Years after it peaked in popularity, once mighty social network Myspace is back in the headlines, although not for anything good: The website, now owned by pop star Justin Timberlake and a company called Specific Media, on Tuesday reached a settlement with the U.S. Federal Trade Commission over charges that it misled users about sharing their personally identifiable information with advertisers.
However, in the course of its investigation, the FTC discovered that Myspace had actually been sharing with third-party advertisers a piece of information on users’ profiles that could identify them. This piece of information, the “Friend ID,” will be recognized by users (or former users of the website) as the string of numbers that followed the “Myspace.com/” Web address for their profiles.
The FTC elaborated on what exactly was wrong with this sharing of user profile information, which was already publicly available to anyone who visited that user’s page:
“Despite the promises contained in its privacy policy, the FTC charged, Myspace provided advertisers with the Friend ID of users who were viewing particular pages on the site. Advertisers could use the Friend ID to locate a user’s Myspace profile to obtain personal information publicly available on the profile and, in most instances, the user’s full name. Advertisers also could combine the user’s real name and other personal information with additional information to link broader web-browsing activity to a specific individual.”
Still, the FTC’s claim that the “Friend ID” could be used to obtain information that was, by the agency’s own admission, often quite publicly displayed, is on its own perplexing. After all, that’s how all social networks generally work, by allowing people to enter and broadcast their personal information to other users.
However, a follow-up blog post by the FTC’s chief technologist, Ed Felten, a professor of computer science and public affairs at Princeton, helped clarify exactly what Myspace did that was deemed to be in potential violation of U.S. law. As Felten wrote:
“The FTC’s complaint describes how Myspace made it possible for an ad network to sync Myspace”s Friend ID with the ad network’s Ad ID. To sync two pseudonyms means to connect them, to determine that two separate pseudonyms actually correspond to the same person. If each pseudonym has a body of user information associated with it, syncing allows the two bodies of’ user information to be merged into a single record.”
The crux of the FTC’s problem with Myspace comes down to the fact that the information Myspace was giving advertisers, via browser cookies, could be combined with anonymized information that the advertisers were already keeping about users and their activities (or lack thereof) with ads placed on the site, allowing the advertisers to have a much clearer picture of who exactly was clicking their ads and who was not.
But it’s not certain which, if any advertisers took advantage of the opportunity to match anonymized information with specific Myspace users. As Felten noted: “The FTC did not allege that any ad network did take advantage of the syncing opportunity to gather user information, only that Myspace opened the door to such syncing.”
The FTC’s settlement with Myspace doesn’t constitute an admission of guilt or wrongdoing, as the agency points out. Still, Myspace agrees to 20 years worth of biannual privacy audits by third party agencies to make sure the company is faithfully representing its use of user information to those users, as well as banning future misleading representations of its privacy policies.
The agreement is highly similar to ones the FTC reached with Google and Facebook in 2011 over its charges that those companies also misrepresented their privacy policies to consumers.
However, the fact that the FTC chose to settle with Google and Facebook before Myspace lends another layer of mystery to Tuesday’s news. Namely, why would the FTC go after Myspace now, as its popularity has waned? Also: When did the FTC begin its investigation of Myspace? The agency did not reach TPM in time to comment for this report.
Specific Media, the Irvine, California-based company that now owns Myspace, did not answer those questions either, but provided TPM with a lengthy statement on the FTC settlement, essentially shifting the blame of Myspace’s previous practices to its previous management. The Myspace statement read, in part:
“In order to put any questions regarding Myspace’s pre-acquisition advertising practices behind us, Myspace has reached an agreement with the FTC that makes a formal commitment to our community to accurately disclose how their information is used and shared. Myspace has further agreed to implement a comprehensive privacy program that will minimize future risks to the privacy and security of information.”
Myspace was an independent company until being acquired by News Corporation, the parent company of Fox News, for $580 million in 2005, just a few years before it peaked and began rapidly losing users to Facebook and other, newer social networks. News Corporation sold Myspace to its current owner for about a sixteenth of that amount, just $35 million, in June 2011.
Myspace claimed it had 25 million registered users in February of 2012, down from a peak of over 100 million unique monthly users in 2006. Facebook recently reported surpassing 900 million active users, while Twitter in March claimed over 140 million active users.
