MARK R. WARNER commas VRG, FINANCE BANKING, HOUSING, AND URBAN AFFAIRS: Anited States Senate snort AULES AND ADMINISTRATION January 30, 2019 Mark Zuckerberg Chairman and Chief Executive Officer Facebook, Inc. 1 Hacker Way Menlo Park, CA 94025 Dear Mr. Zuckerberg: write to express concems about allegations of Facebook’ latest efforts to monitor user activity. On January 29", TechCrunch revealed that under the auspices of partnerships with beta testing firms, Facebook had begun paying users aged 13 to 35 to install an enterprise certificate, allowing Facebook to intercept all internet traffic to and from user devices.' According to subsequent reporting by TechCrunch, Facebook relied on intermediaries that often “did not disclose Facebook’s involvement until users had begun the signup process.” Moreover, the advertisements used to recruit participants and the “Project Disclosure” make no mention of Facebook or the commercial purposes to which this data was allegedly put. This arrangement comes in the wake of revelations that Facebook had previously engaged in similar efforts through a virtual private network (VPN) app, Onavo, that it owned and operated According to a series of articles by the Wall Street Journal, Facebook used Onavo to scout emerging competitors by monitoring user activity — acquiring competitors in order to neutralize them as competitive threats, and in cases when that did not work, monitor usage patterns to inform Facebook's own efforts to copy the features and innovations driving adoption of competitors’ apps.? In 2017, my staff contacted Facebook with questions about how Facebook ‘was promoting Onavo through its Facebook app — in particular, framing the app as a VPN that would “protect” users while omitting any reference to the main purpose of the app: allowing Facebook to gather market data on competitors. Revelations in 2017 and 2018 prompted Apple to remove Onavo from its App Store in 2018 after concluding that the app violated its terms of service prohibitions on monitoring activity of other apps on a user's device, as well as a requirement to make clear what user data will be collected and how it will be used. In both the case of Onavo and the Facebook Research project, I have ' Josh Constine, “Facebook Pays Teens to Install VPN That Spies on Them,” TechCrunch (Jan 29, 2019), available at: bps: /techerunch,com/2019/01/29/Facebook-project-atlas, Betsy Morris and Deepa Seetharaman, “The New Copycats: How Facebook Squashes Competition from Startup Wall Sireet Journal (Aug. 9, 2017), available at: INips:/www..4sj,comiariicles/the-new-copyeats-how-facebook- ssquashes-competition-Irom-startups- 502293414; Deepa Seetharaman and Betsy Morris, “Facebook's Onavo Gives Social-Media Firm Inside Peek at Rivals’ User” Wall Street Journal (Aug. 13, 2017), available at: fhups:/vww,vsj.comvarticles/facebooks-onavo-sives-sovial-media-firm-inside-peek-atrivalconcerns that users were not appropriately informed about the extent of Facebook's data- gathering and the commercial purposes of this data collection. Facebook's apparent lack of full transparency with users ~ particularly in the context of ‘research’ efforts — has been a source of frustration for me. As you recall, I wrote the Federal Trade Commission in 2014 in the wake of revelations that Facebook had undertaken a behavioral ‘experiment on hundreds of thousands of users, without obtaining their informed consent. In submitted questions to your Chief Operating Officer, Sheryl Sandberg, I once again raised these concems, asking if Facebook provided for “individualized, informed consent” in all research. projects with human subjects ~ and whether users had the ability to opt out of such research. Tn response, we learned that Facebook does not rely on individualized, informed consent (noting that users consent under the terms of the general Data Policy) and that users have no opportunity to opt out of being enrolled in research studies of their activity.> In large part for this reason, T am working on legislation to require individualized, informed consent in all instances of behavioral and market research conducted by large platforms on users. Fair, robust competition serves as an impetus for innovation, product differentiation, and wider consumer choice. For these reasons, I request that you respond to the following questions: 1) Do you think any user reasonably understood that they were giving Facebook root device access through the enterprise certificate? What specific steps did you take to ensure that users were properly informed of this access? 2) Do you think any user reasonably understood that Facebook was using this data for ‘commercial purposes, including to track competitors? 3). Will you release all participants from the confidentiality agreements Facebook made them sign? 4) As you know, I have begun working on legislation that would require large platforms such as Facebook to provide users, on a continual basis, with an estimate of the overall value of their data to the service provider. In this instance, Facebook seems to have developed valuations for at least some uses of the data that was collected (such as market research). This further emphasizes the need for users to understand fully what data is collected by Facebook, the full range of ways in which it is used, and how much it is worth to the company. Will you commit to supporting this legislation and exploring methods for valuing user data holistically? 5) Will you commit to supporting legislation requiring individualized, informed consent in all instances of behavioral and market research conducted by large platforms on users? > Foreign Influence Operations’ Use of Social Media Platforms: Open Hearing before the Select Commitee on Ineligence, U.S. Senate, 115 Cong. (September 5, 2018) (Response to Questions forthe Record of Sheryl Sandberg, Chief Operating Officer of Facebook), available a: haps. enate.yov/sitede aul files‘documents Facebo aflook forward to receiving your responses within the next two weeks. If'you should have any questions or concems, please contact my office at 202-224-2023. Sincerely, Mok. © Mme, MARK R. WARNER United States Senator