Facebook knows too much, ACLU says in warning of quizzes

August 27, 2009 By Scott Duke Harris

Privacy advocates have long warned that users of Facebook and other social networks who seek amusement from quizzes like "What Simpsons Character Are You?" might be mortified by the way creators of such applications can access and potentially "scrape" personal information -- not just about the quiz-takers, but their friends as well.

Now, engaging in some online jujitsu, the ACLU of Northern California is employing a cautionary Facebook quiz of its own to illustrate how quizzes that may seem "perfectly harmless" can release an array of data to the wider world -- including users' "religion, sexual orientation, political affiliation, photos, events, notes, wall posts, and groups."

The app, titled "What Do Facebook Quizzes Know About You?" delivers its answer by opening a window that scrolls biographical data, attributed comments and photos.

More than 8,000 participants have taken the ACLU's quiz since it was quietly released a few days ago, the ACLU said Wednesday. The group hopes to prompt Facebook to upgrade its privacy default settings for its users, now numbering more than 250 million.

One helpful upgrade, the civil liberties group said, would be for Facebook to "change default privacy settings so that quizzes and other third-party applications run by a user's friends do not have access to the information on a user's profile without the user's opt-in consent."

Facebook users considering such applications as quizzes typically see a page that provides a choice of "Allow" or "cancel." The boilerplate language notes that allowing access "will let it pull your profile information, photos, your friends' info, and other content that it requires to work." But many Facebook users ignore the warning or don't comprehend the potential risks, the ACLU said.

Facebook, which boasts of building its success on creating an online environment users trust, said Wednesday that it has been actively policing its service in recent days and has disabled hundreds of applications, including some quiz apps, found to be inconsistent with Facebook policies.

The company also pointed out that it recently simplified user privacy settings. The final question of the ACLU quiz enables users to visit the Facebook page where they can alter their settings.

"We generally agree with their recommendations and have already made public announcements about relevant changes that are under way," said Barry Schnitt, Facebook's director of policy communications.

The Palo Alto, Calif.-based service has been buffeted by criticism from a variety of privacy advocates, and in some cases has found ways to resolve complaints. "We've also had productive discussions with the Canadian Privacy Commissioner about improving user data controls on Platform," Schnitt said. "We'd be glad to also have productive discussions with the ACLU and generally catch them up, too."

Chris Conley, a technology fellow with the ACLU, said creating a Facebook quiz seemed an apt means for spreading word about privacy risks inherent in such apps. "We wanted to use Facebook itself to show how all these quiz creators have access to personal information," said Conley, a former software engineer at Intel who coded the quiz.

It is difficult to know how third-party app developers use the data, which can be collected and sold for marketing and advertising campaigns, Conley said. Private investigators and political entities are known to create dossiers using technologies that automatically scour the Web. An individual bombarded by spam, for example, may have been targeted because of an affiliation posted on Facebook. "There is no way to know," Conley said.

The text of ACLU's quiz put it in ominous terms: "Once details about your personal life are collected by a quiz developer, who knows where they could end up or how they could be used. Shared? Sold? Turned over to the government?"

The group acknowledged the irony of its approach: "We know it's a little weird to warn you about Facebook quizzes by asking you to take a Facebook quiz -- but at least you know who we are and that we have a real privacy policy that we're committed to upholding. Can you say the same for every unknown author of every quiz you or your friends take?"

Many Facebook quizzes have been created with templates from LOLapps, a San Francisco startup that enables users to create their own quizzes. It has also written its own quizzes, including such popular ones as "Which Sex and the City Character Are You?" and "What Type of Heart Do You Have?"

Efforts to reach LOLapps CEO Kavin Stewart on Wednesday were not successful.
___

(c) 2009, San Jose Mercury News (San Jose, Calif.).
Visit the World Wide Web site of the Mercury News, at http://www.mercurynews.com/
Distributed by McClatchy-Tribune Information Services.