Facebook-owned Instagram can sell your photos

Your photos could be sold and displayed for commercial purposes, if sweeping changes to photo-sharing site Instagram's terms and conditions go ahead.

The hugely popular photo app, which was acquired by Facebook earlier this year, has announced some major changes to its terms of use and privacy policy which come into effect on January 16.

The specific addition in the updated terms and conditions in regards to this is pretty straightforward. It reads:

"To help us deliver interesting paid or sponsored content or promotions, you agree that a business or other entity may pay us to display your username, likeness, photos (along with any associated metadata), and/or actions you take, in connection with paid or sponsored content or promotions, without any compensation to you."

Let's break that statement down a little.

Say you go on a trip and take photos of your hotel room, your meal or even yourself sunbathing by the poolside. Potentially, the hotel could pay Instagram/Facebook for the use of those photos, and display them on their own website or marketing material -- with no financial compensation to you.

Where the terms of service talks about metadata, this specifically means the information stored in the photograph that identify the time, the GPS co-ordinates (ie the exact location; unless location services are turned off), the phone used and more besides (like keywords used to tag the photo).

Your likeness, is of course, your photo. So who knows, a photo of yourself in your bikini drinking a particular beverage could be plastered on a billboard by the drink manufacturer. (This may well run foul of privacy laws, but there doesn't seem to be anything in the small print that suggests this kind of thing couldn't happen somewhere down the line.)

No doubt that as this story hits the news, disgruntled users will cry foul and Instagram/Facebook may well water down the terms and conditions -- they could at the very least, make this clause something you're able to opt-out of.

In another worrying development, Instagram also says:

"You acknowledge that we may not always identify paid services, sponsored content, or commercial communications as such."

This could be in breach of advertising codes of practice, which state that such content should clearly be identified as such.

Sources: For more on this, check out the Cnet article about the topic as well as the new Instagram terms of use and privacy policy.

Facebook founder speaks to BBC

Facebook founder Mark Zuckerberg has spoken to the BBC in a rare video interview about the recent concerns surrounding the company's privacy issues.

He said: "The person who's putting the content on Facebook always owns the information... They want to share it with only a few people and it's important that the information only goes to those people."

He added: "We're not going to sell or share the information except with the people that they've asked it to be shared."

Zuckerberg said that the advertising on the site has grown quickly and that is how it will make its money. And would not sell people's information on in order to do so. But to a lesser degree, Facebook is providing demographic information - not personally identifiable, but still personal information nonetheless - to advertisers.

Online advertisements need to be targeted to relevant markets. Let's look at how GMail works, for instance. I know my information remains personal, but the site still scans my emails for keywords and displays relevant advertisements down the site of the page that relate to those keywords. Effectively, my information is still being used for profit. The same thing happens on Facebook but to a greater degree. I've used its ad service, and have managed to narrow down demographics in order to buy targeted ads, and narrow down the number of targeted users by interest, age, relationship status and more.

Like I said, this isn't personally identifiable. But it means that your information is still being used for advertising, whether you like it or not.

What Facebook collects about you

Facebook's privacy policy is written in plain English, but there are still a few vague phrases kicking around. So, what stuff does Facebook hold on you?

Apart from the usual stuff all websites know about you when you visit (like the numerical identifier, called the IP address, that traces you back to your internet provider) Facebook says it holds personal information you "knowingly choose to disclose that is collected by us and Website use information collected by us as you interact with our Website". This essentially means everything you say and do on Facebook is collected, because everything you do on there is a knowing disclosure - right?

It also says "you provide us with certain personal information, such as your name, your email address, your telephone number, your address, your gender, schools attended and any other personal or preference information that you provide to us". Wow. I certainly haven't told it all of this stuff. I think I registered before you had to specify your gender, so it doesn't know this, either. If people make all of this stuff available for even close friends to view (and say a friend's account gets hacked), it's perfect fodder for an identity thief.

You also need to provide Facebook with your date of birth, because you need to say you're over 13 to use the service. I always provide my date of birth to identify myself when I call a bank.

Note: All this doesn't even apply to the third-party applications that you might have installed. As soon as you give them permission to install themselves on to your Facebook profile, they have access to your data, too. And in an earlier post we discussed Beacon, the feature that broadcast certain actions on third-party websites to your friends that you may have preferred to keep private.

Third parties that you haven't even given permission to access your profile can access aggregated information about you. It's not personally identifiable, but your actions are contributing to Facebook's bottom line. "We do this for purposes such as aggregating how many people in a network like a band or film and personalising advertisements and promotions so that we can provide you with Facebook. We believe this benefits you."

We believe this benefits Facebook, too, n'est-ce pas?

Oh, and most creepy of all, "We may use information about you that we collect from other sources, including but not limited to newspapers and Internet sources such as blogs, instant messaging services, Facebook Platform developers and other users of Facebook, to supplement your profile."

Huh? This is probably something Facebook will focus on more in the future, as information becomes more easily tied to individuals. Does this mean Facebook will be able to associate your profile with, say, a mention of you in a local newspaper? When you list your blog on your profile, will it scan the blog and tie it up with your likes/dislikes? And as Microsoft has a small stake in Facebook, and you list your Hotmail address to sign up - where will that end? Facebook says: "Where such information is used, we generally allow you to specify in your privacy settings that you do not want this to be done or to take other actions that limit the connection of this information to your Profile (e.g. removing photo tag links)."

What I don't like about Facebook is it doesn't make it easy to delete information about myself. If I need to delete things individually from my Wall, for instance - I can't do multiple deletes. Making it possible is one thing, but it's also quite difficult to do.

It's not just Facebook... applications know you, too!

This blog, and others, focuses on Facebook settings and how to make them work for you. But there are thousands of third-party Facebook applications out there (games, quizzes, photo sharing, review sites, maps... the list goes on) that make money from you.

They'll do so mainly either via affiliate links or straight ad revenue. What does this mean? Here are some real-life examples.

Affiliate revenue: Say you've installed an application that allows you to list the books you've read. If a visitor clicks on the book title, they'll be taken to an online bookstore where they can buy a copy. If the visitor goes through with the sale, the application developer, who has set up a deal with the bookstore, will get a cut.

Ad revenue: You might see Google ads at the end of a game. Click on an ad and the app maker will get a cut. Many websites, including this one, display similar ads.

Sometimes an application has no ad links and is a brand awareness exercise. The agency will want to convince their clients that the application is helping the brand name get across.

To measure the effectiveness of these campaigns, application developers need to be able to see demographic information about the people who use their tools. They can use analysis tools from companies like Refresh Analytics, who allow developers to get stats about people who add their programs. Refresh Analytics' tool is described thusly:

The tool can be easily integrated into any Facebook app. It tracks users across 13 demographic and six interest categories: geography, gender, age, marital status, music, books, etc. The info is collected in aggregate to protect user privacy and respect Facebook rules. A daily snapshot of 1,000 users is provided, and historical reports can be generated for the past month, six months or two years.

So, although personal information about you is never revealed, if you have included information about where you're from, your age, marital status and interests, all this information can, and does, get pulled out and it's able to be broken down by app makers so they know, say, the average age of the person who plays their games.

That's why I've not listed any interests or even my gender in my profile. I don't need the advertisers to know all this information if I don't have to reveal it.