Dynamic enforcement of privacy settings by a social networking system on information shared with an external system

• US 8,752,186 B2
• Filed: 07/23/2009
• Issued: 06/10/2014
• Est. Priority Date: 07/23/2009
• Status: Active Grant

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Inventors: Vernal, Michael Steven, Zhu, Wei, Leszczenski, James M., Elman, Joshua E., Morin, David Brookes, Cheever, Charles Duplain, Sanghvi, Ruchi
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US12/508,523
• Publication Number:
  US 20110023129A1
• Time in Patent Office: 1,783 Days
• Field of Search: 726/33, 726/21, 726 1- 10, 726 26- 30, 705/54, 705/1, 705/1.1, 705/7.11, 705 50- 52, 705/2, 705/3
• US Class Current: 726/26
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/306 User profiles

Abstract

An external system (such as a website) that interacts with users communicates with a social networking system to access information about the users, who may also be users of the social networking system. If a privacy setting is changed in the social networking system, and the change applies to information that has been shared with an external system, the change is enforced at the external system. For example, the external system may be notified that the information is invalid and must be deleted, or the external system may periodically request the information so that changes to the privacy settings are eventually experienced at the external systems. When an external system again needs the information, whether expired naturally or actively invalidated by the social network, the external system sends a new request for the information, which is subject to the (possibly revised) privacy settings.

Claims

1. A computer implemented method comprising:

maintaining a user account for each of a plurality of users of a social networking system, each user account comprising social network information associated with a respective user of the plurality of users;

establishing a plurality of connections, each connection between two or more of the user accounts;

maintaining, by the social networking system, one or more privacy settings for a subject user of the plurality of users, the maintained privacy settings selected by the subject user and containing rules for access to social network information associated with the subject user, each rule making one or more items of the social network information associated with the subject user either available or unavailable to one or more other users of the plurality of users based on the established connections between the subject user and the one or more other users;

receiving a request from an external system for information associated with the subject user of the social networking system, the external system outside of the social networking system, the external system configured to provide an online service to the subject user, and the external system further configured to personalize the online service with information associated with the subject user obtained from the social networking system;

transmitting a response to the external system, the response comprising information responsive to the request for information associated with the subject user based on the maintained privacy settings;

updating the maintained privacy settings to change one or more of the rules for access to the social network information associated with the subject user; and

responsive to updating the maintained privacy settings, communicating one or more of the updated privacy settings to the external system instructing the external system to enforce the updated privacy settings.

2. The computer implemented method of claim 1, wherein the response to the external system comprises information associated with the subject user based on the maintained privacy settings.

3. The computer implemented method of claim 1, wherein the response to the external system comprises information associated with the subject user and information describing the maintained privacy settings.

4. The computer implemented method of claim 1, wherein the response to the external system comprises information associated with the subject user, and wherein the social networking system requires use of the information associated with the subject user by the external system to be subject to privacy settings.

5. The computer implemented method of claim 1, wherein communicating one of more of the updated privacy settings to the external system comprises sending a request to the external system to cease using the information in the transmitted response.

6. The computer implemented method of claim 1, further comprising:

receiving a subsequent request from the external system for information associated with the subject user, wherein the social networking system requires that the social network information associated with the subject user will be used by the external system for no more than a predetermined time period after receiving the social network information associated with the subject user.

7. The computer implemented method of claim 1, wherein updating the maintained privacy settings is responsive to a request from the subject user to update privacy settings associated with the subject user.

8. The computer implemented method of claim 1, wherein updating the maintained privacy settings is responsive to a request from another user connected to the subject user via the social networking system to update privacy settings associated with the other user.

9. The computer implemented method of claim 1, further comprising:

requiring the external system to use the social network information associated with the subject user for no more than a predetermined time period after receiving the social network information associated with the subject user.

10. A computer implemented method comprising:

interacting with a subject user of a social networking system, the social networking system maintaining a user account for each of a plurality of users of the social networking system, each user account comprising social network information associated with a respective user of the plurality of users, and the social networking system further maintaining a plurality of connections, each connection between two or more of the user accounts, and the social networking system outside of an external system;

sending a request by the external system to the social networking system for social network information associated with the subject user of the social networking system, the external system configured to provide an online service to the subject user, and the external system further configured to personalize the online service with information associated with the subject user obtained from the social networking system;

receiving, by the external system, a response from the social networking system, the response comprising information responsive to the request for information associated with the subject user and one or more privacy settings governing the use of the information responsive to the request for information associated with the subject user, the one or more privacy settings selected by the subject user and containing rules for access to social network information associated with the subject user, each rule making one or more items of the social network information associated with the subject user either available or unavailable to one or more other users of the plurality of users based on the established connections between the subject user and the one or more other users; and

using the information from the received response in accordance with the one or more privacy settings.

11. The computer implemented method of claim 10, further comprising:

receiving updated privacy settings from the social networking system governing the use of the information responsive to the request for information associated with the subject user; and

using information received from the social networking system in accordance with the updated privacy settings.

12. The computer implemented method of claim 11, further comprising:

enforcing a policy of using the social network information associated with the subject user for no more than a predetermined time period after receiving the social network information associated with the subject user; and

sending a request to the social networking system for the social network information associated with the subject user after the predetermined time period after receiving the social network information associated with the subject user.

13. The computer implemented method of claim 11, wherein the external system receives updated privacy settings from the social networking system, wherein the one or more privacy settings were updated in response to a request from the subject user.

14. The computer implemented method of claim 11, wherein the external system receives updated privacy settings from the social networking system, wherein the one or more privacy settings were updated in response to a request from a connection of the subject user to update privacy settings of the connection.

15. The computer implemented method of claim 10, wherein the response from the social networking system comprises information associated with the subject user based on the one or more privacy settings.

16. The computer implemented method of claim 10, wherein the response from the social networking system comprises information associated with the subject user based on the one or more privacy settings, the privacy settings containing rules for sharing social network information outside of the social networking system.

17. The computer implemented method of claim 10, wherein the response from the social networking system comprises information associated with the subject user, wherein the social networking system requires the external system to use information associated with the subject user based on the one or more privacy settings.

18. The computer implemented method of claim 10, wherein the response from the social networking system comprises information associated with the subject user, and using the information from the received response comprises determining a subset of the information associated with the subject user based on the one or more privacy settings.

19. The computer implemented method of claim 10, further comprising:

receiving a communication from the social networking system requesting the external system to cease using the information in the previously transmitted response.

20. The computer implemented method of claim 10, further comprising:

enforcing a policy to use the social network information associated with the subject user for no more than a predetermined time period after receiving the social network information associated with the subject user.

21. The computer implemented method of claim 10, further comprising:

expunging any of the social network information associated with the subject user received from the social networking system after a predetermined period of time.

22. A computer implemented method comprising:

maintaining a user account for each of a plurality of users of a social networking system, each user account comprising social network information associated with a respective user of the plurality of users;

establishing a plurality of connections, each connection between two or more of the user accounts;

maintaining , by the social networking system, one or more privacy settings for a subject user of the plurality of users, the maintained privacy settings selected by the subject user and containing rules governing access to social network information associated with the subject user, each rule making one or more items of the social network information associated with the subject user either available or unavailable to one or more other users of the plurality of users based on the established connections between the subject user and the one or more other users;

receiving a request from an external system for information associated with the subject user of the social networking system, the external system outside of the social networking system, the external system configured to provide an online service to the subject user, and the external system further configured to personalize the online service with information associated with the subject user obtained from the social networking system; and

responding to the external system, the response comprising information associated with the subject user responsive to the request and information describing the maintained privacy settings governing access to the information associated with the subject user responsive to the request.

23. The computer implemented method of claim 22, further comprising:

updating the maintained privacy settings changing one or more of the rules for access to the social network information associated with the subject user responsive to the request for information; and

communicating the updated privacy settings to the external system instructing the external system to enforce the updated privacy settings.

24. The computer implemented method of claim 23, wherein information describing the updated privacy settings is communicated responsive to receiving a request to update privacy settings associated with the user.

25. The computer implemented method of claim 23, wherein information describing the updated privacy settings is communicated responsive to receiving a request to update privacy settings associated with a connection of the user.

26. The computer implemented method of claim 22, wherein the response to the external system comprises information associated with the subject user, wherein the social networking system requires the external system to use the information associated with the subject user based on the maintained privacy settings.

27. The computer implemented method of claim 22, wherein the information associated with the subject user responsive to the request comprises information identifying a subset of the information associated with the subject user based on the maintained privacy settings.

28. The computer implemented method of claim 22, wherein the information associated with the subject user responsive to the request is required by the social networking system to be used by the external system in accordance with the maintained privacy settings.

29. The computer implemented method of claim 22, further comprising:

updating the maintained privacy settings; and

sending a request to the external system to cease using the information associated with the subject user in a previously transmitted response.

30. The computer implemented method of claim 22, further comprising:

updating the maintained privacy settings; and

receiving a subsequent request from the external system for information associated with the subject user, wherein the social networking system requires the external system to use the social network information associated with the subject user for no more than a predetermined time period after receiving the social network information associated with the subject user.

31. The computer implemented method of claim 22, further comprising:

requiring the external system to use the social network information associated with the subject user for no more than a predetermined time period after receiving the social network information associated with the subject user.