FTC Probes Facebook's EPIC Privacy Fail

A privacy watchdog's criticisms of Facebook appear to have captured the attention of the Federal Trade Commission.

In a letter dated Jan. 14, David Vladeck, head of the FTC's Bureau of Consumer Protection, told the Electronic Privacy Information Center that its complaint about recent privacy changes at Facebook "raises issues of particular interest for us at this time."

Vladeck added that he has asked an official to arrange a followup meeting with EPIC, but also said he can't currently confirm or deny whether the FTC has opened an investigation. FTC investigations are not public until the agency either issues a complaint or closes the matter.

The FTC's consumer protection chief also said in his letter to EPIC that the commission plans to focus on privacy issues raised by social networks at the next roundtable, scheduled to be held in Berkeley, Calif. on Jan. 28.

"As the amount of personal information shared on social networking sites grows, and the number of third parties and advertising networks with access to such information grows, it is important that consumers understand how their data is being shared and what privacy rules apply," Vladeck wrote. "The Commission staff believes it is critical that companies provide transparency about how this data is being handled, maintained, shared, and protected, and what steps consumers may take to control the use of their information."

Last month, EPIC and nine other groups filed a complaint alleging that Facebook's new privacy settings constitute an unfair and deceptive change in terms. The groups say that Facebook's decision to institute the new controls violates users' expectations and diminishes their privacy. The new settings classify a host of data as "publicly available information" -- including users' names, profile pictures, cities, networks, lists of friends and pages that people are fans of.

EPIC late last week filed a supplemental complaint that mentions Vladeck's letter. The new papers also highlight recent statements made by Facebook CEO Mark Zuckerberg and an anonymous employee.

In an interview earlier this month, Zuckerberg said that new social norms justified the company's decision to change its privacy settings. "People have really gotten comfortable not only sharing more information and different kinds, but more openly and with more people," he said. "We view it as our role in the system to constantly be innovating and be updating what our system is to reflect what the current social norms are."

In addition, a Facebook employee allegedly said recently that users' messages are stored in a database regardless of whether users attempt to delete them. "We track everything. Every photo you view, every person you're tagged with, every wall-post you make, and so forth," the employee allegedly added.

EPIC alleges that these public statements demonstrate that Facebook engages in unfair and deceptive trade practices.

The new filing also questions a new iPhone synching feature that transfers users' iPhone contacts to Facebook, even when the phone contacts are not Facebook friends with the users. "Some Facebook users and non-Facebook users have consciously chosen not to provide Facebook with their contact information. This choice is rendered meaningless with the sync function of the application, because information from all phone contacts will be transferred to Facebook if the sync function is enabled on an iPhone," EPIC alleges. "There is no privacy setting on Facebook that allows Facebook users to prevent having their information shared in this way."

Facebook spokesperson Andrew Noyes said that EPIC's latest filing "offers little or no new information to substantiate the claims they make."