Facebook and Your User ID Explained

Facebook blew it when it comes to handling your identity and now it’s trying to save face. It already outlined how it is coming down hard on app developers that sold personally-identifying information to data brokers. For that offence it nailed developers who knowingly passed along User IDs with a six month suspension. But the site also announced several policy changes and clarifications on what will happen to User IDs that were already shared.

Here’s a rundown of how Facebook’s dealing with the situation:

Facebook Ad Networks Must Delete User IDs

In a blog post, Facebook developer Mike Vernal said the site will not allow ad networks to continue operating on Facebook Platform unless they delete all User IDs, regardless of how they were obtained. The idea, I’m guessing, is that advertising on Facebook is more valuable than having personally-identifiable information on file. Vernal doesn’t explain how Facebook will verify deletion.

User IDs Must Stay in the App

While app developers were previously not allowed to share User IDs with advertisers or data firms, Facebook is changing its policy to say that User IDs may not leave the app at all. Because apps may still want unique identifiers to share with permitted outside parties, such as advertisers or content partners, Facebook is creating a way to share an anonymous alternative to the User ID, to be released next week. It’ll be required for all apps starting January 1, 2011.

RapLeaf is Out

Facebook “reached an agreement” with RapLeaf, one of the data brokers called out in the Wall Street Journal’s original article on User ID sharing, Vernal said. RapLeaf, which created detailed profiles on people from Facebook and other Web sources, will delete all User IDs and won’t operate on Facebook Platform anymore. It’s not clear what RapLeaf gets in return, if anything.

No Private Data Changed Hands

Vernal emphasized that no private Facebook data was accessed as a result of User ID sharing with advertisers. We already knew this — User IDs allow access to the public parts of a profile, including names and any other information shared with “everyone” — but the assurance is somewhat comforting.