FTC Facebook Facial Id 2011 Before Ftc

8/13/2019 FTC Facebook Facial Id 2011 Before Ftc

1/33

Before theFederal Trade Commission

Washington, DCIn the Matter ofFacebook, Inc. and theFacial Identiflrcation of Users

EPIC ComplaintIn re Facebook and the FacialIdentification of Users

)))))I

Complaint, Request for Investigation,Injunction, and Other Relief1. Introduction

1. This complaint concerns covert biometric data collection by Facebook, the largest socialnetwork service in the United States. The secretive collection compilation and subsequentuse of facial images for automated online identification adversely impacts consumers inthe United States and around the world.

2. Facebook's Tag Suggestions techniques converts the photos uploaded by Facebookusers into an image identification system under the sole control of Facebook. This hasoccurred without the knowledge or consent of Facebook users and without adequateconsideration of the risks to Facebook users.

3. These business practices violate Facebook's Privacy Policy, as well as public assurancesmade by Facebook to users. These business practices are Unfair and Deceptive TradePractices, subject to review by the Federal Trade Commission (the Commission ) undersection 5 of the Federal Trade Commission Act.

4. There is every reason to believe that unless the Commission acts promptly, Facebook willroutinely automate facial identification and eliminate any pretence of user control overthe use of their own images for online identification.

5. Facebook's actions are unprecedented. Facebook possesses the largest collection ofphotographs of individuals of any corporation in the world. According to an extrapolation' of photo upload data reported by Facebook, the company now possesses about 60 billion

I The Federal Trade CommissionJune 10,2011


2/33


3/33


4/33

protecting legal rights, corporate reform, political accountability, and protectingconsumer privacy. Consumer Watchdog is based in Santa Monica, California.

11. The Privacy Rights Clearinghouse ( PRC ) is a non-proflrt, consumer education andadvocacy otganization based on San Diego, CA and established in 1992. PRC representsconsumers' interests regarding informational privacy at the state and federal levels.PRC's website provides numerous guides on how to protect personal information.www.privacyrights. org.

3. The Importance of Privacy Protection12. The right of privacy is a personal and fundamental right in the United States. The privacyof an individual is directly implicated by the collection, use, and dissemination of

personal information. The opportunities to secure employment, insurance, and credit, toobtain medical services and the rights of due process may be jeopardized by the misuseof personal information.

13. The excessive collection of personal data in the United States coupled with inadequatelegal and technological protections have led to a dramatic increase in the crime of identitytheft.14. As the Supreme Court has made clear, and the Court of Appeals for the District ofColumbia Circuit has recently held, both the common law and the literal understandingof privacy encompass the individual's control of information concerning his or herperson. l215. The Organization for Economic Co-operation and Development ( OECD ) Guidelines on

the Protection of Privacy and Transborder Flows of Personal Data recognize that theright ofindividuals to access and challenge personal data collection is generally regardedas perhaps the most important privacy protection safeguard.

16. The Madrid Privacy Declaration explicitly calls for a moratorium on the development orimplementation of new systems of mass surveillance, including facial recognition, . . .subject to a full and transparent evaluation by independent authorities and democraticdebate. l3

'2 U.S. D p't of Justice v. Reporters Comm. for Freedom of the Press,489 U.S. 749, 763 (1989), cited in Nat'lCable & Tele. Assn, v. Fed. Commc'ns. Comm'n, No. 07-1312 (D.C. Cir. Feb. 13, 2009).'' The Madrid Privacy Declaration: Global Privacy Standards for a Global World, Nov. 3, 2009, available athttp ://thepublicvoice.orglmadrid-declaration/.


4 The Federal Trade CommissionJune 10,2011


5/33


6/33


7/33

researchers are'working on developing and improving facial recognition technology toidentify political dissidents,2632. Facebook currently grants government access to user information on merely a good faithbelief'that the disclosure is required by law or when it is necessary to protect Facebookfrom people it believes are violting its statement of Rights of Responsibilities. 2e33. Central to the meaningful design of face recognition technology with meaningful

safeguard is (1) subject control over image enrollment, (2) subject control over theprocessing and identification of images, (3) transparency in the functioning, use, andpurpose of the facial recognition system, and (4) independent accountability of the imageprocessing entity.34. Some commercial implementations of facial recognition technology adapt one or more of

these safeguards.30

2s Robert Mackey, The Lede: Updates on lran's Dsputed Election, N.Y. TIMES, June 24,2009, available athttp://thelede.blogs.nytimes.com/2009/0 6/24llatest-updates-on-irans-disputed-election-5/.'u Melika Abbasian Nik, Mohammad Mahdi Dehshibi, and Azam Bastanfard, Iranian Face Database andEvaluationwith a New Detection Algorithm,In Proc. of 2ndBEC,200'l ,available athttp://dehshibi.com/flrles/pap ers/hanianYo2}F aceo/o2}DatabaseYo2}andYo2}Evaluationo/o2}with%o20ao/o20new /o20detection.pdf.2e Facebook, Privacy Policy, http:/iwww.facebook.com/policy.php30 See, e.g., Apple, iPhoto - Organize, browse, and share your photos, http://www.apple.com/ilife/iphoto/what-is.html; see generally Apple Support Communities, Conceming the recent privacy hype, can one shut off Faces andlocations in iPhoto? (May 7,201l0< hts://discussions.apple.corn/threadl3D4l943?start:0&tstart:0 ( Similarly,ifyou don't assign faces then there is no data for anyone to steal. So there is no security risk.)


7 The Federal Trade CommissionJune 10, 201 I


8/33


9/33

39. On September 30,2010, Facebook introduced a bulk tagging technology for photos:When people upload a set of photos, they are often of events likeweddings and birthday parties where people are with the same group offriends and family. With our new uploader, you will be able to tagmultiple photos in the same album all at once, as well as tag photos of thera-. p..ion with a lot less effort.38

40. At the outset, Sam Odio, Facebook Photo Products Manager, attempted to distinguishFacebook's face detection and bulk tagging techniques from facial recognitiontechnology:

This isn't face recognition. . . . Picasa and iPhoto--they'll detect a face andsay, This is Sam, and they'll suggest that it's Sam. We're not doing that.We're not linking any faces to profiles automatically. Right now, we wantto stay away from that because it's a very touchy subject.3e

41. On June 7, 2011, Facebook's Justin Mitchell revised the characterization of photo taggingFacebook Photos, acknowledging that Facebook was now deploying face recognitiontechniques.

When you or a friend upload new photos, we use face recognitionsoftware-similar to that found in many photo editing tools-to matchyour new photos to other photos you're tagged in. We group similar photostogether and, whenever possible, suggest the name of the friend in thephotos. If for any reason you don't want your name to be suggested, youwill be able to disable suggested tags in your Privacy Settings. Just click'Customize Settings' and'Suggest photos of me to friends,'Your name willno longer be suggested in photo tags, though friends can still tag youmanually. V/e notifu you when you're tagged, and you can untag yourselfat any time. As alwys, only friends can tag each other in photos.a0

C. Facebook Began Collecting Data on Users' Photos Without Knowledge or Consentin order to Develop Facial Recognition Technology

t' Sa- Odio, More Beautiful Photos, Facebook Blog (September 30, 2010), avalable athttp ://blog.facebook. com/blog.php?post: 43267 0242130.3e Caroline McCarthy, Facebook Photos Get High Resolution, Bulk Tagging, CNET News.com (September 30,2010), available at http:llnews.cnet.com/8301- 13577-3-20018211-36.html.a0 Justin Mitchell, Making Photo Tagging Easier, Facebook Blog, available athttp://blog.facebook.com/blog,php?post:467145887)'30 (last updated June 7, 2011).


9 The Federal Trade CommissionJune 10,2011


10/33

42. Facebook's facial recognition technology works by generating a biometric signature forusers who are tagged in photos on Facebook, i,e. using summary data from photocomparisons.

43. This representation of biometric information, based on the user's facial image, generatedby Facebook, is available to Facebook but not to the user44. Facebook routinely encourages users to tug, i.e. provide actual identiffing information

about, themselves, their friends, and other people they may recognize.45. Facebook associate[s] the tags with [a user's] account, compare what these taggedphotos have in common and store a summary of this comparison. 4246. Facebook automatically compares uploaded photos to the summary information we've

stored about what your tagged photos h e in common, 4347. Facebook gave no notice to users and failed to obtain consent prior to collecting Photo

Comparison Data, generating unique biometric identifiers, and linking biometricidentifiers with individual uses.D. Facebook Began Making Tag Suggestionsil Using Facial Recognition TechnologyWithout Obtaining Users' Consent

48. On December 15 2010, Facebook announced that it was implementing a facialrecognition technology called Tag Suggestions. 4449. On June 7, 2011, Facebook announced that it had deployed Tag Suggestionstechnology over the last several months, and that the technology had been available

internationally.a5

a2 Facebook Help Center, What nformation does Facebook use to tell that a photo looks like me and to suggest thatfriends tag me? How can I turn off tag suggestons? How can I remove the information stored about me for tagsugges tions, https://www.facebook.com/help/?faq: 1 95 1 8.43 Id.aa Heletr A.S. Popkin, Facebook's Facial Recognition Knows LItho Your Friends Are, MSNBC,http://technolog.msnbc.msn.com./_news/201011211615660488-facebooks-facial-recognition-knows-who-your-friends-are- (Dec. 16, 2010).4t Id.


The Federal Trade CommissionJune 10,2011

10


11/33

50. Facebook did not provide users with any other notice about this facial recognitiontechnology.a6

51. Facebook admitted in a later statement that we should have been more clear during theroll-out process when this became available to them. 47 However, as of the filing of thiscomplaint, Facebook has made no effort to recti$r that matter or to allow users to opt-inif they so choose.52. Facebook routinely encourages users to confirm Facebook's indentification of facialimages in user photos when users attempt to upload photos to their accounts on Faceook.53. Facebook automated identification of facial images would occur in the absence of anyuser intervention.54. Facebook enables Tag Suggestions by default; users do not enable Tag Suggestions.55. Facebook did not obtain users' consent before using the unique biometric identifiers

generated by the Photo Comparison Data to identiff individual users when aphotograph containing their image is uploaded to Facebook.E. Facebook Recommendations to Delete Facial Images are False and Misleading56. Attempts by a user to browse or search the Facebook help site for information on how to

delete the facial recognition data that Facebook has collected leads the user to anincorrect method for deleting photo summary information through the user's PrivacySettings page. 48

ouTiffany Kaiser, Facebook Prompts More Privacy Anxieties with Facial Recognition Featur,, DailyTech,http://www.dailytech.com/Facebook+Prompts*More*Privacy*Anxieties+withtFaciallRecognition+Feature/article21 848.htm?loc:interstitialskip (June 8, 201 l).a? Alexei Oroskovic, Facebook Facial Recognition Technology Sparl Renewed Concerns, Reuter,http://www.reuters.com/article/2011/06/08/us-facebook-idUSTRBT 570C2201 10608 (June 8, 201 1).a8 https://www.facebook.com /help/? faq:225 I I 0000848463.


The Federal Trade CommissionJune 10, 2011ll


12/33

lf you dsn't wanl Facebook I suggest that frinds ttg Yot when photos looklike you, you an turn off tlis feature usng your Privaty SettinS5. On lePrivcv ,settinos pa$e, click Cuslomize settings and use [he contrl[rlabeled, "Suggest pltotos uf me to friends." Note: friends wilt stll be able totaE photos of you by hr,rd, br.lt turninE off this feature mans the taEgingpr(ess may be slower for thenr. You ran aso request that w remove thesuffirnary of what y6ur tagged photos have in cornmon. On the PrivacvSettinas paqe, click Custornize sttings and use the controller labeJed,"Delete Photo .Comparison Dt' if you don'I want it lo be stored. Tlt won'tuntag pl:otos you're tagged in but will delete tle sLJfilmary infornrationdrawn fom comparing any tagged plotos of you./ir e lpiltaq=" I73I5 l42 668 557. There is no option within a user's privacy preferences to delete or prevent Facebook'sbiometric data collection.

58. When a user wants to delete the biometric "summary" data associated with his accountthat can be used to pair his name to photos of him, he has to contact Facebook through adifflrcult+o-find link, https://www.facebook.com/help/?faq:225110000848463,thatdirects the user to a specific section on Facebook's help page.59. To access the link, a user must go to Privacy Settings - Customize Settings - SuggestPhotos of me to friends-'Edit Settings' and click on the 'Learn more' link.

EPIC ComplaintIn re Facebook and the FacialIdentification of UsersThe Federal Trade CommissionJune 10,2011

Thirgr othrs shJrc Photos nd vdcs you're lggcd nParmisrion to comnrent on your postsl i:u,'ta ,'d:u\ ut .3. lt.f_l l',: i rr, :\ I : p i:-'5Suggest photos of rnc to friends\l"cn p-o:J c.: I i 'c sq:tlt rr:r'r1:1'nFriends can post on rny WallCafl sec lvll posts by frendsFrcnds cn check mc in to Plccs

Edil Scttngs0 Fricnds only v[dil scttin95fl En.rblce Friends only vEdlt Settings

I2


13/33


14/33


15/33

Help Center' lt/hat can vre help yc,u v,tith?Fi;r,.iple:HowY HOW

suggestingintended to npke it asier to tag photos, tell friends that you'vethem, and shre the memories and experiences n youl photo'.lh elF,'?fq =2 251 L iil0rl0g4 S4 63

Was this ans,wer help.l?

Search

posted photos afeof

Available Lalulag*lfus 9e rs available tnlanguages:DeutschEnslish (US)EspaolEsol (Espaa)Franais (France)Italiano=

i:;Etl?c}lPotugr.s (BrasiDPyccuiIurRE+i()+f(,$)

1 o: Facbook Photos Teanr5ubect: Rqust to delete Photo Conrpsrisorr InfornrabcnPlease remove all photo summry infiormabonassocrated lrrt my account that could be used tomake photo suggesbons,

R:'i;r Ffi',.,:v setino: icr L.oio t.,li

I lssd el

EEE cancel

62. Upon submitting a request to the Facebook Photo Team, the user is notif,red through apop-up message that he or she will be notified when the request has been processed.

63. After the Facebook Photo Team deletes the biometric data that Facebook has collected,Facebook sends an email to the user stating that the "photo comparison information hasbeendeleted..."

EPIC ComplaintIn re Facebook and the FacialIdentification of UsersThe Federal Trade CommissionJune 10, 201 I

Thanks for your messe, '/our requ5t has been submitted tq dre Fcebook FhotosTeam, You'll be nobfied r','lren your request ha been processed. ET

15


16/33

HiIThanl(s for contac{ing the Facebook Photos Team. Your photo comparison information has been deleted atyour requesl lf you have any furlher queslions about pholos, tagqinq or photo privacy, please visit ourPhotos Help Center atlhe following address:httpj/www face booKcom/h elp/?topic=photosThanks for contading FacebooKThe FacebookTeam

febook

64. None of the help pages inform the user regarding whether or not Facebook will resumecollecting biometric photo comparison data when pictures of him are manually tagged inthe future.

65. None of the help pages inform the user if the deleted biometric photo comparison datawill ever be re-collected and used at a later time, like if the user subsequently enables thedefault name/face-pairing technology.F. Facebook Provides an Option for Users to Disable the Company's Tag Suggestion

Technology, But this Option Does not Disable Facebook's Collection of Users'Biometric Data66. A Facebook user can opt-out ofportions ofFacebook's facial recognition program bydisabling Facebook's default use of unique biometric identifiers generated by the PhotoComparison Data to identiSr individual users when a photograph containing their image

is uploaded to Facebook.67. When the default name pairing setting is disabled, the user's friends will have to

manually type and select his name during the photo tagging process instead of havingFacebook automatically generate his name when it recognizes his face.

68. A user can disable the name pairing default by clicking Account: Privacy Settings:Customize Settings: Edit Settings next to Suggest photos of me to friends : and Disable.



T6


17/33

Disabfed vTlis fetur ures r comp;rison of photos yvu're tagqed in lo suggest tht fricnds tg you in new photos.You're always in control of ycur tgr on Facebook:

tnty friends cn tg you in photosWe'll norify you when frier'd has tagged'youYou EJn rernove a frie nd's tg t ilny limTg suggestionr re bsed only on photosyou've llowed yourseifto be tgged inLearn more

Suggest photos of me to frlcndslVhen photos look like m. srrgcst tggln r'n

69, This option disables Facebook's suggestion.70. Facebook's opt-out for Tag Suggestion is cumbersome. A user must go through threescreens and seven clicks to opt-out of having the user's name ppear as arrTagSuggestion. ae

G. Facebook Fails to Establish that Application Developers, the Government, andOther Third Parties Wilt Not Be Able to Access Photo Comparison Datarr71. The Facebook Platform, used for creating applications ( apps ) and for external websitesimplementing apps, makes a variety of information available to applications and externalwebsites and applications.s0 Users give applications access to their basic accountinformation when they connect with an application.5l Applications may also make use ofusers' friends' data, in the context of the user's experience on an application,52 and also

use connections between users who have both connected to an application.s372. App developers have access to the Facebook graph APL It presents a simple, consistentview of the Facebook social graph, uniformly representing objects in the graph (e.g.,

oe The User must click on Account ) Privacy Settings ) Custom ) Customize Settings ) Edit Settings next tosuggest Photos of Me to Friends Change Enable to Disable Okay,s0 Facebook Platform Policies, Storing and Using Data You Receive From Us,https://developers.fcebook.com/polic] [hereinafter Platform Policies ].t' Id. atns.t' Id. atn4.t3 Id. atnll.EPIC ComplaintIn re Facebook and the FacialIdentification of Users

The Federal Trade CommissionJune 10,2011T7


18/33


19/33


20/33

82. Instead, Facebook suggests that users untag themselves after an unwanted tag is appliedor "ask the photo owner to delete the photo."75

Help Centerruntagfr,pl(. What i5 the Lrk button?

r1 Litc

5erch

Photos ls there an option to approv a tag before I am tagged xpanc Arlin a photo?ls thcra an optlon ro approve a tag beforc I am tagged ln photo?while you can't approve tags before they re created, you can control whosees 19ged photos ofyou:

' From the Prvacv sertinas page, adjusl lhe setling for "Photos and videosl'm tag9ed ln." This llmits who can see all raggcd photos of you ln oneplac.r From fhe AlloLnl Settings pagc, turn on tag notlncations so that you

always know when someone tgs you in pho(o.lf you don't llke a tagged photo of yourself, you can:

. g.Eeyglg_p-O5 fiom your Wall.I Remove the tag from the pholo

. Ask the photo owner to delete the photo if you find it abusive orunrvanted,

.i hcl/?tuq =2 2 i 135 3 Drtf,{; /)

83. Facebook has established the Facebook Principles as the foundation of the rights andresponsibilities mentioned above.Tu Within these principles, Facebook states itscommitment to a transparent process, \ryhere "Facebook should publicly make availableinformation about its purpose, plans, policies and operations."TT

I. Facebook Previously Made Public Commitments to Ensuring Users' Privacy84. Facebook's Privacy Policy states that "[c]ertain downloadable software applications and

applets that we offer, such as our browser toolbars and photo uploaders, transmit data toIFacebook]."78

85. Furthermore, Facebook's Privacy Policy states that it "may not make a formal disclosureif [Facebook] believefs] [itsI collection of and use of the information is the obviouspurpose of the application."Te

7s Id.76 Facebook, Facebook Principles, http://www.facebook.com/principles.php.t7 rd.78 Facebook, Privacy P olicy, https://www.facebook.com/policy.php.'n Id.



20


21/33

86. For non-obvious information collection and use, Facebook states it will make adisclosure to you the first time you provide the information to [Facebook] so that you candecide whether you want to use that feature. 8o

87. Facebook has been secretly collecting biometric data, summary information, aboutphotos with respect to specific users tagged in photos uploaded to Facebook.sr88. Photos uploaded to Facebook, including those uploaded through Facebook's photo

uploader, may be compared automatically to the summary information we've storedabout what your tagged photos have in common. The results of this comparison may alsobe used to group photos or suggest that photos look like you. 82

89. Facebook's photo uploader does not disclose the collection of this biometric photocomparison datato users to allow them to decide whether to use the technology.90. Facebook does not allow users to opt-out of allowing Facebook friends to manually tag

them in photos or to approve tags piior to being tagged in photos.83J. Facebook Has a History of Improperly Changing Its Service in Ways that Harm

Users'Privacy91. In September 2006, Facebook disclosed users' personal information, including details

relating to their marital and dating status, without their knowledge or consent through itsNews Feed program.to Hundreds of thousands of users objected to Facebook'sactions.s5 In response, Facebook stated:

We really messed this one up. When we launched News Feed and Mini-Feed we were trying to provide you with a stream of information aboutyour social world. Instead, we did a bad job of explaining what the newieatures were and an even worse job of giving you control of them.86

'o Id.8 I Facebook, Help Center, https ://www. facebook.com/help/?faq: 1 95 I 8.82 Facebook, Help Center, https://www.facebook.com/help/?faq:218540514842030.83 Facebook, Help Center, https://www.facebook.com/helpl?faq:)26951353986675.to See g nerally EPIC, Facebook Privacy,http:llepic.org/privacylfacebooV.8s Justin Smith, Scared students protest Facebook's social dashboard, grappling with rules of attention economy,Inside Facebook (Sept. 6,2006), http://www.insidefacebook. coml2006l09l06lscared-students-protest-facebooks-social-dashboard- grappling-with-rules-of-attention-economy/,86 Mark Zuckerberg, An Open Letterfrom Mark Zuckerberg (Sept. 8, 2006),http ://blog. facebook.com./blog.php?post:2208 5 62130.


The Federal Trade CommissionJune 10,20112l


22/33


23/33

97. Facebook updated its privacy policy and changed the privacy settings available to userson November 19, 2009 andagain on December 9,2009.e6

98. Facebook made the following categories of personal data publicly availableinformation:. usefs'names,. profile photos,. lists of friends,. pages they are fans of,. gender,. geographic regions, and. networks to which they belong.eT

99. By default, Facebook discloses publicly available information to search engines, toInternet users whether or not they use Facebook, and others. According to Facebook,such information can be accessed by every application and website, including those youhave not connected with .

e6 Facebook, Facebook Asks More Than 350 Million [Jsers Around the llorld To Personalize Their Privacy (Dec.9,2009), available at http:llwww.facebook.com/press/releases.php?p=133917.e7 Facebook, Privacy Policy,http://www.facebook.com./policy.php (last visited Dec, 16, 2009).eB Id.




24/33

100. Prior to these changes, only the following items were mandatorily publiclyavailable information :

aa

a user's name anda user's network.

101 EPIC and a broad coalition of organizations filed a complaint with the FTC inDecember 2009 regarding these changes.

I02. Millions of users joined online groups and campaigns challenging Facebook'schanges.

K. Facebook's Facial Recognition Techniques Put At Risk Young Children and areContrary to COPPA

103. As of May 2011, at least 7.5 million U.S. children under the age of 13 actively useFacebook.en This includes more than 5 million children under the age of 10.100

t04 Congress enacted the Children's Online Privacy Protection Act of 1998 ( COPPA )to address the special concerns associated with the collection of personalinformation from children. lo I

105 Facebook collects e-mail addresses and flrrst and last names, which constitutepersonal information under COPPA, from each child with a Facebook account.l02106. Facebook has failed to establish that it does not collect photo summary data from

mrnorst07 Facebook's face recognition technology links a user's photo summary data to the

user's account, including the user's email address and flrrst and last name. Because itis combined with other personal information, the photo summary data also fallswithin COPPA's definition for personal information.r0a

ne Onlin Exposure: Social Networlcs, Mobile Phones, and Scams Can Threaten Your Security, ConsuvBn RnPoRTS,June 201 l, at 30.too Id.'o' 16 c.F.R. 312(1999).102 Facebook collects an e-mail address from each registered user, See Facebook's Privacy Policy, Facebook,http ://www.facebook.com/policy.php (last updated Dec. 22, 2010).t0a COPPA defines personal information to include a frrst and last nams, an e-mail address, or information


The Federal Trade CommissionJune 10, 201 I24


25/33

108. Facebook prompts users to provide data that enables Facebiij to create biometricprof,rles of children. Facebook recognizes children's faces when a photo isuploaded, and it prompts users to answer the question, 'Who is this?

Who's in These Fhotos?Tl'le photos you uploaded were grouped auturnrtically so yu cin quickly label and notify frends infhcse piEturcE, (fricnds crn alwrys untag thernlelvel,)

lVhg is thsl vl'ho is thi:?

Skip Tagging Friends

109. Facebook users are encouraged to tag a child in photos even if the child is not aFacebook member. The only difference with this photo tag is that it will not yet linkto a Facebook user profile, Facebook, however, will retain the data of the child'sface paired with the child's name. This information can enable Facebook to create abiometric profile for the tagged child that has no other relationship with Facebook.

110 Facebook conditions a minor userrs participation in photo sharing and tagging onthe user's disclosure of photo summary data

1 1 L Minors lack the capacity to consent to Facebook's Terms of Service and tounderstand the implications of disclosing personal information to Facebook.

concerning the child or the parents of that child that the website collects online from the child and combines with anidentiflrer described in this paragraph. 15 U.S.C. $ 6501(8XA), (C), (c) (2006).

i




26/33

Il2. Facebook materially benefits from the collection and use of personal informationfrom its minor users.

L. Other Companies Have Been Far More Cautious About the Use of Facial RecognitionTechnology in Consumer Products113 Apple first included facial recognition technology in its iPhoto picture management

software in January 2009. iPhoto automatically detects faces in photos and allowsthe user to click on boxes drawn around detected faces and enter a name in a textfield. iPhoto then searches the user s library for matching faces, including those innewly imported photos. The facially-matched photos appear as recommendationsthat the user is prompted to approve or deny.

lI4. iPhoto Faces currently only accesses and photos stored on a user s computer, asopposed to a network or service provider s seryers. Apple s iCloud service,announced on June 6,2011, automatically uploads and stores all photos from everyuser device to Apple servers. It is unclear if iPhoto Faces facial recognition datacreated by users will be transmitted to iCloud, or if Apple will have access to thatdata.

115. Google began utilizing facial recognition technology after acquiring a biometric andphoto recognition company in2006.

116. Google s photo software, Picasa, uses face-detection technology to scan a user simages for faces by default, unless the user opts-out. Unless it is disabled, Googlescans and groups together the images that it believes to be of the same person. Theuser can add an associated name tag. If the user is signed in through her GoogleAccount, she can use her Google contacts to add personal information to faces.

lI7. Google uses the same technology in its web-based photo product, Picasa WebAlbums. Users can add a name tag by hovering the cursor over an image orclicking Add People. When a user begins typing, the field auto-populates withthe user s Google contacts. Selecting a Google contact for the name tag links theimage to that petson s e-mail address or other identifliing information saved underthe contact.


The Federal Trade CommissionJune 10, 201 126


27/33

1 18. Google developed the technology to integrate this facial recognition technology intoits mobile-based object detection product, Google Goggles. Google ChairmanEric Schmidt recently announced, however, that the company would not release it,noting that this technology could be used for good but also in a very, very badway. He pointed out that an evil dictator could use facial-recognitiontechnology against peoPle.

M. The Federal Trade Commissions Failure to Act on Pending Consumer ComplaintsConcerning Facebook's Unfair and Deceptive Trade Practices May Have Contributedto Facebook's Decision to Deploy Facial Recognition

t19 On Decemb er I7,2009,EPIC and 14 consumer and privacy otganizations filed aComplaint with the FTC concerning Facebook's unfair and deceptive tradepractices. The complaint cited widespread opposition from Facebook users,Senators, bloggers, and news organizations.l0TEPIC's Complaint noted that Facebook's changes to users' privacy settingsdisclose personal information to the public that was previously restricted.Facebook's changes to users' privacy settings also disclose personal information tothird parties that was previously not available. These changes violate userexpectations, diminish user privacy, and contradict Facebook's ownrepresentations. Io8

r20

to'lt08 Id.109tr0 Id.


I21' On January 14,}OLO,EPIC filed a second Complaint with the Commissionconcerning Facebook's unfair and deceptive trade practices.r0e

l2Z. EPIC's amended Complaint observed that Facebook's business practices violateuser expectations, diminish user privacy, and contradict Facebook's ownrepresentations. l lo



28/33


29/33


30/33

133 Finally, the representation, omission, or practice must be material.l3a Essentially,the information must be important to consumers. The relevant question is whetherconsumers would have chosen another product if the deception had not occurred.l3sExpress claims will be presumed material.r36 Materiality is presumed for claims andomissions involving health, safety, or other areas with which the reasonableconsumer would be concerned. l37 The harms of this social networking site'spractices are within the scope of the FTC's authority to enforce Section 5 of theFTC Act and its purveyors should face FTC action for these violations.

Facebook's Implementation of Facial Recognition TechnologyConstitutes Consumer Harm

I34. Facebook's actions injure users throughout the United States by invading therrprivacy; allowing for disclosure and use of information in ways and for purposesother than those consented to or relied upon by such users; causing them to believefalsely that they have full control over the use of their information; andundermining the ability of users to avail themselves of the privacy protectionspromised by the company.

135. The FTC Act empowers and directs the FTC to investigate business practices,including data collection practices that constitute consumer harm.l38 TheCommission realizes the importance of transparency and clarity in the collection ofinformation about consumers. Without real transparency, consumers cannot makeinformed decisions about how to share their information. l3e

Facebook's Use of Facial Recognition Technology ConstitutesConstitutes an Unfair and Deceptive Trade Practice

136. Facebook has said that it may not want everyone in the world to have theinformation you share on Facebook, and that users have extensive and precisecontrols available to choose who sees what among their network and friends, aswell as tools that give them lhe choice to make a limited set of information

t34 Id.t3s Id.t3u Id.131 Id.' r5 u.s.c. g 45.'3e Remarks of David C. Vladeck, Director, FTC Bureau of Consumer Protection, New York University: PromotingConsumer Privacy: Accountability and Transparency in the Modern World (Oct. 2, 2009).




31/33

available to search engines and other outside entities. laO137 Facebook encouraged users to submit personal photographs to Facebook with the

explicit assurance that they would retain control over their photographs.138 Facebook further represented to users that they could untag themselves if they did

not wish to be identified in photographs obtained by Facebook.139. Users could not reasonably have known that Facebook would use their photos to

build a biometric database in order to implement a facial recognition technologyunder the control ofFacebook.

t40 Facebook representations to users regarding the use ofthe photos they haveprovided to Facebook are a sham intended to induce users to provide personalinformation while concealing Facebook's true intent

I4l. Moreover, Facebook failed to establish adequate safeguards to prevent the misuseof this information by third parties, including the Government and applicationdevelopers.

142 Absent injunctive relief by the Commission, Facebook is likely to continue itsunfair and deceptive business practices and harm the public interest, as evidence bythe company's repeated changes to its privacy policy and aggressive efforts to makemore user data publicly available.

r43 Absent injunctive relief by the Commission, Facebook will likely expand the use ofthe facial recognition database it has covertly established for purposes over whichFacebook users will be able to exercise no meaningful control.

la0 Testimony of Chris Kelly, Chief Privacy Officer, Facebook, Before the U.S. House or RepresentativesCommittee on Energy and Commerce Subcommittee on Commerce, Trade, and Consumer Protection Subcommitteeon Communications, Technology and the Internet (June 18, 2009), avalable athttp://energycommerce.house.gov/Press_111120090618/testimony_kelly.pdf.




32/33


33/33

monitoring of the effectiveness of the safeguards' key controls,systems, and procedures

Permit Facebook to reintroduce auto-tagging features only after it has:1. Established appropriate security safeguards2. Revised its privacy policy to limit disclosure of user information,including tagged images, to third parties only where required bylaw and not simply where Facebook has a good faith reason tobelieve that there is a legal requirement to do so3. Obtain informed user consent that also allows individuals to

subsequently opt-out of the auto-tagging featuresf. Seek appropriate injunctive and compensatory relief.

145 EPIC, and the consumer organizations listed above, reserve the right to amend thiscomplaint and to bring other relevant matters to the attention of the Commission.

Respectfully Submitted,

Marc Rotenberg, EPIC Executive DirectorJohn Verdi, EPIC Senior CounselGinger McCall, EPIC Open GovernmentCounselSharon Goott Nissim, EPIC ConsumerProtection CounselELECTRONIC PRIVACYINFORMATION CENTERI4I1718 Connecticut Ave. NW Suite 200Washington, DC 20009202-483-1140 (tel)202-483-1248 (fax)

l4l EPIC is grateful for the assistance of EPIC Clerks Pamela Hartka, James Kleie, Sapna Mehta, Francisco Riojas,Jeramie Scott, Alexander Stout,and Alexandra Wood, who contributed to this Complaint.



Date post:	04-Jun-2018
Category:	Documents
Upload:	sean-ramsey
View:	223 times
Download:	0 times

FTC Facebook Facial Id 2011 Before Ftc

Documents