Yesterday Facebook announced it was changing its settings for face recognition, which it has used since 2010 to match known faces in user profile pictures and other photos to unknown faces in newly uploaded photos. This leads to two questions:

• What exactly has Facebook changed?
• How many Facebook users are actually affected?

News media are starting to report that Facebook has turned face recognition into an “opt-in” feature for all users. This is something EFF and many others have pushed for for years. It’s also the law in Illinois. However, Facebook’s announcement, while far from clear, definitely does not say that face recognition is now opt-in for all users.

Here’s what the announcement does say:

Starting today, people who newly join Facebook or who previously had the tag suggestions setting will have the face recognition setting and will receive information about how it works.

Throughout Facebook’s deliberately vague announcement, it takes great pains to note that the change applies only to new Facebook users and people who currently have the “tag suggestions” setting. However, Facebook migrated many, if not most, existing users from “tag suggestions” to “face recognition” in December 2017 (see here for Facebook’s explanation of the difference between tag suggestions and face recognition). That means this safeguard does not apply to the billions of current Facebook users who have already been moved.

Facebook should not subject any of its users to face surveillance, absent their informed opt-in consent.

Frustratingly, it’s not even clear if new Facebook users will be offered an opt-in for face recognition. The announcement contains two statements referencing "information" or a "notice" that Facebook is sending to certain users, but these statements point in opposite directions. On the one hand: “Starting today, people who newly join Facebook or who previously had the tag suggestions setting will have the face recognition setting and will receive information about how it works.” (Emphasis added.) This suggests that new users will get the notice. On the other hand, the announcement later says: “People who still have the tag suggestions setting will begin to see a notice in their News Feed today.” This suggests that only current users with tag suggestions will get the notice. To make matters even more confusing, the announcement later says: "you can opt to leave your setting off right in the notice, as opposed to having to go to a separate screen. If you do nothing, face recognition will remain off for you" (without clarifying who it means when it says "you"). 

Facebook should not subject any of its users to face surveillance, absent their informed opt-in consent. And Facebook should clear up the uncertainties in its announcement before it gets any more credit than it’s due for this change.

Read more about the background on Facebook’s change and its recent settlement with the FTC for years of violating users’ privacy. And, if you're not one of the users impacted by Facebook's announcement, this link should allow you to turn off face recognition if it isn't already off (click here for the mobile link).