November 28, 2012

Protect Me from Facebook

A legal-sounding notice was spreading across Facebook, promising to protect users’ photos, personal information, and other content from the company. Unfortunately, copying a paragraph into a status update cannot rewrite the agreement accepted when opening an account.

Over the past year, I have seen a peculiar message appear repeatedly in my Facebook feed. It looks like a legal notice, or at least like something written by a person who once walked past a law school. Its purpose is supposedly to protect your personal information, photographs, illustrations, videos, and other copyrighted material from Facebook.

The message begins like this:

In response to the new Facebook guidelines, I hereby declare that my copyright is attached to all of my personal details, illustrations, comics, paintings, professional photos and videos, etc. (as a result of the Berner Convention).

There are several problems already, and we have not reached the second paragraph.

First, there is no "Berner Convention." The author probably meant the Berne Convention, an international agreement protecting literary and artistic works. It covers things such as books, music, photographs, paintings, and films. It does not turn every piece of personal information stored by Facebook into a copyrighted work.

This may appear to be a small spelling error. It is not. When a message claims to establish your legal rights and misspells the name of the treaty providing those rights, that is normally a good moment to stop copying.

Copy, paste, and hope

The notice continues:

For commercial use of the above, my written consent is required at all times. Anyone reading this can copy this text and paste it on their Facebook wall.

This is where the legal strategy becomes particularly ambitious. The proposal is that you can accept Facebook’s terms when creating an account, continue using its service, and then modify the agreement unilaterally by publishing a paragraph on your profile. That is not how contracts work. You cannot change your mortgage by leaving a note in your kitchen. You cannot rewrite your employment agreement by announcing new conditions during lunch. You cannot enter a restaurant, order dinner, and declare on a napkin that the meal is now free. Facebook does not need to search everyone’s status updates each morning to discover which users have issued new contractual amendments overnight.

The terms governing the service are the agreement. A post saying you reject part of that agreement does not replace it, especially while you continue using the product. Your Facebook wall is many things. It is a place for photographs, opinions, birthday messages, political arguments, and evidence that somebody you went to school with has discovered motivational quotes. It is not a notary.

The rumor has a familiar shape

These messages are part of internet folklore. They are usually called hoaxes, and they tend to follow the same structure:

  1. Something terrible is about to happen.
  2. An unnamed authority has confirmed it.
  3. You can protect yourself by copying the message.
  4. You must warn everyone immediately.

The message creates fear, offers an effortless solution, and turns every frightened reader into its distribution system. Older versions arrived by email. Forward this message to ten people or your account will be deleted. Forward this warning because a dangerous virus can destroy your computer merely by appearing in the same postal code. Forward this photograph because every time somebody shares it, a company will donate one cent to save a child, a puppy, or possibly the entire rainforest.

Facebook made the mechanism even more efficient. You no longer needed to find ten email addresses. You could alarm hundreds of friends with one click. Progress. The copyright notice used the same technique. It claimed Facebook had introduced new rules, referred vaguely to international law, and warned that failing to publish the text would amount to permission. None of that was true.

Facebook publicly denied the rumor on November 26, 2012. The company stated that users retained the copyright to their content and that no status update was required to preserve it. This did not stop people from sharing the message.

Facts are useful, but they rarely travel with the same enthusiasm as panic.

Facebook did not own your photographs

The hoax was wrong to claim that Facebook had suddenly taken ownership of everything users published. Users retained ownership of their intellectual property. That sounds reassuring until we read the next part. Facebook’s terms gave the company a nonexclusive, transferable, sublicensable, royalty-free, worldwide license to use intellectual property content posted on or in connection with the service, subject to the user’s privacy and application settings. That sentence matters much more than anything copied into a status update.

Facebook did not need to own your photograph in order to store it, reproduce it, display it, distribute it through the service, or allow other systems involved in operating Facebook to process it. The license existed because a social network cannot function without permission to handle the material people upload.

When you post a photograph, Facebook needs to copy it to servers, create different versions, display it to the selected audience, and deliver it across its infrastructure. None of this means every use is harmless or that users should ignore the terms. It means the relationship is more complicated than “Facebook owns everything” or “I posted a paragraph, so Facebook may no longer touch anything.” Reality has once again failed to fit inside a viral status update.

Copyright is not privacy

The notice also confuses copyright with privacy. These are different problems. Copyright concerns ownership and permitted uses of an original work. A photograph you created may be protected by copyright. Privacy concerns the collection, processing, disclosure, and use of information about you. Your home address is personal information. It is not normally a literary work. Your list of friends may reveal a great deal about you. That does not make it a painting. Your browsing activity can be commercially valuable. It does not become copyrighted merely because it belongs to your life. Invoking the Berne Convention does not create a privacy shield around every piece of information associated with your account.

The distinction matters because the message encourages people to believe they have solved a privacy problem by declaring copyright ownership. They have not. The photographs may already be theirs. The actual questions are what license they granted Facebook, what information the company collects, how that information is used, and which controls are available. Those questions require reading settings and terms. Copying a paragraph is considerably easier, which explains its popularity.

Facebook was already using your information commercially

The message warned that Facebook might use personal material for commercial purposes. This was presented as a future threat. It was already the business.

Facebook provided a service without charging most users directly. In return, it collected information about accounts, activity, connections, interests, and interactions. That information helped the company decide which advertisements to show.

This is why Facebook seemed unusually well informed about whether you might want to lose weight, meet attractive strangers, learn a language, or purchase something you had searched for five minutes earlier. It was not clairvoyance. It was advertising.

You had agreed to participate in this arrangement when accepting the terms and using the service. Whether you understood the arrangement is another question. Most of us treat terms of service as a small obstacle placed between us and the button we want to press. We scroll. We accept. Years later, we discover what we accepted and respond by posting a legal incantation copied from someone we vaguely remember from school. This is not a robust privacy strategy.

The false comfort of public declarations

The most dangerous part of these notices is not that they look foolish. It is that they create the sensation of having done something. The user becomes concerned about privacy, copies the text, publishes it, and feels protected. The concern disappears without any meaningful change to the account. No settings were reviewed. No applications were disconnected. No audience restrictions were changed. No old posts were removed. No terms were read. The only person affected was the friend who had to see the notice for the twelfth time that week.

Security theater works this way. A visible action gives us comfort even when it does not reduce the actual risk. The Facebook notice is privacy theater. It replaces an inconvenient decision with a symbolic gesture. Instead of considering what we share and whether we trust the service, we paste a paragraph and return to uploading photographs. The system continues operating under the same agreement as before. But now our wall contains Latin-adjacent legal vocabulary, so everything feels more official.

What you can actually do

There are real ways to reduce what Facebook knows or can expose about you. You can review the privacy settings. You can limit the audience for posts. You can remove applications connected to the account. You can avoid publishing information you do not want stored or shared. You can delete old content. You can stop using particular features. You can leave Facebook.

None of these actions is as emotionally satisfying as announcing that the Berne Convention has been activated. They do, however, change something.

The uncomfortable truth is that using an online service requires accepting a trade-off. You receive communication, storage, distribution, and access to a network of people. The company receives data, attention, and opportunities to make money from the relationship. You can decide that the exchange is acceptable. You can reduce your participation. You can reject it and leave. What you cannot do is continue using the entire service while canceling selected parts of its agreement through a status update.

Facebook’s lawyers are unlikely to react like this:

Diego has posted the paragraph. Shut down the advertising systems. He found the loophole.

The most effective protection

The best way to protect yourself from Facebook is still the least exciting one. Do not give it information you do not want it to have. Use the privacy controls, but do not confuse controls with guarantees. Think before publishing. Remember that deleting something later does not mean it was never copied, shared, downloaded, or seen. Most importantly, decide whether you want to be there.

If you fundamentally reject how Facebook operates, leaving the service is more effective than publishing a notice inside the service explaining that you reject how it operates. That is the real choice. Everything else is a paragraph floating through the feed, collecting likes, frightening relatives, and accomplishing approximately nothing.