Facebook agrees with Canada on privacy controls

TORONTO — Facebook agreed Thursday to give users more control over the information they share with outside applications like games and quizzes in response to concerns raised by Canadian privacy officials.

Currently, people who wish to use such software have to agree to share all their data with the application. For example, when a user signs up to take a quiz, the software developer could tap the user's biographical information, photos and hobbies, along with profiles and information on friends, even if such data aren't needed to take the quiz.

With the changes, the application developer will have to specify ahead of time which categories of data the software needs. Users will have the opportunity to hold back certain pieces of information when they approve access. A link also will be provided so users can get an explanation of what information is collected and why.

Users will also have to specifically approve any access Facebook applications have to their friends' information. Such access still would be subject to the friend's privacy and application settings.

"Application developers have had virtually unrestricted access to Facebook users' personal information," Privacy Commissioner Jennifer Stoddart told reporters Thursday. "The changes Facebook plans to introduce will allow users to control the types of personal information that applications can access."

Facebook said the entire process would take up to a year to implement.

Although the changes stemmed from Canadian privacy complaints, they will apply to Facebook's 250 million users worldwide.

Dave Morin, senior platform manager at Facebook, said the changes won't hinder developers' ability to create good applications.

"Users will continue to be more and more engaged over time and people will develop better businesses because of it," he said. "It's about the user being in control."

Last month, Canada's privacy commissioner accused Facebook of disclosing personal information about users to the nearly 1 million outside developers worldwide who create Facebook applications.

Stoddart's report also said the Web site breaches Canada's privacy law by keeping a user's personal information indefinitely — even after some members close their accounts.

As part of Thursday's agreement, Facebook will spell out in its privacy policy the difference between deleting an account — which removes all personal information from Facebook servers after two weeks — and deactivating it, which merely makes the profile inaccessible, but lets Facebook keep the information into its database.

Facebook will also provide users with a better explanation of how its advertising programs work and how accounts of deceased users are handled. The site will point out that users' profiles are kept online for friends to post comments and pay tribute; eventually friends and relatives will have a mechanism for deleting accounts.

However, analysts cautioned that the safeguards are not foolproof.

Jules Polonetsky, co-chairman and director at the Future of Privacy Forum think tank in Washington, D.C., said that while users will be more aware that applications are accessing their data, they may still click through the notices without regard for what information they are ceding to the developers.

Privacy has been a central, often thorny issue for Facebook because so many people use it to share personal information with their friends and family. As the 5-year-old social networking service has expanded its user base and added features, its privacy controls have grown increasingly complicated.

The Palo Alto, Calif.-based company has said it was overhauling its privacy controls in an attempt to simplify its users' ability to control who sees the information they share on the site.

The Canadian privacy commission garnered worldwide attention this summer when Canada became the first country to legally examine Facebook's privacy provisions, in response to a complaint last year from students at the Canadian Internet Policy and Public Interest Clinic at the University of Ottawa.

Stoddart said European and Australian regulators had also begun looking at social-networking issues.

Elizabeth Denham, the assistant privacy commissioner who carried out Canada's investigation on Facebook, said her office is now analyzing the privacy policies and practices of six other social networking sites available to Canadians. She would not name the sites.

"Many companies that have been operating for years, need to take note of Canadian law or whatever domestic law of the country they're operating in," she said in an interview.

The outcome of Canada's investigation could influence the practices of other social networking Web sites, such as MySpace and Twitter. MySpace said officials will meet with Canada's privacy commissioner next month. The company said it does not believe the Facebook changes will not affect MySpace operations, as MySpace already deletes users information from its servers once an account is deactivated.

Stoddart said she hopes all social networking sites will adapt their privacy practices based on the Facebook agreement.