New Class Action Says Facebook Should Be Regulated Like Equifax and Other Consumer Reporting Agencies

A proposed class action lawsuit filed this week against Facebook, Inc. argues that the social media giant counts as a “consumer reporting agency” and should be required to provide users with more information about the data it collects from them. This all comes in the wake of the company’s recent data mining scandal that raised questions about whether the social media platform should keep a tighter grip on its users’ information.

Specifically, the lawsuit claims that because Facebook shares data about its users with “third-party advertisers, data brokers, researchers, and other third-parties,” many times in exchange for a fee, the company must comply with consumer privacy protections mandated by the Fair Credit Reporting Act (FCRA).

What’s a Consumer Reporting Agency?

Typically, we associate the term with the “big three” consumer reporting agencies (CRAs) – Experian, Equifax, and TransUnion – that gather consumer information into a credit report and sell it to companies looking to make a decision about us, such as whether to offer us credit, a job, or an insurance policy.

The lawsuit argues that Facebook falls under the FCRA’s definition of a consumer reporting agency because, according to the complaint, the social media platform “regularly assembles and transmits information regarding consumers” to third parties, effectively providing them with consumer reports.

So, Facebook Collects My Data into a Consumer Report About Me?

Yes, technically, the lawsuit argues. By agreeing to the site’s “Terms and Conditions” each user allows Facebook to use his or her “name, profile picture, content, and information in connection with commercial, sponsored, or related content (such as a brand you like) served or enhanced by” the company. This information, the case poses, qualifies as a “consumer report” because it’s sent to Facebook’s advertising partners or application developers “in accordance with the written instructions of the consumer to whom it relates” – i.e. the “Terms and Conditions” you agreed to.

Is Facebook Required to Tell Me What It Does with My Information?

If the company qualifies as a consumer reporting agency as the lawsuit suggests, the FCRA requires Facebook to provide users with full disclosure of the information it sends to third parties. Federal law allows consumers to request from CRAs “all information in the consumer’s file at the time of the request,” including what data is included in the file, who received it, and what they used it for.

The lawsuit argues that Facebook does allow users to download a copy of their “file,” but doesn’t list all the required information. Specifically, the case alleges, the company doesn’t include in consumers’ files the “voluminous” amount of information it collects and shares with third-party data brokers, the source of the information, and the identities of each individual who has permission to see it.

“Facebook’s disclosures were unclear (lacking ‘transparency’),” the lawsuit suggests, “because they referred only to a list of advertisers who had an individual’s personal information, without also specifying the other types of third-parties, like Experian, who had procured the data, or the specific purposes for which an inquiry was made, including for research purposes.”

The plaintiff in the case claims he emailed Facebook asking for the supposedly missing data from his file “because he wanted to confirm who obtained his personal information.” As of April 10, 2018, the complaint notes, Facebook has “failed to respond.”

Why Is This Relevant Now?

As mentioned earlier, the proposed class action follows in the wake of Facebook’s recent data mining scandal, during which political consulting firm Cambridge Analytica was provided with the personal data of up to 87 million Facebook users and, with that information, allegedly helped sway the 2016 presidential election.

Though Facebook has since taken action to improve its security and how its members’ information is used, this lawsuit echoes lawmakers’ view that the social media platform should be subjected to more rigid regulations concerning consumers’ privacy. From the complaint:

Without full and complete disclosures of the information Facebook acquires and compiles, a consumer is unable to adequately assess whether to adjust their [sic] privacy settings to opt out of marketing campaigns, or determine whether false information is being reported about them such that they can correct the information.”

The lawsuit argues that the company, as a consumer reporting agency, should be subjected to the FCRA’s regulations and provide consumers with “a clearer sense of what information Facebook [is] collecting about them.”