SAN FRANCISCO – The gargantuan amount of high-quality user data on Facebook is causing everyone–from marketers to hackers–to salivate like dogs gazing at a steak. They all want a piece of you.

Thanks to Facebook’s Open Graph API (which simplifies the development of third-party applications that interoperate with the social networking site) and social plug-ins (which essentially splash Facebook’s “Like” button all over the Internet), people who are interested in your data are getting a chance at a much choicer cut of it. (For more, read “How Facebook Plans to Dominate the Web.”)

Additionally, Facebook’s Instant Personalization Pilot Program, which the social network introduced this spring, was the wake-up call for many users who had been ignoring the concerns of privacy watchdogs. In response, Facebook updated its privacy settings in late May, to some praise–and confusion.

Read on to see who’s getting a look at what you do on Facebook. You’re sharing more than you think–and you might be surprised at what your data is worth.

Facebook Itself

It goes without saying that Facebook has unrestricted access to everything you do relating to its site, and its growing collection of profile data, preferences, and connections is prompting some experts to estimate the value of the site beyond the GDP of some countries.

For instance, a Mashable article reported that SharesPost, a marketplace for shares in privately owned companies, suggested an $11.5 billion value for Facebook, versus a $1.4 billion value for Twitter and a $1.3 billion value for LinkedIn.

“You’ve filled out the biggest survey in the world for Facebook, and you didn’t even know it,” says Cappy Popp, founder and principal of Thought Labs, whose Doorbell application is one of the top 100 most-used apps on Facebook. “You can’t put a price on it because there’s never been anything like it,” Popp says of the user data that Facebook could accumulate over the next few years.

Everyone Else

A quick look through the Website Openbook, which allows users to search for embarrassing Facebook status updates that anyone can view, shows the volume of people whose accounts are set to broadcast status updates to everyone. Some Facebook status updates reveal far too much.

For instance, a search for “cocaine” or “drunk” in Openbook’s search field yields status updates such as “Cocaine is a man’s best friend” and “I’m so drunk right now need to go to bed.” (Note: Despite its resemblance, Openbook is not part of Facebook.)

Are these updates just jokes? Are they statements taken out of context? They could be either. But slapped next to a name, gender, and profile picture (information that Facebook requires to be public), they create an impression. And it could cost you.

Just ask Natalie Blanchard, who in November 2009 was fighting to have her health benefits reinstated by her employer’s insurance company. The Canadian woman was being treated for depression, but Manulife Financial questioned her health claim after seeing Facebook photos of Blanchard enjoying herself at a party and on the beach.

Facebook’s Instant Personalization Partners

One day in April, registered users of Pandora and Facebook launched their favorite online radio station on Pandora’s site and discovered that they could now see which of their Facebook friends liked the artists and songs they were hearing.

For that to happen, the users either purposely or accidentally passed by the opt-out bar for Facebook’s Instant Personalization Pilot Program, for which Pandora, Yelp, and Microsoft were launch partners. The same thing happened to readers of MSNBC, who were surprised to find information on stories recommended by their Facebook friends pop up on the news Website.

Instant Personalization allows selected Facebook partner Websites to access your data and tailor content to your tastes. With Instant Personalization activated, your Facebook information is available for access the moment you arrive on partner sites. When the program launched in April, Facebook automatically activated it for all users. However, a privacy uproar forced the company to revise its policy, and Instant Personalization is now optional for users.

“A number of people have reported to me that this feels a little weird to them,” says Kurt Opsahl, senior staff attorney for the Electronic Frontier Foundation, about Pandora’s Instant Personalization implementation. Pandora declined to be interviewed for this story.

How Instant Personalization Works

The implications of Instant Personalization are more serious than your discovering your boss’s love for ’80s boy bands. Partner sites can work with Facebook to learn a whole more about you than what you may have told them directly.

According to Peter Eckersley, senior staff technologist for the Electronic Frontier Foundation, the Instant Personalization partner sites use JavaScript code and Ajax calls to get personally identifying information about you from Facebook. So if you already had an account on the Instant Personalization partner site, that site can now see your Facebook information and your existing account information at the same time.

“[The Facebook partner sites] would see the usual cookie that they set in your browser, and the one that Facebook’s API constructs using Ajax, simultaneously,” says Eckersley. “The design of the Facebook API clearly anticipates that the Website will do this.”

Next: Why playing FarmVille may not be in your best interests.

Application Developers

Facebook applications are fun. According to All Facebook, which calls itself the “Unofficial Facebook Resource,” the site’s Facebook Application Leaderboard of applications with the highest monthly users shows that a variety of games–including Zynga’s FarmVille, Texas HoldEm Poker, and Café World–make up more than half of the top 20 applications.

However, fun comes at the cost of privacy.

Once you accept an application on Facebook, it gets an all-access pass to your profile data. The application runs through an iframe (inline frame), a widely used HTML element that lets a site embed its content onto Facebook’s site.

As a result, you’re sending data directly to the third-party application’s servers. Previously that server was required to refresh its Facebook data every 24 hours, but as of the April F8 conference, Facebook did away with that requirement. As a result, the outside parties can store user data for longer periods before refreshing it.
“You’ve authorized that application to do whatever it wants to do,” says Thought Labs’ Popp.

And even if you don’t use Facebook applications, your friends do.

Unless you’ve gone into the ‘info accessible though your friends’ portion of Facebook’s Applications, Games, and Websites privacy settings, your friends are taking your profile information with them on their farming and gambling adventures–without your knowledge, but in most cases with your tacit consent. (For some advice, read “Facebook’s Social Web: How to Protect Your Privacy.”)

Game applications are big business. For instance, FarmVille maker Zynga is reportedly valued at as much as $4 billion. Plus, Facebook just revamped its Insights dashboard, which page owners and application developers can use to obtain data and graphic visualizations about social plug-ins and integrated site content to better understand their return on investment for using Facebook.

Hackers and Worms

Right now it’s hard to know the worth of user data shared through Facebook’s Instant Personalization since the program is so new, but in the wrong hands such information could represent a large chunk of change.

A May article on TechCrunch reported a proof-of-concept exploit on Yelp that took advantage of cross-site scripting to grab Facebook addresses and other information. The exploit’s author was a security consultant looking to prove a point. Yelp, which declined to be interviewed for this story, patched the vulnerability. No user data was stolen.
But other, genuine security threats are thriving on Facebook. The Koobface worm has been lurking on Facebook since 2008, growing more sophisticated with its ability to create an account, friend strangers, and join groups.

And on Memorial Day weekend, hundreds of thousands of Facebook users encountered a clickjacking worm that duped them into “liking” pages that led to the installation of malware for perpetuating the worm’s spread.

“The biggest danger that I can see is that they get your log-in credentials,” says Beth Jones, senior threat researcher at Sophos Labs. The intruders can gain access to information such as mobile phone numbers, partial credit card numbers, and billing addresses stored in the Payments section of Facebook’s account settings.
“That’s where some of the true value of stealing these log-in details comes in,” says Jones. “[Attackers] can start pulling off some really decent identity theft.”

Identity theft can also occur when a snoop looks through Facebook profile data that privacy settings haven’t locked down. “Unfortunately a lot of password-reset questions are answered in your profile,” says the Electronic Frontier Foundation’s Opsahl.

So how much is your Facebook identity worth?

Researchers at VeriSign’s iDefense recently reported that a hacker named Kirllos claimed he had 1.5 million Facebook accounts for sale for a price of $20 to $45 per 1000 accounts, depending on the number of contacts. According to a New York Times story, Facebook said that its own investigation did not find the claim credible. Facebook did not answer an interview request for this article.

Marketers and Advertisers

Companies selling everything from online dating services to lattes are thrilled that they can direct their advertising to Facebook’s 400 million users through nine key demographic and psychographic filters.

“It offers the kind of targeting that marketers have been looking for for years,” says Debra Aho Williamson, senior analyst for eMarketer.

In January, Einstein Bros. Bagels ran a highly successful Facebook promotional campaign, offering new fans of its Facebook page a digital coupon for a free bagel and schmear. The company grew its fanbase from 7000 to 613,063 (as of this writing). In exchange for free food, Facebook users gave Einstein Bros. feedback on food preferences, stores, and who they are.

Reggie Bradford, CEO of social media management company Vitrue, calls Facebook pages a great way to get to know your fans. “There are features like polls, quizzes, or coupons; through those vehicles, you can collect all kinds of market research,” says Bradford.
But how much are people like those rabid bagel eaters worth?

To answer that question, Vitrue created the Social Page Evaluator tool, which attempts to quantify the return on investment for a Facebook page. The tool places a $3,227,020 value on the Einstein Bros. Bagels page based on the number of fans, the posted content on the page, and the interaction between the two. (Note: The dollar amount doesn’t correlate to real-world dollars, but instead serves mostly as a way to compare the “value” between pages. You can evaluate your own Facebook page.)
You could also say that Facebook users are worth the $605 million that eMarketer expects marketers to spend on worldwide Facebook advertising by the end of 2010. That’s up from $435 million in 2009. (eMarketer defines advertising as display, video, search, and other forms of advertising appearing within social network environments.)

“Quantifying the value of a Facebook fan is something we’re going to see a lot more of in the next year,” says eMarketer’s Williamson.

Despite waves of privacy backlash, Facebook continues to thrive and to look for new ways to make money for itself and its partners. To do that, Facebook will continue to leverage its biggest asset: you.

“Facebook is a business. I don’t think they have any ill will toward anyone, but they’re going to do anything they can as a corporation to be successful,” says Popp. “The onus of privacy is on the person using the Web.”

SAN FRANCISCO – Facebook recently made some significant changes to its privacy settings, but ten advocacy groups are want the social network to do more. The groups are asking for six additional privacy changes, ranging from providing a more secure user connection to the Facebook site, to giving you more control over how third-party apps access your data.

The requested privacy fixes were sent to Facebook CEO Mark Zuckerberg in an open letter signed by the American Civil Liberties Union of Northern California, Center for Democracy and Technology, Center for Digital Democracy, Consumer Action, Consumer Watchdog, Electronic Frontier Foundation, Electronic Privacy Information Center, Privacy Activism, Privacy Lives, and Privacy Rights Clearinghouse.

Here’s a breakdown of the new privacy requests.

App Gap

The ten groups are calling for Facebook to give you more control over which types of data a third-party application like Farmville or Quiz Monster can access. The biggest problem the groups see is that your publicly available information on Facebook can be fed to third parties whenever one of your Facebook friends signs up to use an application on Facebook.

While it’s true you can’t protect your basic information–such as your name, profile photo, gender, and networks–from third-party apps , you can control some of the information your friends can share about you.

To adjust your third-party privacy settings, go to Account>Privacy Settings> ‘Edit Settings’ (found under Applications and Websites) at the bottom of the privacy settings page. Then click on the Edit Settings tab next to ‘Info accessible through your friends’. This brings up a checklist that lets you block third-parties from accessing personal data like your bio, birthday, status updates, photos, and other information.

Instant Personalization

The adovcacy groups also ask Facebook to not automatically enroll users in the new Instant Personalization feature. Instant Personalization allows select partner Web sites, including Yelp, Pandora, and Microsoft Docs, to customize your site visits based on the information contained in your Facebook profile.

In fact, Instant Personalization switched to an opt-in program shortly after it launched, so users are no longer automatically enrolled in the program. If you want to check your Instant Personalization settings, go to Account>Privacy Settings> ‘Edit Settings’ (found under Applications and Websites) at the bottom of the privacy settings page. Then select the ‘Edit Settings’ button for Instant Personalization, scroll down to the bottom of the next page, and uncheck the Instant Personalization check box to block the feature.

Don’t Track Users

The advocacy groups say that Facebook is tracking the Web browsing activity of its users whenever they visit any site that has Facebook’s social plugins installed, such as the universal like button.

Even if you don’t click on the Facebook social plugin, the social network will still track you if you’re logged into Facebook, the letter claims. The groups call on Facebook to stop tracking people unless they interact with Facebook’s plugins and also calls on Facebook to make the logout button more prominent on a user’s Facebook homepage. Currently, the logout button is buried under the ‘Account’ drop down menu in the top left corner of your Facebook dashboard.

HTTPS, Full Control and Export Option

Facebook’s statement of Principles says users should “have the freedom to decide with whom they will share their information, and to set privacy controls to protect those choices.” In keeping with that statement, the advocacy groups are asking Facebook to allow users to lock down their profile data completely if they so choose. Currently, Facebook users have to make their profile photo, name, gender, and network affiliations public.

The groups also call on Facebook to provide a free export tool so you can easily take your data, such as your photos, with you if you choose to delete your Facebook account.

Finally, the groups call on Facebook to encrypt its user Web traffic through the HTTPS protocol, which is commonly used for online financial transactions. Earlier this year, Google made a similar move when it automatically used HTTPS when Gmail users login to their accounts.

It will be interesting to see how Facebook reacts to this open letter. When the social network announced its recent privacy changes in May, Zuckerberg said in a blog post that “the overhaul of Facebook’s privacy model” was complete. Considering the intense criticisms Facebook has already experienced over privacy, I’m not so sure the company is ready to revisit the issue yet again.

SAN FRANCISCO – For many of people, Facebook is the first stop in any Web surfing session. It has developed into a highly engaging combination of online bulletin board, personal scrapbook, and group communication network. But did you ever wonder why, being all those things, Facebook is free?

Well, it really isn’t. Facebook offers its service in exchange for the right to capture and collect mountains of demographic and preference data from its users (you mean they didn’t tell you that when you signed up?). That data can be extremely valuable to marketers and advertisers because it is highly detailed and personal.

Many Facebook observers believe that the company hopes eventually to license parts of its “social graph,” or profile information database, to external marketers and advertisers who might use it to target ads or other content to potential customers. But to be useful to marketers, the user data must be set to “public,” and Facebook has come under intense scrutiny over its handling of the privacy of its users’ data of late. In light of the current backlash, any quick moves by Facebook to monetize its user data could prove disastrous.
What will Facebook do?

Low-Hanging Fruit: Facebook’s Business Today

Today, Facebook is mainly an advertising platform. It sells ad space on its site, and it helps its advertisers aim their ads at specific groups of Facebook users, based on “public” elements of its members’ profile data. Facebook also takes in a small amount of money through revenue-sharing agreements with developers who offer apps on Facebook: Facebook hands over a certain amount of “public” profile data to the app makers, enabling them to personalize the experience of the app’s end users.

And that’s it.

Some observers, such as Tom Phillips, CEO of social marketing company Media6Degrees, believe that Facebook’s userbase is so massive, and its database of user data is so rich, that it can do good business simply by selling ad space and by hosting apps on its own platform. “With the amount of volume they have, they only have to do simple things,” Phillips says. “They can make enough money selling big marketers volume impressions online, by running ads at their own site based not on keywords but on the actual tastes and preferences of Facebook users.”
To be sure, Facebook has focused on increasing its membership, and it has been wildly successful on that score: the number of Facebook accounts is now nearing 500 million. So the sheer size of the Facebook audience is attractive to advertisers and app makers; and as a bonus, Facebook provides data tools to advertisers that help them make meaningful impressions on members of that audience.

But the company is deeply indebted to its venture capital backers, who, while already seeing dividends from Facebook’s current business, are looking forward to a big payday (investment plus return) at some visible point in the future. For now, Facebook’s investors are giving Zuckerberg and company plenty of time. People familiar with the situation say that you won’t see a Facebook IPO this year or next year, but you probably will see one in 2012.

Still, Facebook has already taken some bold steps in that direction, periodically marching out new features to capture more user data for its massive “social graph”–and trying to make as much of that data “public” as possible. That public data is what marketers use to ensure that they are knocking on the right doors (websites) with the right marketing messages (ads, usually) to sell products. But those same bold moves have earned it the ire of many critics concerned about the privacy of user data.
So the interesting question isn’t “How does Facebook make money right now?” but “How does Facebook intend to leverage its massive store of data to achieve full profit-making potential over the next two years?”

Stay the Course?

For the most part, Facebook has restricted its business partners to using the data it provides to approach users within Facebook. For example, Facebook gives onsite advertisers and app developers the advantage of its user data to help them target ads and customize the content in apps. Facebook does not directly charge those partners for the privilege, however. That could change.

According to Harvard Business School professor Ben Edelman, Facebook could stick with its current money-making model, but start charging for things that it does for free now. “Facebook may be using the old crack dealer model–the first puff is free,” Edelman says. After app developers and partner Websites get ‘hooked,’ Facebook could start charging for access to its user data, he says.

Edelman believes that many of Facebook’s current business partners would be happy to pay. “If American Airlines can afford to spend $100,000 to somebody to design their page, I imagine that they could afford to pay $10,000 a year to Facebook itself,” Edelman says.

Sitting on a Gold Mine?

To marketers, the Facebook data is potentially more valuable than the data collected by other massively popular sites, like Google. That’s because Facebook collects a rich set of personally identifiable information (PII) from its user profiles. The data contains not only the user’s demographic data, but also data about their online and offline likes and dislikes–and those of their friends. The personal and social detail of Facebook’s data could give marketers unprecedented power to find new customers.

A Facebook profile may contain your age, sex and location information. It might also know that you are an avid runner who attended a wine-tasting party last Tuesday night. It might even know for example, that you recently visited the Websites of MSNBC.com and MoveOn.org. A marketer such as Coca-Cola or Saturn or Nike, could compare this combination of demographic and preference data, and determine your similarity to people who have already bought their products.

But there’s more. Facebook also collects and makes “public” the list of people who are your Facebook friends. If a marketer is looking to reach people who have a good chance of going out and buying their product, they might naturally want to focus on people whose friends have already purchased that product, explains Tom Phillips of Media6Degrees.

That sort of “social marketing” is a much more fine-grained and effective way of targeting potential customers than relying on the traditional demographics approach (for example, “42-year-old men in Montana often buy Ford trucks”). The tastes and buying habits of your circle of friends, in other words, are much better predictors of what you are likely to buy, than are your age, sex, and location data.
Phillips’s company has made a business of finding (and scoring) similarities in the social data of different groups of people, yielding a “social graph” of preferences. Phillips says that one of his company’s clients might provide Media6Degrees with a list of its customers, and then ask Media6Degrees to find people with similar social graphs from within its database of roughly 20 million people, the assumption being that similar people with similar tastes are likely to buy similar things–that they share a “common brand affinity.”

But some Web marketers, including Media6Degrees, are steering clear of Facebook user data, fearing that using it could sweep them into the center of the current privacy firestorm alongside Facebook itself. Though Media6Degree’s success depends entirely on the breadth and depth of its database of (social) people, Phillips says that his company has no interest in adding Facebook’s data to its current collection. Why? Because Facebook’s massive database is full of PII, and the stigma associated with such data is so great right now that Media6Degrees might face a privacy backlash of its own if it added some of that content to its database.
Anonymous Social Marketing?

Critics have long suspected Facebook of harboring plans to sell or license big chunks of its social graph to large Web marketers, but to date, the company has not done so. Will it? Most observers think so. “I don’t think Facebook can get to where they want to be without doing that,” Harvard’s Edelman says. Facebook’s central challenge is to figure out a way to make money from its user data without further inflaming consumers, advocacy groups, and government bodies such as Congress and the FTC.

Eric Wheeler, CEO of 33Across, another Web marketing firm, says that his company routinely licenses user data from blog sites, social media sites, and app developers, but doesn’t collect the actual IP addresses, names, or e-mail addresses from those sites. “There is no PII; We don’t need it, so none of that ever touches our system,” Wheeler says. Instead, 33Across uses cookies. A company like Sprint (a 33Across client) might provide 33Across with a list of its current customers, and then ask 33Across to track the online social interactions that those customers have with others. If 33Across determines that a particular contact might be likely to buy a Sprint product, the firm drops a cookie into the contact’s browser so that a relevant Sprint ad can be served up there in the future.
Wheeler believes that Facebook, using its wealth of user data, could take a similar approach. Or Facebook could decouple its user data from its platform and license it to companies like 33Across (Wheeler says that he’d love to have access to Facebook’s data) or directly to large marketers like Nike, but in an anonymized form that contains no personally identifiable information.

Watching and Waiting

At the moment, Facebook is closely watching the privacy backlash and the debate that has been raging since the company’s last privacy settings overhaul in late April. The public outcry has prompted talk in Washington, D.C., about the need for a social networking privacy bill, as well as a Federal Trade Commission investigation into the data management practices of Facebook and Google.
Though Facebook has a habit of bulling forward with new programs–and asking for forgiveness afterward rather than for permission in advance–the company is unlikely to try to license large chunks of PII from its database to marketers anytime soon. The air around Facebook and its data is so highly charged right now that Zuckerberg and company have good reason to move cautiously in the near term.

If Facebook users suddenly began receiving direct-marketing come-ons based on personal information harvested from their Facebook profiles, the result could be a user revolt, followed by class-action lawsuits, followed by government intervention.

So Facebook watches and waits to see where the chips fall in the current policy debate over online privacy. It also awaits the fate of Rick Boucher’s bill in Congress, and the FTC’s conclusions about Facebook’s and Google’s business practices regarding privacy.
Much of the online advertising industry hopes to be free to regulate itself, unfettered by a rigid set of rules imposed by the Congress or the FTC.

Facebook’s earlier behavior has pushed the advertising and regulatory communities toward a showdown over privacy. After the dust settles and everyone–consumers, lawmakers, Web advertisers, and privacy groups–is heard, perhaps a set of rules will emerge by which Facebook can measure its moves and ambitions going forward. The company’s future depends on finding just the right balance between the privacy expectations of its users and the quality of the social marketing data it can serve to its business partners.