The Federal Trade Commission announced a settlement with social-networking site MySpace concerning privacy and consumer data. (After the jump is a discussion of pseudonymity and privacy in the MySpace case.) The FTC said:
Social networking service Myspace has agreed to settle Federal Trade Commission charges that it misrepresented its protection of users’ personal information. The settlement, part of the FTC’s ongoing efforts make sure companies live up to the privacy promises they make to consumers, bars Myspace from future privacy misrepresentations, requires it to implement a comprehensive privacy program, and calls for regular, independent privacy assessments for the next 20 years.
The Myspace social network has millions of users who create and customize online profiles containing substantial personalized content. Myspace assigns a persistent unique identifier, called a “Friend ID,” to each profile created on Myspace. A user’s profile publicly discloses his or her age, gender, profile picture (if the user chooses to include one), display name, and, by default, the user’s full name. User profiles also may contain additional information such as pictures, hobbies, interests, and lists of users’ friends. […]
In addition, Myspace certified that it complied with the U.S.-EU Safe Harbor Framework, which provides a method for U.S. companies to transfer personal data lawfully from the European Union to the United States. As part of its self-certification, Myspace claimed that it complied with the Safe Harbor Principles, including the requirements that consumers be given notice of how their information will be used and the choice to opt out. The FTC alleged that these statements were false.
The FTC’s complaint describes how Myspace made it possible for an ad network to sync Myspace”s Friend ID with the ad network’s Ad ID. To sync two pseudonyms means to connect them, to determine that two separate pseudonyms actually correspond to the same person. If each pseudonym has a body of user information associated with it, syncing allows the two bodies of’ user information to be merged into a single record.
Myspace enabled syncing by causing the Friend ID to be sent to the ad network when an ad was requested. When the user visited a Myspace page containing a third-party ad, the page would contain a directive to the browser to contact an ad network URL. The user’s browser would contact that ad network URL–conveying the Friend ID to the ad network–while sending along the cookie containing the Ad ID. This made it easy for the ad network to sync the two identifiers. […]
While enabling syncing was one of the issues in this case, it’s important to recognize that syncing of pseudonyms is not always a privacy problem nor a violation of the law. What made the possible syncing problematic in the case of Myspace was that (1) Myspace enabled ad networks to use Myspace’s Friend ID pseudonym to get personal information about the associated user, and (2) Myspace promised its users that it would not share that personal information with third parties.