My post from yesterday on Facebook’s Social Ads program got picked up by bloggers at the New York Times and CNet, so I’ve heard some more feedback than usual. Here’s a few more thoughts on the issue in response to themes emerging from the conversation:
Chris Kelly, Facebook’s Chief Privacy Officer, responded to the Times essentially by emphasizing that the site obtains enough consent from users to feature their names and likenesses in advertising:
Mr. Kelly said the advertisements are simply a “representation” of the action users have taken: choosing to link themselves to a product. … And he argued that it would be difficult for someone used in one of these ads to object because that person had already chosen to publicly identify themselves with the brand doing the advertising.
I think that may depend on the nature of the disclosure to the user and of the design of the advertiser’s Facebook page or application. Take Facebook’s own sample Social Ad — it has a user’s name and picture, her rating for a movie, and a plug for Blockbuster, all arranged in a way that makes it look like the user is a celebrity endorser for Blockbuster. The key question: even if this user understands she is sending her movie ratings to her friends, does she understand that she’s also starring in a Blockbuster ad? If there are clear disclosures — not just that information-sharing is happening but also that your identity will be used for promotional purposes — as well as an affirmative opt-in, then there is no problem under these privacy laws. Surely some Facebook users want to plug products they use and enjoy, and I have no quarrel with them — as long as they truly consent.
But consent is slippery in this space, and my sense is that, as with the News Feeds debacle, Facebook is assuming that social networkers have no appreciable privacy boundaries. That’s not so. And you shouldn’t transfer consent for some sharing into consent for all sharing, including sharing placed in a different context that implies endorsement.
As I noted in an update to the original post, even those who are annoyed by the use of their image in Social Ads may not have legally cognizable damages. Celebrities who object to being used in advertisements have clearer financial losses to claim in a lawsuit — their value as paid endorsers could be destroyed. The rest of us wouldn’t experience such tangible losses. California’s statute includes a fixed $750 penalty for plaintiffs who can’t otherwise prove damages, but of course that’s a tiny gnat on the hide of a behemoth like Facebook.
This explains why such cases are not common, and may also indicate that Facebook’s exposure to a realistic prospect of liability is miniscule. But if this program does violate privacy laws, the fact that you can get away with it is not a satisfying rationale for going ahead.
3. Torts and Statutes
I talked mostly about the New York law because it’s well known. But there are statutes in other states, and there are appropriation torts in even more states. A tort is not some exotic rara avis; many of the lawsuits that individuals bring, from defamation to car-crash negligence actions, are torts that may not be embodied in statutes. Bottom line: this privacy law is not some weird New York exception, but a common requirement, in some form or other, in many states.
Saul Hansell, the Times reporter/blogger, asked me if the New York law applied when the user wasn’t in New York. That sounds like a question from a first-year civil procedure exam (take it from me, who teaches that course). So I told him that opened up a whole other can of worms. Internet jurisdiction is very complicated and will take this post way off topic.
Suffice to say that the issue generally turns on the purposeful connection of the activity to a state. It seems to me that Facebook knows where all its users are located (and a whole lot more, of course…). If a Social Ad generated from a user’s behavior is sent to the person’s friend in New York, then likely that ad is subject to the New York law.
There is so much power and promise in various embodiments of social networking. But the privacy issues involved are profound and I am concerned that this Social Ads innovation may indicate a cavalier attitude to consent and an incorrect presumption that social networkers don’t care about their privacy. They do, they should, and so should the companies seeking to harness the power of social networks for their own benefit.
[UPDATE: Facebook has retreated somewhat in its new advertising plans after getting a lot of heat for them, but it's unclear whether their improved policy includes Social Ads.]
[Comments closed -- comment on the original post please...]