[A]s researchers from the University of Virginia have detailed in a recent report, Facebook provides applications with access to far more private user information than they need to function. Adrienne Felt, a student and lead researcher on the project, told me that of the top 150 applications they examined in October 2007, "8.7 percent didn't need any information; 82 percent used public data (name, network, list of friends); and only 9.3 percent needed private information (e.g., birthday). Since all of the applications are given full access to private data, this means that 90.7 percent of applications are being given more privileges than they need."

But that's not the end of the problem. There's more:

Facebook's Web site and lengthy application terms of service curiously fail to mention something rather important. In addition to providing the application developer access to most of your private profile data, you also agree to allow the developer to see private data on all of your friends too.

Many Facebook users set their profiles to private, which stops anyone but their friends from seeing their profile details. This is a great privacy feature that can protect users from cyberstalkers and is completely gutted by the application system. To restate things--if you set your profile to private, and one of your friends adds an application, most of your profile information that is visible to your friend is also available to the application developer--even if you yourself have not installed the application.

The good news is that Facebook lets you configure the amount of your own private data that your friend's applications can see. The bad news is that it's hidden away, requiring several clicks through menus to find a page listing specific privacy settings (Privacy -> Applications -> Other Applications). Furthermore, the default values are extremely lax, such that a user who has yet to discover the preference page is essentially sharing her entire profile by default.

This friend data-sharing "feature," and the ability to protect against it, isn't mentioned anywhere else on Facebook's site, nor are users informed about it when they install an application.

Soghoian's story hasn't gained a lot of traction, and an outcry hasn't yet ensued over Facebook's policies for its applications. I was recently on a panel with Chris Kelly, Facebook's Chief Privacy Officer, at the Advisory Committee to the Congressional Internet Caucus's State of the Net Conference. The issue of applications didn't come up, so unfortunately, I didn't have the opportunity to speak with him about it. Facebook's general position on privacy seems to be that they are being transparent about the privacy risks their users are facing, that they offer their users a choice, and that when there's an outcry over privacy, they respond. All these things are true, but there are flaws in this approach.

First, the notice about privacy risks currently isn't effective. At the panel, I complained that privacy policies are woefully ineffective at informing consumers because nobody reads them. In a humorous moment, panelist and FTC Commissioner Jon Leibowitz, who uses Facebook, admitted that he hadn't yet read Facebook's privacy policy.

Second, the choice users have is often difficult to make, as Soghoian demonstrates in his article. Moreover, the choices consumers are given are often all-or-nothing, take-it-or-leave-it choices that encourage often ill-informed users not to opt out or to agree to use a feature such as an application. But for many users, they may prefer a better menu of choices, such as the ability to use an application but not surrender all of their personal information or that of their friends.

Third, I think that the better privacy strategy is for companies to think proactively about privacy, rather than to wait until the people are banging on the castle doors calling for the king's head. The older generation of Information Age companies -- Microsoft and ChoicePoint for example -- have learned from their privacy fiascoes and now are attempting to embrace privacy rather than resist it. But the newer generation of companies, such as Facebook and others, do not seem to have learned these lessons.