Skip to main content

Have you reviewed your company’s privacy policy lately? The FTC’s proposed settlement with social network Myspace serves as a timely reminder to make sure what you tell people about your privacy practices lines up with what actually happens in the day-to-day operation of your business. While you’re at it, double-check to make sure you’re giving customers the straight story about third-party access to their information. The Myspace case is the latest in the FTC’s line of law enforcement actions challenging what the agency says are false promises made to consumers about how companies use — and more importantly, how they promise not to use — people's personal information. One particular FTC concern in this case is that the information Myspace shared with advertisers gave advertisers access to users’ full names, in violation of the company’s privacy promises. When it comes to personally identifiable information (PII), a person’s name is about as personally identifiable as it gets. Some background on what the FTC says was going on: Like other social network sites, Myspace users can create and customize personal online profiles. To register, people have to give their full name, email address, birth date, and gender. Then there’s optional info Myspace collects, like a user’s picture, relationship status, sexual orientation, hobbies, etc. Myspace assigns a unique identifier — called a Friend ID — to each profile that’s created. According to the FTC, Myspace’s default settings made users’ full names publicly available via the Friend ID. People had to override that default if they wanted to hide their full names. What did Myspace say about how it used people’s information? According to the FTC, it boiled down to this: that the company wouldn’t use or share a person’s personally identifiable information except as described in its privacy policy, including sharing information with third parties. Even when Myspace used cookies to customize content and advertising, the company told people that “the information used for this feature does not provide your PII or identify you as an individual to third parties.” But the FTC’s complaint alleges that those promises didn’t square with what was actually happening on the site. Here’s how third-party advertisers fit into the picture. Myspace makes money by allowing affiliate or third-party ad networks to display ads on its site. When a Myspace page loads, Myspace sends a request to the network, telling it to serve up an ad. The FTC says that along with that request, Myspace transmitted the Friend ID, age, and gender of the user who was looking at the page. Third-party advertisers could take simple steps to get detailed information about individual users, including visiting their personal profiles on Myspace to get their full names and even combining their names and other personal information with that advertiser’s tracking cookies to compile a history of websites the person has visited. The FTC’s complaint alleges that Myspace represented, expressly or by implication, that it wouldn’t use or share a user’s personally identifiable information except as described in the privacy policy — including sharing it with third parties — without telling users and getting their OK first. But the FTC says that despite that claim, Myspace shared users’ Friend IDs with third-party advertisers. At minimum, the Friend ID gave advertisers access to the user’s basic profile information, which for most people, included their full name. That wasn’t explained in Myspace’s privacy policy and the company didn’t get users’ OK to do that. Therefore, alleges the FTC, what the company said about how it handled personal information was false or misleading, in violation of the FTC Act. The complaint also charges that Myspace told people that any web browsing activity shared with advertisers would be anonymized. But given that advertisers could tie a user’s Friend ID and the additional personal information the Friend ID gave access to with the advertiser’s tracking cookies, that claim also was false and deceptive. Next: More about the FTC’s settlement with Myspace


It is your choice whether to submit a comment. If you do, you must create a user name, or we will not post your comment. The Federal Trade Commission Act authorizes this information collection for purposes of managing online comments. Comments and user names are part of the Federal Trade Commission’s (FTC) public records system, and user names also are part of the FTC’s computer user records system. We may routinely use these records as described in the FTC’s Privacy Act system notices. For more information on how the FTC handles information that we collect, please read our privacy policy.

The purpose of this blog and its comments section is to inform readers about Federal Trade Commission activity, and share information to help them avoid, report, and recover from fraud, scams, and bad business practices. Your thoughts, ideas, and concerns are welcome, and we encourage comments. But keep in mind, this is a moderated blog. We review all comments before they are posted, and we won’t post comments that don’t comply with our commenting policy. We expect commenters to treat each other and the blog writers with respect.

  • We won’t post off-topic comments, repeated identical comments, or comments that include sales pitches or promotions.
  • We won’t post comments that include vulgar messages, personal attacks by name, or offensive terms that target specific people or groups.
  • We won’t post threats, defamatory statements, or suggestions or encouragement of illegal activity.
  • We won’t post comments that include personal information, like Social Security numbers, account numbers, home addresses, and email addresses. To file a detailed report about a scam, go to

We don't edit comments to remove objectionable content, so please ensure that your comment contains none of the above. The comments posted on this blog become part of the public domain. To protect your privacy and the privacy of other people, please do not include personal information. Opinions in comments that appear in this blog belong to the individuals who expressed them. They do not belong to or represent views of the Federal Trade Commission.

No comments available.

Get Business Blog updates