Facebook apologizes for glitch in privacy of posts

Facebook apologized Thursday for a bug in its system that caused the public sharing of the posts of 14 million people who thought they were making private updates.

The company said the mistake happened as it worked to redesign how it displays parts of user profiles that are always public.

Facebook posts are public by default for new accounts, but every Facebook user can limit who sees each post by using what the company calls an “audience selector.” Users also can make new posts visible only to friends or sub-groups of friends, for example, by altering this default through their privacy settings.

However, for four days in May, the bug ignored user preferences and set the default audience for all new posts to “public,” the company said. Facebook stopped the bug on May 22, but it did not restore the proper privacy settings to all posts until May 27.

The problem did not change who could see older posts, Facebook chief privacy offer Erin Egan said in a statement.

Users could have changed the individual audience setting on posts, but they would have had to notice that the setting was different from what they had chosen.

Facebook began notifying those affected Thursday.

Jonathan Mayer, a professor of computer science and public affairs at Princeton University, said on Twitter that this latest privacy gaffe by Facebook “looks like a viable Federal Trade Commission/state attorney general deception case.” That’s because the company had promised that the setting users set in their most recent privacy preferences would be maintained for future posts. In this case, this did not happen for several days. Facebook’s 2011 consent decree with the FTC calls for the company to get “express consent” from users before sharing their information beyond what they established in their privacy settings. Even if the bug was an accident on Facebook’s part, Mayer said in an email that the FTC can bring enforcement action for privacy mistakes.