A new Facebook change will make it easier for developers to migrate their existing apps to Open Graph without requesting additional permissions from users.
This will happen through the merging of the publish_actions and publish_stream permissions, according to a post on the company’s developer blog Wednesday. Apps that were previously granted publish_stream do not need to request publish_actions. This is good news for developers planning to add Open Graph capabilities to their existing apps, but should not be taken an opportunity to begin publishing all sorts of activity users wouldn’t wish to be share on Facebook. The social network has updated its app policy to read:
If a user grants you a publishing permission, actions you take on the user’s behalf must be expected by the user and consistent with the user’s actions within your app.
When Open Graph launched in September 2011, Facebook introduced a new publish_actions permission that allowed apps to publish stories on a user’s behalf. Previously, apps requested publish_stream permissions, which would work for posting items to a user’s Wall, but didn’t create the Timeline activity boxes now associated with Open Graph apps. As a result, developers migrating to the new format had to ask for what was essentially the same permission twice.
Now Facebook will combine these permissions so that apps only have to ask users once to publish on their behalf. The publish_actions permission will now include basic publish_stream permissions, including posting on a user’s timeline, posting photos/videos, commenting on and liking content. This permission will appear on the first auth dialog screen. Apps that need advanced capabilities, like posting to a friend’s timeline or to groups will still need to request publish_stream, which appears on a second screen where users can opt out.
Earlier this month we learned Facebook was working with a small set of partners — including Instagram before the company was acquired — to test extending the old publish_stream permission to include the new Open Graph publish_actions permission. Facebook told us then, as it iterated today “This setting does not change the controls users have or what apps can publish, and it will continue to be the app’s responsibility to make it clear to the user what content will be shared back to Facebook.”
In the case of Instagram, automatically enabling Timeline permissions made sense because it simply optimized the format of posts and users still have a clear choice whether or not to share a photo on Facebook when they create an image in the Instagram app. The only action Instagram publishes is “took a photo,” and as a result, few users will even notice a difference in how the app interacts with their Facebook account. It would be against Facebook policy for Instagram to automatically begin publishing stories about when users follow another account, write comments or take other actions within the mobile app that people haven’t explicitly chosen to share with Facebook friends.
Developers should make it as clear as possible which actions in their apps post to users’ Timelines and to their friends’ News Feeds. If users begin to mark an app’s stories as spam, Facebook is likely to revoke publishing permissions or shut down an app completely. More information is available from the publishing permissions and platform policies sections of the developer site.