Facebook is not alone in misuse or wrongful use of phone number given for 2FA. LinkedIn explicitly requires phone number to be added on the profile to enable 2FA and makes the phone number visible by default to all the contacts, if you don't want your phone number visible; you'll have to loose 2FA as LinkedIn doesn't support authenticator or other alternate 2FA means(FB does).
I came to know this as after I enabled 2FA on LinkedIn, I started receiving messages from random people on WhatsApp whom I later found to be my LinkedIn contacts.
It really made me wonder what other shady stuff they might be doing with my and my customer’s data.
Here is a direct link: https://www.linkedin.com/psettings/two-step-verification
But really, this is how organizations should be run: there should be a user-privacy-focused resource inside the company that can work with product to guide how features get implemented. (The same goes for accessibility, technical feasibility, and other things that product people aren't necessarily measured against.)
This is exactly what made me quit Facebook a while back. Started to spam me with notifications when I only wanted to add a backup number.
oh wait theyre dealing ankind of drugs too . .
- Asking for email password: https://arstechnica.com/information-technology/2019/04/faceb...
- Targeting ads using phone numbers obtained through two-factor authentication: https://www.engadget.com/2018/09/28/facebook-two-factor-phon...
- Improper use of facial recognition: https://www.npr.org/sections/thetwo-way/2018/04/16/603056662...
>the FTC alleges that Facebook violated the FTC Act’s prohibition against deceptive practices when it told users it would collect their phone numbers to enable a security feature, but did not disclose that it also used those numbers for advertising purposes.
>The FTC also alleges that Facebook misrepresented users’ ability to control the use of facial recognition technology with their accounts. According to the complaint, Facebook’s data policy, updated in April 2018, was deceptive to tens of millions of users who have Facebook’s facial recognition setting called “Tag Suggestions” because that setting was turned on by default, and the updated data policy suggested that users would need to opt-in to having facial recognition enabled for their accounts.
$5 billion is a lot, but Facebook is huge. Even considering, it's probably not pocket change for them, but they are getting a benefit from it for sure. They are buying public opinion.
"Look at us..we took a big fine and agreed to respect your privacy .. you can trust us now." It's essentially a very expensive ad, used to rebuild trust with their cattle; I mean users.
"As part of Facebook’s order-mandated privacy program, which covers WhatsApp and Instagram, Facebook must conduct a privacy review of every new or modified product, service, or practice before it is implemented, and document its decisions about user privacy. The designated compliance officers must generate a quarterly privacy review report, which they must share with the CEO and the independent assessor, as well as with the FTC upon request by the agency."
I've never heard someone express the point you're making: can you think of any example where the PR impact turned out that way?
The FTC settlement indemnifies Facebook for "any and all claims prior to June 12, 2019"
The only reasons these specific prohibitions are spelled out is because Facebook is known to have specifically performed these acts in the past.
It does feel like they confessed and repented a few spectacularly egregious sins and bought a $5 billion indulgence for the rest.
If they agree to not do bad things, then do the bad things, seems then we have a bad actor.
I doubt that any individual or lawsuit could affect this kind of change.
they should get even stricter
force them to relinquish the absolute control of the founder/ceo, enable voting rights and more
investors are undiscerning and exchanges are not creating ultimatums for listing, so these founder privileges are only revoked after they mess up really bad which is cool
Whatever privacy review Facebook was undergoing like once a year was done by a private firm that Facebook could pick and then have to pay. So is it any wonder that those so-called privacy auditors have found nothing wrong with Facebook so far in 8 years? (even as the privacy scandals and Facebook's apologizing perpetuated in the media).
These types of settlements are a joke. There's zero doubt in my mind Facebook already has a plan for how to work around these restrictions and do 90% of what it's already been doing anyway.
As a side-note, does anyone still believe Facebook was genuine about getting Facebook female users' naked pictures "to protect them from revenge porn" genuine?
They've already lied about collecting the phone numbers and facial recognition as being used for security. And those were obvious lies to me from day one, too. Pretty much every new feature Facebook launches that seems good for users has an undertone of "...and this is how we'll track you now."
What they do is issue settlements, Facebook agreed to this fine, and to the conditions surrounding it, because if they didn't they might face hard, law based regulation from Congress.
The issue here is, the FTC process relies on good faith from the companies it settles with, and Facebook has repeatedly shown to be a bad faith actor in this regard (which is why its a 5 billion dollar fine to begin with)
The only way this is going to end is with very onerous regulation from Congress.
The GDPR has it's flaws, but at last Europe has bitten the bullet and faced up to their responsibility to protect consumers and reign in privacy abuses. It's about time US lawmakers got their act together.
being fined 25% of annual profit (2018 $22.111bn) is probably not "a big win".
But yeah, the business terms of the settlement are surely inspiring a champagne toast back at HQ.
* Facebook is prohibited from using telephone numbers obtained to enable a security feature (e.g., two-factor authentication) for advertising;
* Facebook must provide clear and conspicuous notice of its use of facial recognition technology, and obtain affirmative express user consent prior to any use that materially exceeds its prior disclosures to users;
* Facebook is prohibited from asking for email passwords to other services when consumers sign up for its services.
This might, at first blush, seem like a win for users, but consider it from a different perspective.
When a settlement involves promising not to do a bunch of really, really bad stuff, that typically means the settlement doesn't have much bite. It's comparatively easy for a company to agree not to do egregiously bad things, and comparatively harder for it to agree not to do things that are still problematic, but less egregious.
These things that Facebook has agreed to not do are way outside the boundaries of ethical privacy practices -- but there's still a ton of gray area that remains unaddressed.
So from Facebook's perspective, this is probably a big win. The settlement allows the company to give the appearance of taking concrete steps to respect users' privacy. But what it might actually mean is that there were many other less egregious privacy violations that it was able to slip past the FTC's judgment.