Two days ago, the New York Times reported that Facebook had given some of the largest technology companies broader access to user data than most people were aware of. The year is ending much as it began.
In March, the Guardian, the Observer and the New York Times reported that Cambridge Analytica, a political consulting firm, had obtained data from millions of Facebook profiles. The data was collected through a personality quiz app. A few hundred thousand people installed it, and under Facebook's rules at the time, the app could also collect data about their friends. Facebook later estimated the number of people affected at up to 87 million.
Most of those people never used the quiz.
This year marked a change in public perception. Many people stopped viewing social media as a helpful service and began viewing it as something acting upon them.
What happened this year?
For the full timeline, the Wikipedia article on the Facebook and Cambridge Analytica data scandal presents it clearly. In summary:
- March: the reports are published. #DeleteFacebook trends, and Facebook's stock declines.
- April: Mark Zuckerberg testifies before the US Congress over two days. Facebook begins restricting what apps and developers can access.
- May: Cambridge Analytica shuts down. The GDPR applies in Europe the same month.
- September: Facebook discloses a security breach involving its "View As" feature. In October, it states that personal data was taken from about 29 million people.
- October and December: Google announces it will shut down the consumer version of Google+ after finding bugs that exposed profile data, and then moves the closure date up to April.
In Canada, the federal Privacy Commissioner and British Columbia's commissioner opened a joint investigation into Facebook in April. It is still under way.
For ordinary users, these events have merged into a single impression: these companies know a great deal about them, and they do not really know what is done with that information.
What did this mean for small businesses on social media?
Small businesses were not responsible for these events, but they were directly affected by them.
The restrictions on platform access disrupted tools almost overnight. Scheduling apps, reporting dashboards and any tool that pulled data from Facebook or Instagram had to be rebuilt or reapproved, and some stopped working entirely. Facebook discontinued ad targeting based on external data brokers. In addition, the January News Feed change was already reducing organic reach for pages.
In a single year, a small business on Facebook therefore faced lower reach, fewer tools, different advertising options, and customers who were more wary of the platform as a whole, all without being consulted.
Facebook was not the only platform involved. In July, Twitter removed locked accounts, and many follower counts fell overnight. This week, Tumblr banned adult content, and many ordinary accounts are being flagged in error. Google+ is closing. The platforms differ, but the lesson is the same.
This pattern is familiar to us. We have observed platforms rise, change and decline since the Raincity years in Vancouver. A business that builds on another company's platform remains subject to that company's decisions, which can change access at any time.
How can a business own its audience?
This is the central lesson for any business, and it was valid well before this year.
Your followers on a platform are not your audience. They are the platform's audience, and the platform allows you to reach some of them, some of the time, on its terms. Your email list, your website and your domain name belong to you. No algorithm change can reduce your reach to your own list, and no automated system error can suspend your website.
This does not mean leaving social media. It means using social media as an entry point rather than as your primary base. Every effective post should give people a reason to visit your site, subscribe to your email newsletter, or contact you directly.
One detail matters more than many expect: use your own domain for email rather than a free webmail address. If your business email is on your own domain, you can change providers without changing your address, and your business appears more established. Setting up domains and email properly is inexpensive, and it is one more asset you own.
Why should a business be transparent about its data?
This year, people began asking what businesses do with their information. Not everyone asks, and not every time, but enough people do for it to matter.
Most small businesses do very little with customer data. That is positive, and it is worth stating. Write a short privacy policy in plain language. Collect only what you need. If you run Facebook or Google ads with tracking on your site, disclose it. Do not install pixels you do not use.
Transparency on small matters builds trust on larger ones, and the law is moving in the same direction. The GDPR applies to any business with European customers, and in Canada, reporting data breaches under PIPEDA became mandatory on November 1.
How should a business prepare for rule changes?
The main lesson of this year is that platforms will change their rules quickly and without consulting you.
We therefore recommend planning for it. Assume that any platform you depend on could cut your reach in half next year, change its advertising rules, or lose favour with your customers, and determine what you would still have. If the answer is very little, the solution is a solid website, a genuine email list, and a consistent practice of moving people from rented platforms to channels you own.
Social media remains a daily tool for us going into the new year. However, we do not rely on it to hold anything a business cannot afford to lose.