Almost right from its very beginning Facebook Inc was not the benign Internet presence it pretended to be

Facebook Inc. - incorporated in July 2004 and headquartered at 1 Hacker Way (so named by Facebook management), Menlo Park, California 94025 - has at least twelve data centres around the world which collect, transmit, collate, store and monetise data drawn from an est. 2 billion active Facebook accounts. 

In May 2017 this social media company was worth est. US$407.3 billion according to Forbes.com.

Now that the social media giant finds itself being officially investigated to varying degrees by the United Kingdom, Australia and the United States on matters of user data collection, data retention, privacy and safety - as well as being the object of a number of lawsuits - here is a timeline indicating how Mark Zuckerberg brought Facebook to this low point......

FACEBOOK INC

2005

Facebook Privacy Policy states that Thefacebook takes appropriate precautions to protect our users' information. Your account information is located on a secured server behind a firewall. However it also states When you visit the Web Site you may provide us with two types of information: personal information you knowingly choose to disclose that is collected by us and Web Site use information collected by us on an aggregate basis as you and others browse our Web Site.
When you register on the Web Site, you provide us with certain personal information, such as your name, your email address, your telephone number, your address, your gender, schools attended and any other personal or preference information that you provide to us.
When you enter our Web Site, we collect the user's browser type and IP address. This information is gathered for all users to the Web Site. In addition, we store certain information from your browser using "cookies." A cookie is a piece of data stored on the user's computer tied to information about the user. We use session ID cookies to confirm that users are logged in. These cookies terminate once the users close the browser. We do not use cookies to collect private information from any user.
Thefacebook also collects information about you from other sources, such as newspapers and instant messaging services. This information is gathered regardless of your use of the Web Site. 

2006

Facebook’s privacy policy is now expressing this sentiment; We understand you may not want everyone in the world to have the information you share on Facebook; that is why we give you control of your information. Our default privacy settings limit the information displayed in your profile to your school, your specified local area, and other reasonable community limitations that we tell you about….

However the company is still collecting as much information about Facebook users that it can, as well as informing account holders that; Facebook may also collect information about you from other sources, such as newspapers, blogs, instant messaging services, and other users of the Facebook service through the operation of the service (e.g., photo tags) in order to provide you with more useful information and a more personalized experience. By using Facebook, you are consenting to have your personal data transferred to and processed in the United States.

2007

Facebook Platform  - app developers can now access the “’social graph’ ie., tracked connections between users and their friends.

Beacon - shares what users are doing on other websites with their Facebook friends without specific consent.

2008

Facebook Connect - corrects Beacon’s mistakes by requiring users to take deliberate action before they share activity from other websites when logged in using Facebook.

2009

Canada’s Office of the Privacy Commissioner found that it geared its default privacy settings toward openness, failed to inform users their data would be used to serve ads, and leaked data to third party developers, including when their friends used apps. Facebook vows to encourage “users to review their privacy settings” but does not agree to all the recommendations……

Beacon officially shut down after at least one lawsuit commenced over privacy issue.

Facebook hosts the Farmville game which was later revealed as a data miner.

2010

Facebook’s privacy policy states; When you connect with an application or website it will have access to General Information about you. The term General Information includes your and your friends’ names, profile pictures, gender, user IDs, connections, and any content shared using the Everyone privacy setting. ... The default privacy setting for certain types of information you post on Facebook is set to “everyone.” ... Because it takes two to connect, your privacy settings only control who can see the connection on your profile page. If you are uncomfortable with the connection being publicly available, you should consider removing (or not making) the connection.

On 28 April 2010 Electronic Frontiers Foundation reported that: Facebook announced a plan to transform most of the bits in your profile (including your hometown, education, work, activities, interests, and more) into connections, which are public information. If you refuse to make these items into a Connection, Facebook will remove all unlinked information.

2011

Social reporting tool – allows Facebook users to directly contact other users to request a post or image takedown if either relates directly to them. Any takedown is voluntary if content doesn't breach Facebook rules.

Facebook Inc initially refuses to take down a defamatory site invading the privacy of Clarence Valley highschool students. It only does so after direct pressure is applied by a community member.

2012

In February the Parliament of Australia invites the Australian public to connect with it via Facebook.

Facebook begins roll out Facebook Camera for iOS to English-speaking countries - a standalone photos app where users can shoot, filter, and share single or sets of photos and scroll through a feed of photos uploaded to Facebook by friends.

Facebook confirmed that it's launching a real-time ad exchange, which allows advertisers for the first time to target audiences on Facebook using their own first-party data and data from third parties….. Facebook Exchange will debut in the next few weeks, and eight DSPs and retargeting firms will be cleared to buy the inventory: TellApart, Triggit, Turn, DataXu, MediaMath, AppNexus, The TradeDesk and AdRoll

2013

Facebook begins collaboration with Dr. Alexandr Kogan eventually supplying him with data on 57 million Facebook friendships by 2015. User data supplied to Kogan for his research was later sent to Cambridge Analytica without Facebook users knowledge or consent.

Facebook hosts Hangouts - live video.

2014

Facebook Groups - app for iOS and Android introduced and then deleted some months later.

Facebook buys WhatsAppMessaging.

Facebook conducts a number of psychological experiments on users without their knowledge or consent. It is reported that 689,000 users had their home pages manipulated.

Facebook applies for patent on software which can scan users faces for emotional mood assessment via use of user’s digital device camera (patent granted 2017).

2015

Security Checkup - new tool to simplifying privacy controls.

Head of Research at Facebook Inc, Peter Fleming, and one of the company’s  contract researchers are listed as co-authors of Alexander Kogan’s published research on the relationship of social class and international friendships. 

University researchers claim Facebook tracks the web browsing of everyone who visits a page on its site even if the user does not have an account.

2016

WhatsAppMessaging begins to share user data with Facebook parent company which can now access users WhatsApp phone number, contact list, and usage data (e.g. when you last used WhatsApp, what device you used it on, and what OS you ran it on).

2017

Privacy Basics - new tool to simplify privacy controls.

Becomes public knowledge that Facebook revealed to one Australian advertiser that it had a database of young users – 1.9 million high schoolers, 1.5 million tertiary students and 3 million young workers – and that it could tell advertisers when young workers were particularly vulnerable.

Facebook reported to be planning $750 million data center in New Albany, Ohio employing only 50 permanent staff.

Facebook admits to US Securities and Exchange Commission that 1.5% of its 2.01 billion accounts worldwide are “undesirable” - that is likely to be fake accounts. Yahoo Finance calculates that to be upwards of 30 million accounts.

In December Germany’s Federal Cartel Office released preliminary investigation findings and stated: The Bundeskartellamt has informed the company Facebook in writing of its preliminary legal assessment in the abuse of dominance proceeding which the authority is conducting against Facebook. Based on the current stage of the proceedings, the authority assumes that Facebook is dominant on the German market for social networks. The authority holds the view that Facebook is abusing this dominant position by making the use of its social network conditional on its being allowed to limitlessly amass every kind of data generated by using third-party websites and merge it with the user's Facebook account. These third-party sites include firstly services owned by Facebook such as WhatsApp or Instagram, and secondly websites and apps of other operators with embedded Facebook APIs.

Google search engines now host multiple Facebook apps.

By 2017 numerous government departments and agencies in Australia have Facebook accounts, from which the company can harvest visitor data whether or not the visitor has a Facebook account.

Included on the long list of government departments/agencies is the federal Dept. of Human Services (DHS). DHS states that it posts on its Facebook page about payments and services, answers questions, gives useful tips, shares news, and give updates on relevant issues. This means that anyone who visits or interacts with the five DHS Facebook pages will have their Internet usage data scraped, information contained in any questions asked retained and collated with any other information Facebook holds on that visitor. DHS appears to be aware of privacy vulnerabilities in its use of Facebook as it is at pains to point out that The department is not responsible for the privacy practices or content of Facebook.......

Australian federal and state electoral commissions also have active Facebook pages.

In December 2017 Facebook rolled out Messenger Kids app which is installed via an adult's Facebook account. This app offers video and text chats for children using their own digital devices. Although Messenger Kids displays no ads it does not appear to be exempt from Facebook's user data collection.

Facebook Inc initially refuses to remove a scam account attempting to raise money and only does so after media pressure. 

2018

On 16 March Facebook Inc. announces it has suspended the accounts of Aleksandr Kogan, Cambridge Analytica and Strategic Communication Laboratries Group on the basis they had misused Facebook user data,  

In late March it was revealed that Facebook's Android app is capable of hoovering up extensive call data without users knowledge or consent.

Facebook-created VR app like Spaces obtain information about what users doing there, much in the same way that any third-party app developer would. Facebook also records a “heatmap” of viewer data for 360-degree videos, for instance, flagging which parts of a video people find most interesting.

Facebook admits that it archived unpublished and deleted user videos created using a now redundant video streaming function. 

Facebook Inc. admits that up to 87 million account holders may have had their personal information accessed by the Trump presidential campaign-linked data miner Cambridge Analytica. Either because  Facebook users accessed the thisisyourdigitallife app or because they had friended a person had done so.

Only 53 Australian Facebook users took the thisisyourdigitallife personality quiz but the app hoovered up the data on est 311,127 other users included in friendship lists once it accessed those 53 accounts. Just 10 New Zealanders used the app but data from another est. 67,000 users was collected via their friendship groups.

Facebook also admits that its software allowed reverse searching of its user pages employing only ‘phone numbers and email addresses and that “malicious actors” may have used this feature to scrap public profile data from most of its 2 billion users.

The company admits that its account recovery process can also allow these malicious actors to access user data.

By 2 April Facebook Inc. had lost an est. US$100 billion in market capitalisation.

In April Facebook announces a tightening of its privacy controls and states it intends to police all third party requests for access to user data. Given the company stated it had in total 215,000 staff worldwide as of December 2017 and, not all those staff would be available to personally monitor third party requests relating to Facebook’s est. 2 billion active monthly users, one wonders just how reliable this latest ‘promise’ from Facebook Inc. will be.

On 4 April 2018 USA Today reported that: Members of the House and Senate committees that will question Facebook CEO Mark Zuckerberg about user privacy protection next week are also some of the biggest recipients of campaign contributions from company employees and the Facebook Inc. PAC.

The committee that got the most Facebook contributions is the House Energy and Commerce Committee, which announced Wednesday morning it would question Zuckerberg on April 11.

Open Secrets lists Facebook Inc PAC contributions to 2016 U.S. federal election campaigns:

Contributions from this PAC to federal candidates (list recipients) (44% to Democrats, 55% to Republicans)	$519,500
Contributions to this PAC from individual donors of $200 or more (list donors)	$619,240

In April Facebook admits that it has entered an unspecified number of the 1.3 billion 
Messenger accounts and, without users knowledge or consent, selectively removed messages sent to those users by Mark Zuckerberg and other unnamed Facebook Inc executives/employees. 

Australian Privacy Commissioner launches investigation into Facebook Inc.

Five U.S. state attorneys-general reported to have begun investigations into how Facebook Inc. collects, shares and does or doesn't protect user information.

According to the Insurance Journal on 5 April 2018: Users and investors have filed at least 18 lawsuits since last month’s revelations about Cambridge Analytica. Beyond privacy violations, they are accusing Facebook of user agreement breaches, negligence, consumer fraud, unfair competition, securities fraud and racketeering.

On 6 April Facebook Inc annouces that it has suspended the account of Canadian tech company AggregateIQ because of its involvenment in the Cambridge Analytica scandal and three days later suspends CubeYou on similar grounds while it investigates.

On 9 April TNW reports that Facebook's cryptocurrency ad filter failed.

The Washington Post  reported on 9 April:

As for Facebook itself, former FBI special agent Clinton Watts told me that, in one sense, the numbers should not be surprising since “everyone has a message to get out, and Facebook is the best place to do it. Russia, Cambridge Analytica or any campaign for that matter has to go to social media to be effective.” The problem arose in Facebook’s mode of operating. “Their motto was move fast and break things, and they did, they moved fast and in the end broke the trust of their users with the platform,” Watts said. “They didn’t do solid assessments of who was accessing data on their platforms, and they didn’t effectively scrutinize advertisements and accounts surfacing on their platforms.”

By 10 April it was being reported that a number of Facebook IT engineers were quitting or asking to change departments over ethical concerns.

On 11 April 2018 Facebook Inc. founder, CEO and controlling shareholder, 33 year-old Mark Elliot Zuckerberg appears before the US House of Representatives House Energy and Commerce Committee's Facebook: Transparency and Use of Consumer Data hearing.

The day before Zuckerberg fronted the Senate Committee on the Judiciary, Senate Committee on Commerce, Science, and Transportation’s  Facebook, Social Media Privacy, and the Use and Abuse of Data hearing.

Despite all of the above, as of 11 April 2018 the Australian Government Dept of Human Services retains its "Humans Services", "Student Update", "Families Update" and "Seniors Update" Facebook pages and, the departmental website still links to "How to 'Like' " instructions and shows visitors how to set up their own Facebook account with a link to its very own 'how to' YouTube video. Cenrelink's General Manager also still has an official Facebook account.

Note:
Given the federal Department of Human Services admitted that it had employed third parties to monitor social media including Facebook for information about welfare recipients that it could match with internal departmental data, one has to wonder what range of methods were used to undertake this surveillance and exactly who the contractors were.

Are those nasty digital chickens coming home to roost for Mark Zuckerberg and Facebook?

In 2014 rumours began to spread about the about Strategic Communication Laboratries (SLC) Cambridge Analytica.

By 12 December 2015, after contacting Facebook's public relations representatives in London, The Guardian (UK) was reporting that:

"A little-known data company, now embedded within Cruz’s campaign and indirectly financed by his primary billionaire benefactor, paid researchers at Cambridge University to gather detailed psychological profiles about the US electorate using a massive pool of mainly unwitting US Facebook users built with an online survey.

As part of an aggressive new voter-targeting operation, Cambridge Analytica – financially supported by reclusive hedge fund magnate and leading Republican donor Robert Mercer – is now using so-called “psychographic profiles” of US citizens in order to help win Cruz votes, despite earlier concerns and red flags from potential survey-takers.

Documents seen by the Guardian have uncovered longstanding ethical and privacy issues about the way academics hoovered up personal data by accessing a vast set of US Facebook profiles, in order to build sophisticated models of users’ personalities.

By 6 January 2016 The Guardian was reporting on what was likely to turn up in Facebook feeds by way of political advertising:

If you lived in north-east Iowa, the evangelical stronghold where the battle for the soul of conservative American politics will play out in person on Monday, and happened to have given Senator Ted Cruz’s campaign your email address sometime in the last few months, you might find something especially appealing this weekend in your Facebook feed.

Even the most obtuse member of Facebook Inc.'s board or senior management would have been aware that the company was fast becoming an active participant in the US presidential primaries campaign. 

Fast forward to now as the chickens come home to roost.......

Google Search, 3 April 2018

The Guardian, 26 March 2018:

In rejecting the media’s characterisation of this large-scale privacy violation as a “data breach”, Facebook claims “everyone involved” in the 2014 data-siphoning exercise had given their consent. “People knowingly provided their information,” the company claimed. As with its interpretation of the word “clear”, Facebook seems to have a skewed understanding of what “knowingly” really means.

Facebook’s senior executives may now be feeling apologetic, “outraged” even. But in January 2016, as Trump surged in the polls, Facebook’s COO, Sheryl Sandberg, told investors the 2016 election was “a big deal in terms of ad spend”. In other words, a major commercial opportunity. The ability to target voters, she said, was key: “Using Facebook and Instagram ads you can target by congressional district, you can target by interest, you can target by demographics or any combination of those,” she boasted. “And we’re seeing politicians at all levels really take advantage of that targeting.”

It’s perhaps worth remembering, then, that until recently Facebook was encouraging political operatives to take full advantage of its garden of surveillance. And while aspects of the Cambridge Analytica affair may be surprising, and offer a disturbing glimpse into the shadows, the routine exploitation of information about our lives – about who we are – is what’s powering Facebook. It’s the behemoth’s lifeblood.

This was a statement from the U.K. Parliament House of Commons Digital, Culture, Media and Sport Committee on 28 March 2018:

Christopher Wylie gave evidence to the Committee on Tuesday 27th March 2018 during which he referred to the evidence the Committee is publishing today. This session is available to watch. Please note the transcript will be published online shortly.

On Tuesday 20th March, the Committee Chair Damian Collins MP wrote to Mark Zuckerberg, CEO of Facebook, requesting oral evidence. Facebook have responded offering two senior executives. The Committee has accepted evidence from Chris Cox, Chief Product Officer, but has written today to Facebook to clarify whether  Mr. Zuckerberg will also appear himself, as requested. This matter was also raised with The UK Prime Minister Theresa May, in her evidence before the Liaison Committee on the evening of the 27th March. She said that Facebook should be taking the matter seriously.

On Thursday 22nd, the Committee wrote to Alexander Nix, the suspended CEO of Cambridge Analytica, recalling him to Parliament to give further evidence. Mr. Nix has agreed to come before the Committee again. You can watch the evidence session that took place on 27th February 2018 where Mr. Nix gave evidence on Parliamentlive.tv and read the transcript.

Chris Wylie Background Papers - referring to the work of SCL elections, Cambridge Analytica, Global Science... by clarencegirl on Scribd

https://www.scribd.com/document/375126186/Chris-Wylie-Background-Papers-referring-to-the-work-of-SCL-elections-Cambridge-Analytica-Global-Science-Research-Aggregate-IQ-their-connections

Turns out that Facebook Inc is the biggest baddie of all on the Internet

“The FTC is firmly and fully committed to using all of its tools to protect the privacy of consumers. Foremost among these tools is enforcement action against companies that fail to honor their privacy promises, including to comply with Privacy Shield, or that engage in unfair acts that cause substantial injury to consumers in violation of the FTC Act. Companies who have settled previous FTC actions must also comply with FTC order provisions imposing privacy and data security requirements. Accordingly, the FTC takes very seriously recent press reports raising substantial concerns about the privacy practices of Facebook. Today, the FTC is confirming that it has an open non-public investigation into these practices.”  [US Federal Trade Commission (FTC), Statement, 26 March 2018]

It may have been the Cambridge Analytica-Facebook situation as first set out by Carole Cadwalladr at The Guardian & The Observer (UK) that recently alerted the average Internet user to the issue of digital privacy on social media and, it was certainly the situation which caught the eye of the US Federal Trade Commission which is now investigating.

The story of that data harvest so far.....

The Guardian UK, 25 March 2018:

The story of how those data made the journey from Facebook’s servers to Cambridge Analytica’s is now widely known. But it is also widely misunderstood. (Many people were puzzled, for example, by Facebook’s vehement insistence that the exfiltration of a huge trove of users’ data was not a “breach”.) The shorthand version of what happened – that “a slug of Facebook data on 50 million Americans was sucked down by a UK academic named Aleksandr Kogan, and wrongly sold to Cambridge Analytica” – misses an important point, which is that in acquiring the data in the first place Kogan was acting with Facebook’s full knowledge and approval.

In 2013, he wrote an app called “Thisisyourdigitallife” which offered users an online personality test, describing itself as “a research app used by psychologists”. 

Approximately 270,000 people downloaded it and in doing so gave their consent for Kogan to access information such as the city they set on their profile, or content they had liked, as well as more limited information about friends who had their privacy settings set to allow it. This drew more than 50 million unsuspecting Facebook users into Kogan’s net.

The key point is that all of this was allowed by the terms and conditions under which he was operating. Thousands of other Facebook apps were also operating under similar T&Cs – and had been since 2007, when the company turned its social networking service into an application platform.

So Kogan was only a bit player in the data-hoovering game: apps such as the insanely popular Candy Crush, for example, were also able to collect players’ public profiles, friends lists and email addresses. And Facebook seemed blissfully indifferent to this open door because it was central to its commercial strategy: the more apps there were on its platform the more powerful the network effects would be and the more personal data there would be to monetise.

That’s why the bigger story behind the current controversy is the fact that what Cambridge Analytica claimed to have accomplished would not have been possible without Facebook. Which means that, in the end, Facebook poses the problem that democracies will have to solve. [my yellow highlighting]

However, it is not the only way Facebook is collecting personal information to enrich Zuckerberg and his shareholders.

Now we find out that Facebook Inc is scraping information from Android devices such as mobile phones and adding phone logs to its Big Brother database.

Global News, 25 March 2018:

In the same week Facebook found itself in the middle of a massive data scandal, recent reports indicate that the social media giant has also scraped records of phone calls and SMS data from its users with Android devices without explicit permission.

New Zealand-based software developer Dylan McKay tweeted earlier this week that upon downloading his Facebook data in zip file (which is an option for all users) he claims to have discovered records of phone calls and a historical data of every contact on his phone., including contacts he no longer had, from a period between 2016 and 2017.

Downloaded my facebook data as a ZIP file

Somehow it has my entire call history with my partner's mum pic.twitter.com/CIRUguf4vD

— Dylan McKay (@dylanmckaynz) March 21, 2018

After he made the discovery, McKay set up a Google poll to gather evidence from other users who’ve been affected.

So far, just under 900 people have responded to the poll, and more than 20 per cent confirmed they found call records and/or text metadata in their Facebook data archive. Another 74 people responded to the poll saying that MMS data was collected, 106 people responded saying that SMS data was collected, and 104 responded saying that cellular calls were collected.

READ MORE: Here’s who’s using your Facebook activity to get inside your head

The story was first published by the tech news website Ars Technica on Saturday, who interviewed several Facebook users, and had a member of its staff download their Facebook data archive. Following, this, the site could confirm that the data file downloaded by the staff member contained call logs from a device that individual used between 2015 and 2016, as well as SMS and MMS message data.

Several Global News staff members also requested their data archives as well in the preparation of this story and some found that the contact lists from their mobile devices were recorded in the file. No one noted any text message or call logs in the data files they downloaded.

Ars Technica reached out to Facebook for comment before the publication of its story, who said that the practice was a common one among social networking and messaging apps.

“The most important part of apps and services that help you make connections is to make it easy to find the people you want to connect with. So, the first time you sign in on your phone to a messaging or social app, it’s a widely used practice to begin by uploading your phone contacts.”

Following McKay’s tweets, other users came out on social media expressing similar concerns about what they discovered after downloading their data archives.

Oh wow my deleted Facebook Zip file contains info on every single phone cellphone call and text I made for about a year- cool totally not creepy.

— Mat Johnson (@mat_johnson) March 23, 2018

I’ve just looked at the data files I requested from Facebook and they had every single phone number in my contacts. They had every single social event I went to, a list of all my friends (and their birthdays) and a list of every text I’ve sent.

— Emma Kennedy (@EmmaKennedy) March 25, 2018

…In recent years, the company has updated this process to clarify that when requesting access to your contact list, it intends to access all call logs and SMS text messages as well, but Android users in the past may have unknowingly given Facebook access to this data. [my yellow highlighting]

It is also wise to remember that even Internet users who do not have a Facebook account have their PC or other digital device scanned for information each time they click on a link to Facebook. 

Facebook image via ZDNet, 3 January 2014

ZDNet on 3 January 2014: By "content" Facebook means “anything you or other users post on Facebook”. By "information" Facebook means “facts and other information about you, including actions taken by users and non-users who interact with Facebook”. [my yellow highlighting]

Nor should we ignore this report about Facebook's surreptitious activities.......

Law360 (March 2, 2018, 7:02 PM EST) -- A California federal judge held Friday that Facebook can’t shake a proposed class action over its allegedly unlawful collection and storage of non-users’ facial scans, declining to toss the matter for lack of standing, just as he recently did in a related suit involving users of the site.

U.S. District Judge James Donato rejected Facebook Inc.’s renewed motion to dismiss litigation led by Frederick William Gullen for lack of subject-matter jurisdiction, pointing to his Feb. 26 decision in a related proposed class action accusing the social media... [my yellow highlighting]

Then there is the lobbying to discourage federal regulation of Facebook.......

According to SOCIAL MEDIA CASEROUNDUP (selected cases) in April 2015, by 2013 Facebook Inc had spent more than US$1 million on lobbying efforts to water down the US Children's Online Privacy Protection Act (COPPA). It was particularly concerned about any change of status of third party "add ons"/"plug-ins" which might by default make platforms like Facebook legally liable for any harm to a minor/s which occurred, as well asbeing resistant to any increase in general protections for minors or any expanded definition of protected "personal information" being included in the Act.

Quartz, 22 March 2018:

Facebook CEO Mark Zuckerberg said yesterday that the company welcomes more regulation, particularly to bring transparency to political advertising online. But in recent months, Facebook has been quietly fighting lawmakers to keep them from passing an act that does exactly that, campaign transparency advocates and Congressional staff tell Quartz.

The Honest Ads Act was introduced last October to close a loophole that has existed since politicians started advertising on the internet, and was expected by many to sail through Congress. Coming as Congress investigated how Russia used tech companies to influence the 2016 election, it was considered by many in Washington DC to be the bare minimum lawmakers could do to address the problem.

The act introduces disclosure and disclaimer rules to online political advertising. Tech companies would have to keep copies of election ads, and make them available to the public. The ads would also have to contain disclaimers similar to those included in TV or print political ads, informing voters who paid for the ad, how much, and whom they targeted.

“The benefit of having disclaimers on all political ads [is] the more suspicious ads would be more identifiable,” said Brendan Fischer, the director of federal and Federal Election Commission reform at theCampaign Legal Center (CLC) in Washington.

In a vote of confidence from bitterly-divided Washington, the act was rolled out by a bipartisan group of senators—John McCain, the Republican from Arizona, and Democrats Amy Klobuchar from Minnesota and Mark Warner of Virginia—and it currently has the support of 18 senators. But it hasn’t moved from the committee on “Rules and Administration” since was first introduced, thanks in part to Facebook’s lobbying efforts.

Fischer, who is a co-author of a CLC report on US vulnerabilities online after the 2016 election, accuses Facebook of “working behind the scenes using the levers of power to stop any legislation from moving forward.”

Facebook’s lobbying clout

Lobbyists for the company have been trying to dissuade senators from moving the Honest Ads Act forward, some Congressional aides say. 

Facebook’s argument to Congress behind the scenes has been that they are “voluntarily complying” with most of what the Honest Ads Act asks, so why pass a law, said one Congressional staffer working on the bill. Facebook also doesn’t want to be responsible for maintaining the publicly accessible repository of political advertising, including funding information, that the act demands, the staffer said.

Facebook spent nearly $3.1 million lobbying Congress and other US federal government agencies in the last quarter of 2017, on issues including the Honest Ads Act according to its latest federal disclosure form. It also signed on Blue Mountain Strategies, a lobbying firm founded by Warner’s former chief of staff, an Oct. 30, 2017 filing shows.

It’s part of a massive uptick in lobbying spending in recent years. [my yellow highlighting]

Despite all its lobbying Facebook Inc is not immune from official censure for its deceptive business practices.

Take this analysis of a 2011 binding agreement between the US Federal Trade Commission and Facebook Inc.....

Federal Register / Vol. 76, No. 233 / Monday, December 5, 2011 / Notices

FEDERAL TRADE COMMISSION [File No. 092 3184], 2 December 2011:

The Federal Trade Commission has accepted, subject to final approval, a consent agreement from Facebook, Inc. (‘‘Facebook’’)……

The Commission’s complaint alleges eight violations of Section 5(a) of the FTC Act, which prohibits deceptive and unfair acts or practices in or affecting commerce, by Facebook:

* Facebook’s Deceptive Privacy Settings: Facebook communicated to users that they could restrict certain information they provided on the site to a limited audience, such as ‘‘Friends Only.’’ In fact, selecting these categories did not prevent users’ information from being shared with Apps that their Friends used.

* Facebook’s Deceptive and Unfair December 2009 Privacy Changes: In December 2009, Facebook changed its site so that certain information that users may have designated as private— such as a user’s Friend List —was made public, without adequate disclosure to users. This conduct was also unfair to users.

* Facebook’s Deception Regarding App Access: Facebook represented to users that whenever they authorized an App, the App would only access the information of the user that it needed to operate. In fact, the App could access nearly all of the user’s information, even if unrelated to the App’s operations. For example, an App that provided horoscopes for users could access the user’s photos or employment information, even though there is no need for a horoscope App to access such information. 

* Facebook’s Deception Regarding Sharing with Advertisers: Facebook promised users that it would not share their personal information with advertisers; in fact, Facebook did share this information with advertisers when a user clicked on a Facebook ad.

* Facebook’s Deception Regarding Its Verified Apps Program: Facebook had a ‘‘Verified Apps’’ program through which it represented that it had certified the security of certain Apps when, in fact, it had not. 

* Facebook’s Deception Regarding Photo and Video Deletion: Facebook stated to users that, when they deactivate or delete their accounts, their photos and videos would be inaccessible. In fact, Facebook continued to allow access to this content even after a user deactivated or deleted his or her account.

* Safe Harbor: Facebook deceptively stated that it complied with the U.S.-EU Safe Harbor Framework, a mechanism by which U.S. companies may transfer data from the European Union to the United States consistent with European law.

The proposed order contains provisions designed to prevent Facebook from engaging in practices in the future that are the same or similar to those alleged in the complaint.

Part I of the proposed order prohibits Facebook from misrepresenting the privacy or security of ‘‘covered information,’’ as well as the company’s compliance with any privacy, security, or other compliance program, including but not limited to the U.S.-EU Safe Harbor Framework. ‘‘Covered information’’ is defined broadly as ‘‘information from or about an individual consumer, including but not limited to: 

(a) A first or last name; 

(b) a home or other physical address, including street name and name of city or town; (c) an email address or other online contact information, such as an instant messaging user identifier or a screen name; 

(d) a mobile or other telephone number; 

(e) photos and videos; (f) Internet Protocol (‘‘IP’’) address, User ID, or other persistent identifier; (g) physical location; or 

(h) any information combined with any of (a) through (g) above.’’

Part II of the proposed order requires Facebook to give its users a clear and prominent notice and obtain their affirmative express consent before sharing their previously-collected information with third parties in any (a) through (g) above.’’ Part II of the proposed order requires Facebook to give its users a clear and prominent notice and obtain their affirmative express consent before sharing their previously-collected information with third parties in any way that materially exceeds the restrictions imposed by their privacy settings. A ‘‘material . . . practice is one which is likely to affect a consumer’s choice of or conduct regarding a product.’’ FTC Policy Statement on Deception, Appended to Cliffdale Associates, Inc., 103 F.T.C. 110, 174 (1984).

Part III of the proposed order requires Facebook to implement procedures reasonably designed to ensure that a user’s covered information cannot be accessed from Facebook’s servers after a reasonable period of time, not to exceed thirty (30) days, following a user’s deletion of his or her account.

Part IV of the proposed order requires Facebook to establish and maintain a comprehensive privacy program that is reasonably designed to: 

(1) Address privacy risks related to the development and management of new and existing products and services, and 

(2) protect the privacy and confidentiality of covered information. The privacy program must be documented in writing and must contain controls and procedures appropriate to Facebook’s size and complexity, the nature and scope of its activities, and the sensitivity of covered information. Specifically, the order requires Facebook to:

* Designate an employee or employees to coordinate and be responsible for the privacy program;

* Identify reasonably-foreseeable, material risks, both internal and external, that could result in the unauthorized collection, use, or disclosure of covered information and assess the sufficiency of any safeguards in place to control these risks;

* Design and implement reasonable controls and procedures to address the risks identified through the privacy risk assessment and regularly test or monitor the effectiveness of these controls and procedures;

* Develop and use reasonable steps to select and retain service providers capable of appropriately protecting the privacy of covered information they receive from respondent, and require service providers by contract to implement and maintain appropriate privacy protections; and

* Evaluate and adjust its privacy program in light of the results of the testing and monitoring, any material changes to its operations or business arrangements, or any other circumstances that it knows or has reason to know may have a material impact on the effectiveness of its privacy program.

Part V of the proposed order requires that Facebook obtain within 180 days, and every other year thereafter for twenty (20) years, an assessment and report from a qualified, objective, independent third-party professional, certifying, among other things, that it has in place a privacy program that provides protections that meet or exceed the protections required by Part IV of the proposed order; and its privacy controls are operating with sufficient effectiveness to provide reasonable assurance that the privacy of covered information is protected. Parts VI through X of the proposed order are reporting and compliance provisions. Part VI requires that Facebook retain all ‘‘widely disseminated statements’’ that describe the extent to which respondent maintains and protects the privacy, security, and confidentiality of any covered information, along with all materials relied upon in making such statements, for a period of three (3) years. Part VI further requires Facebook to retain, for a period of six (6) months from the date received, all consumer complaints directed at Facebook, or forwarded to Facebook by a third party, that relate to the conduct prohibited by the proposed order, and any responses to such complaints. Part VI also requires Facebook to retain for a period of five (5) years from the date received, documents, prepared by or on behalf of Facebook, that contradict, qualify, or call into question its compliance with the proposed order. Part VI additionally requires Facebook to retain for a period of three (3) years, each materially different document relating to its attempt to obtain the affirmative express consent of users referred to in Part II, along with documents and information sufficient to show each user’s consent and documents sufficient to demonstrate, on an aggregate basis, the number of users for whom each such privacy setting was in effect at any time Facebook has attempted to obtain such consent. Finally, Part VI requires that Facebook retain all materials relied upon to prepare the third-party assessments for a period of three (3) years after the date that each assessment is prepared. 

Part VII requires dissemination of the order now and in the future to principals, officers, directors, and managers, and to all current and future employees, agents, and representatives having supervisory responsibilities relating to the subject matter of the order. Part VIII ensures notification to the FTC of changes in corporate status. Part IX mandates that Facebook submit an initial compliance report to the FTC and make available to the FTC subsequent reports. Part X is a provision ‘‘sunsetting’’ the order after twenty (20) years, with certain exceptions.

The purpose of the analysis is to aid public comment on the proposed order. It is not intended to constitute an official interpretation of the complaint or proposed order, or to modify the proposed order’s terms in any way. 

By direction of the Commission. 

Donald S. Clark, Secretary. [FR Doc. 2011–31158 Filed 12–2–11; 8:45 am [my yellow highlighting]