Facebook privacy, what really changes?

On Monday, Facebook intends to revise its SRR and Data Use Policy. They are inviting users to vote on them. That is a sham, really, as for the vote to be binding, 30% of users would have to vote, which is obviously not going to happen. The comments on that page includes tens of thousands of people posting the same bogus message. Those people are such clueless and gullible morons that they deserve all the spam in the world. For the people who are really interested in what's going on, even if the vote is a sham, they should read on.

On their Site Governance page, Facebook allow you to vote on upcoming changes. Since they don't make it really obvious what the changes are, I thought I'd do that here. The TL;DR? Nothing really changes, only the (extremely ineffective) right to vote on changes to these terms and conditions is removed.

SRR

Everybody who signed up for a Facebook account agreed to these terms and conditions, even if 99.99% of users didn't read them. I compared the existing SRR against the proposed version. And there are only minor differences:

4.4. Registration and Account Security, Clause 4:

The original text:

You will not use your personal timeline for your own commercial gain (such as selling your status update to an advertiser).

becomes:

You will not use your personal timeline primarily for your own commercial gain, and will use a Facebook Page for such purposes.

which is fine. It's just a clarification.

12. Special Provisions Applicable to Pages

The original text:

If you create or administer a Page on Facebook, you agree to our Pages Terms.

becomes:

If you create or administer a Page on Facebook, or run a promotion or an offer from your Page, you agree to our Pages Terms.

which is just another clarification. Just legalese too, as it'd be impossible to run a promotion or offer from the page without actually creating or administering said page first.

14. Amendments

This is the third and only substantial change in the SRR. The original text reads:

1. We can change this Statement if we provide you notice (by posting the change on the Facebook Site Governance Page) and an opportunity to comment. To get notice of any future changes to this Statement, visit our Facebook Site Governance Page and "like" the Page.
2. For changes to sections 7, 8, 9, and 11 (sections relating to payments, application developers, website operators, and advertisers), we will give you a minimum of three days notice. For all other changes we will give you a minimum of seven days notice. Comments to proposed changes will be made on the Facebook Site Governance Page.
3. If more than 7,000 users post a substantive comment on a particular proposed change, we will also give you the opportunity to participate in a vote in which you will be provided alternatives. The vote shall be binding on us if more than 30% of all active registered users as of the date of the notice vote.
4. If we make changes to policies referenced in or incorporated by this Statement, we may provide notice on the Site Governance Page.
5. We can make changes for legal or administrative reasons, or to correct an inaccurate statement, upon notice without opportunity to comment.Your continued use of Facebook following changes to our terms constitutes your acceptance of our amended terms.

and the proposed version reads:

1. Unless we make a change for legal or administrative reasons, or to correct an inaccurate statement, we will provide you with seven (7) days notice (for example, by posting the change on the Facebook Site Governance Page) and an opportunity to comment on changes to this Statement. You can also visit our Facebook Site Governance Page and "like" the Page to get updates about changes to this Statement.
2. If we make changes to policies referenced in or incorporated by this Statement, we may provide notice on the Site Governance Page.
3. Your continued use of Facebook following changes to our terms constitutes your acceptance of our amended terms.

Clause 1 is again some clarification and makes the 7 day notice period explicit. Also, the provision for legal/administrative reasons and inaccurate statements has moved from clause 5. No biggie. Clause 2 was an exception to the old version of clause 1 and is no longer needed. Extending the 3 day period to 7 days means it's actually an (admittedly small) improvement in user rights. Clause 3 is removed. That is the only thing that is really intriguing. It removes the ability to vote on changes as well as the idea that 30% of registered users voting makes the vote binding to Facebook. In reality, getting 30% of active users to vote is an obvious pipe dream and this change will have no effect whatsoever. I doubt that even 1% of users is savvy or cares enough to vote. Even the more than 80,000 idiots who posted the bogus message amount to less than 0.1% of registered active users. Instead, the ability to vote is removed, as can be seen later.

Data Use Policy

The old and new versions differ in formatting and the odd typo or grammatical error has been fixed. Let's ignore those and compare the actual changes...

Information we receive and how it is used

Registration information

Yet some more clarification:

When you sign up for Facebook, you are required to provide your name, email address, birthday, and gender.

becomes:

When you sign up for Facebook, you are required to provide information such as your name, email address, birthday, and gender. In some cases, you may be able to register using other information, like your telephone number.

This is probably because Facebook Messenger can now be used with just a name and phone number.

Information you choose to share

"use our contact importers" has been changed to "find friends using our contact importers" because, well, using a contact importer and not finding any friends with them is not exactly noteworthy activity.

Other information we receive about you

From:

Sometimes we get data from our advertising partners, customers and other third parties that helps us (or them) deliver ads, understand online activity, and generally make Facebook better. For example, an advertiser may tell us information about you (like how you responded to an ad on Facebook or on another site) in order to measure the effectiveness of - and improve the quality of - ads.

To:

Sometimes we get data from our affiliates or our advertising partners, customers and other third parties that helps us (or them) deliver ads, understand online activity, and generally make Facebook better. For example, an advertiser may tell us information about you (like how you responded to an ad on Facebook or on another site) in order to measure the effectiveness of - and improve the quality of - ads.

Affiliates have been given mention, whereas they were previously counted as "other third parties".

Usernames and User IDs

Out with the old:

Your Facebook email address includes your public username like so: username@facebook.com. Anyone in a message conversation can reply to it.

And in with the new:

Your Facebook email address includes your public username like so: username@facebook.com. You can control who can start a message thread with you using your How You Connect settings. If they include others on that message, the others can reply too.

Yet more clarification. Nothing to worry about.

How we use the information we receive

A phrase is added:

We use the information we receive about you in connection with the services and features we provide to you and other users like your friends, our partners, the advertisers that purchase ads on the site, and the developers that build the games, applications, and websites you use. For example, in addition to helping people see and find things that you do and share, we may use the information we receive about you:

That isn't precisely shocking. That is what Facebook is about to most users, except it is now mentioned explicitly.

Sharing and finding you on Facebook

A new tip has been added:

When you hide things on your timeline, like posts or connections, it means those things will not appear on your timeline. But, remember, anyone in the audience of those posts or who can see a connection may still see it elsewhere, like on someone else's timeline or in search results. You can also delete or change the audience of content you post.

It is just a tip added for those who care. I doubt many people will read it, but it's good that it's been added.

Finding you on Facebook

The old text:

You can choose who can look up your timeline using the email address or telephone number you added to your timeline through your privacy settings. But remember, if you choose Friends, only your current Facebook friends will be able to find you this way.

is expanded to:

You can choose who can look up your timeline using the email address or telephone number you added to your timeline through your privacy settings. But remember that people can still find you or a link to your timeline on Facebook through other people and the things they share about you or through other posts, like if you are tagged in a friend's photo or post something to a public page.

This, yet again, is not an actual policy change, but simply a clarification as it is simply the nature of Facebook (and of links on the internet in general).

What friends and others share about you

The tip about tags in a private space has been reworded to refer to "links and tags" without otherwise changing anything. Also, the following paragraph was added to the section:

Other information
As described in the what your friends and others share about you section of this policy, your friends and others may share information about you. They may share photos or other information about you and tag you in their posts. If you do not like a particular post, tell them or report the post.

That takes care of things that aren't links or tags. In an unprecedented and shocking move, Facebook actually asks you to employ some common sense and resolve things amicably. I know... that's asking a lot.

Other websites and applications

Remember that these games, applications and websites are created and maintained by other businesses and developers who are not part of, or controlled by, Facebook, so you should always make sure to read their terms of service and privacy policies.

Surprise, Facebook doesn't control everything... yet!

Controlling what information you share with applications

People share way too much info with applications, I think. Here's what happens at least:

When you connect with a game, application or website - such as by going to a game, logging in to a website using your Facebook account, or adding an app to your timeline - we give the game, application, or website (sometimes referred to as just "Applications" or "Apps") your basic info, which includes your User ID, as well your friends' User IDs (or your friend list) and your public information.

This is clarified slightly in the proposed version, but this doesn't actually change any policy:

When you connect with a game, application or website - such as by going to a game, logging in to a website using your Facebook account, or adding an app to your timeline - we give the game, application, or website (sometimes referred to as just "Applications" or "Apps") your basic info (we sometimes call this your "public profile"), which includes your User ID and your public information. We also give them your friends' User IDs (also called your friend list) as part of your basic info.

There is also a sentence added about apps retaining user data. No change in policy, just a description of reality and the status quo:

For example, Apps may have reasons (e.g. legal obligations) to retain some data that you share with them.

Logging in to another site using Facebook

This one may seem like it's a change in policy, but it's not. I suppose this counts as fixing an inaccurate statement, by adding in 3 words at the end:

Facebook Platform lets you log into other applications and websites using your Facebook account. When you log in using Facebook, we give the site your User ID (just like when you connect with any other application), but we do not share your email address or password with that website through this process without your permission.

About instant personalization

Apart from noting that instant personalisation is also called "Start now", there are some larger changes. For example, the tip on disabling an instant personalisation site or app:

If you turn off an instant personalization site or app after you have been using it or visited it a few times (or after you have given it specific permission to access your data), it will not automatically delete your data received through Facebook. But the site is contractually required to delete your data if you ask it to.

is clarified to:

If you turn off an instant personalization site or app after you have been using it or visited it a few times (or after you have given it specific permission to access your data), it will not automatically delete information about you it received through Facebook. Like all other apps, the site is required by our policies to delete information about you if you ask it to.

This, as well as some other places in this section, replaces references to "your data" with "information about you". Additionally, 4 paragraphs on Pages are removed, because they are duplicate content that already existed in the section "Sharing and finding you on Facebook"

How advertising and Sponsored Stories work

Personalized ads

Facebook uses the information it has about you to show ads. In case you didn't know what they mean by information, Facebook feels the need to clarify that that information includes... information:

We use the information we receive, including the information you provide at registration or add to your account or timeline, to deliver ads and to make them more relevant to you.

And in their example to illustrate what might be shared with an advertiser, they've removed two sentences:

When an advertiser creates an ad, they are given the opportunity to choose their audience by location, demographics, likes, keywords, and any other information we receive or can tell about you and other users. For example, an advertiser can choose to target 18 to 35 year-old women who live in the United States and like basketball. An advertiser could also choose to target certain topics or keywords, like "music" or even people who like a particular song or artist. If you indicate that you are interested in topics, such as by liking a Page, including topics such as products, brands, religion, health status, or political views, you may see ads related to those topics as well. We require advertisers to comply with our Advertising Guidelines, including provisions relating to the use of sensitive data.

I doubt very much that the removal of that first sentence means you will no longer see ads related to those topics, though. I also doubt that the removal of the reference to Advertising Guidelines means that advertisers will no longer have to abide by them, though I would have preferred them leaving this in.

More telling is that they removed another sentence, about anonymity in the reports on ad performance to advertisers:

But these reports are anonymous. We do not tell advertisers who saw or clicked on their ads.

Although the text immediately preceding it still implies that the reports are anonymous, this is no longer made explicit.

Sponsored stories

Facebook is clarifying that sponsored stories go to friends and subscribers, whereas the original policy only referred to friends.

Some other things you need to know

Notifications and Other Messages

More privacy controls are actually being added in to the policy:

We may send you notifications and other messages using the contact information we have for you, like your email address. You can control most of the notifications you receive, including ones from Pages you like and applications you use, using your Notifications settings.

is being expanded to:

We may send you notifications and other messages using the contact information we have for you, like your email address. You can control most of the notifications you receive, including ones from Pages you like and applications you use, using controls we provide, such as a control included in the email you receive or in your "Notifications" settings.

to include a reference to controls in notification emails.

Friend finder

This added phrase sounds more like marketing fluff than legalese:

We offer tools to help you upload your friends' contact information so that you and others can find friends on Facebook, and invite friends who do not use Facebook to join, and so we can offer you and others better experiences on Facebook through suggestions and other customized experiences.

Invitations

Whereas invitations used to come with up to two reminders:

When you invite a friend to join Facebook, we send a message on your behalf using your name, and up to two reminders. We may also include names and pictures of other people your friend might know on Facebook. The invitation will also give your friend the opportunity to opt out of receiving other invitations to join Facebook.

that number is now no longer explicit:

InvitationsWhen you invite a friend to join Facebook, we send a message on your behalf using your name, and we may also include names and pictures of other people your friend might know on Facebook. We'll also send a few reminders to those you invite, but the invitation will also give your friend the opportunity to opt out of receiving other invitations to join Facebook.

Affiliates

This is a newly added section:

We may share information we receive with businesses that are legally part of the same group of companies that Facebook is part of, or that become part of that group (often these companies are called affiliates). Likewise, our affiliates may share information with us as well. This sharing is done in compliance with applicable laws including where such applicable laws require consent. We and our affiliates may use shared information to help provide, understand, and improve our services and their own services.

This isn't exactly a surprise. It is good that it is being made explicit.

Service Providers

Apart from helping to host their website, serving photos and videos, processing payments, analyzing data, measuring the effectiveness of ads or providing search results, Facebook may now use external companies to "conduct and publish research".

Opportunity to comment and vote

As I noted at the very start of this lengthy article, it would seem like the opportunity to vote is being removed. Since the requirement of 30% of active registered users voting will never be met, the change might seem substantial, but is rather moot.

If we receive more than 7000 comments concerning a particular change, we will put the change up for a vote. The vote will be binding on us if more than 30% of all active registered users as of the date of the notice vote.

is reduced to:

After the comment period, if we adopt any changes, we will provide notice (for example, on the Facebook Site Governance Page or in this policy) of the effective date.