Is MySpace data availability truly more open?

In the post MySpace Opens Up The Data Pipe With Full Launch Of Data Availability, Arrington praised MySpace on fully launching data availability

MySpace is taking a much more interesting approach than Google, which controls data sent to third party sites via an iframe. MySpace is actually streaming data to these sites, which allows for true integration between the services, not just a bolted-on social tool.

My initial reaction is awesome, now I (as a 3rd party service provider) can consume the open user data but reading further into the article

Since actual data is being streamed out of MySpace, they have a strict terms of use policy that forbids third party sites from storing or caching the data, other than the unique MySpace user id of the user. Each time a page is rendered the third party must re-request the data from MySpace via a set of APIs. That means any changes by the user to their MySpace profile data or friends list will be instantly applied across third parties who access the data.

So basically MySpace TOS forbids me to do anything more than what is currently allowed by Google Friend Connect. Granted that there is a technical difference between the two, Google Friend Connect uses an iframe and MySpace actually lets the data out, there is no inherent difference in the 3rd party service provider ability to consume the data. In fact I would argue that it is more work for the 3rd party service provider to provide a UI page to render the data rather than just sticking in an iframe and letting Google do the heavy lifting.

Saying that MySpace’s data availability solution solves the problem of constant syncing of data so that the users remain in control is like Facebook saying that they are blocking Google Friend Connect due to user privacy concerns. IMHO the real reason is to maintain control and quoting the user privacy concern is merely a convenient PR front for both companies. I am surprised that Arrington is buying into MySpace’s PR spiel especially since he called Facebook on their user privacy concern blocking Google Friend Connect.

Time to define open privacy standards?

Today, I came across this post “Are shoeboxes better than Flickr?” and it got me wondering (again) whether it is time to define open privacy standards much like OpenID did for identity and OAuth did for authentication / authorization.

I come across such privacy discussions frequently but nowhere have I seen any consensus on privacy standards other than broad sweeping statements or wishes such as (quoting from the above article)

I have a policy which I assert over my stuff that I control, which is this protected zone in the cloud. And I have some real control over how I define policies over that thing and who gets access to it and on what terms. And I get to audit that access in a coherent way.

As I said in a comment on the above post, this is a loaded statement or perhaps the devil is in the details. It’s not like people haven’t tried, I know for a fact that there were several such discussions at dataportability.org that never reached any consensus (check out the policy group threads), plus numerous posts by Michael Arrington, Robert Scoble, Marc Canter, Steve Gillmor, etc. My personal take on it “user privacy is a personal and individual thing and is also dependent on the context of usage“. I attempted to define some levels of privacy controls that make sense but it is far from complete. Marc Canter has a similar idea and calls it dynamic privacy.

I understand that this is a difficult area to tackle but I think it is time to define open privacy standards much like the approach taken by OpenID and OAuth. Let’s start with something small and tangible for 1.0 version and build on it based on real-world usage on what works and what doesn’t work, essentially going it the agile way.

My data and having it my way

Quoting Burger King slogan “having it my way”, last week was a flurry of announcements, arguments, and personality clashes among tech pundits discussing, or rather arguing, the implications of user privacy following announcements from 3 big companies, MySpace, Google, Facebook, each announcing remarkably similar data portability features. I won’t belabor the details of each announcement because they have been covered in great details.

A controversial thing that came out of the announcements is Facebook blocking access to its users data from Google Friend Connect. The official reason cited by Facebook is that Google Friend Connect violated their TOS with regards to respecting their users privacy. IMO the real reason, as pointed out by several tech pundits already, is that Facebook wanted to continue to wall in their users data while conveniently citing the TOS privacy concern as the reason to block access.

What transpired afterward is even more controversial as several tech pundits, Steve Gillmor, Sam Whitmore, Marc Canter, Dana Gardner, Mike Arrington, Mike Vizard, Robert Scoble, self-invited guest Chris Saad (Gillmor’s words, not mine), weighed in about user privacy in general, and really ripped into each other at a Gillmore Gang conference call. You can read related posts on the subject at

• Battle Over Data Ownership on Gillmor Gang, Michael Arrington
• Facebook has a point where it comes to your privacy, Robert Scoble
• How SHOULD dynamic privacy work?, Marc Canter

Arrington and Scoble duked it out here Data Portability: It’s The New Walled Garden and later on in the Gillmor Gang conference call. I have also seen similar mulitiple discussions raised at DataPortability.org without any conclusion.

Details notwithstanding, I had a epiphany about user privacy while trying to sort through the numerous and different opinions about what constitutes right and wrong user privacy controls. It dawned on me that user privacy is a personal and individual thing and is also dependent on the context of usage. IMO, this means no one can or should tell me what I consider private or not. Hence it is not meaningful to define a universal bill of rights for user privacy that works for everyone.

Let’s take the hotly debated example between Scoble and Arrington. Arrington’s position is that his data is his data and he should have the ultimate control over how that data is used which includes the ability to stop someone like Scoble with whom he has shared his email with to not use it on 3rd party services like Plaxo without Arrington’s explicit permission. Scoble’s counter argument is that once Arrington shares his email that he has given implicit permission for Scoble to use it elsewhere. He cited the examples of adding Arrington’s email to his Gmail and Yahoo mail accounts so he can email Arrington from either email account and Arrington has no issue with that. However, Arrington has an issue if Scoble wanted to expose Arrington’s email to a 3rd party service like Plaxo which according to Arrington has a tendency to spam people. If Scoble doesn’t care that Arrington use his email on Plaxo, then that’s Scoble’s right to not care, but if Arrington has an issue with Scoble using his email on Plaxo, then that’s Arrington right to care. Note that Arrington’s reaction is context based because he has no problem with Scoble adding his email to Gmail and Yahoo accounts, which brings me back to my point about user privacy being a personal and individual thing and is also dependent on the context of usage.

So how does this translate to implementing the right user privacy controls. IMO, a service should implement privacy controls ranging from air tight to I honestly don’t care who sees and uses my data along with a set of sensible defaults, e.g.,

1. I am a private person and I want to explicitly approve every use of my data, WARNING: this might result in excessive permission requests but it’s what you asked for, think Microsoft Vista User Account Control feature.
2. I am ok with sharing some but not all of my data with my friends and the world. Here’s where the sensible defaults come in, the challenge is to define a set of sensible defaults that makes sense for a particular service but needs to be contextual aware or requires contextual approval.
3. I love attention and frankly don’t care who sees and uses my data. WARNING: you might regret this later on when you run for the post of US President or mayor when there are bikini pictures of you on the web but that’s a risk you accept.

I suspect most users will pick option 2, and that’s where the real fun begins, defining sensible defaults for each service while allowing for contextual awareness or approval. It’s interesting to note that in his post on How SHOULD dynamic privacy work?, Marc Canter also mentioned the need for privacy controls to be contextual aware although his example is different than mine. I like my example better =)

Disclaimer
The above perspective is offered purely, and selfishly, from a user’s point of view without consideration for why big companies like MySpace or Facebook would want to provide free service and making their users data fully portable, hence loosing a competitive advantage. Does a service have a right to users data for providing free service in return, I think so. However, if the industry mindshare is moving towards making data portable, big companies are forced to go along so they don’t get left behind and that is exactly what Google, MySpace, Microsoft, and Facebook did though with varying degrees of data portability but it’s a good start.

One last thought, I believe it is Gillmor that posed this argument, when you sign up for a free service and agrees to their TOS, you have agreed to the terms that they laid out regarding usage of your data, so it’s a done deal and you have to abide by the terms you agreed to. First off, to be realistic, very few people read TOS in its entirety, if you do, you are in the minority. As they say, the devil is in the details which you unwittingly agreed to without reading in full because TOS are designed to be purposely mind numbingly boring and unnecessarily long to discourage a user from reading it in full and providing CYA coverage. And even if you read it in full, it’s not easy to decipher the legal jargon thrown in for further confusion. IMO, while this is technically a correct argument, it is not an effective argument.