Dynamic enforcement of privacy settings by a social networking system on information shared with an external system

• US 8,955,145 B2
• Filed: 04/30/2014
• Issued: 02/10/2015
• Est. Priority Date: 07/23/2009
• Status: Active Grant

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Inventors: Vernal, Michael Steven, Zhu, Wei, Leszczenski, James M., Elman, Joshua E., Morin, David Brookes, Cheever, Charles Duplain, Sanghvi, Ruchi
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US14/266,300
• Publication Number:
  US 20140237618A1
• Time in Patent Office: 286 Days
• Field of Search: 726/1, 726 26- 30
• US Class Current: 726/26
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/306 User profiles

Abstract

An external system (such as a website) that interacts with users communicates with a social networking system to access information about the users, who may also be users of the social networking system. If a privacy setting is changed in the social networking system, and the change applies to information that has been shared with an external system, the change is enforced at the external system. For example, the external system may be notified that the information is invalid and must be deleted, or the external system may periodically request the information so that changes to the privacy settings are eventually experienced at the external systems. When an external system again needs the information, whether expired naturally or actively invalidated by the social network, the external system sends a new request for the information, which is subject to the (possibly revised) privacy settings.

Claims

1. A computer implemented method comprising:

maintaining a user account for each of a plurality of users of a social networking system, each user account comprising social network information associated with a respective user of the plurality of users;

establishing a plurality of connections, each connection between two or more of the user accounts;

maintaining, by the social networking system, one or more privacy settings for a subject user of the plurality of users, the maintained privacy settings selected by the subject user and containing rules for access to social network information associated with the subject user, each rule making one or more items of the social network information associated with the subject user either available or unavailable to one or more other users of the plurality of users based on the established connections between the subject user and the one or more other users;

receiving a request from an external system for information associated with the subject user of the social networking system, the external system outside of the social networking system, the external system configured to provide an online service to the subject user, and the external system further configured to personalize the online service with information associated with the subject user obtained from the social networking system;

establishing, with the external system, a predetermined time period for the external system to delete at least a portion of the information associated with the subject user of the social networking system and shared with the external system by the social networking system; and

transmitting a response to the external system, the response comprising information responsive to the request for information associated with the subject user based on the maintained privacy settings, the external system configured to delete at least a portion of the information associated with the subject user that was transmitted to the external system by the social networking system.

2. The computer implemented method of claim 1, wherein the response to the external system comprises information associated with the subject user and information describing the maintained privacy settings.

3. The computer implemented method of claim 1, wherein the response to the external system comprises information associated with the subject user, and wherein the social networking system requires use of the information associated with the subject user by the external system to be subject to privacy settings.

4. The computer implemented method of claim 1, further comprising:

updating the maintained privacy settings; and

responsive to updating the privacy settings for the subject user, communicating one or more of the updated privacy settings to the external system by sending a request to the external system to cease using the information in the transmitted response.

5. The computer implemented method of claim 1, wherein the information associated with the subject user comprises information unaffected by any change in the maintained privacy settings, and wherein the information unaffected by any change in the maintained privacy settings is not deleted after the predetermined time period.

6. The computer implemented method of claim 1, further comprising:

updating the maintained privacy settings to change one or more of the rules for access to the social network information associated with the subject user; and

responsive to updating the maintained privacy settings, communicating one or more of the updated privacy settings to the external system instructing the external system to enforce the updated privacy settings.

7. The computer implemented method of claim 6, wherein updating the maintained privacy settings is responsive to a request from the subject user to update privacy settings associated with the subject user.

8. The computer implemented method of claim 6, wherein updating the maintained privacy settings is responsive to a request from another user connected to the subject user via the social networking system to update privacy settings associated with the other user.

9. The computer implemented method of claim 6, wherein the external system is instructed to enforce the updated privacy settings before the predetermined time period has lapsed.

10. A non-transitory computer-readable storage medium storing instructions, the instructions when executed by a processor causing the processor to:

maintain a user account for each of a plurality of users of a social networking system, each user account comprising social network information associated with a respective user of the plurality of users;

establish a plurality of connections, each connection between two or more of the user accounts;

maintain, by the social networking system, one or more privacy settings for a subject user of the plurality of users, the maintained privacy settings selected by the subject user and containing rules for access to social network information associated with the subject user, each rule making one or more items of the social network information associated with the subject user either available or unavailable to one or more other users of the plurality of users based on the established connections between the subject user and the one or more other users;

receive a request from an external system for information associated with the subject user of the social networking system, the external system outside of the social networking system, the external system configured to provide an online service to the subject user, and the external system further configured to personalize the online service with information associated with the subject user obtained from the social networking system;

establish, with the external system, a predetermined time period for the external system to delete at least a portion of the information associated with the subject user of the social networking system and shared with the external system by the social networking system; and

transmit a response to the external system, the response comprising information responsive to the request for information associated with the subject user based on the maintained privacy settings, the external system configured to delete at least a portion of the information associated with the subject user that was transmitted to the external system by the social networking system.

11. The non-transitory computer-readable storage medium of claim 10, wherein the response to the external system comprises information associated with the subject user and information describing the maintained privacy settings.

12. The non-transitory computer-readable storage medium of claim 10, wherein the response to the external system comprises information associated with the subject user, and wherein the social networking system requires use of the information associated with the subject user by the external system to be subject to privacy settings.

13. The non-transitory computer-readable storage medium of claim 10, further comprising:

updating the maintained privacy settings; and

responsive to updating the privacy settings for the subject user, communicating one or more of the updated privacy settings to the external system by sending a request to the external system to cease using the information in the transmitted response.

14. The non-transitory computer-readable storage medium of claim 10, wherein the information associated with the subject user comprises information unaffected by any change in the maintained privacy settings, and wherein the information unaffected by any change in the maintained privacy settings is not deleted after the predetermined time period.

15. The non-transitory computer-readable storage medium of claim 10, the processor further caused to:

update the maintained privacy settings to change one or more of the rules for access to the social network information associated with the subject user; and

responsive to updating the maintained privacy settings, communicate one or more of the updated privacy settings to the external system instructing the external system to enforce the updated privacy settings.

16. The non-transitory computer-readable storage medium of claim 15, wherein updating the maintained privacy settings is responsive to a request from the subject user to update privacy settings associated with the subject user.

17. The non-transitory computer-readable storage medium of claim 15, wherein updating the maintained privacy settings is responsive to a request from another user connected to the subject user via the social networking system to update privacy settings associated with the other user.

18. The non-transitory computer-readable storage medium of claim 15, wherein the external system is instructed to enforce the updated privacy settings before the predetermined time period has lapsed.

19. A computer system comprising:

an electronic processor; and

a non-transitory memory storing instructions executable by the electronic processor to;

maintain a user account for each of a plurality of users of a social networking system, each user account comprising social network information associated with a respective user of the plurality of users;

establish a plurality of connections, each connection between two or more of the user accounts;

maintain, by the social networking system, one or more privacy settings for a subject user of the plurality of users, the maintained privacy settings selected by the subject user and containing rules for access to social network information associated with the subject user, each rule making one or more items of the social network information associated with the subject user either available or unavailable to one or more other users of the plurality of users based on the established connections between the subject user and the one or more other users;

receive a request from an external system for information associated with the subject user of the social networking system, the external system outside of the social networking system, the external system configured to provide an online service to the subject user, and the external system further configured to personalize the online service with information associated with the subject user obtained from the social networking system;

establish, with the external system, a predetermined time period for the external system to delete at least a portion of the information associated with the subject user of the social networking system and shared with the external system by the social networking system; and

transmit a response to the external system, the response comprising information responsive to the request for information associated with the subject user based on the maintained privacy settings, the external system configured to delete at least a portion of the information associated with the subject user that was transmitted to the external system by the social networking system.

20. The system of claim 19, the non-transitory memory storing instructions further executable by the electronic processor to:

update the maintained privacy settings to change one or more of the rules for access to the social network information associated with the subject user; and

responsive to updating the maintained privacy settings, communicate one or more of the updated privacy settings to the external system instructing the external system to enforce the updated privacy settings.