Mark Zuckerberg is just like us
His data was sold to a malicious third party as well, he confirmed, in an answer to a question from the Democratic representative Anna Eshoo.
Facebook is refusing to explicitly confirm that this malicious third party is GSR, the company started by the Cambridge University researcher Alexsandr Kogan. But since – as Zuckerberg has also repeatedly said – the investigations into other companies are not yet complete, it is hard to think who else it might be.
Zuckerberg’s admission makes it harder than ever for Facebook to claim that its platform circa 2013 was fit for purpose: if even the CEO cannot lock down his privacy settings, who can?
Facebook is declaring war on Cambridge University
Zuckerberg implied that Facebook had only just discovered that the university has a large psychographics research team, and he is shocked. “There’s a whole programme associated with Cambridge,” he said, “with a number of researchers who were building similar apps” to that constructed by Kogan. Cambridge was also implicated in the banning of a second data broker, Cubeyou, from Facebook on Monday.
Zuckerberg said they needed to understand whether “something bad” was going on at Cambridge University, and implied that if Facebook discovers something amiss, it may consider suing the institution.
Regulation is very much on the table
But in the meantime, the EU’s general data protection regulation (GDPR) is everyone’s favourite. Time and again, senators and representatives suggested new regulations would be the only possible response to the scandal. “This incident yet again shows that our laws aren’t working,” said Frank Pallone, the ranking member of the house committee on energy and commerce, in his opening remarks. “I was happy to hear Mr Zuckerberg concede that his industry needed to be regulated. We need comprehensive privacy and data protection legislation.”
The nature of that regulation, of course, is what the real fight will be. As representative Fred Upton noted, “a more regulatory environment might stifle new platforms, might stifle competition” – something, of course, that Facebook might not be too unhappy about. Of course, Upton’s follow-up question – asking Zuckerberg what regulation he would like to see – does not seem like the best way to shackle Facebook.
But in the meantime, European regulators are suddenly the heroes of the day. Multiple congressional representatives asked Zuckerberg whether or not he would enforce GDPR for Americans, a question he repeatedly dodged by promising GDPR “controls” rather than “protections”.
Facebook’s American roots are a strength
“Your success story is an American success story, embodying values such as freedom of speech and freedom of enterprise,” said the committee chairman, Greg Walden, in his opening remarks. As on the previous day, Zuckerberg had responded to a question about breaking up the firm by noting that doing so would weaken the US’s competitive advantage against China.
But it is a tricky line to walk. At other times, Zuckerberg played up the company’s global audience: something between 85-90% of Facebook’s users are based outside the US, creating a raft of unique problems. Behind closed doors, Facebook explicitly refers to itself as a global company, not an American one, and the company knows its future growth is reliant on new international users.
There are some questions Zuckerberg can’t – or won’t – answer
By the end of the second hearing, we had learned the areas Facebook wanted to avoid. Questions about its profiling prowess, for instance, were generally answered through misdirection. Asked who owns “the virtual you”, Zuckerberg’s favoured response was to note that you own all the “content” you upload, and can delete it at will. That does not answer the question, of course: the advertising profile that Facebook builds up about you cannot be deleted, and you have no control over it.
Similarly, Zuckerberg repeatedly tried to dodge the question of how much data Facebook holds about users’ browsing behaviour. Speaking to the Senate, he rebuffed the question for a full minute before conceding that Facebook tracks that information, but argued that most users understand that and desire it. Speaking to the house, he carefully phrased his answer to note that browsing information is not part of “your content” – true, since you do not upload that information, but perhaps beside the point.