“…would not reasonably expect.”
Those four words form the basis of a fair and ethical data practice. Today, as he was questioned by the Senate Judiciary and Commerce committees, Mark Zuckerberg made it clear that, even today, he isn’t concerned with what users might reasonably expect him to do with their data, as long as he’s taking care of his “third-party problem.”
I live-tweeted most of the session (yes, really. I watched C-SPAN for five hours!), and thought I’d share some highlights with you here.
Key takeaway #1: We need more technologists working in government to set policy
Fully half the senators don’t seem to understand how the internet and digital advertising work. Concepts like data portability and data monetization are complicated, but our elected leaders need to become conversant in them. Otherwise, we will end up with outdated and innovation-stifling regulations – or worse.
Over and over, senators rehashed questions that Mr. Zuckerberg had answered previously, or failed to use their five minutes to ask questions that constituents really care about.
"Is the TOS a take-it-or-leave-it proposition" asks Whitehouse.
Well, yea. And hey, guess what, we've also neutered TOS violations with arbitration clauses.
Senator Heller asks a bunch of silly questions, missing the opportunity to ask, "the email you sent to 87 million users also revealed that some private messages may have been accessible to Cambridge Analytica."
Please just recuse your time. Sigh.
A handful of senators were well-briefed, and they teased out some of the most important responses from Mr. Zuckerberg.
"Is self-certification the best way to protect your users?" BOOM.
Crucial question with no good answer that would leave Facebook with full control of its platform and processes.
Interesting. Roy Blunt starts off all buddy-buddy, and then comes out swinging on cross-device tracking.
And then Zuckerberg straight up *obfuscates* knowing full well that FB cookies are hoovering up data all over the internet on non-FB sites.
Key takeaway #2: Facebook continues to deflect attention away from its own uses of personal data
Over and over, Mr. Zuckerberg corrected senators when they referred to “Facebook selling personal information.”
Senator Markey invokes the FTC consent decree. Zuckerberg deflecting gracefully: "We require permission to use the platform" and "we don't sell user data."
But third parties aren’t the only potentially harmful actors in the Facebook ecosystem. Remember when they published the results of a “mood manipulation study” back in 2014? We
Facebook’s researchers have become social scientists, without the rigor of traditional oversight… if the company isn’t cautious, it could rewrite the ethics of research in ways that prove extremely detrimental to subjects and researchers alike.
Frankly, that’s exactly what has happened with Cambridge Analytica and however many other analytics and insights firms are ultimately implicated in allegations of election tampering. While Facebook has tamped down on data access via Platform, it has not solved the problem of discriminatory targeting using proxies for sensitive data like race, health, religion, etc.
Re discriminatory ad targeting, Zuckerberg says: "that's not a feature that's available anymore"... except the proxies are still there, and every researcher (and clever media buyer) knows it.
(AI TOOLS!)
And it truly doesn’t know where to start when it comes to identifying potential “real world harms” and mitigating them.
Zuckerberg is now talking about "real world harms" but honestly, Facebook has a really poor track record of anticipating harms, and correcting them when they occur.
See, for example, the "real name" requirement, and the risks that poses to marginalized individuals.
Key takeaway #3: Facebook has a business model problem
Jason Kint, CEO of Digital Content Next, a trade association for premium publishers, tweeted this, and I couldn’t agree more:
Senator Hassan drove to the heart of the problem. Facebook's business model requires maximum collection of human/behavioral data across all pages/apps/device info they can get their hands on. His fiduciary success conflicts with society.
Mr. Zuckerberg spent an awful lot of time evading questions about how Facebook has cornered the digital advertising market so effectively. For example, he said this when asked about cross-device identity stitching:
"You can probably correlate [cookies] between sessions."
And this about “data ownership,” which he spent a lot of time asserting was the user’s:
Sen Tester: "You're making $40B/year on your platform, which sounds an awful lot like you own my data. If I own it, I can stop it."
Zuckerberg's response: "Yes, you grant us a license to use it."
Sigh.
And when asked about Like buttons on third-party websites, he seemed to think that average users reasonably expect that their actions on that page were recorded – even if they’d logged out of Facebook.
"When we show a Like button on a website..." says Zuckerberg.
Except that it doesn't take clicking on the Like button for Facebook to hoover up your data. So Zuck deflects AGAIN.
What It Means: The “reasonable expectation” doctrine will bring Facebook to its knees
Senator Young (R-IND) is calling further attention to the reality of digital citizenry: in the same way that most people don't understand how lawmaking works, they also don't understand how the internet works.
Silicon Valley, in general, fails to consider "reasonable expectations."
For better or worse, we are all global digital citizens, and we occupy a universe that’s moving too fast for lawmakers to keep up and too fast for most individuals to manage. Most companies will never reach the scale of Facebook, Google, Amazon, or Apple – aka “digital utilities” – but we need them to help set the guardrails for ethical, fair, and just data practices. Facebook, more than some others, has flouted the doctrine of reasonable expectation: what an average user would expect them to be doing with the data they are amassing within the platform.
That said, I agree with my colleague Jessie Liu: neither advertisers nor users will abandon Facebook en masse. Rather, it will be global regulators who challenge its near-monopolistic control of digital citizen data, and force it to change how it does business. So what do you do as a marketer or a privacy professional? Start asking whether you meet the reasonable expectation doctrine, and remember the mantra, just because you can, doesn’t mean you should.
I want to leave you with this short clip from the hearing itself. It’s 45 seconds of comic relief in which Senator Dick Durbin distills down the heart of these hearings without mincing words.
As always, please don’t hesitate to reach out to me here or on Twitter at @fatemehx2. I would love to hear your thoughts, however you wish to share them!
(This post originally appeared on the Forrester Research blog, which can be viewed
