Is Facebook About to Run Into Privacy Issues Again?

Activist group wants FTC, GAO and lawmakers to investigate

There's always inherent risk—as well as opportunity—when you make it up as you go. Facebook's new plan to work with big data vendors (reported today by Ad Age) to connect consumers' offline purchasing data with its member profiles for targeted ads has once again put the social network in the crosshairs of the privacy hawks, even as it has potential advertisers excited.

The timing isn't good for Facebook, given that lawmakers and regulators are investigating whether offline data collected by data brokers, when combined with online data, violates consumers' privacy. 

As soon as next week, Facebook will announce it is expanding its custom audiences ad program that allows advertisers to link their customer lists with Facebook users to include offline third-party databases advertisers contract with including Acxiom, Datalogix and Epsilon. The three databases—Facebook users, advertiser customer lists and third-party databases—would be anonymously matched via user emails and phone numbers for targeting more relevant ads.

While attractive to advertisers, privacy advocates are alarmed. Facebook's plan is exactly what they have feared—that more online data is being combined with offline data in a digital arms race that fails to give consumers control over their own information.

"Clearly the integration of these powerful databases and purchasing records to be used for targeting is a serious privacy concern and needs to be investigated," said Jeff Chester, the executive director for the Center for Digital Democracy. "We need new privacy controls and marketing policies to protect sensitive information."

Hearing about Facebook's plan, the CDD Friday alerted the Federal Trade Commission, the General Accountability Office and key lawmakers at the front of the privacy debate. Many of the same companies that are part of the new Facebook ad plan, such as Acxiom and Datalogix, are part of a recent Federal Trade Commission investigation into the privacy practices of companies that collect, assemble and sell consumer information to third parties, both online and offline. The GAO is also conducting a comprehensive study into data broker privacy practices.

Facebook declined to comment about privacy concerns. The company is already under a 20-year consent decree with the FTC to give consumers clear and prominent notice and obtain consent from users before sharing information beyond privacy settings. 

Even if Facebook rolls out the expanded custom audiences plan with new privacy controls, the debate in Washington over data brokers privacy practices will not go away anytime soon.