Facebook is uniquely positioned to provide one other powerful privacy feature. It could use its own facial-recognition capabilities to see whether anyone else’s profile pictures seem like a match for yours—whether you have Facebook doppelgangers. If you do, then an algorithm like FindFace will have a hard time pinpointing you in particular as opposed to your lookalikes. And if you really are unique, Facebook could offer to blur the photo and lower the resolution until you fade into the crowd.
* * *
The reason that Facebook can offer this range of privacy protections is that it is a walled garden. It controls content like profile pictures, and the only way to get them is to go through Facebook, rate-limiting and all. Unfortunately, a vast sea of images on the Internet—perhaps even the majority of them—are not under anyone’s control.
Google your name. Look at the gallery of familiar faces staring back. Google didn’t covertly extract these pictures from Facebook. Its army of bots collected them from millions of public websites and linked them to keywords on the page, your name included. Since these bots take a little information from a lot of different places, no single website has reason to restrict these visits in the way that Facebook does siphoning. In fact, most sites actively seek out these bots to ensure that they’re searchable on Google.
Right now, the primary way that you can search for an image is with keywords describing it. Google does allow you to search for images with other images, but it doesn’t use facial recognition to do so—you can’t search for similar faces like you can with FindFace. In fact, Google Executive Chairman Eric Schmidt referred to facial recognition as “the only technology Google has built and, after looking at it, we decided to stop.”
But the ability to crawl the web and amass a database of photos is not the sole province of big search engines like Google. Although mimicking FindFace on the scale of the entire Internet is probably still beyond the realm of technical feasibility for the moment, it may not be impossible for long. Facial recognition technology is improving exponentially according to experts at NIST, and storage and processing power are always getting cheaper. A startup with fewer ethical inhibitions may soon be able to write a web crawler, build a database, and unleash the Internet-wide facial recognition search that Google has thus far resisted. And once this feature becomes the next social media must-have, will companies like Google continue to hold back?
Even if the Internet won’t turn into a giant facial-recognition database tomorrow, this technology can be applied on a smaller scale right now—in fact, it already has. In 2011, Alessandro Acquisti, a professor at Carnegie Mellon University, downloaded the profile pictures of every member of the school’s network on Facebook and matched them against webcam photos of volunteers. He found that almost a third of his subjects could be identified in this manner, revealing their Facebook profiles. With today’s technology, the success rate likely would be much higher. (In the time since Acquisti’s experiment, Facebook has improved protections after several of these mass download incidents.)