[josephagoss]

Based on the first link, that letter scares me a lot. I have a feeling that this level of regulation will destroy any social startup. You'd need a compliance department larger than engineering just to remain legal. This is clearly a win to Facebook.

[vorpalhex]

Or you just build your permissions and opt-in platform as a base for the social app.

We wouldn't let a self driving startup ignore traffic laws because it's "too hard". Likewise we shouldn't let a social startup ignore privacy laws and auditing.

[Spivak]

At least on the surface it doesn't seem that bad. You just have an opt-in data collection with (type-of-data, purpose-of-data) tuples and let users actually delete data on request.

Allow Socially to collect the following information for the purposes of providing you service:

- Minimal Account Information: email address and password

To prevent spam if you don't provide additional profile information you will be required to verify your account with a valid government ID. Only the expiration date will be stored.

- Information posted to your timeline.

Without this you will be unable to post updates.

- Messages sent to others.

Without this you will be unable to send messages.

- Profile Information: Name, Address ...

Allow Socially to collect the following information for the purposes of protecting your account:

- Network Addresses used to access the service.

- Login location

- Login times

After a short time using the service if we see a login that doesn't match the information on record we will notify the primary email for approval.

- Links to other sites you click.

We will check links you click against our list of known phishing sites and scams and warn you before redirecting you.

Allow Socially to collect the following information for running internal studies and improving our service.

- Features you use.

- Posts you read.

- Links to other sites you click.

Allow Socially to collect the following information to help make ads more relevant to you:

...