cook was publicly criticized by the German data protect commissioner and the consumer protection minister. Chapter 20 . Corporate Social Responsibility 591 'Hamburg state data protection supervisor Johannes Caspar was an increase in spam that led Facebook to crack down red Facebook's privacy practices, and prosecutors were beginning in 2010. The other was that the apps would take user given 7 days s shared. idering taking formal action against the company. Faced information off the platform or misuse that information. In 2010 applications on Facebook's site-were found to have trans- Rotenberg mitted personal information on users to outside parties. e changes possible fines and additional damage to its reputation, essional. I ebook agreed to make changes in its Friend Finder service To make platformatizing work, companies needed access Rotenberg make it easier to block users from accessing address to Facebook users and data. In September 2011 Zuckerberg arr of the int of no looks . " An Austrian law school student Max Schrems requested announced that the company would update its "open graph" to live our information Facebook had on him, as the EU Data allow developers enhanced access to users. The system "allows election Directive provided. Facebook provided him with a outside applications-which users must sign up for-to tap 1 end up into Facebook users' data. The open graph will now allow a he fact with 1,222 pages of information. He said that there was Formation that was not included in the files. He and friends variety of media companies and start-ups to create applications ends, it for consuming and sharing content inside of Facebook."1 12 or her in established the online campaign Europe-v-Facebook that Facebook had partnered with Sweden's Spotify to allow sued 22 complaints that the group sent to the Irish Data Facebook users to allow their friends to see in real time the Protection Commissioner, who had jurisdiction over Facebook. music they were listening to. Daniel Ek, CEO of Spotify, said a The campaign inundated Facebook with requests by users for person was twice as likely to purchase music if they have a com- Their data . 108 recommendation from a friend on Facebook. Ek said, "We ices." are bringing people back to paying for music again."1 14 dent The German state of Schleswig-Holstein had ordered government agencies to take Facebook's Like button off their Zuckerberg said, "It's amazing how much music you can from computers. The European Commission also stopped using discover from your friends. Knowing that you helped a friend ared Facebook's public relations service discover something new, and that they like your taste in music, book is awesome."1 15 ures es. APPLICATIONS AND DEVELOPERS Netflix similarly sought to increase demand by having Facebook users share information on the movies they rented. Many marketing companies had developed detailed informa- This, however, was thwarted in the United States by the Video tion on consumers and sought to link their data with the infor- Privacy Protection Act that prohibited the release of informa- mation on Facebook's users so they could offer better targeted tion on video rentals. The law would have to be revised or advertisements, offers, and promotions. Intermediaries such as repealed for rental information to be shared. The video rental Merkle and Lithium Technologies worked with companies to sharing feature could still be made available outside the United develop applications to place on Facebook. For example States . Disney Destinations, which operated Disneyland and Wal Disney World, had detailed information on visitors to its parks. POST-LOGOFF TRACKING and nearly 18 million of its visitors were on Facebook. 19 Tom In September 2011 Nik Cubrilovic, an Australian blogger, Boyles, senior vice president of Disney Destinations, said. detected that Facebook placed cookies on users' browsers, and "Understanding our guests' past stays, favorite experiences and that those cookies tracked browsing after the user had logged attractions, entertainment preferences and desires allows us to out. Andrew Noyes, a Facebook spokesperson, said, "There create the most magical vacations possible. Social media is was no security or privacy breach. Facebook did not store or adding to our core 'Know me' strategy."110 use any information it should not have." The cookies had Facebook did not share information with advertisers unique identifiers, but Facebook did not keep the identifiers so about individual users, but it did aggregate information about it could not use any data after a user logged out. Facebook fixed users who, for example, clicked the like button on a brand or the problem advertisement. Facebook could provide that information to Privacy activists were not satisfied, however. Ten NGOs wrote to the Federal Trade Commission calling for an investi- apps developers and advertisers Facebook's popularity led some entrepreneurs to aban- gation of Facebook's tracking. The group wrote, "Thes don their plans to develop their own user base and to work off changes in business practices give the company far great Facebook's user base. This "platformatizing" has "enabled us ability to disclose the personal information of its users to to grab the things we need to generate commerce and allows us business partners than in the past. Options for users to preser to do what we do best," said Danny Leffel, CEO of Yardsellr the privacy standards they have established have beco Inc. 1 Developers had been allowed on Facebook since 2007, but as apps proliferated, two types of problems resulted. One 112 Wall Street Journal, September 23, 201 1. 113 Ibid. 114 San Jose Mercury News, September 23, 2011. 106 New York Times, January 25, 2011. 115 Ibid. 107 Ibid . 1 16This law was passed in 1998 after opponents of Supreme Court n 108 Irish Times, October 15, 2011. Robert Bork obtained his video rental records from Blockbuster and 109 Wall Street Journal, October 3, 2011. information against him in a media campaign. 110 Ibid . 117San Jose Mercury News, September 30, 2011. 111 Wall Street Journal, September 22, 2011.The Children's Online Privacy Protection Act (Coppa) 592 Chapter 20 . Corporate Social Responsibility prohibited online companies from registering children under 13 confusing, impractical, and unfair. " David Jacobs of EPIC, as users. Zuckerberg opposed Coppa and said, "[Coppa] will be one of the authors of the letter, said, "We would like the FTC to a fight we take on at some point." ~ Facebook had a "safety investigate the extent to which Facebook's recent changes and advisory board" that included heads of two children's safety its secret tracking of users after they have logged out constitute NGOs. Both advocated allowing children under 13 on Facebook unfair and deceptive business practices." Greg Stefancik, a and allowing Facebook to protect them. Both NGOs received Facebook engineer, said, "We do not share or sell the informa financial support from online firms including Facebook. 126 tion we see when you visit a Web site with a Facebook social plugin to third parties and we do not use it to deliver ads to PROPOSED REGULATION you. " A user from Illinois quickly filed a lawsuit seeking redress for wrongs committed by Facebook. Representative In December 2010 the FTC issued a report on online privacy. 127 Markey and Representative Joe Barton (R-TX) wrote to the The report criticized companies for their practices, particularly FTC urging that the residual cookie should be investigated as for the ability of third-party tracking of online users. The FTC an "unfair and deceptive act." report called for "privacy by design," greater Jodee Rich of People Browser, which analyzed social reater transparency of company policies, better consumer education about data prac- network data, warned, "Facebook wants to be omnipresent in the Web by adding commerce, video and mail to their early tices, and streamlined privacy policies including "do not track" success with news feeds and picture tagging. Trying to be all mechanism that a user could use to prevent tracking. The report things to all people was the undoing of Microsoft and AOL. If stopped short of recommending detailed regulation of online Facebook continues to overreach, they will stumble. "120 activity, but called on Web sites to make it easier for users to control their data. FTC Chairman Jon Leibowitz explained, FACEBOOK AND CHILDREN "Despite some good actors, self-regulation of privacy has not In 2011 Consumer Reports released a survey that showed that worked adequately and is not working adequately for American 7.5 million children under 13 years of age were on Facebook consumers. We'd like to see companies work a lot faster to and 5 million were under 5. Federal law and Facebook policy make consumer choice easier."12 Mark Zaneis of the prohibit children under 13 to have online accounts. Consumer Interactive Advertising Bureau (IAB) said that if a "do not Reports said that the children's accounts "were largely unsu- track" mechanism were established and participation was high pervised by their parents, exposing them to malware or serious as it was for the "do not call" mechanism for telephone calls, threats such as predators and bullies." The magazine stated, the online advertising industry would suffer "significant eco- "Clearly, Facebook presents children and their friends and fam- nomic harm."129 ilies with safety, security, and privacy risks."12 Technology The FTC did not have the authority to establish a do-not- editor Jeff Fox said, "Despite Facebook's age requirements track mechanism, so Congress would have to act. In March many kids are using the site who shouldn't be. What's more the Obama administration called on Congress to give the FTC troubling was the finding from our survey that indicated that a authority to enforce privacy protections. "The administration majority of parents of kids 10 and under seemed largely uncon- urges Congress to enact a 'consumer privacy bill of rights' to cerned by their children's use of the site."122 Facebook had a provide baseline consumer data privacy protections," wrote Family Safety Center on its Web site and had introduced new Lawrence Strickling of the Department of Commerce. security tools making it easier to report bullying and abuse con- Senators John Kerry (D-MA) and John Mccain (R-AZ) tent. Bret Taylor, chief technology officer for Facebook, said, sponsored The Commercial Privacy Bill of Rights Act of 2011 "Whenever we find out that someone's misrepresented their to "establish a right to protect every American when it comes to age on Facebook, we shut down their account. We don't allow people to misrepresent their age."123 the collection, use, and dissemination of their personally identi- The National Center on Addiction and Substance Abuse fiable information (PII)." Kerry said "Every single day each of at Columbia University conducts an annual back-to-school us produces a staggering amount of personal information on the survey of 12-17 year olds. The 16th annual survey asked about Internet. This journey can be tracked, it can be stored and it can the use of social media and found: 124 Compared to teens that be shared on an almost unimaginable scale." The three prin- spend no time on social networking sites in a typical day, teens cipal rights that would be established by the bill were that do are . The right to security and accountability . Five times likelier to use tobacco; . The right to notice, consent, access, and correction of . Three times likelier to use alcohol; and information . Twice as likely to use marijuana. . The right to data minimization, distribution constraints and date integrity 118 Washington Post, September 30, 2011. 119 San Jose Mercury News, September 30, 2011. 120 New York Times, September 22, 2011. 125 New York Times, October 16, 2011. 121 New York Times, October 16, 2011. 126 Ibid 122 San Jose Mercury News, May 11, 2011. 123 San Jose Mercury News, May 20, 2011. 127 Federal Trade Commission, "Protecting Consumer Privacy in an Era of Rapid Change," December 2010. 4, 2011. 24National Center on Addiction and Substance Abuse, Press Release, August 129 Ibid 128 New York Times, December 2, 2010. 130 New York Times, April 13, 2011.588 Chap 20 . Corporate Social Responsibility all states with the same requirement. Wal-Mart also announced ourselves and our resources."Wal-Mart established jobs and a so-called conscientious objector policy in which a pharmacist opportunities zones in 50 cities in which it hoped to open stores could direct a customer to another pharmacist or pharmacy. and vowed to locate in areas that traditionally had been shunned Wal-Mart announced a new position of senior director of by other retailers. Wal-Mart planned to help local businesses stakeholder engagement and sought "an innovative, out-of-the directly by placing advertisements for them in newspapers and box thinker" to "help pioneer a new model of how Wal-Mart on its in-store radio network. It also planned to provide coach works with outside stakeholders, resulting in fundamental ing for local retailers and financial support for local chambers changes in how the company does business." Wal-Mart also announced a search for a person to conduct "opposition of commerce. To reduce opposition from local banks to its industrial research" and oversee its "crisis communications program" and bank application in Utah, Wal-Mart pledged not to open any another for a person to "mobilize resources" during a "crisis branch banks. The application was opposed by the Independent situation."86 Community Bankers of America, the North Dakota Bankers Association, the American Bankers Association, and individual banks. Wal-Mart received support from the Salvation Army Preparation Questions and the National Center for Missing and Exploited Children, both of which had traditionally been supported by the company. 1. Evaluate the steps Wal-Mart has taken in developing a Wal-Mart had refused to sell the Plan B contraceptive, nonmarket strategy in response to the social pressure it also known as RU-486 or the morning-after pill, in its 3,700 faces. pharmacies. When the state of Massachusetts ordered Wal-Mart 2. What is Wal-Mart's motivation for its nonmarket strategy? to sell the pills, the company announced that it would do so in 3. What else should Wal-Mart do, if anything? Source: This case was prepared from public sources by David P. Baron. Copyright @ 2006 by the Trustees of the Leland Stanford Junior University. All rights reserved. Reprinted with permission. Facebook and Online Privacy INTRODUCTION challenge in the coming years is to convert that dominance in In 201 1 Facebook users exceeded 800 million people, and on one time and attention into a bigger share of consumer wallets-a day 500 million people logged into Facebook. User's spent more bigger share of money they spend either directly or indirectly time on Facebook than the total on the next four most popular through advertising." One continuing threat to that task was sites. In the first quarter of 2011 Facebook had 346 billion ad online privacy, which threatened usage as well as government impressions (views of advertisements). Revenues were expected regulation in the United States, Europe, and other countries. to reach nearly $2 billion in 2011. Growth on Facebook had con- tinued at a torrid pace as more and more users used it as their ONLINE PRIVACY interface with the Internet. Research firm eMarketer estimated that online advertising revenue would increase to $132 billion by Online privacy was not directly regulated in the United States, 2015, a two-thirds increase from 201 1. which had relied on self-regulation by individual companies Facebook had remained privately held and had limited the and the industry. Most major Web sites posted a privacy policy number of shareholders to fewer than 500 to avoid Securities and some allowed users to opt out of data collection. Tracking nd Exchange Commission (SEC) reporting and disclosure of Internet browsing was widespread, with Google leading equirements. The company had raised capital through private the way. Incidents raised concerns among users, attracted th lacements, including $1.5 billion raised in 2011 through a pri- media, and led to government efforts to protect privacy. Som ate placement led by Goldman Sachs. Facebook was widely regulatory proposals if enacted could severely limit data colle xpected to go public in 2012 and could have a valuation of tion and reduce online advertising revenue directly. In addition 50 billion to $100 billion existing laws in the United States posed challenges to onli The strategy challenge for Facebook was described by companies, and pending privacy regulation in the Europe rofessor Eric Brynjolfsson of the Massachusetts Institute of Union could affect online businesses worldwide. Legislat echnology, "As Facebook becomes more and more synony had been introduced in Congress to regulate online priv ous with the Internet experience, that is going to benefit and President Obama had called for a "consumer privacy acebook shareholders. Facebook has been very successful in of rights." etting the lion's share of people's time and attention. Their 85 Aaron Bernstein, edited by Dan Beucke, "A Social Strategist for Wal- Business Week, February 6, 2006. 106. Michael Barbaro, "Wal-Mart Offers Aid to Rivals," New York Times, April 5, 86 Michael Barbaro, "Wal-Mart Begins Quest for Generals in P.R. War York Times, March 30, 2006. 87 New York Times, September 22, 201 1.The second right provided for opt-out and not opt-in. he bill also did not contain a do-not-track provision. Kerry Chapter 20 . Corporate Social Responsibility 593 Plained that do-not-track "didn't seem to fit into our ability Directive. came from the proposed revision in the EU Data Protection oppa) der 13 "get the balance between consumer support and industry ill be "port that we were able to get," but he added that it would In light of the pressure Facebook faced, it increased the afety ikely be an amendment that would be considered. size of its Washington office and established a political action In March 2011 N ol1 Microsoft announced that forthcoming committee FB PAC to "give our employees a way to make afety their voice heard in the political process by supporting candi- book mernet Explorer 9 would include Mozilla's do-not-track pil- hey feature that displayed a header when a user connected dates who share our goals of promoting the value of innovation ived a Web site that asked users if they wanted their activity to our economy while giving people the power to share and make the world more open and connected." 2 Facebook hired racked on that site. Microsoft also planned to retain its cur- Tim Sparapani, a former privacy expert at the American Civil ent Tracking Protection Lists. Google planned a "Keep My Liberties Union, for its Washington office. Sparapani said, "We Opt-Outs" feature for Chrome. need to be here to define ourselves before someone else does it The threat of legislation and FTC regulation spurred for us. It's clear we need to be part of the new thinking of industry self-regulation. The IAB, whose members include Washington-and early in the company's maturation the major online companies including Facebook, adopted a process."153 code of conduct that included a version of a do-not-track Preparation Questions mechanism. The LAB members agreed to display a turquoise triangle with an "i" in the center that allowed a user to click 1. Are users really concerned about these privacy issues? Is it mainly a small set of privacy activists who are through to a Web site where it could opt out of tracking by raising concerns? participating com companies. Carmen Balber of Consumer 2. Is competition in privacy sufficient to protect users? Watchdog caustically ally characterized the IAB mechanism, 3. How big a threat is the proposed revision to the EU's Data "The LAB's program does not give consumers the ability to Protection Directive? opt out of tracking-either in theory or practice. Companies 4. Should Facebook establish a right to be forgotten for its who participate agree to stop targeted advertisements for con- community of users? sumers that opt out. However, they may continue to track 5. How should Facebook handle the default setting on the (others) at will."131 introduction of its next new feature? Although Facebook did not track users outside its Web 6. Should Facebook ask users for permission before targeting site, any regulation of online activity would have ramifications advertising to users? 7. What data protection policy should Facebook adopt? for the company. Perhaps the greatest regulatory uncertainty Copyright @ 2011 by David P. Baron. All rights reserved. Reprinted with permission. usnig590 Chapter 20 . Corporate Social Responsibility Timeline, Zu to review and edit their entries ared an automatic sign-up that changes users' privacy settings with- In response to the announcement of Timeline, Rotenberg commented, "It's getting really difficult to evaluate the changes out their permission."94 Data protection regulators in the European Union reacted that Facebook makes, and I say that as a privacy professional. I quickly to the introduction of the face-recognition technology. can't imagine what the typical user goes through."to Rotenberg Data protection regulators in Hamburg, Germany and the Netherlands asked Facebook to disable the technology and the planned to write the FTC about his concerns. Ben Barr of the Commission's data protection advisory panel took up the issue technology blog Mashable, wrote, "We're at the point of no of whether the feature violated a user's privacy. A Facebook return. Facebook's passive sharing will change how we live our lives. More and more, the things we do in real life will fe will end up spokesperson in Berlin said, "We will consider the points the Hamburg Data Protection Authority have made about the photo as Facebook posts. And while we may be consoled by the fact tag suggest feature but firmly reject any claim that we are not that most of this stuff is being posted just to your friends, it meeting our obligations under European Union data protection only takes one friend to share that information with his or her law."Facebook said it had received few complaints about the friends to start a viral chain."102 face-recognition feature. In July 2011 the privacy commissioner of Canada, SETTLEMENT WITH THE FTC Jennifer Stoddart, raised concerns about data gleaned by third- party apps such as games and quizzes on Facebook. In August Facebook and the FTC reached a settlement on the EPIC com Facebook responded by announcing new privacy features that plaint that Facebook had engaged in "deceptive trade practices. required apps to notify user of and obtain permission for spe- The settlement required Facebook to undergo independen cific information at the time it is needed, rather the current privacy audits for 10 years and prohibited the company from blanket approval. The new features would be implemented making public information that a user had previously share worldwide. Stoddart commented, "application developers have with a limited group. The settlement did not require Faceboo had virtually unrestricted access to Facebook users' personal to obtain permission from users to be included in new featur information. The changes Facebook plans to introduce will nor did it require the company to agree to changes in feature allow users to control the types of personal information that Referring to earlier privacy features introduced applications can access."96 The August announcement included other features to Facebook, Amber Yoo of the Privacy Rights Clearinghous give users better control over the content they posted. The said, "Companies know that making a user go through an ex changes allowed users to edit and remove content and improved step to secure greater privacy over their account is somethin majority of users aren't going to do."103 "Who can see this?" by changing the label "Everyone" to "Public." Some privacy controls were also moved to a user's Jeff Chester, executive director of the Center for Dig home page. Privacy advocates generally praised Facebook for Democracy, commented on the settlement, "We have not r the changes. Facebook vice-president Chris Cox, said, "We the fine print, but the fact is that business realities are goin want to make this stuff unmistakable clear. It has to clear that shape Facebook's data collection practices-not regulation Facebook is a leader in how people control who sees what." the absence of a major consumer revolt, Facebook is goin Skeptics observed that the changes came 6 weeks after Google continue to push the envelope."104 He continued, "I have introduced its new social network Google+. Justin Brookman, doubts about the impact of the settlement. Does the cor director of the privacy program at the Center for Democracy decree provide new rights for users on Facebook to co and Technology, who had consulted with Facebook on the their data, or it is a digital bump in the road that will do no changes observed, "This is Facebook competing on privacy." to deter the social network's voracious appetite for cons Simon Davies, director of Privacy International, said, "Google information?"105 has shamed the company into reform but even now most The settlement between the FTC and Facebook Facebook executives don't understand why privacy is a criti- cally important design component." patterned after a similar settlement with Google over p In September 2011 Facebook introduced its new Timeline controls on its now-defunct Buzz social media site. T ormat for storing and sharing. Mark Zuckerberg said, "We had also reached a settlement with the FTC. Both settle anted to make Timeline a place you were proud to call your required an annual independent audit of the companies' policies. me. Timeline is a completely new aesthetic for Facebook. It's e story of your life. You have all your stories, all your apps, and new way to express who you are." When he introduced PRIVACY ENFORCEMENT IN THE EUROPEAN UN In Germany people who were not Facebook users com that they were receiving Facebook solicitations becau w York Times, August 4, 2011. email addresses were culled from Facebook users' em Jose Mercury News, August 28, 2011. all Street Journal, August 24, 2011. ancial Times, August 23, 2011. 102 Ibid 101 San Jose Mercury News, September 27, 201 1. in Jose Mercury News, September 23, 2011. 104 Ibid. 103 San Jose Mercury News, November 11, 2011. 105 ThidThe United States had little regulation of the Internet or aline commerce, but the pra the practices of online companies were Chapter 20 . Corporate Social Responsibility 589 did to other laws, including antitrust laws. The Federal developers sold data to data brokers. Privacy concerns also unced Commission (FTC) had authority to regulate "deceptive arose in connection with the introduction of its Places feature in 2010. Facebook tightened its practices. nacist We practices, " and this authority covered privacy policies. Facebook also had a "hate and harassment" team that or of FTC had the authority to initiate civil proceedings against policed its Web site, taking down objectionable material. -the Impanies, and citizens could file complaints with the FTC. fart The European Union had more strict data protection regu- Nevertheless postings by users continued to be a problem. sion than had the United States, and the United States and the Moreover, the company faced issues pertaining to free speech tal So it had reached a safe harbor agreement that allowed U.S. firms In one case Facebook allowed postings that led Pakistan to Process data outside the EU. Companies that operated in the block Facebook. Team member Nick Sullivan said, "In the EU as did Facebook, Go k, Google, and Twitter abided by its data pro- same way that efforts to combat bullying offline are not 100 ection laws. Those companies stored data on clouds and oper- percent effective, the efforts to stop people from saying some- ed their clouds from Ireland. A number of other countries had either."91 thing offensive about another person online are not complete been forced to adopt the EU rules. The EU commissioner for justice Viviane Reding e Reding had been developing an updated In December 2009 Facebook had trumpeted a new privacy "gulation to present to the Parliament and Council of Ministers platform that it said was "setting a new standard in user con- trol." The new privacy features "include added control for each in January 2012. The revision would strengthen privacy protections on a number piece of content users share, simplified privacy settings, help in umber of dimensions. One was to require choosing settings and expanded privacy education materials." opt- in for permission ssion for Web sites to use personally identifiable What Facebook did not disclose was that the default had been information. Another was to establish a right to be forgotten, reset to make publicly available a variety of personal informa- which would require require a Web site to delete all information about a tion, including name, picture, location, gender, and friends list. person upon request (see also the Chapter 16 case The European This led to a firestorm of complaints and protests. A number of Union Data Protection Directive (B)). In November 2011 privacy NGOs leaped on the issue, and the Electronic Privacy Reding announced in a speech that she intended to go much Information Center (EPIC) and other NGOs filed a complaint further than the changes in the proposed revision. She said, "We with the FTC. both believe that companies who direct their services to Facebook introduced its Sponsored Stories, which European consumers should be subject to EU data protections allowed advertisers to use the online equivalent of word-of- mouth advertising. Advertisers could pay to send an advertise- laws. Otherwise, they should not be able to do business on our ment to the friends list of a user that clicked the Like button on internal market. This also applies to social networks with users an advertisement or brand. Privacy setting were maintained, so in the EU. We have to make sure that they comply with EU law the advertisement would go only to those in the user's selected and even if its data are stored in a 'cloud." Reding had group. 92 criticized Facebook for its data retention policies. New Facebook features also posed challenges. In June The bold proposal to regulate outside the European Facebook introduced its face-recognition technology that Union was opposed by U.S. businesses. The American Chamber allowed users to tag and identify friends in photos. Then, when of Commerce to the European Union had filed a 42-page brief, a user posted a photo, the face-recognition technology identi- with the commission warning against revisions to the directive fied and suggested the name of the person tagged from the at would inhibit the free flow of information." user's set of friends. The photo then provided a link to the page A USA Today/Gallup Poll in 2011 found that 26 percent of the person linked. Facebook explained, "If for some reason f respondents who used Facebook daily were "very concerned' someone doesn't want their name to be suggested, they can dis- out privacy compared to 35 percent who used Facebook less able the feature in their Privacy Settings." It was easy for users gularly. Surveys of Internet users regularly found that when to hide a photo on their home pages, but the tag remained on ked about privacy, respondents express concerns, but when the page of the person who tagged it. Eliminating the tag was pondents were asked to list things that concern them, online more cumbersome. When it rolled out the technology, Facebook vacy was not high on their lists. A study by three Google made it the default and a user had to opt-out if it wanted to earchers found that survey responses depended significantly avoid the tagging. Marc Rotenberg, executive director of EPIC, complained, "Facebook users thought they were simply tag- how the questions were asked ging their friends. Turns out Facebook was building an image CEBOOK AND DATA profile database to automate online identification." Representative Edward J. Markey (D-MA), who had sponsored ebook did not sell personal information to anyone or share privacy legislation in the House of Representatives and was an ith advertisers. In 2010 it was revealed that some apps advocate of opt-in, said, "If this new feature is as useful as luding Farm Ville had transferred data including users' Facebook claims, it should be able to stand on its own, without numbers off Facebook's Web site. Moreover, some apps 91 New York Times, December 13, 2010. enforcement powers of the FTC 92 San Jose Mercury News, January 27, 2011. York Times, November 10, 2011. 93 Wa 1. June 7, 2011