Terms of Service

As you may have noticed already, I am working this summer with the fellows from unhosted.org to help launch the Terms of Service; Didn’t read project.

Since June, I have put about 250 hours of work: reviewing Terms, pointing out what’s good or bad, thinking about how to come up with a rating system that makes sense, how to integrate with other projects such as Tosback2 which helps track and archive changes. Writing JSON, a bit of JavaScript, and HTML/CSS and, of course, a lot of emails.

So far, we’ve got very positive feedback, even though the project isn’t yet to alpha release. A lot of stuff breaks, I make changes all the time, and also its load of mistakes.

But if there’s one thing for sure, it’s that I’m as enthusiastic as ever. Everybody seems to be so grateful that some people decided to help fix the biggest lie on the web.

But this project will never work without a community. We need diversity of opinions, legal expertise, some JavaScript coders, and we need other projects to cooperate with us!

In the media

Huffintgton Post: ToS;DR Explains Those Ridiculous Terms Of Service You Agreed To, 10/08/2012

Time MoneyLand – Decision Making: New Site Grades Those Pesky ‘Terms of Service’ Agreements You Never Read, 10/08/2012

Hacker News / Reddit

In German

Nerdcore, 13/08/2012

Crowdsourcing: Ein Tüv für AGB will für schnellen Überblick sorgen, 7/08/2012

Datenschutz: Projekt analysiert AGB der Webunternehmen auf Gemeinheiten, 6/08/2012

Facebook updates the Terms of Service. But we’re watching them. (2/2)

18 juin 2012

1 réponse

Facebook, Terms of Service, vie privée

Two weeks ago I started to revamp the ToS;DR project. We aim at creating readable and rated version of terms of service (ToS), so that the next time you sign up, you won’t lie about being aware of the terms. Ignorance keeps you docile, we hope that by giving you full awareness of what you sign up for, we can pressure services and get some fairness in the terms.

So, to follow on the last post, Facebook ditched their Privacy Policy for a Data Use Policy. It’s mostly the same things, but this very long document has undergone some changes. Fortunately, we at Unhosted kept a copy of the previous version.

Without too many comments, here are some changes that caught my attention (what’s ~~striked~~ has been deleted from the previous version and what’s highlighted has been added to it.)

Your information

This is a modification we can spot here and there: in addition to “clicking”, “viewing or otherwise interacting with things” is enough to send data about you or about other people to Facebook. Connect that with the “Social Plugins” (aka the Like button) and you get a pretty good idea of what’s happening as soon as you see them appearing: you’re sending data about you, what you read, even if you haven’t asked for anything.

We receive data about you whenever you interact with Facebook, such as when you look at another person’s timeline, send or receive a message, search for a friend or a Page, click on, view or otherwise interact with things, use a Facebook mobile app, or purchase Facebook Credits or make other purchases through Facebook.

This one is fun. It looks like in the last version, someone forgot to mention the cookies here!

We receive data whenever you visit a game, application, or website that uses Facebook Platform or visit a site with a Facebook feature (such as a social plugin), sometimes through cookies. This may include the date and time you visit the site; the web address, or URL, you’re on; technical information about the IP address, browser and the operating system you use; and, if you are logged in to Facebook, your User ID.

We get here to an important fact of Facebook: it sells our data, all combined, without personally identifying information such as username or user ID. But it would be interesting to really be able to inspect these data… Is it really impossible to identify anyone personally? Or is it identifiable enough?

We only provide data to our advertising partners or customers after we have removed your name or any other personally identifying information from it, or have combined it with other people’s data in a way that it is no longer associated with you. Similarly, when we receive data about you from our advertising partners or customers, we keep the data for 180 days. After that, we combine the data with other people’s data in a way that it is no longer associated with you.

This one is a welcome addition:

Of course, for information others share about you, they control how it is shared.
We store data for as long as it is necessary to provide products and services to you and others, including those described above. Typically, information associated with your account will be kept until your account is deleted. For certain categories of data, we may also tell you about specific data retention practices.

Sharing information

~~If you do not make a selection, your information will be shared with the last audience you selected. If you want to change your selection later you can do that too on your profile.~~

I don’t really get this one:

Although you choose with whom you share, there may be ways for others to determine information about you. For example, if you hide your birthday so no one can see it on your timeline, but friends post “happy birthday!” on your timeline, people may determine your birthday.

“As a general rule, you should assume that if you do not see a sharing icon, the information will be publicly available.” Yes. Public is default.

People on Facebook may be able to see mutual friends, even if they cannot see your entire list of friends.
Some things (like your name, profile pictures and cover photos) do not have sharing icons because they are always publicly available. As a general rule, you should assume that if you do not see a sharing icon, the information will be publicly available.

That might be a useful feature to have a bit of control over what’s displayed. How is the implementation?

Your activity log is a place where you can go to view most of your information on Facebook, including things you’ve hidden from your timeline. You can use this log to manage your content. For example, you can do things like delete stories, change the audience of your stories or stop an application from publishing to your timeline on your behalf.
When you hide something from your timeline, you are not deleting it. This means that the story may be visible elsewhere, like in your friends’ News Feed. If you want to delete a story you posted, choose the delete option.

Other applications

Applications also get your age range, locale, and gender when you and your friends visit them. Age range (e.g., 18-21) lets applications provide you with age-appropriate content. Locale (e.g., en-US) lets applications know what language you speak. Gender lets applications refer to you correctly. If you do not want applications to receive this information about you, you can turn off all Facebook applications

When you first visit an app, Facebook lets the app know your language, your country, and whether you are under 18, between 18-20, or 21 and over. Age range lets apps provide you with age-appropriate content. If you install the app, it can access, store and update the information you’ve shared. Apps you’ve installed can update their records of your basic info, age range, language and country. If you haven’t used an app in a while, it won’t be able to continue to update the additional information you’ve given them permission to access. Learn more at: https://www.facebook.com/help/how-apps-work (…)

You always can remove apps you’ve installed by using your app settings at: https://www.facebook.com/settings/?tab=applications. But remember, apps may still be able to access your information when the people you share with use them. And, if you’ve removed an application and want them to delete the information you’ve already shared with them, you should contact the application and ask them to delete it. Visit the application’s page on Facebook or their own website to learn more about the app.

Sometimes plugins act just like applications. You can spot one of these plugins because it will ask you for permission to access your information or to publish information back to Facebook. For example, if you use a registration plugin on a website, the plugin will ask your permission to share your basic info with the website to make it easier for you to register for the website. Similarly, if you use an Add To Timeline plugin, the plugin will ask your permission to publish stories about your activities on that website to Facebook.

If you post something using a social plugin and you do not see a sharing icon, you should assume that story is Public. For example, if you post a comment through a Facebook comment plugin on a site, your story is Public and everyone, including the website, can see your story.

Advertising

Personalized ads

We do not share any of your information with advertisers (unless, of course, you give us permission). As described in this policy, we may share your information when we have removed from it anything that personally identifies you or combined it with other information so that it no longer personally identifies you.
We use the information we receive to deliver ads and to make them more relevant to you. This includes all of the things you share and do on Facebook, such as the Pages you like or key words from your stories, and the things we infer from your use of Facebook. Learn more at: https://www.facebook.com/help/?page=226611954016283
When an advertiser creates an ad, they are given the opportunity to choose their audience by location, demographics, likes, keywords, and any other information we receive or can tell about you and other users. For example, an advertiser can choose to target 18 to 35 year-old women who live in the United States and like basketball. An advertiser could also choose to target certain topics or keywords, like “music” or even people who like a particular song or artist.

Ads are tracking you even if you don’t click them.

~~if a person clicks on the add~~

if a person views or otherwise interacts with the ad

and now an example of how very incredibly useful Facebook is for humanity:

Advertisers of sci-fi movies, for example, could ask us to target “sci-fi fans” and we would target that group, which may include you. Or if you “like” Pages that are car-related and mention a particular car brand in a post, we might put you in the “potential car buyer” category and let a car brand target to that group, which would include you

Misc

Note that the access requests to your data are basically gone. If you’ve ever tried to “download a copy of your Facebook data” like I did, then you know how ridiculous this is.

Access Requests

We provide initial responses to access requests within a reasonable period of time, typically within thirty days. You can also download a copy of everything you’ve put into Facebook using our download your information tool.

You can access and correct most of your personal data stored by Facebook by logging into your account and viewing your timeline and activity log. You can also download a copy of your personal data by visiting your “Account Settings”, clicking on “Download a copy of your Facebook data” and then clicking on the link for your expanded archive. Learn more at: https://www.facebook.com/help/?faq=226281544049399

So in the end, no really fancy changes AFAICS.

For the official review of changes, see Facebook’s governance website.

Credits

I express my gratitude for Moresounds‘ music which helped me get through this boring task. Fortunately, this will soon be automated when the EFF’s TosBack is restarted.

Facebook updates the Terms of Service. But we’re watching them. (1)

13 juin 2012

1 réponse

Facebook, Terms of Service, vie privée

You may have seen it, Facebook is updating its terms of service — you know, that document no one reads but everyone agrees to when they sign up to services online.

For over a year, Facebook has had a practice to allow 7,000 Facebook users to solicit a public vote over a proposed change in the terms. That is undeniably a good policy, unlike Twitter’s we can change the terms at any time and we will notify you if we decide so with a simple tweet from @Twitter or an email.

By the way, for those who don’t remember, Twitter has substantially changed their terms of service in 2009, adopting a radically different approach to your copyright. Whereas before Twitter claimed no copyright license and encouraged users to publish their tweets under a free copyright license like Creative Commons or Public Domain, they now state: “you grant us a worldwide, non-exclusive, royalty-free license (with the right to sublicense) to use, copy, reproduce, process, adapt, modify, publish, transmit, display and distribute such Content in any and all media or distribution methods (now known or later developed).”

But, enough about Twitter. Let’s go back to Facebook. The company, certainly with the IPO operation and some other contextual elements, decided to update their Terms of Service. According to these terms at the time, when Facebook makes a proposal for change:

If more than 7,000 users comment on the proposed change, we will also give you the opportunity to participate in a vote in which you will be provided alternatives.

So that’s what happened in April 2012. People from the Europe v. Facebook campaign launched a platform to encourage people to comment. And that worked, so Facebook organised a vote. An overwhelming majority of the users who participated voted against the changes. However, as the terms stated:

The vote shall be binding on us if more than 30% of all active registered users as of the date of the notice vote.

Needless to say, taking into account the fact that the vote was very poorly advertised outside and inside Facebook, this ratio of 30% of the active users (for a total of users around 900 million!) does not represent a big risk for Facebook.

So anyway, Facebook published their new Terms. Unfortunately, after a couple of hours browsing through their pages, I was unable to find a document referencing the changes. Fortunately, I was watching them for a while already when I started taking over the ToS;DR project (Terms of Service; Didn’t Read). More on that project later

In a nutshell, the new Statement of Rights and Responsibilities remains pretty much the same. They reflect better the way Facebook deals with data and information from people who are not Facebook users (which demonstrates how much Facebook can track everyone online). Some interesting bits:

If more than 7,000 users post a substantive comment on a particular proposed change,

What’s emphasized has been added. So it looks like it will be more difficult to solicit a public vote.

Facebook offers social reporting tools to enable users to provide feedback about tagging.

So a new feature that might be useful. I have no idea what it relates to however, since I don’t have a Facebook account any more.

You will not use our copyrights or trademarks (including Facebook, the Facebook and F Logos, FB, Face, Poke, Book and Wall), or any confusingly similar marks, except as expressly permitted by our Brand Usage Guidelines or with our prior written permission.

Yeah, that’s right, you’ve read well. Facebook now claims trademarks on the words “Face,” “Book,” and “Wall.”

One last point, the new terms have systematically replaced “Privacy Policy” with “Data Use Policy.” Things could not be more clear

[Next step: I should have a look at the changes from the Privacy Policy to the Data Use Policy. Lots of interesting changes I hope.]