 |
| © Aaron P. Bernstein/Reuters Facebook CEO Mark Zuckerberg testifies before a Senate Judiciary and Commerce Committees joint… |
By Alyssa Newcomb, NBC News
Facebook is having another tough week.
The social media company is under renewed scrutiny over its handling of user data after The New York Times reported on Sunday that smartphone manufacturers had been given access to the private information of Facebook users without asking their permission.
The story received a swift response from Facebook, which published a blog post entitled "Why We Disagree with The New York Times" and even took the rare step of using Twitter to respond to critics and answer questions.
That response was not enough for Sen. Mark Warner, D-Va., who said at an event hosted by Axios on Tuesday that he wants Facebook to "come clean with the whole story in the first 24 hours."
In particular, Warner asked if Facebook shared data with Chinese smartphone manufacturers.
"Did Facebook share that information with Chinese companies like Huawei?" Warner said. "I think Facebook owes us that answer."
The manufacturers' deals with Facebook allowed dozens of companies, including Apple, Microsoft and BlackBerry, to recreate a mobile version of Facebook for their users, according to Facebook. Some of the deals date back more than a decade to before cellphones could host apps, creating the need for Facebook to work with phone manufacturers to create mobile-friendly experiences for its social network.
Ime Archibong, vice president of product partnerships, said in Facebook's blog post that many of these experiences are no longer needed, since the use of apps on iOS and Android is now widespread. As a result, he added that Facebook had already ended 22 of these partnerships and began winding them down in April.
"These partners signed agreements that prevented people's Facebook information from being used for any other purpose than to recreate Facebook-like experiences," Archibong said.
Facebook faces real consequences from the Federal Trade Commission for these revelations. The social media giant agreed to a consent decree in 2011, which was designed to protect users from having their Facebook data shared with third parties without their consent, said Lindsey Barrett, an incoming clinical fellow and staff attorney at the Institute for Public Representation's Communications & Technology Clinic at Georgetown Law.
"The consent decree required Facebook to obtain consumers' affirmative express consent before enacting changes that override their privacy preferences," Barrett said. "Some of the deals with the device companies did exactly that — the companies could access detailed information on users and their friends even if the user hadn't given Facebook permission to share their information with third parties."
The FTC is already probing whether Facebook violated the consent decree. At issue are Facebook's app permissions that gave developers access to not only a user's data, but that of their friends. The issue came to light after it was revealed Cambridge Analytica, a data analysis firm that worked with President Donald Trump's campaign, used apps as a way to harvest data on Americans before the U.S. presidential election.
If the FTC finds that Facebook violated that agreement, it could face a record fine.
While Facebook has already admitted fault with how it handled data collection by connected apps, the situation with phone manufacturers is different — but could still run afoul of its FTC deal.
At issue is the question of whether the smartphone makers should be viewed as third parties or if Facebook was right to consider them as service providers.
"Facebook's response is that they consider device companies service providers as opposed to full third parties, and that the consent decree gives them more leniency in their dealings with service providers," Barrett said. "I'm not sure that argument holds water, and it doesn't help that Facebook has yet to release the full list of companies that were engaged in these partnerships."
Facebook said their agreements with smartphone manufacturers held them to strict rules and the company is not aware of any abuses.
"Partners could not integrate the user's Facebook features with their devices without the user's permission. And our partnership and engineering teams approved the Facebook experiences these companies built," Archibong said in a blog post. "Contrary to claims by The New York Times, friends' information, like photos, was only accessible on devices when people made a decision to share their information with those friends."
Apple was one of the few brands Archibong mentioned in his newsroom post. On Monday, Apple CEO Tim Cook said the iPhone maker requested "zero" personal data in its deal with Facebook.
"We weren't in the data business. We've never been in the data business," Cook told NPR Monday afternoon, after he delivered the keynote at Apple's annual developer conference in San Jose, California.
Hi @SenBlumenthal, You raise an important issue but NYT is wrong on this point. Blackberry, Amazon, Microsoft etc could not integrate people’s FB information with their devices without that person’s permission. https://t.co/IXVTAScpww— Facebook (@facebook) June 4, 2018
On Monday, New York Attorney General Barbara Underwood said her office would expand its investigationinto Cambridge Analytica's reported misuse of Facebook user data to include Facebook's data sharing with hardware manufacturers.
Barrett said she expects that Facebook will face "renewed scrutiny and public pressure, as they well should."
"This highlights the limits of relying on individual user controls to protect privacy writ large. It's like clean air and clean water," she said. " If your data is only as safe as the most unreliable actor in your ecosystem — say, your most share-happy Facebook friend — there is no functional means for any individual to protect herself beyond throwing her phone into the ocean."
Barrett said she expects that Facebook will face "renewed scrutiny and public pressure, as they well should."
"This highlights the limits of relying on individual user controls to protect privacy writ large. It's like clean air and clean water," she said. " If your data is only as safe as the most unreliable actor in your ecosystem — say, your most share-happy Facebook friend — there is no functional means for any individual to protect herself beyond throwing her phone into the ocean."
