Dear Mark Zuckerberg..

I just finished reading your response to the Cambridge Analytica scandal … with quite a few years in online advertising under my belt I know something about trust and figured I have some thoughts you might find helpful.

The core problem with Facebook’s public trust problem is that, by default, you trust the wrong people… your advertisers and developers.

What’s worse, you don’t fully trust your own users…

I think you can fix this… pretty quickly, by changing a few core things. Read on.

Problem #1: You trust by default.

As an advertiser I can target people who are interested in “Relationship Counseling” with a few clicks. You trust me not to do anything bad with that information…

Yet. If my ad copy were to say .. “Struggling with your relationship?”, it would get rejected by your audit team. The problem is not the ad’s impact on the user, but that the user can realize that I know he/she is in relationship counseling.

I mean, your team says it themselves:

“Ads must not contain content that asserts or implies personal attributes.”

And then provides some very helpful examples. This is my personal favorite:

So… it’s ok for me to sell services to people who are broke. I just can’t suggest that I know you’re broke!! Oh, and if you weren’t aware, those who target broke people tend to be some of the worst people out there. I highly recommend John Oliver’s segment on predatory lending.

So problem #1. You trust your advertisers by default.

Problem #2: You are opaque with your customers.

I tried to find out what you know about me. Using your tools, I couldn’t find it. I had to google to find an article that pointed me to the page (very well hidden btw) where I could actually see what you “know about me”. This tool is great, and making it more prominent is also great.

And here is the second problem. You make this information hard to find, hard to control and you certainly don’t make it clear to me when and how you use it.

What if you flip these two fundamental beliefs?

You can’t claim that you don’t know about this. There was some bad press last year about you enabling people to target individuals with anxiety. What did you do? You removed the ability to target anxiety.

This is what you do, each time. Bad news comes up, you play “whack a mole”, exclude the bad thing that was found, and then try to continue as usual.

And thus my reason for this letter… your response is simply… more of the same, and not enough.

You propose you will audit people with “access to large amounts of information” … so you’ll play whack-a-mole with all the big boys and reduce the abuse a bit.

You have, what, 100s of thousands of advertisers and developers and will audit 0.1% of them?

Mark, do you truly believe this will change the trust equation?

What can you do?

Suggestion #1: Stop trusting by default. Audit before you grant access, not after.

I know a little bit about Trust. From 2005–2007 I ran the analytics team at “Right Media”, the first online ad exchange.. and we had some serious serious ad quality issues. Why? By default we trusted our advertisers. They would throw all sorts of shit in their ads… and we’d have to go back and turn them off one by one.

At my next job, co-founding another AdTech startup, AppNexus, we vowed not to make the same mistake and instead flipped the model… every single advertisement *AND* landing page, had to be approved by default. A strange thing happened, the number of problems we had with bad advertisements dropped dramatically. (We had other trust issues, but related to supply, where we did trust by default!)

Audit before you grant it, not after, and not only for those who had “access to large amounts of information”. Ensure they have a proper business case, ensure they have encryption and proper data controls.

Yes, it’ll be expensive and mean a revenue hit. Yes it throws up a massive hurdle. But, if you truly want to protect our data, this is the only way.

While you’re at it… stop auditing just the content of the ads, but also look closely at the offer and the brand. Just this past Monday I was still getting ads for “Kryptonex ” offering access to Sweden’s new cryptocoin — a brilliant bitcoin scam. (landing page here)

Must suck to read that huh? You thought you banned this back in June, but no… bitcoin scams slip through on a nearly weekly basis!

Suggestion #2: Trust your users, be 100% transparent about the data access you grant and how it’s used.

If an advertiser is using the fact that I’m broke to target me… let me know. Show it in the ad. Be transparent. Give me the control, right then and there, to remove that piece of data about me. Hey, you could even have people replace it with data that they *would* be interested in seeing advertisements about.

Initially you’ll probably piss off a lot of people, but that probably means you shouldn’t have been doing these things in the first place!

I’m, eternally optimistic. If you trust in your true customers, the billions of people who use Facebook, they will repay that trust.

In conclusion

I have great respect for the company you have built, and I believe that you mean well. That said, from what I read, it feels like you have lost touch.

Hopefully this letter helped. Happy to chat further if you like.

-Mike