There’s something comforting about a company telling us that our privacy matters.
A friendly notification, a few settings to review, perhaps a little padlock somewhere on the screen. We click through, make a couple of changes, and get back to whatever we were doing. Excellent! Privacy handled; one less thing to worry about. Except, of course, it’s worth asking what those promises actually mean.
On October 21, just a few days ago, a New Mexico judge ordered Meta to pay $25 billion in civil penalties after a jury found that Facebook violated the state’s consumer protection law. The case examined misleading statements about users’ privacy, access to their personal information, and the company’s handling of harmful content.
Meta disputes the ruling and says it will appeal, so the legal process is still unfolding. However, this initial decision gives us plenty to think about concerning the distance between a company’s promises and what happens to our information.
For those of us who remember Facebook’s early days, part of the appeal was the gossiping aspect of it: finding out what everyone was doing… Old classmates, friends overseas, someone you met once and somehow remained connected to for twenty years.
We shared photos, relationships, birthdays, and opinions that perhaps would have benefited from a little more reflection. But choosing to share parts of our lives does not mean we have stopped caring about privacy. We might happily share a vacation photo with friends, while having very different feelings about a company collecting, analyzing, or passing along information about us. And both things can be true.
The New Mexico case grew out of the Cambridge Analytica scandal and examined Facebook’s representations about its data practices. It is the latest development in a controversy that stretches back years… In its separate 2019 action against Facebook, the Federal Trade Commission alleged that the company shared information with developers of apps used by people’s Facebook friends, including when those people had selected more restrictive privacy settings.
Think about that for a moment: you could make a choice about your own privacy, and an app someone else used could still become part of the story. That makes “Well, you shouldn’t have posted so much” a rather incomplete response, don’t you think?
It also helps explain why privacy settings deserve a closer look. “Who can see my posts?” and “What can the company do with my information?” are different questions. A setting that limits your audience does not, by itself, answer questions about tracking, advertising, or sharing with other companies. The FTC’s guidance on online tracking explains some of those additional ways websites and apps collect and use information.
At UMD, that distinction matters beyond our personal accounts. A tool might help us organize a class, collaborate on research, or save an impressive amount of time on administrative work. Naturally, we want to use it, preferably before the next meeting. But a reassuring sentence on its website leaves plenty of practical questions unanswered. “What information will we upload?” “Does it include information about students, colleagues, or research participants?” “Who else can access it?” “What happens when we stop using the service?”
UMD’s Software Risk Management process helps evaluate security, privacy, and accessibility risks before software is purchased or used. And for our everyday lives, where you don’t have an SRM team by your side, a little curiosity can help, too:
- Find out what information the service collects, why it collects it, and who receives it. You can find this information in the App Store before downloading an app, or in its Privacy Policy.
- Consider whether an app needs your location, contacts, microphone, or access to all your photos for the feature you want to use.
- Check what each setting actually controls. Post visibility, advertising preferences, and app permissions can address different things.
- Share thoughtfully; consider whether you need to provide a detail at all, especially when it involves someone else.
- Look for evidence beyond the company’s marketing; independent reporting and findings from consumer protection agencies can provide useful context.
And let’s be fair: nobody should need a law degree and an uninterrupted weekend to understand what happens to their information. Companies remain responsible for explaining their practices honestly and honoring the choices they offer. Our vigilance does not replace their accountability.
A familiar logo, a popular app, and a beautifully designed privacy page can make us feel comfortable, but they also deserve questions.
So, the next time a company tells you that your privacy matters, take a moment to look at what it actually does. And then, by all means, get back to checking what your old classmates are doing.