Why we'll never escape Facebook

Written by James Cowan, Canadian Business Magazine

After a spring of skirmishes between Facebook, its users, international privacy watchdogs and Internet activists, two things have become clear:

  1. You should quit Facebook.
  2. You probably won’t.

The case for quitting is strong. Critics allege Facebook changes privacy policies at whim, makes it difficult to control personal information and hoards users’ data. They also claim that Mark Zuckerberg, the company’s 26-year-old founder is a false prophet who claims his generation values openness, and casts anyone who cares about privacy as an old-fashioned fuddy-duddy.

These arguments are made convincingly and often. Yet users don’t seem to care. The site added 30 million new users in May alone, according to Inside Network, a research firm. More than 912,000 Canadians joined the site in May, a 6% hike in membership, along with close to 7.9 million Americans. Facebook this spring overtook Google as the most visited site in the world. Roughly 55% of the people who visited a social networking site last month used Facebook, compared with 16% who usedYouTube, the second-most-popular site in the category. Roughly 41% of all Americans now use Facebook; in Canada, the number now sits at 47.9%. Facebook will soon have 500 million users, more people than live in the United States, Canada, the United Kingdom, France and Spain combined.

Whether we like it or not, the battle over privacy has already been fought. Facebook won. “The days of being anonymous on the Internet are gone, unless you take steps to be anonymous,” says David Fewer, director of the Canadian Internet Policy and Public Interest Clinic. “You used to have to give your permission to be tracked. Now, these businesses have models where you opt out of being tracked. The onus has switched.”

Facebook is different from almost any other product or service in the enormous degree of emotional and time investment it demands from its users. The average American Internet user in January spent 14 minutes on Facebook each day, up from 11.5 minutes just four months earlier. It’s become a cornerstone of people’s lives, a component of their identity and not something they’ll toss away over abstract concerns over who might see their baby photos. Protest movements may claim a few defectors, regulators may impose minor restrictions that will prove useless in the face of the Internet’s rapid change, and competitors may promise better networks, but Facebook is currently a Goliath without a David.

Zuckerberg has long cast the transition to “opt-in” privacy as a social good rather than a part of Facebook’s business model, which it clearly is. Famous for his unvarying wardrobe of T-shirts and hooded sweatshirts, Zuckerberg looks and talks like a spokesman for the Internet generation. Born in 1984 and raised in the suburbs of New York, Zuckerberg was a geek from the get-go. (He had aStar Wars€“themed bar mitzvah.) He was MVP of his private high school’s fencing team, can read and write in five languages and arrived at Harvard in 2003 with a heap of academic awards.

Neither his sartorial sense nor sense of humour has evolved much since university; he reportedly wears rubber sandals to board meeting, and his business card once read: “I’m CEO€¦bitch.” David Kirkpatrick, author ofThe Facebook Effect, an authorized history of the company, writes, “It’s not that he sets out to break the rules; he just doesn’t pay much attention to them.” (You’d be forgiven for thinking that Zuckerberg doesn’t sound like the ideal candidate to serve as gatekeeper of one of the world’s fastest-growing databases of personal information.) He has never been a compelling public speaker — he lacks the zeal of Steve Jobs or the earnest thoughtfulness of Bill Gates — Zuckerberg still occasionally ventures forth to preach the virtues of a more open world. “People have really gotten comfortable not only sharing more information and different kinds, but more openly and with more people. That social norm is just something that has evolved over time,” he told a technology conference in January. Zuckerberg’s own Facebook bio reads: “I’m trying to make the world a more open place” and lists “Openness” among his interests.

Unfortunately, only 381 out of Facebook’s half-billion users share that particular interest, a bit of trivia which begins to hint at the flaw in Zuckerberg’s rhetoric of openness. Facebook has not simply benefited from the zeitgeist — it has shaped the zeitgeist to suit its own needs. Since its founding in 2004, it has prodded and cajoled people into making their information more public, forcing online culture to conform with its own corporate interests. The company thrives on advertising revenue, on pooling users’ information and using that data to target ads at very specific demographics. Knowing your age and gender helps somewhat. Knowing that you enjoyed the last Black Eyed Peas record, shop at the Gap, went to the University of Toronto and love to garden helps more. Facebook knows who its members are dating, when they break up, when they change jobs and when they move.

“Facebook’s patrons are not its customers. We’re its product,” says Fewer. Facebook displayed 176.3 billion ads in the first three months of 2010, more than industry leader Yahoo, according to comScore, a market-research firm. Forecasters predict Facebook will exceed US$1 billion in revenue this year, up from roughly US$650 million in 2009. With its market valuation more than doubling in less than a year, from US$10 billion in July 2009 to US$22 billion last month, Facebook needs users to keeping on sharing.

And people, so far, seem happy to share. There are now 25 billion bits of information, from web links to photo albums, shared on the site each month. When Zuckerberg announced in April changes designed to strengthen connections between Facebook and the wider web, the company further increased the size of its online real estate. By introducing the company’s familiar “Like” buttons on outside sites, even more people would engage with Facebook, increasing its appeal for advertisers. The “Like” buttons onIMDB, a movie information site, were used more than 350,000 times in their first two weeks, while 100,000 sites used new software to link themselves with Facebook. The NHL’s site, for example, saw traffic from Facebook increase 80% as users viewed pictures, articles and videos. Meanwhile, the new “instant personalization” feature, which uses Facebook data to personalize users’ experiences on outside websites, means Facebook could soon find itself at the hub of everything from online dating to travel sites to polling. “These are ultimately the places where Facebook is going to make money on their services: connecting with other people, connecting users with advertisers and sharing information,” says Michael Gartenberg, a partner with the Altimeter Group, a California-based technology advising firm.

Critics don’t hate these new services so much as the way they were implemented. Controversy came when Facebook decided it would subscribe all its users to the new service, forcing them to opt out if they didn’t want their likes and dislikes shared with the wider web.

While many of the concerns expressed in the media and online are valid, some are also sheer paranoia, likely driven by a misunderstanding of how Facebook handles the information it collects. Advertisers are never handed a list of users in their chosen demographic. Instead, Facebook promises to show the ad to the appropriate users and then reports on the results. Because of this, it doesn’t really matter whether a person’s hometown or love of Italian cooking is made public or private. Facebook still knows — and targets its ads accordingly.

“The targeting is not affected by whether your information is available to everyone or just friends, or friends of friends,” says Debbie Frost, director of communications and public affairs for Facebook. “The advertisers never learn anything about our users. If I’m a manufacturer of tents, and I want to target people ages 20 to 30 who like camping, then I can do that. The report I get from Facebook says my ad was shown 80,000 times to people who fit that demographic.”

While Facebook doesn’t sell users’ information to advertisers, it remains unclear what happens to the personal data harvested by the dozens of games, quizzes, personality tests and other time wasters that clutter Facebook. Produced by third-party developers, these games do not necessarily adhere to Facebook’s privacy rules, meaning that cute virtual pumpkin patch you’ve been tending could be a front for a data-mining operation. And even if users didn’t partake in these third-party applications, their information could still be collected if friends were playing. In a recent FTC filing, U.S. privacy groups complained about Facebook’s relationship with third-party developers, deriding its decision to allow them to now retain users’ information for more than 24 hours. This is one of the largest complaints about Facebook, that ever-shifting privacy commitments mean users sign up expecting one level of protection, only to have the rules change in six months. It is not unlike Ford selling you a car, then showing up six months later and announcing you can no longer have air bags. The company has made commitments to no longer tinker with users’ privacy settings — as it has done in the past — and to try to maintain a more consistent privacy policy in the future. “We’ve made a commitment that once you’ve made those choices, new products and services will align with what you choose,” Frost says.

But Facebook still benefits from cultivating users willing to share more and more information. Each time someone lists an interest or clicks a “Like” button, that information gets added to the database, slowly creating increasingly sophisticated profiles of Facebook users and making it possible to focus advertising with pinpoint precision. If you don’t like being treated as nothing more than a set of ad-consuming eyeballs, the solution is not to tighten your privacy settings. It’s quitting Facebook altogether.

Zuckerberg’s business strategy from the outset seems to involve transgressing first, than asking for forgiveness. People become addicted to the service and see that dependency exploited in subtle ways. So far, it’s a strategy that has worked. Zuckerberg’s first privacy snafu pre-dates Facebook. While at Harvard, he created an application called “Facemash,” using information stolen from online campus directories. The Facebook prototype had a sophomoric twist; users were shown photos of two classmates and then asked to vote on which was more attractive. School administrators closed the site within days and hauled Zuckerberg before Harvard’s administrative board on accusations of breaching security, violating copyright and breaching individuals’ privacy. He was placed on probation.

When Facebook (or Thefacebook, as it was then known) launched three months later, Zuckerberg appeared to have a new-found respect for privacy. Only students with a Harvard e-mail address could join, and they could limit access, barring everyone except other people in their residence if they wished. One of the company’s earliest privacy policies stipulates: “No personal information that you submit to Thefacebook will be available to any user of the Web Site who does not belong to at least one of the groups specified by you in your privacy settings.” Published in 2005, the policy is plainly written and less than 1,000 words. The company’s current privacy policy is 4½ times that size, making it — as myriad news stories have noted — longer than the U.S. Constitution.

The problem is not only that Facebook’s rule book is increasingly complex, but also that the rules often change without warning. In 2006, Facebook introduced its “news feed” feature. Instead of having to visit friends’ pages for news, information about breakups, job changes and other life events were aggregated directly on users’ home pages. Having personal information suddenly broadcast bothered some users, and there was a rebellion. One million of the site’s users joined anti-news-feed protest groups and plans fomented for a “Don’t Log Onto Facebook Day.” The uproar makes Facebook’s current controversy look puny. One in 10 protested the news feed four years ago, which remains a central feature of day-to-day life on Facebook. In protest over recent privacy changes, over 28,000 Facebook users committed to deleting their accounts on May 31. That’s only one in every 22,000 users.

If the news-feed fight makes current Facebook protests look impotent in comparison, it also made clear Zuckerberg’s standard response to controversy. In the case of the news-feed backlash, Zuckerberg posted a message on the company’s blog headlined “We really messed this one up.” The news feed was designed to “provide you with a stream of information about your social world,” Zuckerberg said. “Instead, we did a bad job of explaining what the new features were and an even worse job of giving you control of them.” His words echoed an old politician’s trick, apologizing for how his actions were interpreted rather than the sin itself.

Then, in 2007, the company introduced its Beacon program as part of its first big advertising drives. The service reported information about users’ activities on partner sites. If you rented a movie from Blockbuster or purchased something at eBay, that information would appear on your Facebook page. Beacon spurred two class-action lawsuits — one against Facebook and its partners, another targeting Blockbuster — charging the service violated privacy laws because it required users to manually opt out of participation. Nearly two years later, Facebook paid $9.5 million to settle the suit and shuttered the Beacon program for good. However, it has already launched Facebook Connect, a similar program with better privacy controls. In 2007, Zuckerberg posted a now-familiar refrain on the company’s blog: “We simply did a bad job with this release, and I apologize for it.” Zuckerberg finds it easier to ask for forgiveness, rather than permission.

All Facebook’s previous privacy battles were a mere prelude to what happened on April 21, when Zuckerberg strolled on to the stage at a developers’ conference in San Francisco and let loose. He unveiled “instant personalization,” which shared personal information with music site Pandora and Yelp, a review site, and then tailored the content displayed on those sites to the user’s interests.

External websites are also now able to place “Like” buttons beside their content, allowing Facebook users to flag articles and information for their friends. Furthermore, software developers who make programs that run on Facebook, like the popular game Farmville or personality quizzes, would be allowed to store the information for more than 24 hours, a reversal of a previous company policy. Days before the developers’ conference, the company began its push toward “Connected Profiles,” which required information like a user’s hometown, education and interests either be made publicly available or removed from the profile. The final change became a focal point for public anger, with allegations the company was forcing users to over-share about their lives. Users seem to forget that participating in Facebook is an option, not mandatory. It can’t over-share information it’s not told.

The controversy brought renewed scrutiny to Facebook’s privacy policies as a whole. Rapid growth, a pile-up of new features and ad hoc responses to previous privacy concerns meant the site’s privacy controls had become maddeningly complex, with users required to navigate 50 different settings and 170 different options. Soon, the media was reporting a “Facebook backlash,” as publicity forQuit Facebook Dayspread and high-profile geeks like pundit Leo Laporte, entrepreneur Jason Calacanis and Peter Rojas, the co-founder of Engadget, closed their accounts. A question-and-answer published in theNew York Timeswith Elliot Schrage, vice-president of public policy, was meant to placate concerns but came across as dismissive. “We know that changing Facebook — something people have demonstrated is important to them — can be unsettling,” Schrage wrote. Many disliked Schrage’s tone, but the message was no different than Zuckerberg’s in the past: we screwed up on the implementation, not the idea.

One could question whether Facebook goofed at all. The public embraced the changes announced in April. Yet, faced with a mounting pile of negative press, Zuckerberg announced changes designed to simplify the site’s privacy settings. Nonetheless, the site’s default settings still encourage people to share their status updates, photos and videos. Having been derided in the press, villainized online and even sued, Zuckerberg still contends the world still needs to become a more open place. “Maybe I’m in denial,” a sweaty and shell-shocked Zuckerberg told a tech conference in early June. “I think our goals haven’t really changed that much at all.” Zuckerberg still casts Facebook as a public good, improving the world by encouraging us to open the blinds and let the sun shine in on our private lives.

Facebook’s position, while self-serving, is not without merit. Only one-third of Internet users worry about how much information is available about them online, compared with 40% in 2006, according to recently released research by the Pew Internet and American Life Project. Just 4% of Internet users reported having something embarrassing posted online. Furthermore, 22% of all Internet users say that five or more pieces of personal information about them, such as birth date, home address or cellphone number are available online, with the number increasing to 32% for people between the ages of 18 and 32, or Zuckerberg’s generation.

One of the most enduring myths about Facebook is that it exploits young people too stupid and inexperienced to know better. True, a recent study did find 42% of respondents between the ages of 18 and 29 could not answer a single question about privacy law correctly. But the same study found young people were just as likely to read sites’ privacy policies as older respondents. Furthermore, the Pew study found people between the ages of 18 and 29 were most likely to limit the information about them on social networking sites, with 71% taking precautions compared with 62% of people between the ages of 30 and 49. “Young adults are more active in managing their online identities and reputations,” says Mary Madden, a Pew senior research specialist. “While it may appear to older adults or the public at large that they’re making choices that are very liberal, they are paying a lot of attention to their self-presentation.”

This may all bolster Zuckerberg’s case for openness while quashing the concerns of nervous privacy advocates fretting for our troubled youth. But if young people were the most savvy about social networking, they were also the most distrustful. When asked how much of the time you can trust social networking sites, 28% said “never,” while only 2% said “just about always.” (The largest cohort, 51%, said “some of the time.”) In comparison, only 19% of users between 30 and 49 said they’d never trust Facebook or similar sites.

Privacy activists remain understandably skeptical about Facebook’s true motives. Led by the Electronic Privacy Information Centre, a research group based in Washington, 15 similar groups filed a complaint with the Federal Trade Commission in early May, alleging Facebook’s instant personalization program violated privacy rights by automatically subscribing users. On the day after Zuckerberg announced the company’s latest concessions to privacy concerns, the groups, with names like the Privacy Rights Now Coalition and the Centre for Digital Democracy, held a conference call to explain everything that Facebook was still doing wrong. The list was lengthy, from forcing users to opt out of instant personalization to inadequate monitoring of outside applications. “We shouldn’t lose sight of the fact that, despite the procedural improvements, the substance does remain largely unchanged,” said Chip Pitts, president of the Bill of Rights Defense Committee and a Stanford law professor. “The default settings remain vastly more open to the world than the prior incarnations of Facebook that allowed it to get the 400 million, 500 million users that it now has.”

Four U.S. Senators in April sent a letter to Facebook demanding further privacy changes. In a press release, they declared social networking sites “a Wild West of the Internet,” adding “users need ability to control private information and fully understand how it’s being used.” American activists look to Canada as proof that regulators can provide order to the lawless web. Canadian Privacy Commissioner Jennifer Stoddart last year wrung concessions from Facebook, including the introduction of a method to permanently delete an account. But the Internet moves quickly, and government regulators are lumbering. Even Fewer, whose Canadian Internet Policy and Public Interest Clinic filed the complaint that led to Stoddart’s actions, says regulation is only a partial solution to the public’s concerns. Further class-action lawsuits, like the ones that torpedoed Beacon, could have an effect. Ultimately, it will take the emergence of a viable competitor to force Facebook to change. “Competition in the marketplace provides the greatest incentives for businesses to provide secure, competitive products,” Fewer says. “You’ve got a crappy product, you’ve got one that doesn’t respect your privacy, you’ve got a product with weekly security issues — people will leave you when a new product comes along. Not even a better product, just a new one. The warts I don’t know about might be better than the ones I do know.”

Sadly, there is no social network yet ready to steal all of Facebook’s friends. Media hype in recent weeks has focused on upstarts like Diaspora and Appleseed, but neither will be operational until this summer (at least). Existing competitors like MySpace have already been deemed passé by the Internet elite. And even if a rival service emerges, the structure of Facebook will make it difficult for users to kick their habit. Zuckerberg has convinced Facebook users that openness means the freedom to share the trivialities of daily life. But on the wider Internet, openness has long meant the ability to move information freely from one spot to another with minimal hassle. And by that definition of openness, Facebook is remarkably closed. Anyone who has ever tried to export a photograph or a contact list knows that once information is fed into Facebook, it is remarkably difficult to dislodge. Having committed all this time to building a home on Facebook, it is unlikely that users will want to start anew elsewhere, even if Diaspora or MySpace or any of the other sites now billing themselves as privacy-friendly versions of Facebook prove viable. There are plenty of valid reasons to leave Facebook, but it’s got some high walls around it. For its growing population, it may just prove easier to stay.

Originally appeared on