Facebook's "Fan - sumers": Do Social Ads Violate Users' Privacy?

Within the past few weeks, the ever-growing social networking site Facebook announced that it would start a new feature - social advertising.

Facebook already allows its users to create profiles and share information with a group of friends. Each member creates a profile page where he or she can post photos, hobbies, favorite music, and other personal information. What the new features will add is that advertisers will be able to enter Facebook's world and create profile pages to promote their products, music, or services -- pages where other users can register as "fans" (or what Facebook calls "fan-sumers") of a particular company or entertainer.

Moreover, if a user registers as a "fan," Facebook will generate ads that display the user's photo alongside product endorsements. These ads will be shown to the user's Facebook friends about items he or she purchased or endorsed. For example, a Facebook user who rents a movie on Blockbuster.com will be asked if he would like to have his movie selections broadcast to all his friends on Facebook. If he says yes, those friends will receive that movie message, along with an ad from Blockbuster which incorporates his photo.

This new program has caused some privacy advocates to question the legality of Facebook's actions: While Facebook believes its members have consented to the use of their images, have they also consented, in particular, to their names or images being paired with an advertisement? Facebook has claimed that there is no privacy concern here, since only "friends" will receive an advertisement with a member's photo or name.

As I will explain, if Facebook was or is clear about seeking users' consent for their photos' appearance in social advertising, its engaging in social advertising is legal. It should, however, notify its users that it is doing so and provide them with a chance to opt out of such advertising.

Facebook's Argument in Favor of Social Advertising

Facebook has described "social advertising" through its employee blogging. The product manager for Facebook ads notes:

"You now have a way to connect with things you are passionate about. We've launched Facebook Pages, which are distinct, customized profiles designed for businesses, bands, celebrities and more to represent them on Facebook. We noticed people wanted to connect with their favorite music, restaurants, and brands; but there was no good place for these types of affiliations to exist. Now, there is a place for them and you can become a fan of whatever pages you choose in order to interact with your passions in new ways. You can post reviews for a local restaurant, buy tickets to a new movie, or be the first to get a heads up about new promotions." The blog also goes on to say, "Ads will be getting more relevant and more interesting to you. Instead of random messages from advertisers, we've launched Social Ads. Social Ads provide advertisements alongside related actions your friends have taken on the site. These actions may be things like 'Leah is now a fan of The Offspring' (if I added The Offspring to my music) or 'Justin wrote a review for Sushi Hut' (If Justin wrote this review on the Sushi Hut page). These actions could then be paired with an ad "

Ads will reportedly be displayed in the left-hand Ad Space on Facebook -- visible to users as they browse Facebook to network with their friends. The social ads will also be appended to news feeds, where customized ads will be attached to relevant "social stories," such as the news that a friend has become a joined your Facebook Page. Only when ads are appended to a news item, will advertisers be charged by Facebook, for the right to attach their own commercial message. At the top of an ad, for instance, might be a photo of the user and the fact that he uses a given product.

As Facebook also notes, news feeds can be linked to outside websites as well, "so users can tell friends about what they rented at Blockbuster or are auctioning on eBay." Facebook reports that many of its 50+ million users already tell friends about particular products or brands they like, so it argues that the only change here is that their messages might now include ads from the companies that sell those products or brands. The way this will work is that when a new software technology reports back to Facebook that a user has transacted at an affiliate website, a new advertisement can be created.

Privacy Protections: Does Social Advertising Violate User Privacy?

Some law professors, including Daniel Solove, have worried that social advertising may violate Facebook users' privacy. As Solove noted on his blog, "Facebook . . . assumes that if people rate products highly or write good things about a product then they consent to being used in an advertisement for it. Facebook doesn't understand that privacy amounts to much more than keeping secrets -- it involves controlling accessibility to personal data." Solove mentions, as well, that the appropriation of a person's name or image might be an invasion of the person's privacy.

As I noted in my prior column about the unconsented use of a teen's photo, taken from Flickr under a creative commons license, in an advertisement, one aspect of the right of privacy is a common-law or statutory right of publicity - the right to control the commercial appropriation of one's image without one's consent. Many states recognize the right of publicity and award damages for its violation. Thus, if consent on Facebook is not sufficient, the right of publicity has been violated.

Another law professor has pointed out that a New York statute requires that a user provide written consent to have their image used. The statute states that "any person whose name, portrait, picture, or voice is used within this state for advertising purposes or for the purposes of trade without their written consent first obtained" can sue for damages. Moreover, such a use is a criminal misdemeanor. Does clicking on a "Terms of Use" agreement count as written consent? The statute may be envisioning a formal, individualized release, such as, say, individuals who appeared in the "Borat" movie signed.

Facebook believes that it is protecting its users' privacy - noting, for example, that advertisers have no access on the site to "personal information about you, or even what social actions accompany their ads." However, a separate technology will track purchases made by users on affiliated outside websites. With respect to these purchases, Facebook claims that "affiliate websites always notify you of any stories they want to send, and you'll have two opportunities--one on the website, and one on Facebook--to opt out of that story."

The Key Issue: The Scope of Consent

The key issue here is what the scope of a user's consent is: A user who is happy to talk about a product positively has not, by his or her positive comments alone, consented to having his or her name and photo used in an ad for the product. If that were the case, then positive comments about a product would be a defense to a "right of publicity" claim, and they are not.

At this point, Facebook's wisest course would be to approach its users for the full, individualized consent necessary, asking them to check off a box indicating their consent to every commercial use of their image that Facebook envisions. Without this new, specific, individualized consent, Facebook is likely to be embroiled in litigation from "fan-sumers" who resent being enlisted to be "fan-vertisers" too.