• by Wendy Davis  @wendyndavis, May 13, 2010

It's not just U.S. officials who find Facebook's new privacy policy problematic. European privacy regulators also are criticizing the social networking site for "unacceptable" default settings that took effect last December.

The EU's Article 29 Working Party said this week that it told Facebook it must reset its defaults so that "access to the profile information and information about the connections of a user is limited to self-selected contacts." The group specifically added that search engines should not be able to access users' data without their express consent.

In addition, the Working Party said that social networking services should give users control over the data that third-party developers can access. The regulators also emphasized that it would be unlawful for applications to obtain Facebook members from their friends. "Providers of social networking sites should be aware that it would be a breach of data protection law if they use personal data of other individuals contained in a user profile for commercial purposes if these other individuals have not given their free and unambiguous consent," the Working Party stated.

Last December, Facebook stirred controversy by revising many of its privacy default settings to share-everything-with-everyone. The company also reclassified a host of users' data as publicly available.

More recently, Facebook again riled critics by rolling out new features, including "instant personalization," which shares users' names, photos, friend lists and other information with the outside companies Yelp, Microsoft Docs and Pandora. Users can opt out of the feature, but privacy advocates and other observers say Facebook should have launched it on an opt-in basis.

The changes have resulted in lawsuits in the U.S. and at least two complaints at the Federal Trade Commission. In addition, Sen. Chuck Schumer (D-N.Y.) publicly urged the company to obtain users' explicit consent to instant personalization.