Following days of silence, CEO announces Facebook will change how it shares data with third-party apps and admits ‘we made mistakes’
Facebook is changing the way it shares data with third-party applications, Mark Zuckerberg announced Wednesday in his first public statement since the Observer reported that the personal data of about 50 million Americans had been harvested and improperly shared with a political consultancy.
According to the UK Guardian, The Facebook CEO broke his five-day silence on the scandal that has enveloped his company this week in a Facebook post acknowledging that the policies that allowed the misuse of data were “a breach of trust between Facebook and the people who share their data with us and expect us to protect it”.
“We have a responsibility to protect your data, and if we can’t then we don’t deserve to serve you,” Zuckerberg wrote. He noted that the company has already changed some of the rules that enabled the breach, but added: “We also made mistakes, there’s more to do, and we need to step up and do it”.
Facebook’s chief operating officer, Sheryl Sandberg, shared Zuckerberg’s post and added her own comment: “We know that this was a major violation of peoples’ trust, and I deeply regret that we didn’t do enough to deal with it.”
Zuckerberg also spoke to a handful of media outlets on Wednesday, including a televised interview with CNN in which he apologized for the “breach of trust”, saying: “I’m really sorry that this happened.”
In similar conversations with the New York Times, Wired, and tech website Recode, Zuckerberg expressed qualified openness to testifying before Congress and said that he was not entirely opposed to Facebook being subject to more regulations.
Everything you need to know about the Cambridge Analytica exposé – video explainer
The crisis stems from Facebook policies that allowed third-party app developers to extract personal data about users and their friends from 2007 to 2014.
Facebook greatly reduced the amount of data that was available to third parties in 2014, but not before a Cambridge University researcher named Aleksandr Kogan had used an app to extract the information of more than 50 million people, and then transferred it to Cambridge Analytica for commercial and political use.
On Saturday, Facebook’s deputy general counsel, Paul Grewal, appeared to defend the lax policies that allowed data harvesting from unwitting friends, writing in a statement:
“Aleksandr Kogan requested and gained access to information from users who chose to sign up to his app, and everyone involved gave their consent.”
But after five days of outrage from the public, and calls for investigations and regulation from lawmakers in the US and UK, the company appears to be acknowledging that blaming users for not understanding its byzantine terms of service will not suffice.
The company will investigate apps that had access to “large amounts of information” prior to the 2014 changes, Zuckerberg said, and audit any apps that show “suspicious activity”.
A Facebook spokesperson declined to share how Facebook was defining “large amounts of information” or how many apps would be scrutinized.
Zuckerberg said in his interviews that the number of apps was in the “thousands”. The company will also inform those whose data was “misused”, including people who were directly affected by the Kogan data operation.
An online petition calling for just such disclosure for people included in Kogan’s data set had garnered more than 15,000 signatures since the weekend.
Facebook also promised to further restrict the amount of data third-party developers can access when users login to their sites with their Facebook profile, turn off data sharing for apps that haven’t been used for three months, and move the tool that allows users to restrict the data they share from the Settings menu to the News Feed.
David Carroll, a US design professor who is challenging Cambridge Analytica through the UK courts to access his data profile harvested from Facebook, called the reforms “inadequate”.
“Users should be notified, and not have to know to go and find out,” he told the Guardian by email.
Zuckerberg’s statement notably did not offer any explanation for why Facebook did not make any effort to inform affected users when Guardian reporters first told the company of the data misuse in December 2015.
He did address the question in his press interviews, acknowledging to CNN that it was “a mistake” to rely on Kogan and Cambridge Analytica’s certifications that they had destroyed the data.
“I don’t know about you, but I’m used to when people legally certify that they’re going to do something, that they do it,” he said. “We need to make sure that we don’t make that mistake ever again.”
“With Mark Zuckerberg’s response, they are trying to convey that they are taking this seriously, but they are reacting to furore rather than facts,” said Jeff Hauser of the Center for Economic and Policy Research. “The facts are not new to them.”
Jonathan Albright, a research director at the Tow Center for Digital Journalism, said that while he welcomed Zuckerberg’s explanation of how Cambridge Analytica gained access to the data in question, he was disappointed that the CEO did not address why Facebook enabled so much third-party access to its users’ personal information for so many years.
“This problem is part of Facebook and cannot be split off as an unfortunate instance of misuse,” Albright said.
“It was standard practice and encouraged. Facebook was literally racing towards building tools that opened their users’ data to marketing partners and new business verticals. So this is something that’s inherent to the culture and design of the company.”
