Privacy Progress Update
Table of Contents
How We Do It
“We realized we needed an order of magnitude greater investment in privacy—the summer of 2019 was that moment. The degree of change for Meta has been massive—it's required foundational changes to our people, processes, and technical infrastructure, and oversight and accountability. And we continue to invest in protecting people's data as systems, technology, and expectations evolve.”
– Michel Protti, Chief Privacy and Compliance Officer, Product
Governance
Privacy Product Groups
Product Risk & Compliance Organization
Led by Chief Privacy and Compliance Officer, Product, Michel Protti, the Product Risk & Compliance organization is made up of dozens of teams, both technical and non-technical, focused on guiding the company on privacy strategies.
The Product Risk & Compliance Organization is at the center of our company’s commitment to its comprehensive privacy program. Its mission—to instill responsible practices and enable innovation across Meta—guides this work by ensuring people understand and trust how Meta products and services use their data responsibly.
The Product Risk & Compliance Organization is just one organization among many across the company that is responsible for privacy. There are thousands of people in different organizations and roles across Meta, including public policy, legal and product teams, who are working to embed privacy, safety, security, and other areas of risk management, into all facets of our company operations. Getting privacy right is a deeply cross-functional effort, and we believe everyone at Meta is responsible for that effort.
Privacy and Data Policy
Led by Erin Egan, Vice President and Chief Privacy Officer, Policy, the Privacy and Data Policy team leads our engagement in the global public discussion around privacy, including new regulatory frameworks, and ensures that feedback from governments and experts around the world is considered in our product design and data use practices.
To do so, the Privacy and Data Policy team consults with these groups through a variety of consultation mechanisms. This includes:
- Ongoing consultations with experts as a part of our product development process, and to inform our long-term approach to privacy
- Workshops (including Data Dialogues) and other convenings on complex privacy questions
- Funding experts to do "deep dive" consultations with us on how we can improve aspects of our privacy program
- Supporting cross-industry initiatives like Trust, Transparency and Control Labs (TTC Labs) and Open Loop that develop innovative solutions that help us and others build technology responsibly
- Hosting a regular conversation series with leading privacy experts from around the world to discuss a range of pressing privacy policy topics
External Privacy Events
Advisory Groups
- The privacy needs around the world
- Messaging and encryption
- Wearables, virtual reality and the metaverse
- Artificial intelligence
- Monetization and ads
Privacy Legal
Audit & Privacy Committee
Internal Audit
Creating a Culture of Privacy
Training
A core component of our privacy education approach is delivered through our privacy training. Our privacy training covers the foundational elements of privacy and is designed to help everyone here at Meta feel empowered to identify privacy risks and make responsible decisions that help mitigate them, so we can all take pride in not only what we build, but how we build it. One key theme is ensuring that Meta personnel are aware that they are the first line of defense to guard against privacy risks and to mitigate such risks.
Both our annual privacy training and our privacy training courses for new hires and new contingent workers provide scenario-based examples of privacy considerations aligned with our business operations and include an assessment to test the understanding of the relevant privacy concepts. These trainings are updated and deployed annually to ensure relevant information is included in addition to core concepts.
In addition to our foundational privacy training, Meta regularly deploys specialized privacy education to targeted audiences, tailored to evolving topics and risks.
Privacy Awareness
Another way we drive company-wide awareness around privacy is through regular communication to employees. In addition to our privacy training courses, we deliver ongoing privacy content through internal communication channels, updates from Meta’s leadership, and internal Q&A sessions.
Regulatory Readiness Process
Privacy Risk Identification and Assessment
Safeguards and Controls
Issues Management
Privacy Red Team
Incident Management
In addition to our robust mitigations and safeguards, we also maintain a process to (1) identify when an event potentially undermines the confidentiality, integrity, or availability of data for which Meta is responsible, (2) investigate those situations, and (3) take any needed steps to address gaps we identify.
Our Incident Management program operates globally to oversee the processes by which we identify, assess, investigate, and remediate privacy incidents. Although the Privacy and Data Practices team leads the incident management process, privacy incidents are everyone’s responsibility at Meta. Teams from across the company, including legal and product teams, play vital roles. We continue to invest time, resources, and energy in building a multi-layered program that is constantly evolving and improving, and we highlight three components of our approach below.
Proactive Identification
Bug Bounty
Transparency
Third-Party Oversight
Third parties are external partners who do business with Meta but aren’t owned or operated by Meta. These third parties typically fall into two major categories: those who provide a service for Meta (like vendors who provide website design support or technology solutions to enable our business) and those who build their businesses around our platform (like app or API developers). To mitigate privacy risks posed by data and personal information exchanged with third parties, we developed a dedicated third party oversight and management program, which is responsible for overseeing third party risks and implementing appropriate privacy safeguards.
Third Party Service Providers
Third-Party Developers
Anti-Scraping
Our anti-scraping team is dedicated to detecting, investigating and blocking patterns of behavior associated with unauthorized scraping. Scraping is the automated collection of data from a website or app and can be either authorized or unauthorized. Using automation to access or collect data from Meta’s platforms without our permission is a violation of our terms of service.
Prevention and Mitigation
Investigation and Enforcement
Risk Review
The Risk Review process – which includes privacy review – is a central part of developing new and updated products, services, and practices at Meta. Through this process, we assess how data will be used and protected as a part of new or updated products, services and practices. We review an average of 1,800 products, features and data practices per month across the company before they ship to assess and mitigate risks.
Our strategy is focused on embedding hundreds of high-quality, reusable internal requirements into our Risk Review system designed to meet external expectations globally. An example of a requirement is mandating that when requested, user data be deleted within a certain period of time. This way, product teams can consider privacy risks at the start of the product development process, and easily apply requirements to maintain high standards of compliance.
To help ensure those requirements are working in practice, we’ve developed consolidated and uniform technical solutions to satisfy a given requirement, with continuous compliance checks to confirm the solution is effective.
For newly developed products which may not be covered by internal requirements, such as certain AI products and features, we have a robust process in place to triage critical decisions with senior-level subject matter experts. Decisions are then codified into requirements.
Technical Privacy Investments
By embedding privacy into Meta’s tools and processes, teams can think about privacy earlier in the product development lifecycle and more easily and consistently deliver privacy benefits for our users.
We’re investing in technological innovations that scale and improve our approach to privacy. By combining the efficiency and scalability of AI with the nuance and expertise of human judgment, we’re better able to ensure consistent decisions that deliver innovative products.
AI for Compliance Efforts
Privacy Aware Infrastructure
Privacy Product Outcomes
We’ve become a privacy-first product development company ensuring that from inception to shipping, any product or feature considers the privacy implications from the start. This is part of our commitment to delivering privacy in both new product innovations and updates to existing products. To reinforce this commitment, Privacy is a core component of performance evaluation for our engineering teams.
You can see this in many examples of products we’ve shipped:
End-to-End Encryption in Messaging
Wearables
- The capture LED is a visible light that lets others know when AI Glasses are being used to take photos and record videos, for the user’s gallery or streaming.
- The glasses are configured such that users cannot capture photos or videos while the capture LED is fully covered. If the capture LED is fully obscured, the user will not be able to utilize the camera and will be notified to remove the obfuscation before proceeding.
- We published an updated white paper that explains our approach to bystander signaling for active capture and AI features.
- Wrist sensor data (including EMG data) from the Meta Neural Band is processed locally on user devices to enable control of AI Glasses. Users can choose to share their wrist sensor data with eta, if they are experiencing an issue with their Meta Neural Band. The Meta AI app continues to provide easy access to privacy settings to manage information and additional data sharing with Meta.
Teen Accounts
Meta AI on WhatsApp
Why Am I Seeing This Ad
Meta Content Library and AI Tools
Educating People About Privacy
- Privacy Policy, which details how we collect, use, share, retain, and transfer information, as well as what rights and controls people have over their privacy.
- Privacy Center, where people can go to better understand our practices so they can make informed decisions about their privacy in a way that is right for them. Through education and access to privacy and security controls, we address some of the most common privacy concerns from the billions of people who spend their time with us everyday. Privacy Center has several modules, including sharing, collection, use, security, youth, generative AI, and ads, to directly connect an issue or concern with the relevant privacy and security controls we’ve built across our apps and services over the years.
- Data and Privacy Section of Newsroom, where we provide more information about how we’ve approached privacy in the context of particular features or issues.
- Additional educational materials. We are committed to helping users understand our data practices and regularly introduce new educational resources. We launched a new animated video that clearly explains how organic personalization works and showcases the privacy controls available to users. The video also introduces the role of AI in enhancing personalization. By adding this video to our existing personalization resources, we aim to increase awareness of user controls and reinforce Meta’s dedication to transparency.
Giving People Greater Access and Control Over Their Information
- Privacy Checkup: Guides people through important privacy and security settings on Facebook to help strengthen account security and manage who can see what they share and how their information is used. Privacy Checkup has five distinct topics to help people control who can see what they share, how their information is used and how to strengthen their account security.
- Who Can See What You Share helps people review who can see their profile information, like their phone number and email address, as well as their posts.
- How to Keep Your Account Secure helps people strengthen their account security by setting a stronger password and turning on two-factor authentication.
- How People Can Find You on Facebook lets people review ways in which people can look you up on Facebook and who can send you friend requests.
- Your Data Settings on Facebook lets people review the information they share with apps they’ve logged into with Facebook. They can also remove the apps they no longer use.
- Your Ad Preferences on Facebook provides information about how ads work on our Products, lets people decide what profile info advertisers can use to show them ads, and lets them control who can see their social interactions, like likes, alongside ads.
- Manage Activity: Allows people to manage posts in bulk with filters to help you sort and find the content they are looking for, like posts with specific people or from a specific date range. It also includes a deletion control that provides a more permanent option, so people can move old posts in bulk to the trash. After 30 days, posts sent to the trash will be deleted, unless they choose to manually delete or restore them before then. You can access this feature by going to Activity Log in Facebook and Your Activity in Instagram.
- Accounts Center: Accounts Center is a place to help people manage connected experiences and change account settings across their Facebook, Instagram, WhatsApp, and Meta accounts. People can choose to add Facebook, Instagram, WhatsApp, and Meta accounts to the same Accounts Center, enabling them to:
- Manage connected experiences across the accounts in the same Accounts Center, such as sharing posts or stories to multiple profiles at once, and logging in across accounts. Learn more.
- Manage individual settings for each account in Accounts Center, such as personal details, password & security, and your information & permissions. Learn more.
- Download Your Information and Access Your Information: Within Accounts Center settings, Meta provides tools to make people’s information on our products useful and easy to find, such as Activity Log, Access Your Information, and Download Your Information.
- Manage settings across all accounts at once if they are in the same Accounts Center, such as ad preferences and activity off-Meta technologies (which provides a summary of activity that businesses and organizations share with us about people’s interactions, such as visiting their apps or websites, and gives people the option to disconnect their past activity from their account). Learn more.
- For WhatsApp users, adding their WhatsApp account to an Accounts Center is optional, and can unlock connected experiences across apps, such as seamlessly sharing your WhatsApp Status to Instagram or Facebook Stories. If you choose this option, your personal messages and calls are still protected with end-to-end encryption, meaning no one outside of the chat, not even WhatsApp or Meta, can read, listen to, or share them.
- Meta Quest and Meta Horizon:
- Social Privacy settings: You can choose how social you want to be and how your information is shared with others through your privacy settings. You can make your Meta Horizon profile public or private, your Active Status allows you to control whether to share when you're online or were recently online, and Hide app activity lets you hide your activity for specific apps. These privacy settings are simple and easily accessible from your Quest headset or the Horizon app.
- Privacy Indicator and Permissions History: The privacy indicator that lets you know when certain privacy related features are currently in use—and which of the apps in your library are currently using them. That includes your microphone, location, spatial data, eye tracking (for Quest Pro only), and Natural Facial Expressions (for Quest Pro only). The Permissions History feature also shows which of your installed apps accessed your microphone, location, spatial data, eye tracking (for Quest Pro only), Natural Facial Expressions (for Quest Pro only), and storage data, over the last seven days.
- Parent-managed Accounts: Parents can set up parent-managed Meta accounts for 10-12 year olds (ages may vary depending on location), allowing preteens to access a vast array of engaging and educational content in VR – with age-appropriate protections built specifically for them.
Ongoing Commitment to Privacy
“Getting privacy right is a continual, collective investment across our company, and is the responsibility of everyone at Meta to advance our mission.”
– Michel Protti, Chief Privacy and Compliance Officer, Product
Protecting users’ data and privacy is essential to our business and our vision for the future. To do so, we’re continually refining and improving our privacy program and our products, as we respond to evolving expectations and technological developments—working with policy makers and data protection experts to find solutions to unprecedented challenges—and sharing our progress as we do.