[dmix]

Indeed, I don't believe the problem here was that Facebook was tricking their users here into handing over their phones/emails contact information (aka this persons client lists). FB is explicit about permissions in this sense, although most users agree to everything without thinking twice.

The real problem is how the information was utilized by the recommendation engine, which is known to be creepily effective at matching people (people who just met for the first time, for example). FB is investing heavily in AI here so this is the natural outcome - where the results are very effective but has some unintended side effects. The side effects are largely due to the fact this connectivity happens in the background, outside of a place where the user can control privacy settings on particular contacts.

So I'm not sure there is an easy solution here. Mining contacts and social information is Facebook's business. It's what you hand over to use the service and why many people stop using Facebook voluntarily - or carefully limit what information they allow access to. I never allow FB to access my phones contacts, for instance, and their mobile app still works fine.

[taurath]

Fundamentally though that's the problem with the modern web - the services that users get is not a transaction in the sense that the user knows what they're giving up for the service - it's all hidden under an innocent permissions check (if it's Facebook) or not said at all (if its LinkedIn). The user provides permission for a small pittance like their email address or phone number and it snowballs into having every want need and action tracked and catalogued to make the service owner money. A product not intent on tricking the user into giving up every bit of the data on their life would ask if it could use individual bits of information to serve them ads and sell their information.

It takes more than it asks, and the fine print is there to cover its ass, when in reality if users were asked about what information they were willing to share they would be much more uptight. The users's have no real idea what is happening with their data, what they've given up or how its used to make the company money. It may be true that most user's don't care, and some might even prefer the outcome to them in the form of "relevant" ads (if the choice is made over "irrelevant" ads or paying for the service). It certainly is transforming what is in the public sphere about people, and the lessening of privacy can certainly be used as a weapon (and it is, to the extent that it is a big powerful force arrayed against a person independently figuring out what they want to spend their resources on).