Facebook privacy control overhaul will remove ability to limit who can find us

Are you suffering from CFF – Chronic Facebook Fatigue? The mental and bodily malaise that comes from constant tweaking of privacy options in the Land of the Face?

Fear not, for the most recent round of changes, announced today, carry some good privacy tidings, including privacy shortcuts from the main page drop-down menu, plus a new Request Removal tool for managing multiple photos in which you have been tagged.

The changes will begin rolling out at the end of the year.

Facebook is also adding in-context educational notices throughout its platform to help make it easier to understand how to control your sharing.

For example, a reminder may inform users how items hidden on their timelines can still appear in news feeds, in searches, and in other places.

But lest we get all giddy, note that the new privacy changes are part good, part bad.

On the plus side is the privacy short-cut.

You’ll be able to click on a lock icon, next to the Home button on the upper right of the drop-down menu, to quickly access settings for “Who can see my stuff?” “Who can contact me?” and “How do I stop someone from bothering me?”

You’ll also be able to access Help Center content from the short-cut drop-down menu.

As Facebook product manager Sam Lessin notes in his writeup of the changes, this quick access replaces what used to be a bit of a maze.

Up until now, tweaking privacy and timeline controls required you to stop what you were doing and navigate through a separate set of pages.

In the best of all possible worlds, the ease of access to Facebook privacy controls would increase their use.

That’s good. It’s hard to imagine their use getting worse, at any rate.

As Consumer Reports reported in April, 13 million US Facebook users aren’t using, or are oblivious to, privacy controls.

Facebook is arguing that another positive step is the upcoming ability to remove your name from multiple photos that you are tagged in.

We’ll be able to go to the “Photos of You” tab, select multiple photos, and ask friends to take down the shots we don’t want to be tagged in. We’ll also be able to append a message about why this is important.

The tool will enable you to take off your name from multiple photos. But bear in mind that while untagged photos don’t appear on your timeline, the photos can still appear in other places on Facebook, such as search, news feed, or your friends’ timelines.

It’s sounds like it will be a convenient way to bemoan rampant tagging to the slap-happy taggers in your network, but it doesn’t go far enough.

As Sophos’s Graham Cluley noted when he wrote up the last big privacy setting revamp in August 2011, Facebook-using Naked Security readers list photo-tagging as one of the least popular elements of the site.

Rather than having to slog through a continual process of requesting that people untag them in photos, and that they please leave off the habit entirely in the future, and rather than simply blocking tagged photos from appearing on their timelines, many Facebook users want to simply block anyone from tagging them without having received express prior permission to do so.

Unfortunately, Facebook has failed to give us this blanket tag-blocking ability in these recent privacy changes.

Another negative change is the removal of the ability to hide yourself from people searching for you by name.

Facebook is axing the setting called “Who can look up my timeline by name,” which controlled whether someone could be found by typing their name into the Facebook search bar.

That setting was “very limited in scope,” Lessin wrote, and didn’t keep people from being found in “many other ways across the site.”

He wrote:

"Because of the limited nature of the setting, we removed it for people who weren’t using it, and have built new, contextual tools, along with education about how to use them. In the coming weeks, we’ll be retiring this setting for the small percentage of people who still have it."

Again, it’s the wrong direction. If the original setting was limited in scope and failed to do what it purported – e.g., choose who can find you – why not rework it so as to actually protect people’s privacy and give them the right to not be found?

Why not patch those privacy leakage holes, those “many other ways across the site” that allow people to find those who don’t want to be found?

Facebook deserves kudos for putting privacy controls in a quick short-cut where more people might access and use them, and the contextual education sounds like a win, but it all would be more comforting if the company weren’t, at the same time, trashing the important privacy control of who can find us.

If you are on Facebook and want to keep yourself informed about the latest news from the world of internet security and privacy, join the Sophos Facebook page where more than 200,000 people regularly discuss these issues and best practice.