Tell Congress to Protect Our Personal InformationLearn More About Unauthorized Access to Data
It seems almost every week there are new revelations about Facebook’s data use and sharing policies. The Federal Trade Commission is currently investigating Facebook for a potential consent decree violation related to the release of user data to Cambridge Analytica. The new allegations of data misuse in the New York Times this week may also be a violation of the consent decree. They are at least worthy of FTC investigation. And the cache of previously sealed litigation documents published by a British Member of Parliament earlier this month seem to indicate that Facebook may have been strategically withholding this valuable data from “strategic competitors” such as upstart Vine. Taken together, the two stories paint a frightening picture. Was Facebook granting access to private user data to cement its market position, offering it up to the powerful and wielding it as a cudgel against potential competitors? At the close of the current investigation, the FTC should demand remedies that protect users’ privacy while encouraging competition on the Facebook platform and against Facebook itself.
Facebook is in many ways a great product. This is why the FTC investigation and remedies are so important. If the Facebook product were only harmful and not useful or beneficial to users, the solution to its privacy and competition concerns would be simple: Stop using Facebook. But because the platform provides an important way to reach friends, organize events, and share photos, the government must act not only to make Facebook work for users, but to make sure that the next great communications platform has the opportunity to disrupt Facebook’s powerful position and compete. To that end, Public Knowledge supports comprehensive privacy legislation and sector specific structural regulation for dominant platforms, in addition to strong enforcement of our current laws.
Based on the FTC’s rules for consent decree violations, it’s likely the FTC will levy a hefty fine on Facebook. But more important will be the behavioral and structural remedies they impose. I expect the FTC and Facebook will reach a settlement for a new consent decree, as this is common practice to avoid long and expensive litigation. This means the FTC will have broad authority for the types of remedies it can seek, and will be limited only by whether Facebook finds the remedy preferable to an expensive and uncertain trial. This, together with the large fining authority, offers the FTC a very significant stick to push Facebook to accept strong remedies in the consent decree.
Since the original Cambridge Analytica problem was a release of data to a third party application on the platform, its likely the FTC will address protections for user data in third party apps. It may be tempting to solve this problem by banning connections to third party apps altogether. But this would have the unintended consequence of limiting potential competitors for some of Facebook’s key features. Facebook’s privacy violations should not be used to further insulate the platform and entrench their market power. Third party apps and partners may be important sources of actual or potential competition for the social media platform. Indeed, it appears Facebook may have recognized this when it created a list of “strategic competitors” from whom to withhold certain data and support. Although it may seem unbelievable that a small upstart like Vine could one day challenge Facebook, beginning in one “vertical” such as micro-videos or restaurant recommendations and then expanding is one of the few methods available to compete against large platforms like Facebook. This method of competition must be protected.
At the same time, Facebook must not be allowed to trick users with unclear notice or jargon-filled privacy policies. Facebook also should not be choosing winners and losers on its platform by sharing user data with certain companies it selects and not others. Facebook needs a data portability and interoperability tool that allows users to choose exactly which data to share and with what companies they will share it. Facebook should not get to decide what happens to user data. Users should decide.
Users may want to share their “social graph” (their list of friends) with other services that might compete with Facebook. This is useful when joining a new service so that the service can help you identify which of your friends are using that service and connect with them. This was the data that Facebook appears to have withheld from Vine, according to the litigation documents published in the UK. For some data, it will be important to think through the rights that users have in data that other users want to share. For example, sharing the social graph shares not just data about that one user, but about the users they are “friends” with as well. In Facebook's response to the New York Times story, it gives another example: Users may want to use Facebook Messenger in another app like Spotify to chat without leaving the app. If an app wanted to offer that and users wanted to use it, Facebook should facilitate that in a secure and clear way. Users currently can publish the same post to Instagram and Facebook at the same time, another form of interoperability that would help Facebook competitors gain users. This functionality should not be limited to companies Facebook owns or selects. On the other hand, some data such as Facebook’s tracking data, that many users do not even know is being collected, should probably not be shared at all.
The FTC needs to carefully consider how Facebook will give real, meaningful notice to users and make sure they are allowed to make their own informed decisions with regard to their data. The system Facebook currently defends, that merely logging in was the method of granting permission to share, is very clearly insufficient.
It’s important that these limitations on data sharing also be applied to Facebook’s own applications, WhatsApp and Instagram. The FTC should subpoena documents to learn about Facebook’s internal data flows between their own products. Many users do not know that Facebook owns these products, in fact “leaving Facebook” to switch to Instagram due to their privacy concerns. The aggregation of user data can increase its value and intrusiveness exponentially. Facebook should not be allowed to aggregate its users’ data together with data from Instagram and WhatsApp. They should be subject to the same data port user choice tool as Facebook’s 3rd party apps and competitors.
The FTC’s remedy must clearly state that the rules apply to sharing, use, and access to data. Facebook is muddying the waters by drawing a distinction between sharing data with third parties and allowing third parties access to the data. Whatever technical distinction they may have in mind, the impact on users is functionally quite similar. The rules should apply to sharing, use, and granting access to data.
Of course, I don’t mean to suggest that this FTC remedy will broadly provide platform accountability. Many of these problems apply to other tech platforms and that is why legislation is still necessary and antitrust scrutiny must be applied. But the investigation currently going on at the FTC is a great opportunity to improve data flows at Facebook, and the FTC should not squander it.
One popular proposal has been that the FTC should threaten Facebook with a fine so high it will convince them to agree to break up the company rather than pay the fine. I’m concerned that this idea will not work. FTC Commissioner Rohit Chopra has written that “corporate recidivists,” companies that continue to violate FTC rules and orders, should be subject to divestiture remedies from the FTC. While such a remedy would be great at immediately creating competition, I do not believe it could be achieved at court or in settlement. Facebook sees being broken up as such a dire fate that they would certainly litigate rather than agree to divest Instagram and WhatsApp, even if threatened with an incredibly high fine. It's hard to assess without non-public information who would win the case if it were litigated. But assuming the FTC won this case at trial, it would be unlikely to be able to obtain these divestitures in court. First, the suit the FTC would bring would be about the underlying consent decree violation that’s alleged to have occurred: The unauthorized transfer of user data to Cambridge Analytica (and perhaps additionally the new allegations of sharing with other “partners” explained in the New York Times). This is not an antitrust case, but a case about a potential violation of a privacy-related consent decree. Divestitures are not a common remedy for such cases, and the courts increasingly view antitrust with a skeptical eye. The litigation could take many years to resolve, during which time Facebook could continue its current market practices. Instead we need to focus our energy on real solutions.