Facebook, Inc. 41%

OVERALL – 41%

Facebook, Inc. placed sixth out of eight Internet companies in its overall score. The company’s performance across all categories suffered because its disclosure sometimes did not include Instagram. Disclosure by and about WhatsApp was markedly less and of poorer quality than disclosure pertaining to its namesake service, the Facebook social network. If the company Facebook, Inc. had been evaluated on the strength of its policies and commitments pertaining to the Facebook service alone, its total score would have been substantially higher. Facebook, Inc. acquired Instagram in 2012 and WhatsApp in 2014. The Index methodology holds a corporation responsible for the policies and practices of a new service, subsidiary, or acquisition after an initial six-month period. Given the growing use of Instagram (400 million users) and WhatsApp (900 million users) around the world, Facebook, Inc. should be held fully responsible for whether – and the extent to which – Instagram and WhatsApp demonstrate respect for users’ freedom of expression and privacy.

COMMITMENT – 62%

Even while losing points due to WhatsApp, Facebook Inc.’s disclosure about its commitments, and efforts to implement them, earned the company fourth place in this category, at it was more than twenty percentage points ahead of the next company, Kakao. Facebook, Inc. joined the Global Network Initiative (GNI) in 2013. Its disclosures related to human rights impact assessment (C4) were minimal; after the company completes its first round of assessment as a new member of the GNI, the company’s score will likely rise in the direction of the GNI’s founding companies.

Facebook Inc. has no evidence of board-level oversight for issues relating to freedom of expression and privacy, and the company’s public disclosure offers no information on whether executive and management oversight has been extended to WhatsApp (C2). The company offers little in the way of public disclosure about grievance and remedy mechanisms (C6) for users who believe their freedom of expression or privacy rights were infringed in connection with the company’s business.

FREEDOM OF EXPRESSION – 35%

Facebook, Inc. came sixth out of eight Internet companies on Freedom of Expression, and its score was almost half of the highest score in this category. In some cases, the company’s score was dragged down by lack of disclosure and poorer-quality policies of Instagram and Whatsapp. In one case however the reverse was true: On disclosure about identity policy (F11), the Facebook service scored zero points because it can require users to verify their identity, either with government-issued identification or other forms of ID connected to offline identity. WhatsApp and Instagram earned full credit on this indicator because they do not require the same sort of ID checks.

Transparency about requests for content restriction: Facebook, Inc. earned high marks for clearly disclosing what types of content or activities it does not permit and how it enforces its rules (F3). However the company did much worse on disclosure about the circumstances under which it may restrict or deny users from accessing the service (F4). Among Internet companies that publish transparency reports about government requests to restrict content or access to the service (F7), Facebook’s disclosure is the least comprehensive and also fails to clarify whether it includes services other than the Facebook service. It provides no data about any type of private requests – from people or entities not acting under official government auspices – to remove or restrict content (F8).

Enforcement of terms of service: The company provides no information about the volume and nature of content that it restricts or removes in the course of enforcing its terms of service (F9). No company in the Index received credit on this indicator. Facebook, Inc. representatives made clear to our research team that, in their opinion, this type of disclosure would be neither meaningful nor helpful to users’ freedom of expression.

PRIVACY – 36%

Facebook, Inc’s privacy-related disclosures and policies lagged behind all of its peers examined in the Index – except for Tencent and Mail.ru, whom it surpassed by a large margin. Similar to the company’s performance in other categories, privacy-related policies for WhatsApp and Instagram were incomplete or non-existent compared to disclosure for the Facebook service.

Handling of user information: Facebook, Inc. does a better job than the other U.S.-based Internet companies on disclosures about the collection of user information (P3) although it lags behind Kakao. The company’s disclosure about collection of user information from third parties (P8) was especially poor, and like most companies, Facebook, Inc. ignores the “Do Not Track” standard that allows users to opt-out of certain types of web tracking. While the Facebook service provides users with some options to control the company’s sharing of their information (P5), there was insufficient evidence that WhatsApp and Instagram offer similar options. The company’s disclosures about if and why it shares user information with third parties (P4) were in the middle of a group that generally needs improvement. Disclosure about retention of user information (P7) was much better for the Facebook service than for Instagram and WhatsApp, though the Facebook service still only received partial credit. Similarly, while the Facebook service earned full points for enabling users to view the information it holds about them (P6), WhatsApp and Instagram offered less to no information, respectively.

Transparency about requests for user data: Transparency reporting on third-party requests for user data (P11) was fairly strong for the Facebook service, but the company’s disclosure provided no information as to whether Instagram and WhatsApp were included. While a company representative told our research team in private communications that the company’s transparency reporting includes Instagram, that information is not available to users who lack personal connections to company staff and therefore does not meet the requirements for credit, according to the Index methodology.

Security: On security practices (P12) the Facebook service received a high (though not perfect) score, but there was little disclosure for the other services. The company received no credit on encryption of private user content (P13) because users of the Facebook service and Instagram cannot encrypt their private messages. Also, while WhatsApp states that, “WhatsApp communication between your phone and our server is encrypted,” the service provides insufficient detail to determine whether user content is encrypted in a way that the company has no access. Although the score for this indicator is based on company disclosure, it is worth noting that Open Whisper Systems, which has partnered with WhatsApp, states, “The WhatsApp Android client does not yet support encrypted messaging for group chat or media messages,” suggesting that encryption is not available throughout the service. Likewise, we found no information about encryption on other platforms such as iOS and Windows Phone. Finally, while the Facebook service has taken steps to educate users about security threats (P14), Instagram’s weaker disclosure and WhatsApp’s lack of disclosure dragged down the company’s score on this indicator.