Published
Sharing private residential information
In its policy advisory opinion, the Board recommends that Meta remove the exception to the Privacy Violations Community Standard that allows the sharing of private residential information when it is considered 'publicly available'.
Today, the Oversight Board has published its first policy advisory opinion. Through policy advisory opinions, the Board reviews Meta’s policies on a given topic and makes recommendations for how they should be changed.
To read the full version of the Board’s policy advisory opinion on the sharing of private residential information, click here.
You can also read a summary of the opinion below.
In its policy advisory opinion, the Board recommends that Meta remove the exception to the Privacy Violations Community Standard that allows the sharing of private residential information when it is considered “publicly available.” This would help Meta better protect people’s private residential information.
Among its other recommendations, the Board proposes that Meta create a communications channel for victims of doxing, give users more control over how they consent to sharing their private residential information and provide data showing the amount of content removed following privacy-related government requests.
Details of Meta’s request
Last year, Meta requested a policy advisory opinion from the Board on the sharing of private residential addresses and images, and the contexts in which this information may be published on Facebook and Instagram. Meta considers this to be a difficult question as while access to such information can be relevant to journalism and civic activism, “exposing this information without consent can create a risk to residents’ safety and infringe on an individual’s privacy.”
Meta’s request noted several potential harms linked to releasing personal information, including residential addresses and images. These include “doxing,” (which refers to the release of documents, abbreviated as “dox”) where information which can identify someone is revealed online. Meta noted that doxing can have negative real-world consequences, such as harassment or stalking.
Key findings
Under the Facebook Privacy Violations Community Standard users should not share “personally identifiable information about yourself or others,” including addresses, “except when shared or solicited to promote charitable causes, find missing people, animals, or objects, or contact business service providers.”
This also includes “private information” such as “imagery that displays the external view of private residences.” Such imagery may only be removed, however, when all of the following conditions apply: “The residence is a single-family home, or the resident’s unit number is identified in the image/caption. The city/neighborhood or GPS pin (for example, a pin from Google Maps) are identified. The content identifies the resident(s). That same resident objects to the exposure of their private residence, or there is context of organizing protests against the resident (This does not include embassies that also serve as residences).”
The Facebook Privacy Violations policy states that “private information may become publicly available through news coverage, court filings, press releases, or other sources.” When that happens, Meta may allow the information to be posted. For example, if a person’s address is considered “publicly available,” images will be permitted on Facebook and Instagram identifying that individual with an address. Meta’s internal guidance provided to content reviewers states that information “published by at least five news outlets” is no longer private information for the purposes of the Facebook Privacy Violations policy.
The Board understands that the sharing of private residential addresses and images represents a potentially serious violation of the right to privacy both for people who use Facebook and Instagram, and those who do not.
Once this information is shared, the harms that can result, such as doxing, are difficult to remedy. Harms resulting from doxing disproportionately affect groups such as women, children and LGBTQIA+ people, and can include emotional distress, loss of employment and even physical harm or death.
As the potential for harm is particularly context specific, it is challenging to develop objective and universal indicators that would allow content reviewers to distinguish the sharing of content that would be harmful from shares that would not be. That is why the Board believes that the Privacy Violations policy should be more protective of privacy.
International human rights standards permit necessary and proportionate restrictions on expression to protect people’s right to privacy. As such, the Board favors narrowing the exceptions to the Privacy Violations policy to help Meta better protect the private residential information of people both on and off its platforms.
In exchanges with the Board, Meta stressed that “ensuring that the “publicly available” definition does not exempt content from removal that poses a risk of offline harm” is a “persistent concern.” Public records and other sources of what could be considered “publicly available” information still require resources and effort to be accessed by the general public. On social media, however, such information may be shared and accessed more quickly, and on a much bigger scale, which significantly increases the risk of harm. As such, the Board proposes removing the “publicly available” exception for the sharing of both private residential addresses and images that meet certain criteria.
The Oversight Board’s recommendations
In its policy advisory opinion, the Board makes 17 recommendations covering content policy, enforcement, and transparency.
On content policy, Meta should:
1. Remove the exception that allows the sharing of private residential information when considered “publicly available.” This means Meta would no longer allow otherwise violating content on Facebook and Instagram if it has been “published by at least five news outlets” or if it contains residential addresses or imagery from financial records or statements of an organization, court records, professional and business licenses, sex offender registries or press releases from government agencies, or law enforcement.
2. Ensure that its newsworthiness exception is consistently applied. As recommended in recommendation 3 in the Board’s Colombia protests case (2021-010-FB-UA), Meta should develop and publicize clear criteria for content reviewers to escalate for additional review public interest content that potentially violates the Community Standards but may be eligible for the newsworthiness exception. Given its discussion in multiple cases, the Board would like to explore the application of the newsworthiness exception in a future policy advisory opinion.
3. Allow the sharing of “imagery that displays the external view of private residences” when the property depicted is the focus of the news story, even when the following conditions listed in the Privacy Violations Community Standard are met (“The residence is a single-family home, or the resident’s unit number is identified in the image/caption. The city/neighborhood or GPS pin (for example, a pin from Google Maps) are identified. The content identifies the resident(s). That same resident objects to the exposure of their private residence.”) However, Meta should not allow the sharing of images of private residences when there is a “context of organizing protests against the resident.”
4. Allow the organization of protests at publicly owned official residences. Meta should allow the publication of addresses and imagery of official residences provided to high-ranking government officials, such as heads of state, heads of federal or local government, ambassadors and consuls. High-ranking government officials are generally expected to tolerate lower levels of privacy, especially at their place of work, and to receive heightened protection by security personnel. This recommendation proposes allowing the organization of protests at publicly owned official residences, not the private residences of government officials.
5. Allow the sharing of private residential addresses when posted by the affected user themselves or when the user consents to its publication. By default, users should be considered not to have given such consent.
6. Ensure users have a quick and effective mechanism to request the removal of private information posted by others.
7. Explain more clearly in the Facebook Privacy Violations policy when disclosing the city where a residence is located will suffice for the content to be removed (e.g., by specifically referencing the population threshold at which sharing only the city as part of the content will no longer be considered violating).
8. Explain in the Facebook Privacy Violations policy its criteria for assessing whether the resident is sufficiently identified in the content. Meta should clarify whether the person’s full or partial name needs to be disclosed, together with their residential information, or whether their photo and/or a more general description by inference would suffice.
9. Explain to users that it enforces the Facebook Community Standards on Instagram, with several specific exceptions, and include a link to the Facebook Privacy Violations Community Standard in the language of the Instagram Community Guidelines.
On enforcement, Meta should:
10. Let users who are reporting content that may violate the Privacy Violations policy provide additional context about their claim.
11. Create a specific communications channel for victims of doxing, available to both people who use its platforms and those who do not. This should be easily accessed, allow the victim to explain in detail their situation and risks the content creates for them, and prompt swift action from the company. Meta should prioritize action when the impacted person says they belong to a group facing heightened risk to their safety in the region where the private residence is located.
12. Consider violations of its Privacy Violations policy as “severe,” where the sharing of private residential information is clearly related to malicious action that created a risk of violence or harassment. This will prompt temporary account suspension.
13. Give users an opportunity to remove or edit private information within their content when it is removed for violating the Privacy Violations policy. If the user removes or edits the private residential information out of the content within a certain deadline, the temporary block on the content would be lifted.
14. Let users indicate in their appeal to Meta that their content falls into one of the exceptions to the Privacy Violations policy.
On transparency, Meta should:
15. Publish quantitative data on the enforcement of the Privacy Violations policy in the company’s Community Standards Enforcement Report.
16. Break down data in its report on Content Restrictions Based on Local Law to show the amount of content removed following privacy-related government requests, even if taken down under the Privacy Violations policy and not under local privacy laws.
17. Provide users with more detail on the specific policy in the Privacy Violations Community Standard that their content was found to violate. Meta should implement this across its platforms’ working languages.
For further information:
In the attachments below, you can find links to the following documents:
- The original request for a policy advisory opinion from Meta.
- A policy update received from Meta.
- An appendix of public comments received for this policy advisory opinion.
- Full version of the Board’s policy advisory opinion.
