Privacy progress update
Table of contents
How we do it
"We realised we needed an order of magnitude greater investment in privacy – the summer of 2019 was that moment. The degree of change for Meta has been massive – it's required foundational changes to our people, processes and technical infrastructure, and oversight and accountability. And we continue to invest in protecting people's data as systems, technology and expectations evolve."
– Michel Protti, Chief Privacy and Compliance Officer, Product
Governance
Privacy product groups
Product risk & compliance organisation
Led by Chief Privacy and Compliance Officer, Product, Michel Protti, the product risk & compliance organisation is made up of dozens of teams, both technical and non-technical, focused on guiding the company on privacy strategies.
The product risk & compliance organisation is at the centre of our company’s commitment to its comprehensive privacy programme. Its mission – to instil responsible practices and enable innovation across Meta – guides this work by ensuring that people understand and trust how Meta products and services use their data responsibly.
The product risk & compliance organisation is just one organisation among many across the company that is responsible for privacy. There are thousands of people in different organisations and roles across Meta, including public policy, legal and product teams, who are working to embed privacy, safety, security and other areas of risk management, into all facets of our company operations. Getting privacy right is a deeply cross-functional effort, and we believe everyone at Meta is responsible for that effort.
Privacy and Data Policy
Led by Erin Egan, Vice President and Chief Privacy Officer, Policy, the Privacy and Data Policy team leads our engagement in the global public discussion around privacy, including new regulatory frameworks, and ensures that feedback from governments and experts around the world is considered in our product design and data use practices.
To do so, the Privacy and Data Policy team consults with these groups through a variety of consultation mechanisms. This includes:
- Ongoing consultations with experts as a part of our product development process, and to inform our long-term approach to privacy
- Workshops (including data dialogues) and other convenings on complex privacy questions
- Funding experts to do "deep dive" consultations with us on how we can improve aspects of our privacy programme
- Supporting cross-industry initiatives such as Trust, Transparency and Control Labs (TTC Labs) and Open Loop that develop innovative solutions that help us and others build technology responsibly
- Hosting a regular conversation series with leading privacy experts from around the world to discuss a range of pressing privacy policy topics
External privacy events
Advisory groups
- The privacy needs around the world
- Messaging and encryption
- Wearables, virtual reality and the metaverse
- Artificial intelligence
- Monetisation and ads
Privacy Legal
Audit & Privacy Committee
Internal audit
Creating a culture of privacy
Training
A core component of our privacy education approach is delivered through our privacy training. Our privacy training covers the foundational elements of privacy and is designed to help everyone here at Meta feel empowered to identify privacy risks and make responsible decisions that help mitigate them, so we can all take pride in not only what we build, but how we build it. One key theme is ensuring that Meta personnel are aware that they are the first line of defence to guard against privacy risks and to mitigate such risks.
Both our annual privacy training and our privacy training courses for new hires and new contingent workers provide scenario-based examples of privacy considerations aligned with our business operations and include an assessment to test the understanding of the relevant privacy concepts. These trainings are updated and deployed annually to ensure that relevant information is included in addition to core concepts.
In addition to our foundational privacy training, Meta regularly deploys specialist privacy education to targeted audiences, tailored to evolving topics and risks.
Privacy awareness
Another way we drive company-wide awareness around privacy is through regular communication to employees. In addition to our privacy training courses, we deliver ongoing privacy content through internal communication channels, updates from Meta’s leadership and internal Q&A sessions.
Regulatory readiness process
Privacy risk identification and assessment
Safeguards and controls
Issues management
Privacy Red Team
Incident management
In addition to our robust mitigations and safeguards, we also maintain a process to (1) identify when an event potentially undermines the confidentiality, integrity or availability of data for which Meta is responsible, (2) investigate those situations, and (3) take any needed steps to address gaps we identify.
Our incident management programme operates globally to oversee the processes by which we identify, assess, investigate and remediate privacy incidents. Although the privacy and data practices team leads the incident management process, privacy incidents are everyone's responsibility at Meta. Teams from across the company, including legal and product teams, play vital roles. We continue to invest time, resources and energy in building a multi-layered programme that is constantly evolving and improving, and we highlight three components of our approach below.
Proactive identification
Bug bounty
Transparency
Third-party oversight
Third parties are external partners who do business with Meta, but aren’t owned or operated by Meta. These third parties typically fall into two major categories: those who provide a service for Meta (such as vendors who provide website design support or technology solutions to enable our business) and those who build their businesses around our platform (such as app or API developers). To mitigate privacy risks posed by data and personal information exchanged with third parties, we developed a dedicated third-party oversight and management programme, which is responsible for overseeing third-party risks and implementing appropriate privacy safeguards.
Third-party service providers
Third-party developers
Anti-scraping
Our anti-scraping team is dedicated to detecting, investigating and blocking patterns of behaviour associated with unauthorised scraping. Scraping is the automated collection of data from a website or app and can be either authorised or unauthorised. Using automation to access or collect data from Meta’s platforms without our permission is a violation of our Terms of Service.
Prevention and mitigation
Investigation and enforcement
Risk review
The risk review process – which includes privacy review – is a central part of developing new and updated products, services and practices at Meta. Through this process, we assess how data will be used and protected as a part of new or updated products, services and practices. We review an average of 1,800 products, features and data practices per month across the company before they are sent to assess and mitigate risks.
Our strategy is focused on embedding hundreds of high-quality, reusable internal requirements into our risk review system designed to meet external expectations globally. An example of a requirement is mandating that when requested, user data be deleted within a certain period of time. This way, product teams can consider privacy risks at the start of the product development process, and easily apply requirements to maintain high standards of compliance.
To help ensure that those requirements are working in practice, we’ve developed consolidated and uniform technical solutions to satisfy a given requirement, with continuous compliance checks to confirm the solution is effective.
For newly developed products which may not be covered by internal requirements, such as certain AI products and features, we have a robust process in place to triage critical decisions with senior-level subject matter experts. Decisions are then codified into requirements.
Technical privacy investments
By embedding privacy into Meta’s tools and processes, teams can think about privacy earlier in the product development lifecycle and more easily and consistently deliver privacy benefits for our users.
We’re investing in technological innovations that scale and improve our approach to privacy. By combining the efficiency and scalability of AI with the nuance and expertise of human judgment, we’re better able to ensure consistent decisions that deliver innovative products.
AI for compliance efforts
Privacy-aware infrastructure
Privacy product outcomes
We’ve become a privacy-first product development company ensuring that from inception to delivery, any product or feature considers the privacy implications from the start. This is part of our commitment to delivering privacy in both new product innovations and updates to existing products. To reinforce this commitment, Privacy is a core component of performance evaluation for our engineering teams.
You can see this in many examples of products we’ve delivered:
End-to-end encryption in messaging
Wearables
- The capture LED is a visible light that lets others know when AI glasses are being used to take photos and record videos, for the user’s gallery or streaming.
- The glasses are configured so that users cannot capture photos or videos while the capture LED is fully covered. If the capture LED is fully obscured, the user will not be able to utilise the camera and will be notified to remove the obfuscation before proceeding.
- We published an updated white paper that explains our approach to bystander signalling for active capture and AI features.
- Wrist sensor data (including EMG data) from the Meta Neural Band is processed locally on user devices to enable control of AI glasses. Users can choose to share their wrist sensor data with Meta, if they are experiencing an issue with their Meta Neural Band. The Meta AI app continues to provide easy access to privacy settings to manage information and additional data sharing with Meta.
Teen Accounts
Meta AI on WhatsApp
Why am I seeing this ad?
Meta Content Library and AI Tools
Educating people about privacy
- Privacy Policy, which details how we collect, use, share, retain and transfer information, as well as what rights and controls people have over their privacy.
- Privacy Centre, where people can go to better understand our practices so they can make informed decisions about their privacy in a way that is right for them. Through education and access to privacy and security controls, we address some of the most common privacy concerns from the billions of people who spend their time with us every day. Privacy Centre has several modules, including sharing, collection, use, security, youth, generative AI and ads, to directly connect an issue or concern with the relevant privacy and security controls we’ve built across our apps and services over the years.
- Data and Privacy Section of Newsroom, where we provide more information about how we’ve approached privacy in the context of particular features or issues.
- Additional educational materials. We are committed to helping users understand our data practices and regularly introduce new educational resources. We launched a new animated video that clearly explains how organic personalisation works and showcases the privacy controls available to users. The video also introduces the role of AI in enhancing personalisation. By adding this video to our existing personalisation resources, we aim to increase awareness of user controls and reinforce Meta’s dedication to transparency.
Giving people greater access and control over their information
- Privacy Checkup: Guides people through important privacy and security settings on Facebook to help strengthen account security and manage who can see what they share and how their information is used. Privacy Checkup has five distinct topics to help people control who can see what they share, how their information is used and how to strengthen their account security.
- Who can see what you share helps people review who can see their profile information, such as their phone number and email address, as well as their posts.
- How to keep your account secure helps people strengthen their account security by setting a stronger password and turning on two-factor authentication.
- How people can find you on Facebook lets people review ways in which people can look you up on Facebook and who can send you friend requests.
- Your data settings on Facebook lets people review the information they share with apps they've logged in to with Facebook. They can also remove the apps they no longer use.
- Your ad preferences on Facebook provides information about how ads work on our Products, lets people decide what profile info advertisers can use to show them ads and lets them control who can see their social interactions, such as likes, alongside ads.
- Manage activity: Allows people to manage posts in bulk with filters to help you sort and find the content they are looking for, such as posts with specific people or from a specific date range. It also includes a deletion control that provides a more permanent option, so people can move old posts in bulk to the bin. After 30 days, posts sent to the bin will be deleted, unless they choose to manually delete or restore them before then. You can access this feature by going to activity log in Facebook and Your activity in Instagram.
- Accounts Centre: Accounts Centre is a place to help people manage connected experiences and change account settings across their Facebook, Instagram, WhatsApp and Meta accounts. People can choose to add Facebook, Instagram, WhatsApp and Meta accounts to the same Accounts Centre, enabling them to:
- Manage connected experiences across the accounts in the same Accounts Centre, such as sharing posts or stories to multiple profiles at once, and logging in across accounts. Learn more.
- Manage individual settings for each account in Accounts Centre, such as personal details, password and security, and your information and permissions. Learn more.
- Download your information and Access your information: Within Accounts Centre settings, Meta provides tools to make people’s information on our products useful and easy to find, such as activity log, access your information and download your information.
- Manage settings across all accounts at once if they are in the same Accounts Centre, such as ad preferences and activity off-Meta technologies (which provides a summary of activity that businesses and organisations share with us about people's interactions, such as visiting their apps or websites, and gives people the option to disconnect their past activity from their account). Learn more.
- For WhatsApp users, adding their WhatsApp account to an Accounts Centre is optional, and can unlock connected experiences across apps, such as seamlessly sharing your WhatsApp Status to Instagram or Facebook Stories. If you choose this option, your personal messages and calls are still protected with end-to-end encryption, meaning no one outside the chat, not even WhatsApp or Meta, can read, listen to or share them.
- Meta Quest and Meta Horizon:
- Social privacy settings: You can choose how social you want to be and how your information is shared with others through your privacy settings. You can make your Meta Horizon profile public or private, your Active Status allows you to control whether to share when you're online or were recently online, and Hide app activity lets you hide your activity for specific apps. These privacy settings are simple and easily accessible from your Quest headset or the Horizon app.
- Privacy indicator and permissions history: The privacy indicator that lets you know when certain privacy-related features are currently in use – and which of the apps in your library are currently using them. That includes your microphone, location, spatial data, eye tracking (for Quest Pro only) and natural facial expressions (for Quest Pro only). The permissions history feature also shows which of your installed apps accessed your microphone, location, spatial data, eye tracking (for Quest Pro only), natural facial expressions (for Quest Pro only) and storage data, over the last seven days.
- Parent-managed accounts: Parents can set up parent-managed Meta accounts for 10-12 year olds (ages may vary depending on location), allowing pre-teens to access a vast array of engaging and educational content in VR – with age-appropriate protections built specifically for them.
Ongoing commitment to privacy
"Getting privacy right is a continual, collective investment across our company, and is the responsibility of everyone at Meta to advance our mission."
– Michel Protti, Chief Privacy and Compliance Officer, Product
Protecting users’ data and privacy is essential to our business and our vision for the future. To do so, we’re continually refining and improving our privacy programme and our products, as we respond to evolving expectations and technological developments – working with policy makers and data protection experts to find solutions to unprecedented challenges – and sharing our progress as we do.