Social media and online video firms are conducting ‘vast surveillance’ on users, FTC finds
<https://www.theguardian.com/technology/2024/sep/19/social-media-companies-su...> www.theguardian.com Social media and online video firms are conducting ‘vast surveillance’ on users, FTC finds Johana Bhuiyan Social media and online video companies are collecting huge troves of your personal information on and off their websites or apps and sharing it with a wide range of third-party entities, a new Federal Trade Commission (FTC) staff report on nine tech companies confirms. The FTC report published on Thursday looked at the data-gathering practices of Facebook, WhatsApp, YouTube, Discord, Reddit, Amazon, Snap, TikTok and Twitter/X between January 2019 and 31 December 2020. The majority of the companies’ business models incentivized tracking how people engaged with their platforms, collecting their personal data and using it to determine what content and ads users see on their feeds, the report states. The FTC’s findings validate years of reporting on the depth and breadth of these companies’ tracking practices and call out the tech firms for “vast surveillance of users”. The agency is recommending Congress pass federal privacy regulations based on what it has documented. In particular, the agency is urging lawmakers to recognize that the business models of many of these companies do little to incentivize effective self-regulation or protection of user data. “Recognizing this basic fact is important for enforcers and policymakers alike because any efforts to limit or regulate how these firms harvest troves of people’s personal data will conflict with their primary business incentives,” FTC chair Lina Khan said in a statement. “To craft effective rules or remedies limiting this data collection, policymakers will need to ensure that violating the law is not more lucrative than abiding by it.” The FTC is also asking that the companies mentioned in the report invest in “limiting data retention and sharing, restricting targeted advertising, and strengthening protections for teens”. Notably, the report highlights how consumers have little control over how these companies use and share their personal details. Most companies collected or inferred demographic information about users such as age, gender and language. Some collected information about household income, education and parental and marital status. But even when this type of personal information was not explicitly collected, some companies could analyze user behavior on the platform to deduce the details of their personal lives without their knowledge. For instance, some companies’ user interest categories included “baby, kids and maternity”, which would reveal parental status, or “newlyweds” and “divorce support”, which would reveal marital status. This information was then used by some companies to tailor what content people saw to increase engagement on their platforms. In some cases, that demographic information was shared with third-party entities to help target them with more relevant advertisements. Whatever product was in use, it was not easy to opt out of data collection, according to the FTC. Nearly all the companies said they fed personal information to automated systems, most often to serve content and advertisements. On the flipside, almost none of them offered “a comprehensive ability to directly control or opt-out of use of their data by all Algorithms, Data Analytics, or AI”, per the report. Several firms say it’s impossible to even compile a full list of who they share your data with. When the companies were asked to enumerate which advertisers, data brokers or other entities they shared consumer data with, none of these nine firms provided the FTC with a full inventory. The FTC also found that despite evidence that children and teens use many of these platforms, many of the tech companies reported that, because their platforms are not directed at children, they do not need different data-sharing practices for children under 13 years of age. According to the report, none of the companies reported having data-sharing practices that treated the information collected about and from 13- to 17-year-olds via their sites and apps differently than adult data, even though data about minors is more sensitive. The FTC called the companies’ data-minimization practices “woefully inadequate”, finding that some of the companies did not delete information when users requested it. “Even those Companies that actually deleted data would only delete some data, but not all,” the report stated. “That is the most basic requirement,” said Mario Trujillo, a staff attorney at the Electronic Frontier Foundation. “The fact that some weren’t doing that even in the face of state privacy laws that require it proves that stronger enforcement is needed, especially from consumers themselves.” Some of the firms have disputed the report’s findings. In a statement, Discord said the FTC report was an important step but lumped “very different models into one bucket”. “Discord’s business model is very different – we are a real-time communications platform with strong user privacy controls and no feeds for endless scrolling. At the time of the study, Discord did not run a formal digital advertising service,” Kate Sheerin, Discord’s head of public policy in the US and Canada, said in a statement. A Google spokesperson said the company had the strictest privacy policies in the industry. “We never sell people’s personal information and we don’t use sensitive information to serve ads. We prohibit ad personalization for users under 18 and we don’t personalize ads to anyone watching ‘made for kids content’ on YouTube,” said Google spokesperson, José Castañeda. The other firms either did not provide an on-the-record comment or did not immediately respond to a request for comment. However, if companies dispute the FTC’s findings, the onus is on them to provide evidence, says the Electronic Privacy Information Center (Epic), a Washington DC-based public interest research organization focused on privacy and free speech. “I used to work in privacy compliance for companies, and let’s just say I believe absolutely nothing without documentation to back up claims,” said Epic global privacy counsel, Calli Schroeder. “And I agree with the FTC’s conclusion that self-regulation is a failure. Companies have repeatedly shown that their priority is profit and they will only take consumer protection and privacy issues seriously when failing to do so affects that profit.”
Buongiorno, mentre in EU è in atto un malcelato piano per _sabotare_ il GDPR (che tanto è inapplicato, quindi serve solo a rompere le scatole agli sfigati), negli USA c'è una fazione dell'amministrazione che sta (ancora) tentando di introdurre una roba simile... comunque, io mi chiedo come diavolo può essere che le stesse aziende facciano /macelleria messicana/ coi dati degli americani mentre /Qualcuno ™/ sostiene che lo stesso trattamento sia del tutto compatibile con il GDPR quando si tratta di cittadini europei... ma sono io che sono limitato! Alberto Cammozzo via nexa <nexa@server-nexa.polito.it> writes:
<https://www.theguardian.com/technology/2024/sep/19/social-media-companies-su...> www.theguardian.com
Social media and online video firms are conducting ‘vast surveillance’ on users, FTC finds
Johana Bhuiyan
(il report completo in PDF di 129 pagine è qui: https://www.ftc.gov/system/files/ftc_gov/pdf/Social-Media-6b-Report-9-11-202... di seguito il comunicato stampa pubblicato da FTC ieri 19 Settembre: «FTC Staff Report Finds Large Social Media and Video Streaming Companies Have Engaged in Vast Surveillance of Users with Lax Privacy Controls and Inadequate Safeguards for Kids and Teens» https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-staff-report... --8<---------------cut here---------------start------------->8--- A new Federal Trade Commission staff report that examines the data collection and use practices of major social media and video streaming services shows they engaged in vast surveillance of consumers in order to monetize their personal information while failing to adequately protect users online, especially children and teens. The [staff report] ** is based on responses to [6(b) orders] issued in December 2020 to nine companies including some of the largest social media and video streaming services: Amazon.com, Inc., which owns the gaming platform Twitch; Facebook, Inc. (now Meta Platforms, Inc.); YouTube LLC; Twitter, Inc. (now X Corp.); Snap Inc.; ByteDance Ltd., which owns the video-sharing platform TikTok; Discord Inc.; Reddit, Inc.; and WhatsApp Inc. The orders asked for information about how the companies collect, track and use personal and demographic information, how they determine which ads and other content are shown to consumers, whether and how they apply algorithms or data analytics to personal and demographic information, and how their practices impact children and teens. “The report lays out how social media and video streaming companies harvest an enormous amount of Americans' personal data and monetize it to the tune of billions of dollars a year,” said FTC Chair Lina M. Khan. “While lucrative for the companies, these surveillance practices can endanger people's privacy, threaten their freedoms, and expose them to a host of harms, from identify theft to stalking. Several firms' failure to adequately protect kids and teens online is especially troubling. The Report's findings are timely, particularly as state and federal policymakers consider legislation to protect people from abusive data practices.” The report found that the companies collected and could indefinitely retain troves of data, including information from data brokers, and about both users and non-users of their platforms. The staff report further highlights that many companies engaged in broad data sharing that raises serious concerns regarding the adequacy of the companies' data handling controls and oversight. In particular, the staff report noted that the companies' data collection, minimization and retention practices were “woefully inadequate.” In addition, the staff report found that some companies did not delete all user data in response to user deletion requests. The staff report also found that the business models of many of the companies incentivized mass collection of user data to monetize, especially through targeted advertising, which accounts for most of their revenue. It further noted that those incentives were in tension with user privacy, and therefore posed risks to users' privacy. Notably, the report found that some companies deployed privacy-invasive tracking technologies, such as pixels, to facilitate advertising to users based on preferences and interests. Additionally, the staff report highlighted the many ways in which the companies fed users' and non-users' personal information into their automated systems, including for use by their algorithms, data analytics, and AI. The report found that users and non-users had little or no way to opt out of how their data was used by these automated systems, and that there were differing, inconsistent, and inadequate approaches to monitoring and testing the use of automated systems. Furthermore, the staff report concluded that the social media and video streaming services didn't adequately protect children and teens on their sites. The report cited research that found social media and digital technology contributed to negative mental health impacts on young users. Based on the data collected, the staff report said many companies assert that there are no children on their platforms because their services were not directed to children or did not allow children to create accounts. The staff report noted that this was an apparent attempt to avoid liability under the [Children's Online Privacy Protection Act Rule]. The staff report found that the social media and video streaming services often treated teens the same as adult users, with most companies allowing teens on their platforms with no account restrictions. The report also noted some of the potential competition implications of the companies' data practices. It noted that companies that amass significant amounts of user data may be in a position to achieve market dominance, which may lead to harmful practices with companies prioritizing acquiring data at the expense of user privacy. It noted that when there is limited competition among social media and video streaming services, consumers will have limited choices. The staff report makes recommendations to policymakers and companies based on staff's observations, findings, and analysis, including: • Congress should pass comprehensive federal privacy legislation to limit surveillance, address baseline protections, and grant consumers data rights; • Companies should limit data collection, implement concrete and enforceable data minimization and retention policies, limit data sharing with third parties and affiliates, delete consumer data when it is no longer needed, and adopt consumer-friendly privacy policies that are clear, simple, and easily understood; • Companies should not collect sensitive information through privacy-invasive ad tracking technologies; • Companies should carefully examine their policies and practices regarding ad targeting based on sensitive categories; • Companies should address the lack of user control over how their data is used by systems as well as the lack of transparency regarding how such systems are used, and also should implement more stringent testing and monitoring standards for such systems; Companies should not ignore the reality that there are child users on their platforms and should treat COPPA as representing the minimum requirements and provide additional safety measures for children; • The Companies should recognize teens are not adults and provide them greater privacy protections; and • Congress should pass federal privacy legislation to fill the gap in privacy protections provided by COPPA for teens over the age of 13. The Commission voted 5-0 to issue the staff report. [Chair Khan], as well as Commissioners [Alvaro Bedoya], [Melissa Holyoak] and [Andrew N. Ferguson] each released separate statements. The lead attorneys on this matter are Jacqueline Ford, Ronnie Solomon and Ryan Mehm from the FTC's Bureau of Consumer Protection. [staff report] </reports/look-behind-scenes-examining-data-practices-social-media-video-streaming-services> [6(b) orders] </news-events/news/press-releases/2020/12/ftc-issues-orders-nine-social-media-video-streaming-services-seeking-data-about-how-they-collect-use> [Children's Online Privacy Protection Act Rule] </business-guidance/resources/childrens-online-privacy-protection-rule-not-just-kids-sites> [Chair Khan] </legal-library/browse/cases-proceedings/public-statements/statement-chair-lina-m-khan-regarding-social-media-video-streaming-service-providers-privacy-report> [Alvaro Bedoya] </legal-library/browse/cases-proceedings/public-statements/statement-commissioner-alvaro-m-bedoya-6b-report-examining-data-practices-social-media-video> [Melissa Holyoak] </legal-library/browse/cases-proceedings/public-statements/concurring-dissenting-statement-commissioner-melissa-holyoak-regarding-social-media-video-streaming> [Andrew N. Ferguson] </legal-library/browse/cases-proceedings/public-statements/concurring-dissenting-statement-commissioner-andrew-n-ferguson-regarding-social-media-video> --8<---------------cut here---------------end--------------->8--- saluti, 380° -- 380° (Giovanni Biscuolo public alter ego) «Noi, incompetenti come siamo, non abbiamo alcun titolo per suggerire alcunché» Disinformation flourishes because many people care deeply about injustice but very few check the facts. Ask me about <https://stallmansupport.org>.
participants (2)
-
380° -
Alberto Cammozzo