Facebook placed fourth out of 12 internet and mobile companies evaluated and fourth in the Index overall. Since it was first evaluated in the 2015 Index, Facebook clarified some of its Instagram and WhatsApp policies, thereby improving its scores. Specifically, Facebook’s most recent transparency report—which covered requests for content removal and requests for user data—clearly stated that the information applies to Facebook, Messenger, WhatsApp, and Instagram.
Despite some notable improvements, there are several areas where Facebook’s policy disclosure could be improved. Transparency about requests it receives to remove content or deactivate accounts was less comprehensive than its data on government requests for user information. Like many companies in the Index, Facebook did not disclose any data about the volume and nature of content it removes or accounts it restricts due to the enforcement of its own terms of service, nor did it disclose information about its policies for responding to possible data breaches.
Facebook, Inc. operates social networking platforms for users globally. Lead among these is the Facebook mobile app and website that enables people to connect and share; Messenger, a mobile-to-mobile messaging application; Instagram, a mobile photo and video sharing app; and WhatsApp Messenger, a cross-platform mobile messaging application. In addition to these platforms, it also provides tools to enable developers to create mobile and web applications that enable integration of external content into Facebook’s platforms.
Facebook tied with Vodafone for the second-highest score of all 22 companies evaluated in the Governance category, behind Microsoft and Yahoo. Facebook’s performance on governance indicators improved substantially since the 2015 edition of the Index. Facebook became a member of the Global Network Initiative (GNI) in 2013, and in 2016 the GNI completed its first independent assessment of the company, finding Facebook in compliance with GNI principles for how companies handle government demands affecting freedom of expression and privacy. Facebook provided evidence that the company’s senior leadership exercises oversight of issues related to freedom of expression and privacy, an improvement from 2015 (G2). Facebook’s disclosure related to its human rights due diligence also improved, as the company committed to conduct regular human rights impact assessments (G4).
Facebook ranked sixth out of 12 internet and mobile companies in the Freedom of Expression category, below almost all other U.S. companies.
Content and account restrictions: Facebook disclosed less than Kakao and Google about what types of content and activities are prohibited on its services, but more than all other internet and mobile companies evaluated (F3). However, it provided no data about the actions it takes to enforce its terms of service rules (F4). As with most companies evaluated, Facebook disclosed nothing about whether it grants government authorities or private parties priority consideration when flagging content for terms of service violations.
Content and account restriction requests: Facebook scored in the top half of internet and mobile companies on this set of indicators, though it offered less disclosure than Google, Yahoo, and Kakao (F5-F7). It offered some disclosure of its process for responding to government and private requests for content and account restrictions (F5). Its disclosure of data about the government requests it receives was less comprehensive (F6). It also provided little information about requests it receives from private parties to remove content or restrict accounts (F7).
Identity policy: WhatsApp and Instagram disclosed that users can register an account without verifying their identity with a government-issued ID; however, Facebook’s social network and Messenger app disclosed they may require users to do so (F11).
Facebook received the fifth-highest score out of 12 internet and mobile companies in the Privacy category.
Handling of user information: Facebook fell short of explaining how it handles user information, placing behind Twitter, Google, Microsoft, Yahoo, and Kakao on these indicators (P3-P9). While the company offered some disclosure about what types of user information it collects (P3), it revealed less about what it shares and with whom (P4), for what purpose (P5), and for how long it retains it (P6). Its disclosure of options users have to control the what information the company collects, retains, and uses was especially poor (P7).
Requests for user information: Facebook disclosed less than Microsoft, Twitter, and Google about how it processes and complies with government requests for user information (P10, P11). However, it received the second-highest score of internet and mobile companies, after Twitter, for its disclosure of data about requests for user information it receives from governments and other third parties (P11).
Security: Facebook disclosed less than many of its peers but more than Twitter about its security policies (P13-P18). It revealed little about its internal security oversight over its products and services (P13) and about user account security features and practices (P17). Facebook received higher than average marks for disclosure of its encryption policies (P16). For the Facebook social network, Facebook Messenger, and WhatsApp, the company clearly stated that the transmission of user communications is encrypted by default, and that it encrypts these transmissions using unique keys.
