On Oct. 18, 2010, the Wall Street Journal (“WSJ”) published an article alleging that applications on Facebook were transmitting personally identifiable information (“PII”) to various Internet advertising companies. (Note: a version of the article appeared on the WSJ’s website on Friday, Oct. 15.) The WSJ article alleged that each of the 10 most popular Facebook applications, including Zynga’s FarmVille, Texas HoldEm Poker, and FrontierVille, were inadvertently transmitting users’ “Facebook ID” numbers (unique numbers assigned to every Facebook user), and, in some cases, the Facebook ID of the user’s friends, to outside companies.
The applications at issue allegedly used a HTTP “referrer” (a common Web standard), to pass on the address of the page the user was viewing, which may expose the user’s Facebook ID, when the user navigates to another page by clicking on a link. Some of the applications passed the referrer headers (containing the Facebook IDs of users) to outside firms, according to the WSJ. According to the WSJ article, sharing of such information violates Facebook’s rules for application developers as well as several of the privacy policies for the applications themselves.
A spokesman for Facebook said the company was taking steps to introduce new technology to address the issue. Facebook has also addressed the issue in a post on its developer blog.
Reaction to the WSJ article has been mixed. In Forbes’ “The Not-So Private Parts” blog, Kashmir Hill called the WSJ’s article “privacy advocacy theater,” defined by privacy commentator Ben Adida as “the act of extreme criticism for an accidental data breach rather than a systemic privacy design flaw.” Hill’s post also highlighted reactions from other commentators, including Henry Blodget of Business Insider, who defended the WSJ’s piece, and media professors Jeff Jarvis and Adam Penenberg, both of whom argued (via Twitter) that other companies, including publishing and credit card companies, shared far more PII than Facebook.
