Youth site Nexopia draws privacy complaint

Canada's privacy commissioner should investigate how a youth-oriented social networking site uses the personal information of its members, an Ottawa-based consumer advocacy group says.

Canada's privacy commissioner should investigate how a youth-oriented social networking site uses the personal information of its members, an Ottawa-based consumer advocacy group said Tuesday.

The Public Interest Advocacy Centre has filed a complaint with Jennifer Stoddart about Nexopia's alleged "unnecessary and non-consensual use and disclosure of personal information."

Nexopia boasts that it has more than 1.4 million users, most of them living in Western Canada, and has become "the place to be for teens looking to express themselves to the world." It hosts user profiles, blogs and forums and has attracted controversy for giving teens a venue to talk about risqué topics like drugs and sex.

Police have said that sexual predators have used Nexopia to search for young victims.

The Edmonton-based website should be forced to adjust how it deals with the personal information of users, who are as young as 13 and may not fully appreciate the implications of what happens to the words and photos they post online, said John Lawford, lawyer for the advocacy centre.

"We did some focus groups with young people in Toronto and we looked at other [research] and it's fairly clear that as you go from 13 to even 16 there's a huge change in the awareness and maturity of teens," he said.

"At the first few years they are especially seeking out notoriety and expressing themselves and trying to find like-minded people. So we ask, does Nexopia have to meet a different privacy level than other social networking sites because they say they're going after teens? And we conclude they do."

The complaint to Stoddart outlines six alleged privacy breaches of the Personal Information Protection and Electronic Documents Act, including a failure to obtain consent to disclose users' information.

Default settings leave profiles open

Lawford also complains that Nexopia profiles, by default, can be accessed by any internet user and show up in Google's search results.

Nexopia chief executive Boris Wertz said Tuesday in an interview that if the privacy commissioner were to make a ruling about the personal information of teens it would have wide-reaching implications for websites operating in Canada.

"If it was decided that minors, or teenagers aged 13 to 18, have no right to decide if they want to have their information public or not then a lot of sites in the world need to change their privacy settings for Canada — it's Twitter, it's Facebook, it's MySpace and it's Nexopia," he said.

Nexopia's profiles are public by default because the idea of the site has always been about interacting with as wide an audience as possible, Wertz said. He noted that Facebook was once a gated community but has also encouraged its users to make their content public.

Last year Stoddart wrote in a report about Facebook's privacy policies that users should decide whether their social networking information is searchable by all the web's users.

"Facebook contends that many users do wish to be searchable, but did not provide any evidence of this. As Facebook has suggested, its users see themselves as a community. In my view, it should be left up to the individual user to decide for himself or herself whether to make information available outside the community," she wrote in July 2009.

It is a reasonable expectation to think Nexopia would keep user data from the rest of the web, and making personal information about young users available to anyone is dangerous, the advocacy centre states in its complaint sent to Stoddart.

"The information that a user enters into their profile can be extremely sensitive, especially if disclosed to the general public. Users may reveal information about their image, sexual orientation and specific location, including their school," the group writes.

"It should therefore not be the default that this information is made available to everyone on the internet … [and the advocacy centre] submits that it is difficult for users to change their visibility and privacy settings given that these settings do not exist in a single place."

The group also contends that Nexopia does not adequately explain its advertising practices and should follow the Canadian Marketing Association's lead in having special rules in dealing with the personal information of teens.

"You want to have your blog post seen by the world, by the community," he said.

A spokeswoman for Stoddart confirmed the complaint has been received and that it will be reviewed.