Internet.org Could Be a Privacy Nightmare

With Internet.org, Facebook is bringing a stripped-down version of the internet to people who can't afford to access it otherwise. The program is also set to bring the first privacy nightmare to the other side of the digital divide.

Internet.org is positioned as a Facebook-led partnership between the company, telecom companies, and service providers, that will provide free internet services to people in developing nations. Despite Facebook's ostensibly noble goals, the platform has faced intense criticism in India, where local Internet.org partner organizations have dropped out over concerns that Facebook is undermining net neutrality in the country by acting as a corporate intermediary for what people see on the internet and hand-selecting services like news, weather forecasts, and job postings—and, of course, Facebook.

Today, Facebook announced that anyone who wants their site to appear on Internet.org can apply to have it included in the free offering, although the company will ultimately have to approve anything that makes it on to Internet.org. Despite these changes, one point about Internet.org remains troubling: its privacy implications.

According to the program's data policy, "[Facebook collects] information when you install, run or use any of our services, including the free websites and services provided through Internet.org." This information includes IP addresses, web services accessed, phone numbers, and more. When Internet.org users try to access a website or service, Facebook will also "modify the request and route it through our servers," which means that users won't pay for their data, but Facebook will also get a huge amount of insight into users' online activity.

Since Internet.org is governed by Facebook's general data policy for its services, this data could be shared with advertisers and the company's many partner organizations.

"However they may want to present Internet.org, Facebook are not in the business of philanthropy, they're in the business of making money," Paul Bernal, a professor of technology law at the University of East Anglia, told me in an email. "With Internet.org that means two things: capturing a market, then using that market. They want people to be hooked in, and then their data is, effectively, controlled by Facebook. In the current era, if you can control someone's data, you have a huge amount of control over them."

Keep in mind that all of this will be foisted upon people who may be using the internet for the very first time, and hence not well versed in the nuances and nonsense of the average end user license agreement.

"What's more," Bernal added, "they regularly change those data policies—so if the only way to get access to the net for people is via Internet.org then they're at the mercy of whatever changes Facebook brings along."

Bernal's concerns with Facebook essentially tapping a captive market of users are shared by the organizations that have decided to renege on their Internet.org partnerships, like Cleartrip, an online travel planning service, which described its leaving as "[drawing] a line in the sand" in a tweet.

According to a statement from the company, the decision was based on reconsidering the idea of "large corporations getting involved with picking and choosing who gets access to what" in terms of the services provided by Internet.org.

The next part of the problem, as Bernal indicated, is what Facebook plans to do with the data it culls from its captive market of people too poor or otherwise underserved to access the internet—that is, gather data from people who really have no other choice but to offer themselves up to Facebook in exchange for a highly delineated internet experience.

Perhaps unsurprisingly, in an interview with the Hindustan Times, an Indian news outlet, Internet.org's Vice President of Product Chris Daniels seemed baffled by the barbed reception it's received in the country. After explaining that data pulled from Internet.org users would be governed by Facebook's standard data policies, he said of the cold welcome, "I honestly don't know why partners would call Facebook or this program evil. Our intentions are good."

Facebook did not immediately respond to Motherboard's request for comment.

"I'm not sure if Chris Daniels thinks it is reassuring that the data would be governed by their data policies," Bernal wrote. "Facebook's privacy policies over the years have been something to cause worry, not reassurance."

UPDATE: Facebook has reached out to Motherboard with a comment that clarifies how Facebook's data policies apply to the data gathered by Internet.org. Facebook does not supply Internet.org data to advertisers. The headline and article have been changed to reflect this. Facebook's statement is below.

"Facebook may share aggregated and anonymous information around daily/monthly active users, and average daily page views with content partners so that they can track the levels of adoption of their services by Internet.org users. This helps Facebook and content partners work together to improve the experience. We may share your phone number, which your mobile operator already has, so we can track the success of the program in on-boarding new people to become paying internet users. We use information to understand what apps are popular which helps us determine what types of services to launch in other countries."