisements you see. We may receive information about whether or not you’ve seen or interacted with certain ads on other sites in order to measure the effectiveness of those ads“ (Privacy Policy, April 22, 2010).

Facebook targets advertisement to individual users by surveilling their usage behaviour and interests: “We allow advertisers to choose the characteristics of users who will see their advertisements and we may use any of the non-personally identifiable attributes we have collected (including information you may have decided not to show to other users, such as your birth year or other sensitive personal information or preferences) to select the appropriate audience for those advertisements. For example, we might use your interest in soccer to show you ads for soccer equipment, but we do not tell the soccer equipment company who you are. […] We occasionally pair advertisements we serve with relevant information we have about you and your friends to make advertisements more interesting and more tailored to you and your friends. For example, if you connect with your favorite band’s page, we may display your name and profile photo next to an advertisement for that page that is displayed to your friends. We only share the personally identifiable information visible in the social ad with the friend who can see the ad. You can opt out of having your information used in social ads on this help page” (Privacy Policy, April 22, 2010).

Zuckerberg and Facebook ignore concerns about advertising settings. Facebook’s privacy policy is the living proof that Facebook is primarily about profit-generation by advertising. “The world will be better if you share more“? For whom, Mark Zuckerberg? “Sharing” on Facebook in economic terms means primarily that Facebook “shares” information with advertising clients. And “sharing” is only the euphemism for selling and commodifying data. Facebook commodifies and trades user data and user behaviour data. Facebook does not make the world a better place, it makes the world a more commercialized place, a big shopping mall without exit. It makes the world only a better place for companies interested in advertising, not for users.

Mr. Zuckerberg, if you are a man who stands by his word, and Facebook for you is really not about profit, then please abolish targeted advertising and any kind of advertising on Facebook tomorrow and transform Facebook into a non-commercial, non-profit Internet platform. Yours truly, Christian Fuchs.

On the Facebook blog, Mark Zuckerberg celebrates these changes: “We’ve focused on three things: a single control for your content, more powerful controls for your basic information and an easy control to turn off all applications. [...] Finally and perhaps most importantly, I am pleased to say that with these changes the overhaul of Facebook’s privacy model is complete. If you find these changes helpful, then we plan to keep this privacy framework for a long time. That means you won’t need to worry about changes. (Believe me, we’re probably happier about this than you are.)“.

There are no changes to targeted advertising, which shows that Facebook thinks that this form of advertising does not pose privacy threats. The privacy policy for example still allows Facebook to make use of data on users’ behaviour on other sites: “We may receive information about whether or not you’ve seen or interacted with certain ads on other sites in order to measure the effectiveness of those ads“ (Facebook Privacy Policy, April 22, 2010).

Targeted advertising is automatically enabled and cannot be disabled, there is neither an opt-in- nor an opt-out-option: “We allow advertisers to choose the characteristics of users who will see their advertisements and we may use any of the non-personally identifiable attributes we have collected (including information you may have decided not to show to other users, such as your birth year or other sensitive personal information or preferences) to select the appropriate audience for those advertisements. For example, we might use your interest in soccer to show you ads for soccer equipment, but we do not tell the soccer equipment company who you are. You can see the criteria advertisers may select by visiting our advertising page. Even though we do not share your information with advertisers without your consent, when you click on or otherwise interact with an advertisement there is a possibility that the advertiser may place a cookie in your browser and note that it meets the criteria they selected“ (Facebook Privacy Policy, April 22, 2010)..

Hidden inside of the privacy terms is a link to a page, where users can opt-out of the placement of cookies by 48 advertising companies. This link is hard to find and is not part of the general Facebook settings. “Advertisements. Sometimes the advertisers who present ads on Facebook use technological methods to measure the effectiveness of their ads and to personalize advertising content. You may opt-out of the placement of cookies by many of these advertisers here. You may also use your browser cookie settings to limit or prevent the placement of cookies by advertising network“.

Targeted Internet advertising is problematic due to several reasons:
* Users are not allowed to decide if they want to have advertising/targeted advertising on Internet platforms. This shows a democratic deficit – platform owners decide, users have to agree if they want to use the sites.
* Targeted advertising advances the total commodification and commercialization of the Internet.
* Targeted advertising tries to manipulate tastes, needs, and consumption behaviour.
* Targeted advertising just like all forms of advertising supports market concentration because the largest corporations are able to purchase much more ads than smaller ones and non-commercial and non-profit organizations.
* On commercial web 2.0 platforms, Internet prosumers are sold as commodity to advertising firms and are thereby economically exploited.
* It is not transparent to the user, which firms are allowed to present targeted advertising.
* Targeted advertising is legitimated by long and complex terms that are cumbersome to read and contain hidden options that are not shown in the general settings in order to enforce capital accumulation by making it more unlikely that users opt-out of certain advertising options (example: opt-out from the setting of cookies by advertising firms on Facebook).

Concerning economic surveillance and the privacy threats posed by it, nothing has changed on Facebook. So there are no reasons to celebrate Facebook’s ”new privacy model“. If, as Zuckerberg says, Facebook’s “privacy model is” now “complete” and should now be kept “for a long time”, then this means that the commodification and exploitation of Facebook users, the total commodification and commercialization of Facebook, economic surveillance, and the lack of democratic control of advertising by users (i.e. the existence of a Facebook advertising dictatorship) are here to stay.

The only viable alternatives to the Facebook privacy and surveillance threat are the creation of non-commercial social networking sites and legal frameworks that require commercial web 2.0 operators to implement opt-in advertising/targeted advertising solutions.