Facebook’s Brilliant but Evil design

Note: the other day I mentioned how exciting I thought the world of social design was…turns out it might be a little too exciting…

Seth Godin writes how 8 billion dollars worth of gift cards seeps through the cracks each year. Astounding number. He rightly points out the reason we buy so many gift cards: it is not socially acceptable to give cash as presents. But when we shift that cash into a gift card, we lose the risk of giving an unwanted gift while giving something more socially appropriate.

Such a small, yet large, difference.

In Chapter 4 of The Wealth of Networks, Yochai Benkler discusses a similar distinction between “extrinsic” motivations and “intrinsic” motivations. Extrinsic motivations come from the marketplace, and involve money. They are appropriate in some situations and not others. Intrinsic motivations come from within, such as pleasure or personal satisfaction. They are also appropriate in some situations and not others.

This distinction is important in social design because so many of the activities people participate in online are motivated from a desire of social standing, not economic standing.

Take the case of a New York Times article recommendation. If I send a link of a NYTimes article to you as a friend, my only motivation is social…intrinsic…and it’s probably a small one at that. I saw this article and I thought you might like it. My reward might be a small up-tick in your opinion of me.

But if I’m getting paid money to give you that recommendation, then my motivation is in part economic, and that changes everything. You are now suspicious of the gesture…and my reward might actually be a penalty…your opinion of me will most likely deteriorate.

When friends deal with friends, money often makes no sense.

What the big social network sites are doing is similar: they’re creating a place where social standing, not economic standing, is the primary motivation. Or, more to the point, they’re modeling that part of our lives in which we yearn for social standing. As Danah Boyd and Nicole Ellison rightfully articulate in Social Network Sites: Definition, History, and Scholarship:

“What makes social network sites unique is not that they allow individuals to meet strangers, but rather that they enable users to articulate and make visible their social networks. This can result in connections between individuals that would not otherwise be made, but that is often not the goal, and these meetings are frequently between “latent ties” (Haythornthwaite, 2005) who share some offline connection. On many of the large SNSs, participants are not necessarily “networking” or looking to meet new people; instead, they are primarily communicating with people who are already a part of their extended social network.”

In other words, you’re mostly dealing with people you already know in some way. The motivation is almost always intrinsic.

But now, with the addition of social advertising on Facebook, an economic element comes into play. Facebook isn’t just showing us information about what our friends are doing as a gift, it’s showing us information in exchange for money. They’ve altered the state of the relationship.

To make matters worse, Facebook is now partnering with 3rd party sites and selling your information to them for money. How does this work?

Here’s a scenario: you go to Blockbuster.com and rent a movie. A little interface element pops up and tells you that Blockbuster is sending information to your Facebook account. It gives you ten seconds to say no…and then it sends it anyway. This is called “opt-out”. You only have the option to say no. It sends your personal information by default. “Opt-in” would be where no action is taken by default.

You then log into your Facebook account, and it says that “Blockbuster is sending a story to your account”. You have the option to say no to this, but it is not apparent at all. In fact, Facebook gives you the option “Don’t show me this again”, which seems to suggest that they agree this message is annoying. They have designed this screen for you to focus on the pain of having to read a silly message and dismiss it. But what isn’t very clear is that when you do so you’re also giving implicit instruction that all services can send information to your news feed in the future. This is a HUGE deal to Facebook…this is how they’re going to make money.

Here’s a good explanation with screenshots of how it works by Ethan Zuckerman. Read his whole piece, and read David Weinberger’s piece too. They’re important.

What kills me about what Facebook is doing is how good the design is. At every step they’ve done things almost perfectly. They’ve pinpointed the motivations of users at each step, and designed the screens in such a way as to make the default action the seemingly best one. They technically give you the option to get out of it, but they have designed the system in such a way to make it much easier to simply let it happen.

If I was on the Facebook design team, I would be proud of this design. It is some of the best social design out there. But if that were the case, if I was on the design team, all of these design decisions would have happened over a long period of time. I wouldn’t have noticed how they’re starting to be evil.

But wait, you say. How the heck can Blockbuster know that I am a Facebook user? I didn’t tell them I was and even if Blockbuster wanted to, they couldn’t read the Facebook cookie on my browser. (contrary to what David says, it’s not possible for Blockbuster to “read” Facebook’s cookie).

But what *is* possible is something more subtle. When you go to Blockbuster.com, what you see is a normal Blockbuster web page. In requesting that page, you also request all the code on that page, which includes javascript code that accesses a URL on the Facebook.com domain (possibly the URL of a 1×1 gif image). Since the javascript is being delivered by Blockbuster, it can attach a unique ID to that URL that identifies you.

So, imagine that Blockbuster writes this out on their web page:

<img src="http://facebook.com/beacon.gif?ID=8675309" />

Then, when your browser makes a request for that Facebook URL (which includes the unique ID assigned by Blockbuster) it also sends your cookie for the Facebook.com domain (as most HTTP requests do). At this point Facebook knows who you are from your cookie and also knows what unique ID belongs to you on the Blockbuster site. Then it’s a simple matter of Blockbuster pinging Facebook and asking “tell me more about the user with this unique ID”.

Facebook then sends demographic information (not identifiable information) to Blockbuster that can then be used to advertise movies to you as long as you keep that unique ID. Blockbuster sends your movie preferences back to Facebook.

(note this is how I imagine it works. I’m no ad guy…folks who are familiar are welcome to clarify how it actually works)

Here is some corresponding legalese about cookies from the Facebook privacy policy:

“Advertisements that appear on Facebook are sometimes delivered (or “served”) directly to users by third party advertisers. They automatically receive your IP address when this happens. These third party advertisers may also download cookies to your computer, or use other technologies such as JavaScript and “web beacons” (also known as “1×1 gifs”) to measure the effectiveness of their ads and to personalize advertising content. Doing this allows the advertising network to recognize your computer each time they send you an advertisement in order to measure the effectiveness of their ads and to personalize advertising content. In this way, they may compile information about where individuals using your computer or browser saw their advertisements and determine which advertisements are clicked. Facebook does not have access to or control of the cookies that may be placed by the third party advertisers. Third party advertisers have no access to your contact information stored on Facebook unless you choose to share it with them.

This privacy policy covers the use of cookies by Facebook and does not cover the use of cookies or other tracking technologies by any of its advertisers. “

Now you might ask: isn’t that some kind of breach of contract? Well, according to their terms of service, Facebook can do pretty much anything with your information that it wants.

“By posting User Content to any part of the Site, you automatically grant, and you represent and warrant that you have the right to grant, to the Company an irrevocable, perpetual, non-exclusive, transferable, fully paid, worldwide license (with the right to sublicense) to use, copy, publicly perform, publicly display, reformat, translate, excerpt (in whole or in part) and distribute such User Content for any purpose, commercial, advertising, or otherwise, on or in connection with the Site or the promotion thereof, to prepare derivative works of, or incorporate into other works, such User Content, and to grant and authorize sublicenses of the foregoing.”

Take a look at this video: Does what happens in Facebook stay in Facebook?. I think on some level most of us assume that our transactions with companies stay with those companies. I know I do. I’m not naive enough to think that there isn’t sharing going on, but in those instances where I’ve seen it I definitely have stopped my relationship with the companies involved. Needless to say, Facebook certainly has my attention.

As Ethan and David mention, the defaults for this system are wrong. Though Facebook can talk a pretty game, what they’re doing feels like a step down the slippery slope of evil.

To give you an idea, when Leah Pearlman announced SocialAds on the Facebook blog, she claimed that Facebook would never “sell any of your information”. But…hmm…aren’t my demographics *my information*? Isn’t what type of movie I like *my information*? Who is Facebook to determine what my information is? Even though companies can’t identify me personally, they are paying Facebook for my age, my interests, and other things about me that make me who I am.

And really, does Facebook think that Blockbuster doesn’t have my identity here? I need an account to rent a movie…so obviously Blockbuster knows who I am. So Facebook is kind of saying “we’re not going to give any identifiable information to 3rd parties…as you’ve already done that”. It really doesn’t matter that Facebook doesn’t give up my email…that’s a cop-out. What they’re doing is connecting the dots…in an under-handed way.

In addition, Pearlman’s blog post says that “You now have the option to share actions you take on other sites with your friends on Facebook.”. This is false. What it should say is “You now have the option to NOT share actions you take on other sites with your friends on Facebook”. If I had the option to share, that’s opt-in. This is opt-out.

It’s all about the defaults, after all.

Facebook offers really good privacy settings for friends and groups. They should offer the same set of privacy settings for 3rd parties. You should be able to say “never share any of my information outside of Facebook ever”. This should be the default! Right now the only option is for controlling what information gets sent back to Facebook from 3rd parties. In other words…you don’t have the option for Facebook to stop selling your information as long as you use the service.

Now, I may be wrong about all of this. Maybe Blockbuster and other 3rd parties aren’t paying Facebook for access to my demographic information. But I want to know!

That’s part of the problem. I don’t know, and very few others seem to know. Very little of Facebook’s relationships with 3rd parties is clear. Who is paying who for what? Don’t people who use Facebook deserve to know what’s going on with their information?

This might not bother some people, but Facebook has changed my relationship with them from one of social rewards to one of economic rewards.

Such a small, yet large, difference.