Commissioner’s Findings - PIPEDA Case Summary #2009-008: Report of Findings: CIPPIC v. Facebook Inc.

1. 1Whether requiring date of birth as a condition of registration contravened Principle 4.3.3
2. 2Whether Facebook adequately explained the purposes for collecting and using date of birth under Principle 4.3.2
3. 3Whether default privacy settings constituted improper opt-out consent for sensitive information under Principle 4.3.6
4. 4Whether Facebook made reasonable efforts to advise users of purposes and extent of information use/disclosure via default settings under Principles 4.2.3 and 4.3.2
5. 5Whether default settings for photo albums met users' reasonable expectations under Principle 4.3.5
6. 6Whether default settings for public search listings met users' reasonable expectations under Principle 4.3.5
7. 7Whether Facebook made reasonable efforts to notify users of advertising purposes under Principle 4.3.2
8. 8Whether Social Ads improperly used opt-out consent for sensitive information under Principle 4.3.6
9. 9Whether users could opt out of Facebook Ads under Principle 4.3.8
10. 10Whether requiring consent to Facebook Ads as a condition of service violated Principle 4.3.3
11. 11Whether Facebook adequately informed users of the purpose for disclosing personal information to third-party application developers under Principles 4.2.2 and 4.2.5
12. 12Whether Facebook provided third-party application developers with access to personal information beyond what was necessary under Principle 4.4.1
13. 13Whether Facebook required consent to disclosure beyond what was necessary to run an application under Principle 4.3.3
14. 14Whether Facebook adequately safeguarded personal information transferred to third-party applications under Principle 4.7
15. 15Whether Facebook obtained meaningful consent for disclosure of personal information to application developers when users or their friends added applications under Principles 4.2, 4.2.3, 4.3.2, 4.3.4, 4.3.5, 4.3.6, and subsection 5(3)
16. 16Whether Facebook failed to notify users of new purposes for collecting, using, or disclosing personal information under Principle 4.2.4
17. 17Whether Facebook failed to provide specific information and obtain meaningful consent for collecting personal information from sources outside Facebook under Principle 4.3
18. 18Whether Facebook inappropriately deprived users of a means to delete all personal information from the site
19. 19Whether Facebook's indefinite retention of personal information in deactivated accounts contravened Principles 4.5 and 4.5.3
20. 20Whether Facebook obtained meaningful consent for memorializing deceased users' profiles under Principle 4.3.3
21. 21Whether memorializing profiles was an unnecessary condition of service under Principle 4.3.3
22. 22Whether Facebook adequately informed users of its practice of account memorialization under Principles 4.2.1, 4.2.3, 4.3.2, and 4.8
23. 23Whether Facebook obtained consent from non-users for uploading their personal information (e.g., tagging, invitations) under Principle 4.3
24. 24Whether Facebook's retention of non-users' email addresses beyond the initial purpose contravened Principle 4.5
25. 25Whether Facebook Mobile's use of a persistent cookie constituted inadequate safeguarding of personal information under Principles 4.7, 4.7.1, and 4.7.3
26. 26Whether Facebook adequately informed users of its practice of monitoring for anomalous activity under Principle 4.8
27. 27Whether Facebook misrepresented its purpose or users' control over personal information under Principles 4.3.2 and 4.4.2

• New uses of information: Allegation not well-founded
• Collection from other sources: Allegation not well-founded
• Facebook Mobile safeguards: Allegation not well-founded
• Deception: Allegation not well-founded
• Date of birth collection: Allegation well-founded and resolved
• Default privacy settings: Allegation well-founded and resolved
• Advertising practices: Allegation well-founded and resolved
• Monitoring for anomalous activity: Allegation well-founded and resolved
• Third-party applications: Allegation well-founded but unresolved
• Retention of deactivated account data: Allegation well-founded but unresolved
• Deceased users' accounts: Allegation well-founded but unresolved
• Non-users' personal information: Allegation well-founded but unresolved

For third-party applications, the Commissioner recommended Facebook implement technological measures to limit developer access to only necessary user information, inform users of specific data requirements and purposes, seek express consent for developer access, and prohibit disclosure of personal information for users not adding an application. For account deactivation, Facebook was asked to develop and inform users of a retention policy for deactivated accounts after a reasonable time. For deceased users, Facebook was urged to include an explanation of memorialization practices in its Privacy Policy. For non-users, Facebook was asked to improve its invitation feature to address knowledge and consent issues for email collection/retention and set a reasonable time limit for retaining non-users' email addresses.

• s.5(3) PIPEDA
• Principle 4.1.4(d) PIPEDA
• Principle 4.2.1 PIPEDA
• Principle 4.2.2 PIPEDA
• Principle 4.2.3 PIPEDA
• Principle 4.2.4 PIPEDA
• Principle 4.2.5 PIPEDA
• Principle 4.3 PIPEDA
• Principle 4.3.2 PIPEDA
• Principle 4.3.3 PIPEDA
• Principle 4.3.4 PIPEDA
• Principle 4.3.5 PIPEDA
• Principle 4.3.6 PIPEDA
• Principle 4.3.8 PIPEDA
• Principle 4.4.1 PIPEDA
• Principle 4.4.2 PIPEDA
• Principle 4.5 PIPEDA
• Principle 4.5.2 PIPEDA
• Principle 4.5.3 PIPEDA
• Principle 4.7 PIPEDA
• Principle 4.7.1 PIPEDA
• Principle 4.7.3 PIPEDA
• Principle 4.8 PIPEDA