Two Facebook users sue the social site over privacy issues
October 14, 2010
The personally identifiable data was then relayed in referrer headers that were sent during a span of three months to specific advertisers when Facebook users clicked on banner ads, according to an amended complaint filed Tuesday in U.S. District Court in San Jose, California.
The banner header, which is included in URLs that lead to an advertising Web page, shows the Facebook address the user was browsing when he encountered the ad. The information is designed to help advertisers serve content that's geared to the user's age, geographic location and various interests.
Following a complete site upgrade earlier in 2010, Facebook began embedding data in the headers that included even more user information, including in many cases the user's Facebook username, according to the complaint.
It then goes on to theorize that a gay user struggling to 'come out of the closet' could be inadvertently ousted by such a scheme.
The tell-tale headers continued until Harvard professor Ben Edelman exposed the leak in June of this year.
“In particular, Facebook caused referrer headers to include not just the URL of a web page a person was viewing (e.g., a person viewing the profile of Facebook user John Doe) but also confirmation of the specific identification of the person viewing a web page (e.g., that it is John Doe himself who is viewing his own profile),” the 24-page complaint says.
“Similar information was revealed as Facebook users browsed photos or utilized other Facebook functions. Clicking an ad in any of these circumstances caused the advertiser to receive the entire web address of the page the user was visiting, including the user's Facebook username.”
The complaint alleges that the Facebook security flaw violated the Electronic Communications Privacy Act, the Stored Communications Act, and California's Computer Crime Law and Consumers Legal Remedies act.
It was filed on behalf of Facebook users David Gould and Mike Robertson, and seeks class-action status so that other Facebook users of the site can also be included in the lawsuit.
Facebook representatives didn't respond to an email seeking comment at the time this was posted.
You can link to the Internet Security web site as much as you like.