Just when Facebook is reportedly about to face a multi-billion-dollar fine from the U.S. Federal Trade Commission (FTC) for failing to abide by a 2011 consent decree to protect user privacy, CEO Mark Zuckerberg has written a voluminous 3200 word essay, claiming privacy is now his highest priority. You can tell that Zuckerberg hopes his tome will be hailed as a historic shift. But so far the actions do not match the words.
There are historic elements to the statement, and they mostly have to do not with privacy per se, but with Zuckerberg’s evolving attitude towards governments. He is asserting ever more autonomy and authority to act unilaterally, despite whatever governments may want. This is complicated, because there are both positive and negative elements to his stance.
Perhaps the biggest tangible change in company policy is Zuckerberg’s new promise to refuse to locate data centers in countries that have a poor record of protecting freedom of speech and human rights. That is, sadly, very many countries these days. Several important ones are demanding that the company locate centers with data about citizens within their borders, partly to make it easier for the government to control speech. One of those is Vietnam, where Facebook has about 45 million users and is the primary media platform. Zuckerberg now promises to refuse such demands, even if it means withdrawing from a country.
That is a major new shift, and could have major impacts on Facebook’s business, not necessarily positive ones, from a commercial standpoint. Zuckerberg, in saying this, also strongly suggests he has abandoned his long-held ambition to launch Facebook’s services in China, where government access to servers is a cost of entry. All this is news, because he has never before made a principled policy change that would have a significant negative effect on his profits.
But in some ways the essay is an enormous head fake. At least in part, it appears to be aimed at distracting analysts and critics from the genuine crises of the moment. To the degree the world actually demands Facebook take privacy seriously, it mostly asks it to be more transparent, and more restrictive, about how personal data is used to target advertising, to give users better controls for how their data is used for such targeting, and to stop violating its currently-professed commitment to protecting customer data (like in the FTC consent decree).
New Facebook privacy controversies and scandals continue to erupt almost weekly, and Zuckerberg says nothing in this privacy-centric essay about any change that might resolve or reduce them. For example, it was recently shown that you can “reverse look up” Facebook user data on the service using just someone’s phone number. Facebook recently refused to alter this feature, even though it is clearly a violation of user privacy. Many of those numbers were added to the service by people only at the company’s request, to be used for two-factor security authentication, not intending to tie them to their profiles.
Another recent scandal emerged when the Wall Street Journal reported that many apps on iOS, and probably on Android, send data back to Facebook, without notifying users, about sometimes very personal things, like a woman’s menstrual cycle, or a house you are considering buying. Such data flowing into Facebook can be very valuable for targeting ads, which remains its primary business. When this problem emerged recently, the company did not come up with a good explanation about why it was happening nor give any evidence such practices would end. And this is just in the last several weeks!
Using the word “privacy” repeatedly in a 3200 word essay is welcome, but given Facebook’s record on privacy, the message Zuckerberg is sending needs first to be received inside his own company.
Declaring that encrypted messaging is the future, and that encryption equals privacy, as Zuckerberg does, may be a compelling future direction. Time, not rhetoric, will tell. But nothing Zuckerberg writes alters or addresses most of the fundamental challenges the company faces right now. Facebook will continue to host public speech, much of it fraught, and continue targeting advertising at users based on their private behavior. It will continue to have to make excruciatingly difficult decisions about what is and is not permissible to say in public on its platform.
It will continue, in effect, to be a more important arbiter of global speech than most governments. And since governments universally dislike and/or aim to ban the use of unbreakable encryption to protect user messages, the company in asserting its plans to move in that direction is further thumbing its nose at just about all governments, including that in the U.S. Both the Trump and Obama administrations have repeatedly made clear that law enforcement should, when necessary, have access to the contents of messages of potential criminals.
Zuckerberg mentions advertising in passing a couple times in his tome, but does not explain whether the more privacy-centric Facebook he promises would approach ad-targeting differently. Two compelling and best-selling new books argue that the personal-data-based ad targeting model, in itself, is the cause of the vast majority of Facebook’s social harms–Roger McNamee’s Zucked, and Shoshana Zuboff’s The Age of Surveillance Capitalism. Targeting ads based on data gives the company the incentive to seduce user’s attention and keep people clicking. Sensational, distracting, and dishonest material is tailor-made for such a system, increasing the likelihood that social harm will result.
The implication of Zuckerberg’s essay, though, is that Facebook might very well be less able to target ads, because more user content would be encrypted, and thus unreadable. A genuinely privacy-centric Facebook would also, by definition, give users far more control over how much of their data was viewable to Facebook itself, and thus available to be processed for ad targeting. If I were an investor reading this, I would sell the stock. This new approach could very likely portend fewer “monetizable” page views, the company’s commercial bread and butter. Combine this with the CEO’s promise to withdraw from countries with whom he cannot agree about data control, and the potential for lower usage and ad sales seems significant.
Encryption is not necessarily what users are demanding. But if Zuckerberg really achieved the goals he sets here, it would in some ways enable Facebook to evade the scrutiny over content control the company is currently facing. If messages are encrypted, Facebook has no visibility into them, no control, and thus less responsibility. But as he acknowledges, that also means bad actors would have free use of the technology too, if they could not be stopped in advance, a subject about which he is vague.
The place users most urgently need new privacy and encryption assistance is not so much in their messages to others, as in their browsing behavior and history. Tracking that and using that information to target advertising to people in intrusive ways, which Facebook itself does routinely, is a privacy violation that consumers are very worried about now. Protecting that behavior would also help shield them from hacking and data theft. But Zuckerberg says nothing about any of that.
For all the uncertainties about this missive, the CEO is staking out a position in both of the two major fault lines of what I’ve separately called the internet civil war. The countries of the world differ radically about what the internet is for—the U.S. essentially believes it to be a platform for political and economic freedom, while China, Russia, Turkey, Hungary, the Philippines, and other politically-repressive governments see it as a platform for control. With this announcement, Zuckerberg is more than ever before aligning his company on the freedom side of that divide.
But by asserting the company’s right to impose full encryption on virtually all communication, he is further accentuating the company’s alienation from all governments. This underscores and accentuates the other major scism on the net–between governments and global net companies.
Zuckerberg says in his statement that he wants to consult and work with law enforcement agencies and government as he moves towards his encryption-based vision. He has often recently claimed, including here, that he is eager to engage in dialogue about the company’s policies with stakeholders and governments. But it’s hard to see this tome as anything but a further assertion of Facebook’s right to unilateral control over its corporate direction, and over the communications and speech rights of his 2.7 billion users worldwide.