Note: This guide is still in preliminary state and will be updated as we continue to explore Places.

August 19, 2010

On August 18, 2010, Facebook announced its new location product, Facebook Places. Much like existing location services foursquare and Gowalla, Places allows users to manually "check-in" to specific places--a concert, café, or classroom --in order to share this information with their social network.

Facebook has made some changes to its regular privacy practices to protect sensitive location-based information, such as limiting the default visibility of check-ins to “Friends Only” and providing notice to you each time you are checked in by a friend. We are happy to see Facebook take steps to protect this information and keep it under your control.

However, we have serious concerns about other privacy protections and controls associated with Places.

This Resource Guide is designed to walk you through the privacy options that you do—and don’t—have when you or your friends use Places. If you share our concerns, please sign our petition and tell Facebook to give you full control over the information you share using Places and other Facebook services!

Breaking Down Places & Privacy

Basic Check-In: Places Keeps Privacy Close to Home

One area where Facebook has taken steps to improve privacy for Places users is by ensuring that sensitive information about location history is not publicly available. Instead, your check-ins will be visible on your profile to only your friends by default. You will also have the opportunity to customize your check-in privacy to a different level, such as friends-of- friends, or even to a subset of your friends.

Places and Friends: Where "No" Is Not an Option

Places allows your friends to "tag" you when they check in somewhere. But while Facebook makes it very easy to say “yes” and allow your friends to check in for you, they make it far more difficult to say “no.” We are very disappointed that Facebook is making it so hard for users to disallow check-ins by friends.

If you’re not a Places user yourself, you’ll be notified when you're tagged by a friend and given two options:

• “allow check-ins,” which gives all of your friends the ability to check you in (permanently, unless you find and change your privacy settings), or
• “not now,” which prevents only the current check-in.

Of course, “not now” means “maybe later.” So if you choose “not now” this time, the next time a friend (even the same friend!) tries to check you in, Facebook will ask you again to “allow check-ins.” And again, and again, and again...

And if you are a Places user, then you won’t even be given the option to say “not now” when your friends check-in for you. When you start using Places, Facebook requires you to also let your friends check-in for you, without telling you that you have the option of disallowing friend check-ins.

(Want to opt out now? Scroll down or click here to learn how!)

"Here Now": Privacy Later?

Another of the features of Places is "Here Now," which provides a list of people who have recently checked-in at a given Place. Unfortunately, there are several privacy features that should be part of the “Here Now” function but aren’t.

• Here Now can only be turned on or off, not configured to be visible only to certain people.

Here Now doesn't allow you to choose exactly who can see that you’ve checked in (or been checked in!). Instead, your only choices are to turn "Here Now" on, which allows any other Facebook user who has checked in to the same Place to see that you are there, or to turn it off entirely. Unlike with basic check-ins, you do not have the option of showing only certain groups of people that you are “Here Now.”

• For many users, even those with fairly restrictive privacy settings, Here Now will be turned on by default.

Here Now is turned on by default for any user who has a single privacy setting set to “Everyone.” If you choose to share your favorite quotation with everyone on Facebook, does that really mean you want to share your current location as well? If not, you may need to check your settings and turn off Here Now.

• You cannot use the Here Now features without creating a permanent check-in on their profile.

The Here Now service could provide a transient notification to your friends when you are in a particular location without leaving a record of your location behind. But Facebook has tied Here Now to permanent records. In order to show up on Here Now, you must create a check-in to a Place that will be a part of your profile until you manually delete it.

(Want to turn this off? Scroll down or click here to learn how!)

Places Data: Where Will It Go?

Facebook plans to immediately open Places data up to applications and Connect sites. In fact, your apps and your friends’ apps may be able to access information about your most recent check-in by default as soon as you start using Places.

As we’ve discussed many times (and even created our own app to highlight!), applications that your friends run can access a vast amount of information about you. Unfortunately, unless you unchecked every single checkbox in the application privacy settings (or turned Platform off entirely), Facebook will allow your friends’ apps to access your most recent check-in locations by default.

Taking Control of Your Places Privacy

If you want to use the privacy controls that are available, here’s how to do so.

Adjusting Check-In Visibility, Turning “Friend Check-Ins” and “Here Now” Off

1. Go to your privacy settings page and select “customize settings.”
2. Adjust your settings:
   1. To adjust who can see your check-ins, use the pulldown next to “Places I Check-In.”
   2. To disallow friend check-ins, disable the "Friends Can Check Me In To Places" option.
   3. To disable Here Now, uncheck the “Include me in 'People Here Now' after I check in” box.

Preventing Your Friends’ Apps From Receiving Your Places Info

1. Go to your privacy settings page and select “edit my settings” under the “Applications and Websites” title.
2. Select “edit settings” next to “info available through my friends.”
3. Uncheck the "Places I've Been" box.

Telling Facebook To Do a Privacy Check-In

Of course, you shouldn’t have to do all of this to protect your own privacy. Instead, Facebook should make sure that your information is under your control, that you can choose who can check you in, who can see when you’re “Here Now,” whether your check-ins are permanent, and whether apps can see your last check-in.

So please sign our petition and continue working with us to tell Facebook to give you full control over the information you share using Places and other Facebook services. We’ve seen progress thus far, and Places certainly isn’t as bad as some releases, but there’s still more we can do together to protect our own information and Demand Our dotRights!