Facebook knows too much, ACLU says in warning of quizzes

By Scott Duke Harris

sdharris@mercurynews

Posted: 08/26/2009 05:49:43 PM PDT

Privacy advocates have long warned that users of Facebook and other social networks who seek amusement from quizzes like "What Simpsons Character Are You?" might be mortified by the way creators of such applications can access and potentially "scrape" personal information — not just about the quiz-takers, but their friends as well.

Now, engaging in some online jujitsu, the ACLU of Northern California is employing a cautionary Facebook quiz of its own to illustrate how quizzes that may seem "perfectly harmless" can release an array of data to the wider world — including users' "religion, sexual orientation, political affiliation, photos, events, notes, wall posts, and groups."

The app, titled "What Do Facebook Quizzes Know About You?" delivers its answer by opening a window that scrolls biographical data, attributed comments and photos.

More than 8,000 participants have taken the ACLU's quiz since it was quietly released a few days ago, the ACLU said Wednesday. The group hopes to prompt Facebook to upgrade its privacy default settings for its users, now numbering more than 250 million.

One helpful upgrade, the civil liberties group said, would be for Facebook to "change default privacy settings so that quizzes and other third-party applications run by a user's friends do not have access to the information on a user's profile without the user's opt-in consent."

Facebook users considering such applications as quizzes typically see a page that provides a choice of "Allow" or "cancel." The boilerplate language notes that allowing access "will let it pull your profile information, photos, your friends' info, and other content that it requires to work." But many Facebook users ignore the warning or don't comprehend the potential risks, the ACLU said.

Facebook, which boasts of building its success on creating an online environment users trust, said Wednesday that it has been actively policing its service in recent days and has disabled hundreds of applications, including some quiz apps, found to be inconsistent with Facebook policies.

The company also pointed out that it recently simplified user privacy settings. The final question of the ACLU quiz enables users to visit the Facebook page where they can alter their settings.

"We generally agree with their recommendations and have already made public announcements about relevant changes that are under way," said Barry Schnitt, Facebook's director of policy communications.

The Palo Alto-based service has been buffeted by criticism from a variety of privacy advocates, and in some cases has found ways to resolve complaints. "We've also had productive discussions with the Canadian Privacy Commissioner about improving user data controls on Platform," Schnitt said. "We'd be glad to also have productive discussions with the ACLU and generally catch them up, too."

Chris Conley, a technology fellow with the ACLU, said creating a Facebook quiz seemed an apt means for spreading word about privacy risks inherent in such apps. "We wanted to use Facebook itself to show how all these quiz creators have access to personal information," said Conley, a former software engineer at Intel who coded the quiz.

It is difficult to know how third-party app developers use the data, which can be collected and sold for marketing and advertising campaigns, Conley said. Private investigators and political entities are known to create dossiers using technologies that automatically scour the Web. An individual bombarded by spam, for example, may have been targeted because of an affiliation posted on Facebook. "There is no way to know," Conley said.

The text of ACLU's quiz put it in ominous terms: "Once details about your personal life are collected by a quiz developer, who knows where they could end up or how they could be used. Shared? Sold? Turned over to the government?"

The group acknowledged the irony of its approach: "We know it's a little weird to warn you about Facebook quizzes by asking you to take a Facebook quiz — but at least you know who we are and that we have a real privacy policy that we're committed to upholding. Can you say the same for every unknown author of every quiz you or your friends take?"

Many Facebook quizzes have been created with templates from LOLapps, a San Francisco startup that enables users to create their own quizzes. It has also written its own quizzes, including such popular ones as "Which Sex and the City Character Are You?" and "What Type of Heart Do You Have?"

Efforts to reach LOLapps CEO Kavin Stewart on Wednesday were not successful.

Contact Scott Duke Harris at 408-920-2704.

HOW PRIVATE IS Facebook?

The ACLU of Northern California created its own Facebook app, a multiple-choice quiz, to show users that the social-networking service"s privacy controls may not live up to expectations. Here"s how it begins:

QUESTION 1: When you take a quiz on Facebook, what can the quiz see about you?

Only your answers to its questions.

Only information that is set as "public" on your profile.

Almost everything on your profile, even if you use privacy settings to limit access.

The ACLU says the correct answer is "almost everything," which it illustrates by opening a window that scrolls data loaded from the quiz-taker"s Facebook page. The quiz can be found at apps.facebook.com/aclunc_privacy_quiz.

~~~~~~~~~~~

Just beware that all social networking sites have inherent dangers. Shoot, just being on the Internet can be dangerous. Life can be dangerous. Whether we're talking your off-line (aka your "real") or your on-line (aka your "Internet) life you have to take precautions.

Usually common sense is the best protection we have. Don't do things that open you up to a possible crime or scam. Just as those involved in personal protection, law enforcement and similar professions can be a crime victim, even the most Internet savvy among us can fall victim to an Internet scam. And most of us don't fall into either category.

And as this article points out, be very careful of what information you put on the Internet. Sometimes you have to give information to sign into a site such as Facebook. Sites in themselves are usually not the problem, it's, as in the case cited here, the apps you allow into your pages.

The bottom line is: be careful out there. Don't let the danger scare you away, there are good, fun, and useful things things on the Internet.

But do be careful.