The problem with this interpretation is that valid contracts depend, among other things, on informed consent and on the legality of what's being required, meaning you can't trick someone into being bound to terms they never really accepted or sufficiently understood and you can't bind them to illegal terms.
In this case, most people haven't read the Facebook terms of service and it is probably unreasonable to expect everyone to not only read them, but to keep abreast of any updates. So it's a grey area. And if you pass laws and regulations around data privacy, then FB won't be able to legally impose such conditions. But as I said earlier, there isn't much inertia behind data privacy. Nobody with power wants it.
> valid contracts depend, among other things, on informed consent and on the legality of what's being required
Yes, and they also depends on power dynamics.
That's why there are a lot of restrictions on what can be written in a contract between public utilities and users. An electricity provider could strong-arm users into signing draconian contracts otherwise.
Social networks have the same negative externalities: if most of your friends move from using emails to using Facebook to communicate and you are not on it your life gets provably worse. You are cut out from a lot of your social circle.
Having walled-garden social networks is anti-competitive by design.
Unfortunately legislators turn a blind eye to this.
“most people haven't read the Facebook terms of service and it is probably unreasonable to expect everyone to not only read them”
I completely disagree with this thought process. If a website is asking your birthday, every like / dislike , every detail about relatives and is able to predict if you like someone even before you do .. you better know how they will use all this data.
Strictly speaking you're correct, but you're describing the should rather than the is. There are too many overly-long ToSes written in arcane legalese to do mundane things like use a website or play a game for the average person to comprehend even the fist time for everything they use, let alone keeping up with the changes and their implications.
It seems that the term "shadow profile" refers to a feature where Facebook retains contact information uploaded by other users in order to recommend them as friends if/when you create a profile [1]. For all the fear associated with the term, that's pretty benign. Is there any evidence for a link between these "profiles" and some of the more egregious claims of privacy infringement?
For privacy advocates the simple act of linking people that way is worrying enough. Not much of a concern for me (my government's creepiness is vastly overshadowed by its incompetence) but it could certainly be dangerous to free thinkers in certain regimes.
I find it hard to believe that they can't associate more information with those profiles than just who has who else as a contact (or has in the past), some derived/guessed and some from purchasing access to other data-sets, and I find impossible to believe that they won't if they can. Not just FB but other purveyors of advert targetting stalkerdom too. This isn't "don't trust the man" foil-hat paranoia - knowing as much as possible about as many people as possible is their well documented business model.
And of course, the shadow profiles would have had names, email addresses, phone numbers, and linkages that could help answer questions like "mother's maiden name". If shadow profiles were included in the recent huge leak then people who had not ever touched nor wanted to touch facebook, may have just become easier social engineering targets.
Terms and conditions which would have a hard time holding up in court without a signature and witness. Maybe things will change in the future since my own bank does this for online agreements as well as a few government agencies but those do have more stringent KYC rules for online verification.