EPIC: Facebook Timeline changes users' privacy settings

EPIC has pointed out a privacy change the new Timeline profile has made for some Facebook users. You can't mass hide all your friending stories any more, nor can you stop them from being posted.
Written by Emil Protalinski, Contributor

The Electronic Privacy Information Center (EPIC) is working very hard to point out Facebook privacy issues to the Federal Trade Commission (FTC). A big part of its onslaught is centered on privacy through obscurity; EPIC insists the FTC's November 2011 settlement with Facebook doesn't allow this, but Facebook strongly disagrees. There's more though: EPIC claims Timeline makes changes to default privacy settings users set before the new profile rolled out, specifically related to the event of friending someone on the social network.

EPIC first made this argument last month. Facebook countered by saying Timeline has nothing to do with privacy.

I pressed EPIC for more information about specific changes Timeline had made that affected users. The organization was very adamant about the privacy through obscurity angle, but also came up with a separate example that was more troubling, at least in my eyes. Timeline changes the default settings for when Facebook posts a story saying you friended someone.

"Among one of the many ways in which Timeline subtly changes user privacy settings is the display of Friending," an EPIC spokesperson said in a statement. "Before Timeline, you could choose not display on your wall the people you friended. With Timeline, Facebook now shows, sometimes by month, the people you friended, *after* you made the choice not to display this information. A Facebook user who previously selected do not disclose friending events on the wall will now see in the Activity Log for friending events 'Allowed on Timeline' when the obvious default should be 'Hidden from Timeline'."

As you can see in the screenshot above, when I friend someone, the story is posted on my Facebook Timeline. That's how I had Facebook set up before I got Timeline, so this doesn't bother me. EPIC argues, however, that Facebook users who explicitly set this type of story to hidden by default have now had it set back to visible by default, ever since they got Timeline. If true, this would indeed violate the settlement Facebook made with FTC.

Worse yet, there doesn't seem to be an option to disable this automatic posting for all friending stories. Not only does this mean that you can't mass hide all previous friending stories, but you can't do so for future ones either. Furthermore, users who had hidden all their friending stories from their profile, and now have them back on the Timeline, cannot undo this change Facebook made for them. "Looks to me like you have to go in and enter 'Hidden from Timeline' for each friending event," an EPIC spokesperson said in a statement. "Which is ridiculous."

I know Facebook offered this option before, but I'm not sure it was available right before Timeline launched. It's thus possible that only users who had the friending stories disabled before the option was removed could keep them disabled. Once Timeline rolled out and turned the friending stories back on for everyone, it became apparent that they can no longer be all disabled by default.

It's worth noting that this issue is separate from the unfriending one found four months ago, before everyone could get Timeline. In that case, Timeline let you see who had unfriended you. This was more a bug than a feature; Facebook fixed it very quickly.

There is still a friending aspect that Facebook users have complete control over. Even with Timeline, you can still set "who can see your friend list on your profile" to the following options: Public, Friends, Only Me, and Custom. It just seems Facebook is not so strict when it comes to the actual event of friending someone.

With its letters to the FTC, EPIC is hoping the US agency will require Facebook to make the following five changes:

  • Restore the privacy settings that users had in 2009, before the unfair and deceptive practices addressed by the Complaint began;
  • Allow users to access all of the data that Facebook keeps about them;
  • Cease creating facial recognition profiles without users' affirmative consent;
  • Make Facebook's privacy audits publicly available to the greatest extent possible;
  • Cease secret post-log out tracking of users across web sites.

The friending privacy change isn't listed, but I think it's one worth clarifying, since it's more significant than the more broad privacy through obscurity issue. I have contacted Facebook about this latest friending issue and will update you if I hear back.

See also:

Editorial standards