You have already opted in to Facebook’s facial recognition feature

News that Facebook has rolled out its facial recognition technology to users outside the United States caused considerable consternation. This facial recognition technology is being used to enhance Facebook’s photo tagging feature by enabling users to tag friends a couple times in photos and have the software find their friends elsewhere in other photos. According to the post titled “Making Photo Tagging Easier“:

Now if you upload pictures from your cousin’s wedding, we’ll group together pictures of the bride and suggest her name. Instead of typing her name 64 times, all you’ll need to do is click “Save” to tag all of your cousin’s pictures at once. By making tagging easier than before, you’re more likely to know right away when friends post photos. We notify you when you’re tagged, and you can untag yourself at any time. As always, only friends can tag each other in photos.

What this is all about?

Facebook commented that this technology works just like “many photo editing tools” like Google’s Picasa and Apple’s iPhoto except these applications run facial recognition software within the application itself and is used to tag users in albums. That facial recognition translates into face tags on Facebook when uploaded (in iPhoto’s case) or in Picasa Web Albums (in Picasa’s case). The Facebook option is a little different because it potentially spans all your friends’ albums and is not limited to your own albums, which would be the case in Picasa or iPhoto. The result is facial recognition which has much broader application and which could be applied to photos you simply would not want to be tagged in for various reasons.

As with products like Groups, Facebook elected to opt users in by default, while giving them an opt-out mechanism through their privacy settings (Sophos’ Naked Security blog has a great post which explains how to disable this function in your privacy settings). This means that the vast majority of Facebook’s 600+ million users will have this function enabled when it is rolled out to them. While most users won’t notice or be too concerned about it (a factor which Facebook seems to rely on as implicit assent to these sorts of moves), privacy advocates in both the United States and Europe (where the EU has launched a probe to assess Facebook’s compliance with privacy guidelines and laws in the EU) have expressed concern about the apparent opt-out paradigm which Facebook has gone with. This issue is somewhat more complicated than it appears.

Legal issues and considerations

An important question is whether this new functionality would pass muster under South African law? To answer that question we need to consider which laws apply to this sort of thing. The Electronic Communications and Transactions Act contains provisions in Chapter 8 which would have a bearing on Facebook’s new photo tagging feature. These provisions include requirements that users consent to collection and use of their personal information as well as certain use and disclosure requirements but compliance with these provisions is voluntary. The Consumer Protection Act has created considerable buzz about consumers’ privacy rights but these are in the context of direct marketing which doesn’t describe the Facebook photo tagging functions so the Consumer Protection Act may not be very useful here.

We are then forced to go back to the source of our right to privacy in South Africa, namely the Right to Privacy in the Bill of Rights which establishes a general Constitutional right to privacy. The right to privacy has been explored by our courts and is given substance by concepts like the legitimate expectations of privacy (I wrote about this is broad terms in this post). This principle begs the question whether allowing Facebook friends to use facial recognition software to enhance photo tagging would exceed our legitimate expectation of privacy? Its worth bearing in mind that photo tagging has been available for some time now and facial recognition is an enhancement of that feature. Whether users have a legitimate expectation that the association between photos of them and their identities not be made unless they specifically consent to those associations being made takes us to the Facebook privacy policy.

The Facebook contractual framework

I’ve mentioned before that the “subjective component [of a legitimate expectation of privacy] means that a person can’t have an expectation of privacy where that person has consented to have his or her privacy invaded”. By making use of Facebook, users’ necessarily and implicitly agree to the Facebook privacy policy by virtue of the Facebook Statement of Rights and Responsibilities and the Privacy Policy. The Statement of Rights and Responsibilities establishes the requirement for your agreement to the Privacy Policy as a condition for your Facebook use:

Date of Last Revision: October 4, 2010.

Statement of Rights and Responsibilities

This Statement of Rights and Responsibilities ("Statement") derives from the Facebook Principles, and governs our relationship with users and others who interact with Facebook. By using or accessing Facebook, you agree to this Statement.

  1. Privacy

    Your privacy is very important to us. We designed our Privacy Policy to make important disclosures about how you can use Facebook to share with others and how we collect and can use your content and information.  We encourage you to read the Privacy Policy, and to use it to help make informed decisions.


  2. Sharing Your Content and Information

    You own all of the content and information you post on Facebook, and you can control how it is shared through your privacy and application settings. In addition:

    1. For content that is covered by intellectual property rights, …
    2. When you delete IP content, …
    3. When you use an application, your content and information is shared with the application.  We require applications to respect your privacy, and your agreement with that application will control how the application can use, store, and transfer that content and information.  (To learn more about Platform, read our Privacy Policy and Platform Page.)
    4. When you publish content or information using the "everyone" setting, …
    5. We always appreciate your feedback or other suggestions about Facebook, but you understand that we may use them without any obligation to compensate you for them (just as you have no obligation to offer them).


The Privacy Policy gives your consent further substance:

To make suggestions.  We use your information, including the addresses you import through our contact importers, to make suggestions to you and other users on Facebook. For example, if another user imports the same email address as you do, we may suggest that you add each other as friends.  Similarly, if one of your friends uploads a picture of you, we may suggest that your friend tag you in the picture. We do this by comparing your friend’s pictures to information we’ve put together from the photos you’ve been tagged in.  We may also suggest that you use certain tools and features based on what your friends have used.  You can control whether we suggest that another user add you as a friend through your “search for you on Facebook” privacy setting. You can control whether we suggest that another user tag you in a photo by clicking customize from your privacy settings.

In a nutshell, you have already opted in to the new feature on the following basis:

  • You have to agree to Facebook’s Statement of Rights and Responsibilities and Privacy Policy as a condition for your Facebook use;
  • Between these two documents, Facebook has created a contractual framework which binds users to its current terms and ongoing amendments;
  • This contractual framework enables the new facial recognition enhanced photo tagging feature and, by virtue of your agreement to this contractual framework, you also consent to this feature subject to your ability to disable the feature in your privacy settings.

The Protection of Personal Information Bill currently includes a requirement that personal information like the association of a name with a face be collected directly from the “data subject” (in this case, the user being identified in the photo) although even this requirement is subject to an exception where the “data subject has consented to the collection of the information from another source”. Consenting to other users tagging you in photos would probably be covered by this exception.

What can you do?

Facebook image tagging

So where does this leave you? Well, Facebook has been pretty clear about your ability to change your privacy settings. The Privacy Policy contains this paragraph:

We give you tools to control how your information is shared with applications and websites that use Platform.  For example, you can block all platform applications and websites completely or block specific applications from accessing your information by visiting your Applications and Websites privacy setting or the specific  application’s “About” page.  You can also use your privacy settings to limit which of your information is available to “everyone”.

If you are concerned about the impact this facial recognition function will have on your privacy, take advantage of the controls in your privacy settings and change the defaults. Facebook takes advantage of the broad consents you give it to enable controversial features. It has been doing this for some time and will continue doing so. As users, the best thing you can do is to make use of the privacy settings Facebook makes available to adjust your privacy levels to a level of publicity you are comfortable with.

Published by Paul Jacobson

Enthusiast, writer, Happiness Engineer at @automattic. I take photos too. Passionate about my wife, Gina and #proudDad.

%d bloggers like this: