Technology April 2, 2009, 12:01AM EST

Facebook Connect: Your 8,000 Hidden Friends

Do Facebook Connect users understand how extensively their profiles and activities are used by third parties?

Story Tools

Facebook has gone a long way to protect the privacy of users on its own site. But what happens when users share their Facebook profiles and friend lists with other sites? Are social networks responsible for defending data its members decide to take elsewhere?

Those questions have taken on added urgency following the introduction of tools by leading social networks, including Facebook and News Corp.'s (NWS) MySpace, that let users interact with their friends on partner sites. Facebook Connect, for example, lets a user instantly share a movie rating on Netflix (NFLX) with all or some of his or her pals on Facebook.

Privacy advocates warn that these services pose a whole new set of concerns about how user data are collected and shared among sites on the Web. Using these open-networking tools, thousands of companies can unearth a trove of new data about a visitor—age, gender, location, interests, and even what a person looks like. "I'm wondering if people really understand when they're using Facebook Connect that other sites get access to their whole user profile and social graph," says Pam Dixon, executive director of the World Privacy Forum.

Announced last July, Facebook Connect has already signed up more than 8,000 partner sites, many of which plan to use data collected on Facebook members for their own purposes. Joost, a video-viewing site that integrated with Facebook Connect in December, checks the ages of viewers entered on their Facebook profiles to give its own content partners—CBS (CBS), for example—a better idea of which Joost users are watching CBS programming. Digg.com will let users display their Facebook profile photos alongside comments they make on the social news-sharing site.

Watching Wherever You Go

Facebook stresses that users voluntarily opt into these information exchanges. The first time members of the social network attempt to log into a partner site using a Facebook name and password, they're told they're about to let the site "pull your profile information, photos, your friends' info, and other content that it requires to work." Further, users retain control over exactly what type of information they're willing to share with these sites. "Facebook users are able to see that they will be sharing data with other sites in a clear and conspicuous manner," says Chris Kelly, chief privacy officer at the company.

Still, Web surfers may not understand exactly how their Facebook activity is being used by third-party sites. "It's about collecting your data, ultimately wherever you go, and being able to deliver targeted communications to you" based on that data, says Jeffrey Chester, executive director at the Center for Digital Democracy.

Digg Chief Executive Jay Adelson, who says his site has no plans to target ads based on users' Facebook profiles, concedes that the possibility exists. "There is the opportunity for using profile information for advertising," Adelson says.