One of Facebook's biggest privacy debacles was also its first major foray into advertising -- the Beacon program. With Beacon, Facebook told users about their friends' purchases at retail sites like Blockbuster.com and Overstock. When Facebook launched Beacon, it did so on an opt-out basis, resulting in a host of irritated users who said they were blindsided by the new platform.
A group of users filed a lawsuit, which Facebook agreed to settle for more than $9 million. But the agreement had some catches. First, Facebook users won't themselves receive any compensation (except for the 19 who were named in the class-action complaint). Instead, Facebook will donate more than $6 million to a new privacy foundation. But that organization will be subject to considerable control by Facebook because one of the three people on the new foundation's board of directors will be the company's chief lobbyist.
The remainder of the settlement money is supposed to go to attorneys' fees for the lawyers who brought the case.
The social networking service also agreed to permanently shutter Beacon. But CEO Mark Zuckerberg said back in November of 2007, four weeks after Beacon's launch, that Facebook was revising the program by making it opt-in. In other words, Facebook had already promised to stop sharing data without users' permission.
One privacy activist and Facebook user, Ginger McCall (who also works at the Electronic Privacy Information Center), objected to the settlement. She said that users weren't benefiting from the deal, both because Facebook would wield a large degree of control over the new foundation and because the company had already retreated from Beacon by making it opt-in.
A trial judge approved the deal over her objection, but she took her complaints to the 9th Circuit Court of Appeals. That court held a hearing last week and, going by the audio file of the arguments, the judges who heard the case aren't thrilled with the settlement either.
“I had problems right from the get-go with this deal,” said Judge Andrew Kleinfeld as soon as Facebook's lawyer got up to argue. His colleague, William Fletcher, also expressed reservations about the deal. A third judge, Procter Hug, is expected to vote on the case but wasn't present at the argument.
Kleinfeld went on to specify the deal's drawbacks. Among others, many people who were affected by Beacon won't benefit by the settlement. Kleinfeld went on to offer some theoretical examples of users who might have been harmed: A church deacon who “appears to be a very respectable person” but has been “renting R-rated movies,” or a “liberal faculty member” whose movie rentals disclose that he's a fan of John Wayne.
“None of those people who were wronged get a nickel,” said Kleinfeld. “They get nothing. All they are is a vehicle for the lawyers to make money.”
Of course, monetary damages tend to be hard to prove in privacy cases. But the Beacon lawsuit involved violations of a specific federal law -- the Video Privacy Protection Act. That statute bans companies from sharing information about people's movie rentals without their permission and provides for damages of $2,500 per violation.
Another major concern about the settlement stemmed from Facebook's promise to shutter Beacon. Why, the judges wanted to know, was that a benefit when Facebook moved to an opt-in system a few weeks after it launched.
The answer, provided by the consumers' attorney, Scott Kamber, raised more questions than it answered. Kamber said that, despite Zuckerberg's November 2007 promise to make Beacon opt-in, the software never worked correctly. In fact, Kamber said, the system was so “broken” that Facebook continued to share information about people's purchases even when they had not explicitly consented.
“Do you mean that even people who didn't opt in were still having their privacy violated?” a judge asked.
“Yes,” Kamber replied.
Assuming that's true, it doesn't make the settlement better. If anything, it makes Facebook's conduct worse. It means that Facebook continued to share information about people's activity without their consent long past the time it promised to stop doing so.
Kamber's assertion also raises the question of why a class-action lawsuit was needed to force Facebook to stop violating people's privacy with Beacon when the company had already promised to do so on its own. The court system should demand some answers to those questions before any settlement in this lawsuit is finalized.