The New York Times recently reported on Facebook’s new advertising program, which lets advertisers advertise using the purchasing preferences of users along with their likenesses (their Facebook thumbnail photos). The Bits blog (of NYT) had follow up posts
here (“Facebook’s Privacy Problem”) and
here (“Are Facebook’s Social Ads Illegal”) raising some privacy concerns. Privacy expert/lawprof Dan Solove blogged about the legal issues
here,
here, and
here.
The root of the problem is this: Facebook broadcasts (or allows advertisers to broadcast) your purchasing preferences as endorsements. Actually, it’s a bit worse than that. Facebook allows advertisers to tell strangers about your actual purchases and uses your likeness somewhat prominently in doing so.
Here’s an example (from
Facebook's description and webapage):
(Facebook also tells your friends about your purchases with partner sites – like “Joe Smith just bought tickets to the Top Gun movie through Fandango” (
WSJ Law Blog.).)
Whatever the precise scope of the program, it’s clear that Facebook is operating in the grey area. The ensuing legal discussion focused on a few issues. First, whether Facebook’s consent mechanism was adequate – whether it was up front and whether it constituted “written” consent. The discussion also focused on the different torts that could come into play – was Facebook improperly disclosing private facts about you, or commercially exploiting your likeness? There was also the quirk that you could not globally opt out from this practice at Facebook, supposedly you had to opt out via each individual partner. (See the link in this SLOG
post.)
I didn’t see any discussion of Section 230. (I half say that in jest, but technically Facebook is making third party content available. I guess the outcome could also depend on whether the tort at issue fell under the scope of Section 230 immunity (see CCBill, etc.).) I’ll leave that discussion to
others. Also, recent decisions (Linden/Second Life) beating up on click-wrap agreements will very much likely come into play.
But the crazy part is that a look at
Facebook’s privacy policy leaves me befuddled about where exactly they obtain the user consent that they're obviously relying on. I didn’t see the actual language highlighted in much of the discussion.
Professor Solove earlier pointed to the provisions regarding user-posted content as potentially granting the consent, but I don’t think these are the provisions Facebook is relying on.
By posting User Content to any part of the Site, you automatically grant, and you represent and warrant that you have the right to grant, to the Company an irrevocable, perpetual, non-exclusive, transferable, fully paid, worldwide license (with the right to sublicense) to use, copy, publicly perform, publicly display, reformat, translate, excerpt (in whole or in part) and distribute such User Content for any purpose on or in connection with the Site or the promotion thereof, to prepare derivative works of, or incorporate into other works, such User Content, and to grant and authorize sublicenses of the foregoing.
It’s unclear actually, User Content is defined quite broadly in the Terms of Use as:
the photos, profiles (including your name, image, and likeness), messages, notes, text, information, music, video, advertisements, listings, and other content that you upload, publish or display (hereinafter, "post") on or through the Service or the Site, or transmit to or share with other users
I would argue that the purchasing preferences are not “uploaded,” “published,” or “displayed” by any user. They are actually published/compiled by the advertiser and Facebook. So they don't constitute "User Content".
There’s a section in their privacy policy dealing with Facebook’s use of information obtained by it which likely applies to Facebook’s newest ad campaign. It’s not really the model of clarity. I’ve pasted it below, and added my thoughts in italics:
Profile information you submit to Facebook will be available to users of Facebook who belong to at least one of the networks you allow to access the information through your privacy settings (e.g., school, geography, friends of friends). [This seems to limit the scope of availability of profile information -- which could include your purchasing preferences -- to someone in one of your networks.] Your name, network names, and profile picture thumbnail will be available in search results across the Facebook network and those limited pieces of information may be made available to third party search engines. This is primarily so your friends can find you and send a friend request. People who see your name in searches, however, will not be able to access your profile information unless they have a relationship to you (friend, friend of friend, member of your networks, etc.) that allows such access based on your privacy settings.
….
Facebook may use information in your profile without identifying you as an individual to third parties. [I think the fact that they showed the picture of the person along with their purchasing preference makes reliance on this language difficult.] We do this for purposes such as aggregating how many people in a network like a band or movie and personalizing advertisements and promotions so that we can provide you Facebook. We believe this benefits you. You can know more about the world around you and, where there are advertisements, they're more likely to be interesting to you. For example, if you put a favorite movie in your profile, we might serve you an advertisement highlighting a screening of a similar one in your town. But we don't tell the movie company who you are. [Unless of course, the movie company happens to look at Facebook??? I have a hard time believing that this is the language Facebook is relying on, but I think it is. It’s about as flimsy as a pair of flip flops you bought on your latest vacation.]
Wow. At the end of the day Facebook’s privacy policy is neither here nor there. It doesn’t clearly deal with the legal issues and call out what “rights” are waived (e.g., “in connection with these ads you grant facebook a license to
use your image, likeness, and personality, and waive any claims based
on appropriation of your personality or any other privacy or
publicity-based claims”)
. Nor does it explain to the average reader what Facebook will or won’t do with your profile information. Maybe they should have come right out and said: “we will create banner ads with your thumbnail photo showing products you purchased.”
At the end of the day people probably don’t read the privacy policy. And there are some procedural unconscionability-type arguments to be made here.
But you can bet it’s going to be parsed in a court, and that’s not going to be terribly fun.
Comments