dreadedmonkeygod . net

Facebook triggered a user revolt over privacy issues associated with their Beacon program. The general idea is that online businesses such as Blockbuster would tell facebook what you were renting/buying, and that information would then be visible to your friends on Facebook.

Obviously Facebook's users were pretty pissed off about this. They felt (and I agree) that this was a violation of their privacy, especially since there was no way to opt out of the system. Whatever they browsed, bought, or rented could become public knowledge.

For the last few weeks, most people have just said that Beacon was a stupid move on Facebook's part, and left it at that. Facebook modified the program to give users a global opt-out mechanism, and everyone moved on. But it looks as though the original implementation of the program might have been illegal.

Lawyer and blogger James Grimmelmann has posted a legal analysis of Beacon under the Video Privacy Protection Act of 1988. He says:

I dug a bit into the legalities of the issue, and this is roughly what I came up with: Facebook and Blockbuster should hunker down and prepare for the lawsuits. Their recent move to allowing a global opt-out may cut them off from accruing further liability, but there's probably an overhang of damages facing them from their past mistakes.

[...]

The VPPA provides damages of $2,500 per violation, plus punitive damages and attorneys' fees. I have no idea how many movies wound up in people's news feeds, but it doesn't have to be too many for the total to hurt. Class action lawyers, start your engines.

We'll see if this actually pans out. I'd like to see Facebook and Blockbuster pay some sort of price beyond what they already have. This is exactly the kind of privacy violation people worry about when they hand over private data to corporations, and everyone involved in implementing this should have known better.