Ironically, in a crisis that was born from data and precision targeting, much of the coverage of the Facebook and Cambridge Analytica crisis has been imprecise with language and distracted in focus.
Was this a "breach" or a "hack", a "harvest" or a "theft"? Variously, it’s been called all of the above, as if the terms, which are oceans apart in legal and literal meaning, are somehow interchangeable.
More than that, are we to understand this as a crisis about our personal data, a complex riddle of servers and permissions and APIs, or is it a fake-Sheikh exposé of political dirty tricks involving Ukranian girls and Sri Lankan politicians, a hidden camera stunt like the sort that did for Big Sam?
Is the villain Trump or Zuckerburg or Nix? Was this an error or a crime or a fraud? With every passing news cycle, the crisis has been further muddied, swirled into an opaque mess into which a sign was stuck that read, more or less, "shady stuff happens here".
Two statements, amid the flurry of comment and conjecture, stand out for me. In stark opposition to his boss’ doe-eyed mea culpa tour of the mainstream media on Wednesday, Facebook’s deputy general counsel, Paul Grewal, cut to the chase: "Kogan [who built the app that accessed the data] requested and gained access to information from users who chose to sign up to his app, and everyone involved gave their consent".
There was no gross violation of the business model. This was the business model
This is the heart of it. There was no hack. No theft.
"Harvest", with all its nefarious implications, just means ‘access at scale’. There was no gross violation of the business model. This was the business model.
Third parties had the right to request access to users’ personal data (and that of their friends) if those users consented. The fact that this data was then shared with another third party, Cambridge Analytica, was indeed a violation of Facebook’s terms of service, but one that Facebook had only limited means to govern or spot.
Thankfully, the powers by which the data was accessed in the first place were narrowed in 2014 (after the ‘harvesting’ took place in this case), and in Europe GDPR’s passage will further narrow them, but to be clear the very basis of Facebook’s interaction with the broader web and the wider world is the transfer of personal data out in exchange for revenue in. It’s not a bug, it’s not even just a feature, it’s the whole model.
Enter, mercifully, Tim Berners-Lee, and the second statement. In an unusually lengthy intervention, he doesn’t mention Trump or Cambridge Analyitica, because he knows this story, this moment, isn’t about them. Trump is a distraction, a black hole from which no story can fully escape once it enters, and CA are just the transient villain.
This, Berners-Lee makes clear, is about the whole web, and how it makes money. "This is a serious moment for the web’s future," he wrote. He addressed Mark Zuckerburg directly, adding "you can fix it, it won’t be easy but … we can make sure web platforms serve humanity".
If you’re not paying for a product then you’re the product
The statement, as you’d expect from Berners-Lee, is a masterclass in nuance. Yes, there’s the clear allocation of responsibility, but buried deep in the nine-tweet message is a huge and generous gift to Facebook. A single word: "platforms". This is the term that Facebook, Google, YouTube, Twitter and the like cling to in defence of their unwillingness to curate their sites, other than in cases of the most severe abuse or law-breaking.
Platforms, that is, rather than publishers. In using the former term. Berners-Lee recognises a reality of the modern web; it’s simply not possible nor desirable for Facebook and others to assume editorial positions on every issue and to weed out content that stands in opposition. They are platforms for us, filled only by the stuff we make and say and think, and so they will reflect both our better angels and our worst.
Berners-Lee’s challenge is to fix the fundamental business model of the free web. It’s an often-repeated truism that "if you’re not paying for a product then you’re the product", and of course that is true of most large digital services. What is becoming clear is that this model, when combined with the moral agnosticism of being a platform rather than a publisher, reliably and regularly creates deeply troubling outcomes. From major brands’ advertising appearing as pre-rolls in front of politically sensitive content, to display advertising being deployed programmatically to sites at the fringes of mainstream opinion, even to the algorithm that governs the auto-complete suggestions in a search bar, the data-driven web is becoming an increasingly uncomfortable place for brands to allow their assets to run free.
We are an influential constituency here, more so than we perhaps realise
For brands and marketers, our role is critical. We are at the coal face of the still-murky transaction on which the free web is built, the ones asking users for their data, as well as the ones relying on that data to serve precision-targeted ads.
Our role as marketers can’t be ignored here, our responsibility can’t be shirked. GDPR will help, and the measures that Zuckerburg announced (chiefly adding a more visible dashboard to allow users to monitor where and to whom their data is available) are a step in the right direction.
But, if we as advertisers are to continue using personal data as a way to inform precision marketing, whether pre-rolls, search, social or display, then it’s our responsibility to make sure we’re not wading into the "shady stuff happens here" quagmire with our eyes shut.
Moral ambiguity hidden behind terms of service and poorly understood mechanics isn’t in our interest. The shade is becoming increasingly evident, and increasingly uncomfortable.
We are an influential constituency here, more so than we perhaps realise. "Fix it" is damn right. But let’s be clear on what that fix needs to look like from our perspective, given we’re the ones putting all the cash in. We need to make the transaction which sits at the heart of the modern web, personal data exchanged for precision messaging, something brands and consumers truly understand, and one in which they are actively willing to participate.
Regulation and transparency are the tools here, and they need to be adjusted until that understanding and that willingness can be demonstrated. If they aren’t adjusted, and brands aren’t willing to continue investing in the shade, then the "serious moment for the web" might end up being even more serious than it seems already.
Alex Hesz is chief strategy officer at Adam & Eve/DDB