Facebook is about to start pushing European users to speed through dedicating permission for its new GDPR privacy law conformity changes. It will ask people to review how Facebook applies data from the web to target them with ads, and surface the sensitive profile info they share. Facebook will also enable European and Canadian users to turn on facial recognition after six years of the feature being blocked there. But with a design that encourages rapidly making the “Agree” button, a lack of granular controls, a laughably cheatable parental consent request for teens and an aesthetic overhaul of Download Your Information that doesn’t make it any easier to switch social networks, Facebook depicts it’s still hungry for your data.
The new privacy change and terms of service consent flow will appear starting the coming week to European users, though they’ll be allowed to dismiss it for now — although the May 25 th GDPR conformity deadline Facebook vowed to uphold in Europe is looming. Meanwhile, Facebook tells it will roll out the changes and permission flowing globally over the coming weeks and months with some slight regional changes. And finally, all teens worldwide that share sensitive info will have to go through the weak new parental consent flow.
Facebook brought a group of reporters to the new Building 23 at its Menlo Park headquarters to preview the changes today. But feedback was heavily critical as journalists grilled Facebook’s deputy chief privacy officer Rob Sherman. Questions centered around how Facebook makes accepting the updates much easier than reviewing or changing them, but Sherman stuck to talking points about how important it was to give users option and information.
” Trust is really important and it’s clear that we have a lot of work to do to regain the trust of people on our service” he said, devoting us deja vu about Mark Zuckerberg’s testimonies before congress.” We know that people won’t be comfortable employing Facebook if they don’t feel that their information is protected .”
Trouble at each step of Facebook’s privacy consent flow
There are a ton of small change, so we’ll lay out each with our criticisms.
Facebook’s consent flow starts well enough with the screen above offering a solid overview of why it’s inducing changes for GDPR and what you’ll be reviewing. But with merely an “X” up top to back out, it’s already training users to speed through by making that big blue button at the bottom.
First up is control of your sensitive profile information, specifically your sexual preference, religion views and political opinions. As you’ll see at each step, you can made the pretty blue” Accept And Continue” button regardless of whether you’ve scrolled through the information. If you hit the ugly grey” Manage Data Setting” button, you have to go through an interstitial where Facebook stimulates its argument trying to deter you from removing the info before letting you make and save your option. It feels patently designed to get users to breeze through it by offering no resistance to continue, but friction if you want to make changes.
Facebook doesn’t let advertisers target you based on this sensitive info, which is good. The only exception is that in the U.S ., political positions alongside political Pages and Events you interact with impact your overarching personality categories that can be targeted with ads. You can opt out of being targeted by those too. But your only option here is either to remove any info you’ve shared in these categories so friends can’t see it, or allow Facebook to use it to personalize the site. There’s no option to keep this stuff on your profile but not let Facebook use it.
Facebook is bringing facial recognition back to Europe and Canada. The Irish Data Protection commissioner who oversees the EU banned it there in 2012. Users in these countries will get a chance to turn it on, which is the default if they speed through. It’s a useful feature that can make sure people know about the photos of them floating around. But here the lack of granularity is concerning. Users might want to see warnings about possible impersonators utilizing their face in their profile pics, but not be suggested as someone to tag in their friends’ photos. Unfortunately, it’s all or nothing. While Facebook is right to make it simple to turn on or off totally, granular controls that unfold for those that want them would be much more empowering.
[ Update: This article has been updated to reflect that Facebook indeed can offer facial recognition in Europe and Canada .]
Data collection across the web
A major concern that’s arisen in the wake of Zuckerberg’s testimonies is how Facebook uses data collected about you from around the web to target users with ads and optimize its service. While Sherman echoed Zuckerberg in saying that users tell the company they prefer relevant ads, and that this data can help thwart hackers and scrapers, many users are unsettled by the offsite collect practises. Here, Facebook lets you block it from targeting you with ads based on data about your browsing behavior on sites that depict its Like and share buttons, conversion Pixel or Audience Network ads. The issue is that there’s no way to stop Facebook from use that data from personalizing your News Feed or optimizing other regions of its service.
New words of service
Facebook lately rewrote its terms of reference of service and data use policy to be more explicit and easy to read. It didn’t make any significant changes other than noting the policy now applies to its subsidiaries like Instagram and Messenger.[ Correction: But WhatsApp and Oculus have their own data policies .] That’s all clearly explained here, which is nice.
But the fact that the button to reject the new Terms of Service isn’t even a button, it’s a tiny” see your alternatives” hyperlink, shows how severely Facebook wants to avoid you closing your account. When Facebook’s product designer for the GDPR flow was asked if she supposed this hyperlink was the best route to present the alternative to the big” I Accept” button, she disingenuously said yes, eliciting jeerings from the room of reporters. It seems obvious that Facebook is trying to minimize the visibility of the path to account deletion rather than building it an obvious course of action if you don’t agree to its terms.
I requested Facebook actually show us what was on the other side of that tiny” see your alternatives” link and this is what we got. First, Facebook doesn’t mention its temporary deactivation alternative, merely the scary permanent delete option. Facebook recommends downloading your data before deleting your account, which you should. But the fact that you’ll have to wait( often a few hours) before you can download your data could push users to delay deletion and perhaps never resume. And only if you keep scrolling do you get to another tiny” I’m ready to delete my account” hyperlink instead of a real button.
GDPR also implements new regulations about how teens are treated, specifically users between the ages of 13( the minimum age required to sign up for Facebook) and 15. If users in this age range have shared their religious views, political views or sexual preference, Facebook requires them to either remove it or get parental consent to keep it. They also need permission to be targeted with ads based on data from Facebook’s partners. Without that permission, they’ll find a less personalized version of Facebook. But the organizations of the system for attaining and verifying that parental consent is a joke.
Users simply select one of their Facebook friends or enter an email address, and that person is asked to give consent for their “child” to share sensitive info. But Facebook blindly trusts that they’ve actually selected their parent or protector, even though it has a feature for users to designate who their family is, and the child could put anyone in the email field, including an alternate address they control. Sherman says Facebook is” not seeking to collect additional information” to substantiate parental consent, so it seems Facebook is happy to let teens easily bypass the checkup.
To keep all users abreast of their privacy situates, Facebook has redesigned its Privacy Shortcuts in a colorful format that sticks out from the rest of the site. No complaints here.
Download your information
Facebook has totally redesigned its Download Your Information tool after keeping it basically the same for the past eight years. You can now view your content and data in different categories without downloading it, which alongside the new privacy shortcuts is perhaps the only unequivocally positive and unproblematic change amidst today’s announcements.
And Facebook now lets you select certain categories of data, date ranges, JSON or HTML format and image quality to download. That could make it quicker and easier if you simply require a transcript of a certain type of content but don’t need to export all your photos and videos, for example. Thankfully, Facebook says you’ll now be able to download your media in a higher resolving than the old tool allowed.
But the big problem here was the subject of my feature piece the coming week about Facebook’s lack of data portability. The Download Your Information tool is supposed to let you take your data and go to a different social network. But it merely exports your social graph, aka your friends, as a text listing of names. There are no links, usernames or other unique identifiers unless friends opt into let you export their email or telephone number( only 4 percent of my friends do ), so good luck seeing the right John Smith on another app. The new version of Download Your Information exports the same old list of names, rather than offering any interoperable format that would let you find your friends elsewhere.
A higher standard
Overall, it seems like Facebook is complying with the letter of GDPR law, but with questionable spirit. Sure, privacy is boring to a lot of people. Too little info and they feel confused and scared. Too many options and screens and they feel overwhelmed and riled. Facebook struck the right balance in some places here. But the subtly pushy designs seem are aiming to steer people away from changing their defaults in ways that could hamper Facebook’s mission and business.
Making the choices equal in visible weight, rather than burying the ways and means of make changes in grayed-out buttons and tiny connections, would have been more fair. And it would have shown that Facebook has faith in the value it offer, such that users would stick around and leave features enabled if they truly wanted to.
When questioned about this, Sherman pointed the finger at other tech companies, “says hes” guessed Facebook was more upfront with users. Asked to clarify if he believed Facebook’s approach was ” better ,” he told ” I think that’s right .” But Facebook isn’t being judged by the industry criterion, because it’s not a standard company. It’s constructed its purpose and its business on top of our private data, and touted itself as a boon to the world. But when asked to clear a higher bar for privacy, Facebook delved into design tricks to keep from losing our data.