• by Wendy Davis  @wendyndavis, June 2, 2008

A Canadian advocacy group has filed a privacy complaint against social networking site Facebook, accusing the company of collecting more data than it needs and sharing it without users' express permission.

"Facebook does not make a reasonable effort to advise users of the purposes for which their personal information is used," the group stated in its 36-page complaint. "Facebook also does not advise users of the extent of their personal information that will be shared by joining a network."

A Facebook spokesperson denied the company is violating Canadian law. "We've reviewed the complaint and found it has serious factual errors--most notably its neglect of the fact that almost all Facebook data is willingly shared by users," the spokesman said.

The organization that filed the complaint, the Canadian Internet Policy and Public Interest Clinic, is asking Canada's privacy commissioner to probe whether the company is violating a Canadian law that limits the circumstances under which companies can collect information about consumers.

The commissioner, Jennifer Stoddart, has up to one year to investigate. If she finds Facebook is violating Canadian law, she has the power to suggest specific recommendations and to take it to court to force it to comply.

Facebook, which also has come under fire in the U.S. for potentially violating users' privacy, recently added controls to the site that give users more power over who can see their photos or other information. But the group that filed the complaint contends that some of these controls can be difficult for users to figure out.

"Facebook purports to be privacy-friendly," said Philippa Lawson, executive director of the clinic that filed the complaint. "They're exaggerating the amount of control that users have."

Many of the specific allegations stem from Facebook's default settings, which are set in favor of sharing information. Users can change these settings to keep data confidential, but the complaint alleges that members don't always realize they must take action to keep information private.

Lawson said that Facebook could cure many of the alleged privacy defects simply by tweaking its default settings. "These should be all set to no sharing, so that when people join Facebook, they have to go in and actually make positive, real choices about who they're going to share with," she said.

The petition specifically mentions the company's two major ad platforms: Beacon, which tells users about their friends' purchases, and SocialAds, which tells people which of their friends are "fans" of particular marketers.

When the programs were launched, users who didn't want to share information about e-commerce activity via Beacon had to opt-out on a purchase-by-purchase basis, and there was no way to opt-out of SocialAds. Facebook has since revised both programs, and now requires users to opt-in to Beacon while allowing them to opt-out of SocialAds.

But the complaint contends that Facebook SocialAds should also require users' express opt-in consent--especially because many Facebook users are teens who might not read or understand the privacy policy. "Many of these users are unaware of the potential dangers of sharing personal information," the complaint asserts. "The privacy policy is long and many users will likely not read the clause that indicates that personal information is used for the purpose of Social Ads."

The U.S. doesn't have a broad nationwide privacy law, but Facebook has come under fire here as well for disclosing information that users assumed was confidential.

Beacon program has already sparked one lawsuit, by Texas resident Cathryn Elaine Harris against movie rental company Blockbuster. Harris alleges that Blockbuster violated the federal Videotape Privacy Protection Act by sharing information about her movie rentals and sales with Facebook without first obtaining her written consent.

In addition, Facebook recently was embarrassed by an article in The New York Times that detailed how difficult it was to delete profile information. After that, the site made it easier for users to purge material.

Lawson said her organization also plans to investigate whether other Web companies violate the country's privacy law. "There's good reason to suspect that other social networking sites are afoul of Canadian law," she said. "If we have the resources, MySpace will be the next one."