Modernizing Authentication — What It Takes to Transform Secure Access
When Facebook launched its Places location product this week, the Northern California branch of the American Civil Liberties Union (ACLU) wasted no time in denouncing the privacy controls of the new feature.
Now, Facebook is firing back at the organization, rebutting the ACLU's criticism point by point, and countering that the company took pains to ingrain significant and intuitive privacy controls into Places.
"Facebook Places sets a new standard for user control and privacy protection for location information," Facebook spokesman Barry Schnitt wrote in a note to reporters and analysts. "We're disappointed that ACLU's Northern California office ignores this and seems to generally misunderstand how the service works."
Then on Friday, Facebook hosted a Webcast to further discuss the controls of the Places product, evidence of the company's heightened sensitivity around privacy concerns in the wake of numerous flare-ups over the issue.
At their core, the ACLU's objections centered around the settings of Facebook Places making it difficult to limit how much information would be shared and with whom.
Places allows people's friends to tag and "check them in" to a location like a bar or restaurant they're visiting, for instance. The ACLU took issue with the default setting that automatically tags members who use Places, which creates a Facebook news feed item that automatically shares that person's location with others.
The group argued that Facebook should have made the default setting opt-in, and that the privacy controls to change that feature are too obscure.
Users who haven't already allowed their friends to check them in to a location will receive a prompt the first time a friend tries to associate them with a location. If they click "not now" (and the ACLU would like to see a prompt saying "not ever"), nothing will show up on their wall, but the location information will show up on their friend's news feed.
Facebook has defended the settings as akin to the longstanding tagging feature in status updates and photos, and noted that users cannot be checked in at a location until they give their affirmative consent.
"We designed the product so that friends can check each other in via tagging, but you have to allow that," Ana Yang, Facebook's product marketing manager for Places, said during today's Webcast. "For anyone who's used tagging, whether it's for photos or status updates, you're always notified anytime you're tagged, and you can just easily remove any tag by clicking on the link, and your name will just disappear from the story."
Facebook also offers users the ability to change their privacy settings to block friends from checking them in, and members can also create custom lists of the users with whom they wish to share location information. But for Nicole Ozer, director of technology and civil liberties policy at the ACLU of Northern California, such safeguards are reminiscent of past Facebook missteps when the company has been accused of obfuscating privacy controls that could limit the flow of information.
"Yes, you can disallow check-ins permanently using your privacy settings," Ozer said. "But Facebook doesnt make that clear to new Places users."
In an apparent nod to the confusion surrounding the settings, Facebook has created a video to guide users through the granular controls for sharing location information using Places.
Follow eSecurityPlanet on Twitter @eSecurityP.