Dynamic enforcement of privacy settings by a social networking system on information shared with an external system

• US 9,754,125 B2
• Filed: 12/23/2014
• Issued: 09/05/2017
• Est. Priority Date: 07/23/2009
• Status: Active Grant

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Inventors: Vernal, Michael Steven, Zhu, Wei, Leszczenski, James M., Elman, Joshua E., Morin, David Brookes, Cheever, Charles Duplain, Sanghvi, Ruchi
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US14/581,786
• Publication Number:
  US 20150113590A1
• Time in Patent Office: 987 Days
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/306 User profiles

Abstract

An external system (such as a website) that interacts with users communicates with a social networking system to access information about the users, who may also be users of the social networking system. If a privacy setting is changed in the social networking system, and the change applies to information that has been shared with an external system, the change is enforced at the external system. For example, the external system may be notified that the information is invalid and must be deleted, or the external system may periodically request the information so that changes to the privacy settings are eventually experienced at the external systems. When an external system again needs the information, whether expired naturally or actively invalidated by the social network, the external system sends a new request for the information, which is subject to the (possibly revised) privacy settings.

Claims

1. A computer implemented method comprising:

interacting, by an external system, with a subject user of a social networking system, wherein the social networking system maintains for each of a plurality of users, a user account, social connections of the user, and information describing actions performed by the user;

sending a request by the external system to the social networking system for social network information associated with the subject user, the social network information comprising information associated with the user stored in the social networking system, the external system configured to provide an online service to the subject user;

establishing, by the external system with the social networking system, a predetermined time period during which the external system is allowed to use the social network information associated with the subject user of the social networking system and shared by the social networking system with the external system;

receiving, by the external system, a response from the social networking system, the response comprising information responsive to the request for information and one or more privacy settings governing the use of the information, the one or more privacy settings selected by the subject user and specifying rules for access to social network information associated with the subject user, each rule determining whether one or more items of the social network information associated with the subject user are available to one or more other users of the plurality of users;

using, by the external system, the information from the received response in accordance with the one or more privacy settings; and

responsive to receiving the social network information associated with the subject user, deleting, by the external system, after the predetermined time period, at least a portion of the information associated with the subject user received from the social networking system.

2. The computer implemented method of claim 1, wherein the response from the social networking system comprises information associated with the subject user.

3. The computer implemented method of claim 1, wherein the response from the social networking system comprises information associated with the subject user, and wherein the social networking system requires use of the information associated with the subject user by the external system to be subject to the one or more privacy settings.

4. The computer implemented method of claim 1, further comprising:

responsive to the social networking system updating the one or more privacy settings for the subject user, receiving one or more of the updated privacy settings, the one or more updated privacy settings conveyed as a request from the social networking system to cease using the information in the received response.

5. The computer implemented method of claim 1, wherein the information associated with the subject user comprises information unaffected by any change in the one or more privacy settings, and wherein the information unaffected by any change in the one or more privacy settings is not deleted after the predetermined time period.

6. The computer implemented method of claim 1, further comprising:

responsive to the social networking system updating the one or more privacy settings to change one or more of the rules for access to the social network information associated with the subject user, receiving one or more of the updated privacy settings from the social networking system with instructions to enforce the updated privacy settings.

7. The computer implemented method of claim 6, wherein the updated privacy settings are responsive to a request from the subject user to update privacy settings associated with the subject user.

8. The computer implemented method of claim 6, wherein the updated privacy settings are responsive to a request from another user connected to the subject user via the social networking system to update privacy settings associated with the other user.

9. The computer implemented method of claim 6, wherein the instructions include enforcing the updated privacy settings before the predetermined time period has lapsed.

10. The computer implemented method of claim 1, further comprising:

responsive to needing the social network information after the predetermined period of time has lapsed, sending a second request to the social networking system for social network information associated with the subject user.

11. A non-transitory computer-readable storage medium storing instructions, the instructions when executed by a processor causing the processor to:

interact, by an external system, with a subject user of a social networking system, wherein the social networking system maintains a user account for each of a plurality of users, a user account, social connections of the user, and information describing actions performed by the user;

send, by the external system, a request to the social networking system for social network information associated with the subject user, the social network information comprising information associated with the user stored in the social networking system, the external system configured to provide an online service to the subject user;

establish, by the external system with the social networking system, a predetermined time period during which the external system is allowed to use the social network information associated with the subject user of the social networking system and shared by the social networking system with the external system;

receive a response from the social networking system, the response comprising information responsive to the request for information and one or more privacy settings governing the use of the information, the one or more privacy settings selected by the subject user and specifying rules for access to social network information associated with the subject user, each rule determining whether one or more items of the social network information associated with the subject user are available to one or more other users of the plurality of users;

use the information from the received response in accordance with the one or more privacy settings; and

responsive to receiving the social network information associated with the subject user, delete, after the predetermined time period, at least a portion of the information associated with the subject user received from the social networking system.

12. The non-transitory computer-readable storage medium of claim 11, wherein the response from the social networking system comprises information associated with the subject user.

13. The non-transitory computer-readable storage medium of claim 11, wherein the response from the social networking system comprises information associated with the subject user, and wherein the social networking system requires use of the information associated with the subject user by the external system to be subject to the one or more privacy settings.

14. The non-transitory computer-readable storage medium of claim 11, the instructions further causing the processor to:

responsive to the social networking system updating the one or more privacy settings for the subject user, receive one or more of the updated privacy settings, the one or more updated privacy settings conveyed as a request from the social networking system to cease using the information in the received response.

15. The non-transitory computer-readable storage medium of claim 11, wherein the information associated with the subject user comprises information unaffected by any change in the one or more privacy settings, and wherein the information unaffected by any change in the one or more privacy settings is not deleted after the predetermined time period.

16. The non-transitory computer-readable storage medium of claim 11, the instructions further causing the processor to:

responsive to the social networking system updating the one or more privacy settings to change one or more of the rules for access to the social network information associated with the subject user, receive one or more of the updated privacy settings from the social networking system with instructions to enforce the updated privacy settings.

17. The non-transitory computer-readable storage medium of claim 16, wherein the updated privacy settings are responsive to a request from the subject user to update privacy settings associated with the subject user.

18. The non-transitory computer-readable storage medium of claim 16, wherein the updated privacy settings are responsive to a request from another user connected to the subject user via the social networking system to update privacy settings associated with the other user.

19. The non-transitory computer-readable storage medium of claim 16, wherein the instructions include enforcing the updated privacy settings before the predetermined time period has lapsed.

20. The non-transitory computer-readable storage medium of claim 11, the instructions further causing the processor to:

responsive to needing the social network information after the predetermined period of time has lapsed, send a second request to the social networking system for social network information associated with the subject user.