Facebook's new privacy policy aims to explain the data it gathers on users more clearly — but doesn't actually change what it collects and shares.
The company unveiled the revisions Wednesday as it faces one of its worst privacy scandals in history. Although Facebook says the changes aren't prompted by recent events or tighter privacy rules coming from the EU, it's an opportune time. CEO Mark Zuckerberg is also set to testify before Congress next week for the first time.
As Facebook evolved from a closed, Harvard-only network with no ads to a giant corporation with $40 billion in advertising revenue and huge subsidiaries like Instagram and WhatsApp, its privacy policy has also shifted — over and over.
Almost always, critics say, the changes meant a move away from protecting user privacy toward pushing openness and more sharing. On the other hand, regulatory and user pressure has sometimes led Facebook to pull back on its data collection and use and to explain things in plainer language — in contrast to dense legalese from many other internet companies.
Among Wednesday's changes: Facebook has added a section explaining that it collects people's contact information if they choose to "upload, sync or import" this to the service. This may include users' address books on their phones, as well as their call logs and text histories. The new policy says Facebook may use this data to help "you and others find people you may know."
The previous policy did not mention call logs or text histories. Several users were surprised to learn recently that Facebook had been collecting information about whom they texted or called and for how long, though not the actual contents of text messages. It seemed to have been done without explicit consent, though Facebook says it collected such data only from Android users who specifically allowed it to do so — for instance, by agreeing to permissions when installing Facebook.
Facebook also adds clarification that local laws could affect what it does with "sensitive" data on people, such as information about a user's race or ethnicity, health, political views or even trade union membership. This and other information, the new policy states, "could be subject to special protections under the laws of your country." But it means the company is unlikely to apply stricter protections to countries with looser privacy laws — such as the U.S., for example. Facebook has always had regional differences in policies, and the new document makes that clearer.
The new policy also makes it clear that WhatsApp and Instagram are part of Facebook and abide by the same privacy policy as their parent. The two were not mentioned in the previous policy. While WhatsApp still doesn't show advertisements, Instagram long has, and the policy consolidation could be a sign of things to come for WhatsApp as well.
Other changes incorporate some of the restrictions Facebook previously announced on what third-party apps can collect from users and their friends. For example, Facebook says it will remove developers' access to people's data if the person has not used the app in three months. Access by apps is under scrutiny following allegations that political consulting firm Cambridge Analytica improperly obtained data on millions of Facebook users through an app that claimed to be a research tool.
The policy changes come a week after Facebook gave its privacy settings a makeover. The company tried to make it easier to navigate its complex and often confusing privacy and security settings, though the makeover didn't change what Facebook collects and shares either.
Those who followed Facebook's privacy gaffes over the years may feel a sense of familiarity. Over and over, the company — often Zuckerberg — owned up to missteps and promised changes.
In 2009, the company announced that it was consolidating six privacy pages and more than 30 settings on to a single privacy page. Yet, somehow, the company said last week that users still had to go to 20 different places to access all of their privacy controls and it was changing this so the controls will be accessible from a single place.
