> That's amoral bullshit and we must demand better.

Why is this amoral bullshit? It seems like a lot of the outrage around this topic is born out of a 'feeling' that you have an instrinsic right to online privacy. But, I don't see this right clearly defined in the constitution, so where does it come from? Are you sure it exists?

> It should be expected that that connecting accounts means sharing little more than the subset of data required for the integration.

I think it's unrealistic to expect FB to expend resources to determine what subset of data is 'required' for every app in its ecosystem. When inspecting the utility/privacy frontier, the current model of requiring users to grant permission to an app makes the most sense to me. The problem in this case is that the permissions modal may not have been clear enough.

These rights have routinely been taken from people with or without their consent throughout history.

EDIT: What I mean to say is having it spelled out can only help, and if we cannot make an argument based on existing legal constructs we might need to spell it out.

When it's not defined by law, it's up for debate. And, my main point is that in such a scenario, I don't think calls for moral condemnation are in order.

In outrage scandals like this, we're so quick to condemn the actor and demand punishment. I think the more constructive action is to condemn the action (not the actor) and demand regulation (not punishment). Condemning the actor may quench our thirst for justice, but I think it's often net harmful.

I get that calling for punishment is a good disincentive for future immoral, unregulated activity, but the punishment has to fit the bill. FB lost, what, $30B of value over this 'scandal'. Is that not a big enough fine?

Isn't that like when a rich/famous person evades punishment for a crime that the average person would get a long jail sentence for, because from loss of income etc they'd already got 'a big enough fine'? i.e. effectively only the non-rich are punished for crimes.

Requiring permissions is a good step, but an auditable history would be a huge gain for users world-wide.

In other words, I would like to make an api call or visit a facebook page and see what data was requested by and sent to every third party with which I have shared data. I could then use that data to see if I'm comfortable sharing that information. Automation could also be undertaken by facebook to weed out obviously malicious actors.

Because

> But, I don't see this right clearly defined in the constitution, so where does it come from? Are you sure it exists?

It comes from morality. Some people think it's immoral to defraud people, whether that is money or their private information.

Some people don't want to live in immoral societies and want the government to enforce some level of moral behaviour amongst it's subjects.

> I think it's unrealistic to expect FB to expend resources to determine what subset of data is 'required' for every app in its ecosystem.

How? They have billions in profits and are in the process of hiring thousands of people to help get their news curation/reporting systems upto scratch. Why can't they setup a process where people have to justify to facebook what they would use the data for?

I could easily argue it would have been in their financial interest as it's quite possible we wouldn't be here talking about facebook if they had taken this approach.

But no, im supposed to believe it's unrealistic to have such simple process.

I don't understand why netflix gets to see all your DM's when all you want the connection to do is send a message to a person you choose. The connection doesn't need to give netflix literally any data besides maybe the fact that a message was sent. why do they need to know who it was too, and any other messages surrounding it?

I am about to change my mind on the GDPR. If Spotify and Netflix are legally obligated to not store any data they do not need, then Facebook can actually make an additional argument that it is ok to give them wider access; after all, the law will ensure they have to handle it properly.

That seems like a huge perverse incentive. Companies will start constructing systems so that more data is "required" so they can legally collect and share more of it. Then convincing them to collect less would require not just convincing them not to collect the data but convincing them to undergo the expense of redesigning all their systems to not "require" it anymore.

This is exactly what companies do. They decide what data they want, and then set out to find a way that each of those data elements is necessary.