FTC's Myspace case: Part 1

Have you reviewed your company’s privacy policy lately? The FTC’s proposed settlement with social network Myspace serves as a timely reminder to make sure what you tell people about your privacy practices lines up with what actually happens in the day-to-day operation of your business. While you’re at it, double-check to make sure you’re giving customers the straight story about third-party access to their information. The Myspace case is the latest in the FTC’s line of law enforcement actions challenging what the agency says are false promises made to consumers about how companies use — and more importantly, how they promise not to use — people's personal information. One particular FTC concern in this case is that the information Myspace shared with advertisers gave advertisers access to users’ full names, in violation of the company’s privacy promises. When it comes to personally identifiable information (PII), a person’s name is about as personally identifiable as it gets. Some background on what the FTC says was going on: Like other social network sites, Myspace users can create and customize personal online profiles. To register, people have to give their full name, email address, birth date, and gender. Then there’s optional info Myspace collects, like a user’s picture, relationship status, sexual orientation, hobbies, etc. Myspace assigns a unique identifier — called a Friend ID — to each profile that’s created. According to the FTC, Myspace’s default settings made users’ full names publicly available via the Friend ID. People had to override that default if they wanted to hide their full names. What did Myspace say about how it used people’s information? According to the FTC, it boiled down to this: that the company wouldn’t use or share a person’s personally identifiable information except as described in its privacy policy, including sharing information with third parties. Even when Myspace used cookies to customize content and advertising, the company told people that “the information used for this feature does not provide your PII or identify you as an individual to third parties.” But the FTC’s complaint alleges that those promises didn’t square with what was actually happening on the site. Here’s how third-party advertisers fit into the picture. Myspace makes money by allowing affiliate or third-party ad networks to display ads on its site. When a Myspace page loads, Myspace sends a request to the network, telling it to serve up an ad. The FTC says that along with that request, Myspace transmitted the Friend ID, age, and gender of the user who was looking at the page. Third-party advertisers could take simple steps to get detailed information about individual users, including visiting their personal profiles on Myspace to get their full names and even combining their names and other personal information with that advertiser’s tracking cookies to compile a history of websites the person has visited. The FTC’s complaint alleges that Myspace represented, expressly or by implication, that it wouldn’t use or share a user’s personally identifiable information except as described in the privacy policy — including sharing it with third parties — without telling users and getting their OK first. But the FTC says that despite that claim, Myspace shared users’ Friend IDs with third-party advertisers. At minimum, the Friend ID gave advertisers access to the user’s basic profile information, which for most people, included their full name. That wasn’t explained in Myspace’s privacy policy and the company didn’t get users’ OK to do that. Therefore, alleges the FTC, what the company said about how it handled personal information was false or misleading, in violation of the FTC Act. The complaint also charges that Myspace told people that any web browsing activity shared with advertisers would be anonymized. But given that advertisers could tie a user’s Friend ID and the additional personal information the Friend ID gave access to with the advertiser’s tracking cookies, that claim also was false and deceptive. Next: More about the FTC’s settlement with Myspace