[BRIEF NOTE] Another RapLeaf post

[rfmcdonald]

As another Stefanie Olsen article details, the story just gets worse.

Despite the swift changes, privacy experts still say Rapleaf may be breaching the privacy of people using social networks like MySpace.com and Facebook, among the other social networks to which it links. Rapleaf lets you retrieve the name, age and social-network affiliations of anyone, as long as you have his or her e-mail address. But what the company does not disclose are the details on how it obtains people's ties to social networks through their e-mail addresses--a nifty feat considering social networks typically don't publish members' e-mail addresses.

Because of this, some people believe Rapleaf's practices may be violating the terms of service of MySpace and Facebook by linking to people's profile pages and scraping data from the sites for commercial purposes.

"It seems to undermine the whole social-network model, where small communities are formed within the larger online world. Users typically decide who to 'friend' and who not to friend. But if companies have found a way to scarf up e-mail addresses and affiliations, then that's serious and the Federal Trade Commission should investigate," said Marc Rotenberg, executive director at the Electronic Privacy Information Center, a nonprofit privacy advocacy group.

"Basic privacy rules would require Rapleaf to allow individuals to inspect and correct personally identifiable data that Rapleaf collects," Rotenberg added. "And basic ownership rules suggest that individuals are entitled to any profits that might result from the sale of their data."

In a post at the RapLeaf blog, a back-handed apology was issued ("Start-ups, privacy, and being wrong")

Last week we also made a decision to send the “you’ve been searched” emails to people that were searched for in Upscoop, a service we run that allows you to upload all your friends and find out what social networks they are on. In retrospect, this was really stupid and very wrong for doing this without any controls. Very very wrong. But at the time, it seemed like a really good idea for some reason. The problem is many people who use Upscoop were unaware that their contacts would receive a courtesy email.

Again, we were wrong. Now we iterate. And we ask for forgiveness.

We stopped sending the Upscoop been-searched emails yesterday. If we decide to re-enact this, we will likely give our users the ability to opt-out of sending email to their contacts. In addition, we will likely not send more than one “been-searched” email to someone more than once a quarter.

A few people also asked us to stop sending the been-searched emails on Rapleaf.com. We debated the merits of that request internally and came to the conclusion that this is a good feature (the vast majority of the feedback on this have been very positive). People should know if their information is available for others to see. But we’ll limit these emails to maximum of once a quarter.

Funny thing, at least according to nhw's account, even users of UpScoop hadn't been told that this could happen. But, as Olsen went on to say in her article, a bad reaction from Facebook and MySpace can be counted on.

Right now, Rapleaf has profiles on roughly 50 million people. According to the company's privacy policies, those profiles might include a person's age, birth date, physical address, alma mater, friends, political affiliations, and favorite books and music, as well as how long that person has been online, which social networks he frequents, and what applications he's downloaded.

In interviews this week and last, Hoffman said the company obtains data on people from Web sites including social networks, and soon, blogs. The company does not have partnerships with any social network, including MySpace and Facebook, to obtain member profile information, including e-mail addresses, he said. Rather, Rapleaf may use the e-mail search features at these social networks to find people's profiles. For other networks, the company uses "proprietary methods," he said.

But in a review of user agreements at various social networks, Rapleaf's business practices appear to violate the terms of service at MySpace and Facebook, among others.

[. . .]

Hoffman said he didn't believe his company's practices were in violation of these terms of service. He added that any search engine that indexes profile pages of MySpace or Facebook violates the user agreements of these sites. "Almost everything you do on these sites is against these terms of service because they're written in such a strict way," he said.

Lawsuits, anyone?