FTC says, "ahem" —

Facebook blocks research into political ads, falsely blames FTC privacy order

FTC says Facebook privacy settlement doesn't require blocking researchers.

An inverted version of the Facebook
Getty Images | GreyParrot

When Facebook disabled the accounts of New York University researchers who were investigating misinformation and political ads on the platform, the social-media giant claimed it did so to comply with a consent decree that it previously agreed to with the Federal Trade Commission. "We took these actions to stop unauthorized scraping and protect people's privacy in line with our privacy program under the FTC Order," Facebook wrote in its explanation of the account suspensions. Facebook said it "disabled the accounts, apps, Pages and platform access associated with NYU's Ad Observatory Project and its operators."

But Facebook's claim that the FTC order forced it to suspend the researchers is false, FTC Bureau of Consumer Protection Acting Director Samuel Levine wrote in a letter to Facebook CEO Mark Zuckerberg on Thursday. The FTC order did require Facebook to create a privacy program, but there was no requirement that would have forced Facebook to shut down the NYU research project. Despite that, Facebook's statement that it suspended the accounts "in line with our privacy program under the FTC Order" conveys the false message that Facebook had no choice in the matter.

Levine's three-paragraph letter to Zuckerberg said:

I write concerning Facebook's recent insinuation that its actions against an academic research project conducted by NYU's Ad Observatory were required by the company's consent decree with the Federal Trade Commission. As the company has since acknowledged, this is inaccurate. The FTC is committed to protecting the privacy of people, and efforts to shield targeted advertising practices from scrutiny run counter to that mission.

While I appreciate that Facebook has now corrected the record, I am disappointed by how your company has conducted itself in this matter. Only last week, Facebook's General Counsel, Jennifer Newstead, committed the company to "timely, transparent communication to BCP staff about significant developments." Yet the FTC received no notice that Facebook would be publicly invoking our consent decree to justify terminating academic research earlier this week.

Had you honored your commitment to contact us in advance, we would have pointed out that the consent decree does not bar Facebook from creating exceptions for good-faith research in the public interest. Indeed, the FTC supports efforts to shed light on opaque business practices, especially around surveillance-based advertising. While it is not our role to resolve individual disputes between Facebook and third parties, we hope that the company is not invoking privacy—much less the FTC consent order—as a pretext to advance other aims.

Facebook “cynically invoke[d] user privacy”

On Tuesday, "Facebook abruptly shut down the accounts of New York University researchers Laura Edelson and Damon McCoy, blocking their research into political ads and the spread of misinformation on the platform," wrote the Knight First Amendment Institute at Columbia University, which is representing Edelson and McCoy in the matter.

Edelson and McCoy researched Facebook using Ad Observer, "a browser plugin they and others created that allows consenting Facebook users to voluntarily share with the researchers limited and anonymous information about the political ads shown to them by the platform."

Facebook's action cut off the access that the researchers used "to uncover systemic flaws in the Facebook Ad Library, to identify misinformation in political ads, including many sowing distrust in our election system, and to study Facebook's apparent amplification of partisan misinformation," Edelson said. "By suspending our accounts, Facebook has tried to shut down all this work." Edelson said that "Facebook suspended my Facebook account and the accounts of several people associated with Cybersecurity for Democracy, our team at NYU."

McCoy said that "Facebook should not be able to cynically invoke user privacy to shut down research that puts them in an unflattering light, particularly when the 'users' Facebook is talking about are advertisers who have consented to making their ads public."

"It is disgraceful that Facebook is attempting to squash legitimate research that is informing the public about disinformation on their platform. With its platform awash in vaccine disinformation and partisan campaigns to manipulate the public, Facebook should be welcoming independent research, not shutting it down," McCoy also said.

The FTC website states that in 2019, Facebook agreed to a $5 billion settlement with the commission "related to allegations that the company violated its 2012 FTC privacy order by deceiving users about their ability to control the privacy of their personal information." Facebook had to pay the penalty and change its privacy practices. The settlement resulted largely from Facebook allowing third-party app developers to access data about users' friends in the Cambridge Analytica scandal.

Researchers deny Facebook claims

When suspending the NYU researchers, Facebook said the Ad Observer browser extension "was programmed to evade our detection systems and scrape data such as usernames, ads, links to user profiles and 'Why am I seeing this ad?' information, some of which is not publicly viewable on Facebook. The extension also collected data about Facebook users who did not install it or consent to the collection."

The researchers deny this, with Edelman telling NPR, "We really don't collect anything that isn't an ad, that isn't public, and we're pretty careful about how we do it."

The Ad Observer website says the browser extension does not collect any personally identifying information. "It copies the ads you see on Facebook and YouTube, so anyone can see them in our public database," the site says. "If you want, you can enter basic demographic information about yourself in the tool to help improve our understanding of why advertisers targeted you."

This is important because "ads are usually seen only by the audience the advertiser wants to target, and then they disappear," making it "difficult for the public to monitor them and hold advertisers accountable," the project says.

Facebook’s FTC fights

The new dispute comes a few weeks after Facebook petitioned the FTC to remove Chair Lina Khan from an antitrust case against the company. Amazon previously filed a similar recusal petition, but neither company has identified a conflict of interest in the usual sense that would require Khan to recuse herself. They simply object to statements about competition and criticisms of the companies that Khan made before becoming FTC chair.

A group of senators led by Elizabeth Warren (D-Mass.) on Wednesday told both companies, "There is no basis for her recusal under the current federal ethics statute or FTC precedent. Your efforts to sideline Chair Khan appear to be nothing more than attempts to force an FTC stalemate that would allow you to evade accountability for any anti-competitive behavior."

Facebook admits truth to Wired

Facebook said it imposed the suspensions about a year after it first told the researchers that their extension would violate Facebook's Terms of Service. As Wired wrote Wednesday, Facebook's claim that the FTC order forced its hand doesn't add up "because the consent decree doesn't prohibit what the researchers have been doing." Facebook admitted that in a response to Wired, the article said:

Joe Osborne, a Facebook spokesperson, acknowledges that the consent decree didn't force Facebook to suspend the researchers' accounts. Rather, he says, Section 7 of the decree requires Facebook to implement a "comprehensive privacy program" that "protects the privacy, confidentiality, and integrity" of user data. It's Facebook's privacy program, not the consent decree itself, that prohibits what the Ad Observer team has been doing. Specifically, Osborne says, the researchers repeatedly violated a section of Facebook's terms of service that provides, "You may not access or collect data from our Products using automated means (without our prior permission)." The blog post announcing the account bans mentions scraping 10 times.

Despite that admission, Facebook's blog post still contained the statement that Facebook suspended the researchers to "protect people's privacy in line with our privacy program under the FTC Order."

We asked Facebook why it hasn't changed or deleted that sentence. A Facebook spokesperson responded to our email but did not answer the question.

Channel Ars Technica