The Myspace case is the latest in the FTC’s line of law enforcement actions challenging what the agency says are false promises made to consumers about how companies use — and more importantly, how they promise not to use — people's personal information. One particular FTC concern in this case is that the information Myspace shared with advertisers gave advertisers access to users’ full names, in violation of the company’s privacy promises. When it comes to personally identifiable information (PII), a person’s name is about as personally identifiable as it gets.
Some background on what the FTC says was going on: Like other social network sites, Myspace users can create and customize personal online profiles. To register, people have to give their full name, email address, birth date, and gender. Then there’s optional info Myspace collects, like a user’s picture, relationship status, sexual orientation, hobbies, etc. Myspace assigns a unique identifier — called a Friend ID — to each profile that’s created. According to the FTC, Myspace’s default settings made users’ full names publicly available via the Friend ID. People had to override that default if they wanted to hide their full names.
But the FTC’s complaint alleges that those promises didn’t square with what was actually happening on the site.
Here’s how third-party advertisers fit into the picture. Myspace makes money by allowing affiliate or third-party ad networks to display ads on its site. When a Myspace page loads, Myspace sends a request to the network, telling it to serve up an ad. The FTC says that along with that request, Myspace transmitted the Friend ID, age, and gender of the user who was looking at the page. Third-party advertisers could take simple steps to get detailed information about individual users, including visiting their personal profiles on Myspace to get their full names and even combining their names and other personal information with that advertiser’s tracking cookies to compile a history of websites the person has visited.
The complaint also charges that Myspace told people that any web browsing activity shared with advertisers would be anonymized. But given that advertisers could tie a user’s Friend ID and the additional personal information the Friend ID gave access to with the advertiser’s tracking cookies, that claim also was false and deceptive.