Facebook's Tuesday announcement that it would suspend the accounts of a group of NYU researchers made it appear like the company had its hands tied. They had been crowdsourcing data about political ad targeting through a browser extension. Facebook repeatedly warned them that this was not permitted.We have been trying for months to get New York University researchers the exact access they need in a privacy-protected manner. Mike Clark, Facebooks product manager, stated in a blog post. These actions were taken to prevent unauthorized scraping and to protect people's privacy, in accordance with the FTC Order privacy program.Clark was referring specifically to the consent decree that the Federal Trade Commission imposed in 2019 and a $5 billion penalty for privacy violations. It is easy to understand the company's dilemma. Researchers can understand the company's dilemma, but federal regulators are powerful and require something more.Facebook was not in this predicament because the consent decree does not prohibit the research. Maybe the company didn't do this to remain in government good graces, but rather because it doesn't want the public learning one of its most secretive secrets: Who gets which ads and why.The Cambridge Analytica scandal was the inspiration for the FTCs punishment. Nominally academic researchers had access to Facebook user data and data about their friends. This data ended up in the hands Cambridge Analytica who used it to microtarget Donald Trump's 2016 campaign.The Ad Observer project at NYU works in a very different way. It does not have access to Facebook data. It is a browser extension. The extension is downloaded by the user. They agree to share the ads they see and the information in the "Why am I seeing this? widget" to researchers. The researchers can then determine which political ads are targeted at which usersdata that Facebook does not publicize.Is this arrangement in violation of the consent decree The consent decree could be applied in two sections. Section 2 requires Facebook users to consent before sharing their data. This is irrelevant because the Ad Observer relies upon users consenting to share data and not Facebook.Jonathan Mayer, Princeton professor of computer science, said that Facebook has certain obligations when it shares data with third parties. However, there is nothing that prohibits a user from telling a third party what they see on Facebook.A spokesperson for Facebook Joe Osborne said that Facebook did not have to suspend accounts of researchers under the consent decree. He says that Section 7 of the decree directs Facebook to create a comprehensive privacy program that protects user privacy, confidentiality, integrity, and security. The consent decree does not prohibit what Ad Observer has done, but Facebook's privacy program. Osborne claims that the researchers violated a section in Facebook's terms of service which says: You may not access or gather data from our Products using automatic means (without our permission).Laura Edelson, a NYU PhD student and cocreator, refutes the idea that the Ad Observer is an automated scraper.She describes scraping as when I create a program that automatically scrolls through a website. The computer then drives how the browser works and whats been downloaded. Our extension does not work like that. Our extension is with the user. We only collect data to show ads to the user.Facebook's privacy claims are nonsense.Bennett Cyphers is a technologist with the Electronic Frontier Foundation. He says there isn't a consistent definition of scraping. However, the term seems odd when people choose to share and document their experiences on a platform. This is something Facebook cannot control. Unless they are saying it is against Facebook's terms of service that users should be taking notes about their interactions with Facebook.It doesn't really matter if the extension is automated. Facebook could change its policy or give permission to researchers under existing policies. The more important question is whether Ad Observer actually violates any person's privacy. Osborne, the spokesperson for Facebook, stated that the extension could expose information about other users if it passes along an advertisement. For example, if I have the extension installed it could share the identity of my friends who commented or liked an ad.
