Blog Post

The Deal With Facebook Places & Privacy in English

Updated: Facebook launched a feature last night called Places that enables users to share their location. Before the launch event had even concluded, the ACLU of Northern California had fired off a missive about how the product fails to protect user privacy. The complaints haven’t stopped since then, with groups like the Center for Digital Democracy saying it will try to get the U.S. Federal Trade Commission involved and widespread Twitter chatter bemoaning the Places default settings.

Facebook should have known this criticism was coming, no matter what it did. Privacy is a very real issue when it comes to people’s personal information, and especially their real-time location. The company tried to make such issues go away with a big simplification of its privacy settings in May and a dedicated presentation about privacy at the Places launch event last night. However, there was no chance that was going to be enough.

From my perspective, the differences between Facebook’s and other people’s check-in products (e.g. Gowalla and Foursquare) are the following:

  • Facebook has more than 500 million users who signed up to use a social network, not a location-sharing service.
  • Facebook allows users to tag their friends at locations. So there’s the possibility that a friend could “check-in” at a location and tag you even if you aren’t actually there.
  • Facebook shows users’ full names and profile data when they’ve recently checked in at a place (this feature is called “Here Now”).

The ACLU’s basic contentions are that:

  • Facebook Places is opt-out instead of opt-in.
  • Users’ check-in data can be seen by people who are not their friends through Here Now.
  • Facebook developers get access to Places data in their applications. In other words, if your friend installs an app but you don’t, your data goes to that developer anyway.

This morning, Facebook contested the ACLU’s complaints with an email to press saying:

  • Places is not actually opt-out. Before any location data about them is published, all users must must opt-in to the product. They cannot be checked in by friends until they are Places users. When a friend tags you at a location you get notified, and it doesn’t show up on your profile until you agree.
  • Users can limit their settings to turn off “Here Now” functionality or their check-ins entirely.
  • Facebook automatically turns Here Now off if you already have restricted other privacy settings, and automatically limits sharing with applications if you opt out of other location-sharing features.

Bringing attention to the issues of privacy around location sharing is a good cause, so props to the ACLU for that. As it is, Facebook users are complaining themselves that turning off Places entirely involves jumping through several hoops. Facebook absolutely could have made Places more opt-in, for instance, by making people find the app themselves and decide to install it on their profiles. But as usual, the company is more concerned with reducing friction that will stop products from spreading and people from sharing. That’s always going to be problematic for many people. In my opinion, friends checking friends in to inaccurate locations will happen rarely unless your friends are jerks or teenagers. Both of those are (hopefully) temporary situations.

Update: We asked Facebook to clarify the issue of how exactly a user opts in to the service. Here’s spokesperson Meredith Chin’s reply:

Before you use Places, when you get tagged by a friend at a place, you receive a notification that asks you if you want to let your friends check you in to places.

If you click “Allow”, then it’s as if you have checked in yourself. This means that you show up on the Place Page in the People Here Now section (unless you have turned that off in your privacy settings) and in the Friends Who Have Visited section.

If you click “Not Now”, then it will be as though you have been tagged in a status update, but you will not be associated with the Place Page. And every time you are tagged you will get the same notification asking if you want to click “Allow” or “Not Now.” (This appears every time you are tagged until you choose one.)

If you have clicked “Allow” then you will still receive a notification when you are tagged, but you will not have to click “Allow” every time. You can, however, go to your privacy settings and disable the ability for friends to check you into places.

If you’re checked in, you appear in the Here Now for a short period of time or until you check in at a new place.

A few things to remember:
You can restrict who sees your check ins using the privacy settings.
Only your friends can check you in.
You can only tag friends when you have also checked in somewhere.

Photo courtesy of Flickr user Shortlake Snapshots.

Related content from GigaOM Pro (sub req’d):

Facebook Tries to Navigate Privacy Storm

Please see the disclosure about Facebook in my bio.

18 Responses to “The Deal With Facebook Places & Privacy in English”

  1. I was entirely disturbed when I saw the Facebook Places feature. I didn’t find it difficult to opt-out, but I am sure that some people might. Within hours of it going live there were directions on how to opt out in my newsfeed, many of which were not correct.

    I actually didn’t have a problem with the application, (I figured, just don’t use it) but then I found out other people could “check me in” which I found creepy. So I did everything I could to disable the darn thing. Hopefully I did.

  2. Thanks for your report. You motivated me to go to my FB Profile page. Under Account, I clicked on Privacy Settings. I saw three new “Places” boxes here and there. I opted out. It was easy. Anybody who’s ever looked at their Privacy Settings would have no trouble with it. However, it would have been better if FB had disabled the additions to start with and given me the choice of participating. FB should have given me and all other users sufficient notice of the change along with clear instructions, and not have left it up to third parties like GigaOm and the ACLU to tell everyone what’s happening. Does that make FB into minions of the devil? No, but I do think they’re too cocksure – callous and careless – and need to be taken down a peg or two. Trouble is, what they’ve created is so damn good!

  3. I have a colleague in private security. Oftentimes he is required to trace and track individuals. He uses Facebook. Yep. It’s amazing how most men will allow a friend request from a cute (but fake) lady. He says it’s the largest, free, publically available databases in the world. People are actively updating their own information on it. Recently he used to watch status updates to find out where people are, or would be. Places is going to be huge for him.
    These aren’t criminals. These are individuals, most like everyone else, but someone is paying to have them traced, tracked, and it’s being facilitated by Facebook. Anyone with even more sinister intentions can (and will) use the service similarly.
    Not being overdramatic, just completely realistic.

  4. What kinda scam is Facebook pulling here?

    “Places is not actually opt-out. Before any location data about them is published, all users must must opt-in to the product. They cannot be checked in by friends until they are Places users. When a friend tags you at a location you get notified, and it doesn’t show up on your profile until you agree.”

    COULDN’T BE MORE WRONG…. while they are correct in saying it won’t show up in my profile until I agrees, I still show up in HIS PROFILE when he tags me. So, if he tags me at a place, all of his friends know exactly where I am. We both have the same friends. I DON’T WANT F***NG PEOPLE KNOWING WHERE I AM. HOW ON EARTH COULD FACEBOOK ALLOW THIS TO BE AN OPT OUT FEATURE.

  5. It is odd that this as an opt-out rather then opt-in feature… well I guess you do have to opt in per se. The first time you’re tagged in a place you have to approve or decline it and then you can choose to opt-in or shut off the feature. Still I don’t think this will be as big a splash as people think for FB… nor will it kill services like FourSquare… The FourSquare community wants to let people know their location for good reason… FB is just trying to get it’s HUGE user base to share locations so they can mine that data and eventually sell a sandwich shop down the street from your office an ad b/c they know you’re there.

  6. dotrights

    ACLU-NC Response to Facebook: Today’s Check-in

    We understand and appreciate the various privacy protections and options that are currently available to Facebook Places users. But there were some straightforward steps that we highlighted to Facebook that they could have taken to improve the privacy features before launch. Not having these common sense privacy protections has unfortunately overshadowed some of the safeguards that the Places team worked so hard to build into the product.

    We have a responsibility to thoroughly analyze the privacy implications of new products and these were our initial concerns.

    Read more at:

    the ACLU-NC “Demand your dotRights” campaign for digital privacy

  7. Because he is succinct and brilliant, and no one has said it better, this is from Wil Wheaton’s blog re: PLACES:

    Facebook continues its all-out assault on its users’ privacy with the new Places feature, which is (of course) on by default, with no warning. Lifehacker has the lowdown, including how to turn it off. As I’ve said before, if you dig Facebook, I’m not going to give you a hard time about it, but I strongly encourage you to turn this feature off. The world doesn’t need to know where you live, and when you are (and aren’t) home. Also: Fuck you, Facebook, for turning this on by default and not warning your users about it. You’re one of the most profoundly immoral companies in the history of the Internet.

    • I’m not saying that privacy issues are not at stake, but I think Wil is being overdramatic here. Facebook isn’t going to tell the world where you live or when you’re home. And it is warning users about the new feature before turning it on for them.

      • While only a fool would include their IRL address anywhere online, or, establish it as a “Place,” what happens when you throw a party and all of a sudden 30 people create a check-in @ Liz’s House? Now, @ Liz’s house is a public Location. Then, you’re @ a bar, and someone Tags you (without your permission), so, 1+1= Liz is not home. Never mind, now every knows where you are, even if you didn’t want them to? Where you are and where you live becomes pretty simple to calculate. Too simple.

        The low-down is that people are handing Facebook personal information and Facebook is profiting from it. People are not truly digitally enlightened or aware of the impact of this yet. And, many are Minors who are engaging in this without Parental Consent (which is required to get a Tattoo).

        I believe @wilw is quite articulate and not cutting anyone any slack. He’s not worried about being invited to FB parties and press announcements. He’s just sayin’ what he’s sayin.”

      • I appreciate the follow up on this.

        My question is, while my 14 year old daughter (on FB for 3 years) is quite smart and well read – At what point in the @meredithchin instructions do her eyes glaze over? Mine did about 30% into the instructions.

        There are seven “ifs” followed by three “things to remember.”

        They couldn’t default to a “No, I don’t want to participate in Places at all.” With an opt-in “Yes, I want to participate in Places” with two simple sub categories, default: “No, I don’t want to allow friends to check me in” and an opt-in “Yes, allow Friends to expose my whereabouts, create fictional travels and physical relationships for me”?????

        It could have been simple. It could have been direct and honest.

        Instead, it’s more smoke/mirrors and “ifs” with “things to remember” no doubt intended to confuse people and gather more personal data without them really understanding what this is about.

        That is why @wilw ‘s sentiment resonates.

        I’m not a fan of Government intervention in business. But, as we’ve seen, big businesses tend to become corrupt if not regulated. Maybe it’s human nature? At this point, I really hope FB gets shackled with an order to remove all Users under 18 without written and verified Parent Consent and Full Disclosure to Parents about what data they are extracting from our children (and selling) and the RISKS that are increasingly apparent through exposure of personal information on FB, particularly tied to REAL WORLD activities (“Places”).

        Seven “ifs” and three “remembers” reeks of “sneaky.” I hate it (Please give me a HATE button).

  8. “Facebook automatically turns Here Now off if you already have restricted other privacy settings, and automatically limits sharing with applications if you opt out of other location-sharing features.”

    I’m sorry, but if my account is any indication, that’s total and complete BS. I have every single privacy setting in Facebook turned to the absolutely most private settings (Friend Only typically). And yet when I logged into the privacy section (which is becoming almost daily it feels like), sure enough the ‘Here Now’ was turned on and ready to go.

    Facebook’s privacy settings have become easier to navigate, no question, but the fact remains that as a company they seem to have a culture that views privacy as ENTIRELY opt-out, not opt-in.

    I keep a Facebook account for it’s utility (friends organizing things mostly), but I’ve gotten to the point now where I don’t even have personal information up there anymore because every time a new feature is added, privacy is once again at stake.