# US 8,752,186 B2 · Dynamic enforcement of privacy settings by a social networking system on information shared with an external system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,752,186 B2 - Document ID: US8752186B2 - Status: Granted - Kind: B2 - Application number: 12/508,523 - Filed: 2009-07-23 - Published: 2011-01-27 - Granted: 2014-06-10 - Earliest claimed: 2009-07-23 - Assignees: Facebook, Inc. - Applicants: Michael Steven Vernal; Wei Zhu; James M. Leszczenski; Joshua E. Elman; David Brookes Morin; Charles Duplain Cheever; Ruchi Sanghvi - Inventors: Michael Steven Vernal; Wei Zhu; James M. Leszczenski; Joshua E. Elman; David Brookes Morin; Charles Duplain Cheever; Ruchi Sanghvi - Web page: https://patentgrep.com/patent/US8752186B2 ## CPC - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - H04L 63/102: {Entity profiles} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/306: User profiles - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An external system (such as a website) that interacts with users communicates with a social networking system to access information about the users, who may also be users of the social networking system. If a privacy setting is changed in the social networking system, and the change applies to information that has been shared with an external system, the change is enforced at the external system. For example, the external system may be notified that the information is invalid and must be deleted, or the external system may periodically request the information so that changes to the privacy settings are eventually experienced at the external systems. When an external system again needs the information, whether expired naturally or actively invalidated by the social network, the external system sends a new request for the information, which is subject to the (possibly revised) privacy settings. ## Claims ### Claim 1 A computer implemented method comprising: maintaining a user account for each of a plurality of users of a social networking system, each user account comprising social network information associated with a respective user of the plurality of users; establishing a plurality of connections, each connection between two or more of the user accounts; maintaining, by the social networking system, one or more privacy settings for a subject user of the plurality of users, the maintained privacy settings selected by the subject user and containing rules for access to social network information associated with the subject user, each rule making one or more items of the social network information associated with the subject user either available or unavailable to one or more other users of the plurality of users based on the established connections between the subject user and the one or more other users; receiving a request from an external system for information associated with the subject user of the social networking system, the external system outside of the social networking system, the external system configured to provide an online service to the subject user, and the external system further configured to personalize the online service with information associated with the subject user obtained from the social networking system; transmitting a response to the external system, the response comprising information responsive to the request for information associated with the subject user based on the maintained privacy settings; updating the maintained privacy settings to change one or more of the rules for access to the social network information associated with the subject user; and responsive to updating the maintained privacy settings, communicating one or more of the updated privacy settings to the external system instructing the external system to enforce the updated privacy settings. ### Claim 2 (depends on 1) The computer implemented method of claim 1, wherein the response to the external system comprises information associated with the subject user based on the maintained privacy settings. ### Claim 3 (depends on 1) The computer implemented method of claim 1, wherein the response to the external system comprises information associated with the subject user and information describing the maintained privacy settings. ### Claim 4 (depends on 1) The computer implemented method of claim 1, wherein the response to the external system comprises information associated with the subject user, and wherein the social networking system requires use of the information associated with the subject user by the external system to be subject to privacy settings. ### Claim 5 (depends on 1) The computer implemented method of claim 1, wherein communicating one of more of the updated privacy settings to the external system comprises sending a request to the external system to cease using the information in the transmitted response. ### Claim 6 (depends on 1) The computer implemented method of claim 1, further comprising: receiving a subsequent request from the external system for information associated with the subject user, wherein the social networking system requires that the social network information associated with the subject user will be used by the external system for no more than a predetermined time period after receiving the social network information associated with the subject user. ### Claim 7 (depends on 1) The computer implemented method of claim 1, wherein updating the maintained privacy settings is responsive to a request from the subject user to update privacy settings associated with the subject user. ### Claim 8 (depends on 1) The computer implemented method of claim 1, wherein updating the maintained privacy settings is responsive to a request from another user connected to the subject user via the social networking system to update privacy settings associated with the other user. ### Claim 9 (depends on 1) The computer implemented method of claim 1, further comprising: requiring the external system to use the social network information associated with the subject user for no more than a predetermined time period after receiving the social network information associated with the subject user. ### Claim 10 A computer implemented method comprising: interacting with a subject user of a social networking system, the social networking system maintaining a user account for each of a plurality of users of the social networking system, each user account comprising social network information associated with a respective user of the plurality of users, and the social networking system further maintaining a plurality of connections, each connection between two or more of the user accounts, and the social networking system outside of an external system; sending a request by the external system to the social networking system for social network information associated with the subject user of the social networking system, the external system configured to provide an online service to the subject user, and the external system further configured to personalize the online service with information associated with the subject user obtained from the social networking system; receiving, by the external system, a response from the social networking system, the response comprising information responsive to the request for information associated with the subject user and one or more privacy settings governing the use of the information responsive to the request for information associated with the subject user, the one or more privacy settings selected by the subject user and containing rules for access to social network information associated with the subject user, each rule making one or more items of the social network information associated with the subject user either available or unavailable to one or more other users of the plurality of users based on the established connections between the subject user and the one or more other users; and using the information from the received response in accordance with the one or more privacy settings. ### Claim 11 (depends on 10) The computer implemented method of claim 10, further comprising: receiving updated privacy settings from the social networking system governing the use of the information responsive to the request for information associated with the subject user; and using information received from the social networking system in accordance with the updated privacy settings. ### Claim 12 (depends on 11) The computer implemented method of claim 11, further comprising: enforcing a policy of using the social network information associated with the subject user for no more than a predetermined time period after receiving the social network information associated with the subject user; and sending a request to the social networking system for the social network information associated with the subject user after the predetermined time period after receiving the social network information associated with the subject user. ### Claim 13 (depends on 11) The computer implemented method of claim 11, wherein the external system receives updated privacy settings from the social networking system, wherein the one or more privacy settings were updated in response to a request from the subject user. ### Claim 14 (depends on 11) The computer implemented method of claim 11, wherein the external system receives updated privacy settings from the social networking system, wherein the one or more privacy settings were updated in response to a request from a connection of the subject user to update privacy settings of the connection. ### Claim 15 (depends on 10) The computer implemented method of claim 10, wherein the response from the social networking system comprises information associated with the subject user based on the one or more privacy settings. ### Claim 16 (depends on 10) The computer implemented method of claim 10, wherein the response from the social networking system comprises information associated with the subject user based on the one or more privacy settings, the privacy settings containing rules for sharing social network information outside of the social networking system. ### Claim 17 (depends on 10) The computer implemented method of claim 10, wherein the response from the social networking system comprises information associated with the subject user, wherein the social networking system requires the external system to use information associated with the subject user based on the one or more privacy settings. ### Claim 18 (depends on 10) The computer implemented method of claim 10, wherein the response from the social networking system comprises information associated with the subject user, and using the information from the received response comprises determining a subset of the information associated with the subject user based on the one or more privacy settings. ### Claim 19 (depends on 10) The computer implemented method of claim 10, further comprising: receiving a communication from the social networking system requesting the external system to cease using the information in the previously transmitted response. ### Claim 20 (depends on 10) The computer implemented method of claim 10, further comprising: enforcing a policy to use the social network information associated with the subject user for no more than a predetermined time period after receiving the social network information associated with the subject user. ### Claim 21 (depends on 10) The computer implemented method of claim 10, further comprising: expunging any of the social network information associated with the subject user received from the social networking system after a predetermined period of time. ### Claim 22 A computer implemented method comprising: maintaining a user account for each of a plurality of users of a social networking system, each user account comprising social network information associated with a respective user of the plurality of users; establishing a plurality of connections, each connection between two or more of the user accounts; maintaining , by the social networking system, one or more privacy settings for a subject user of the plurality of users, the maintained privacy settings selected by the subject user and containing rules governing access to social network information associated with the subject user, each rule making one or more items of the social network information associated with the subject user either available or unavailable to one or more other users of the plurality of users based on the established connections between the subject user and the one or more other users; receiving a request from an external system for information associated with the subject user of the social networking system, the external system outside of the social networking system, the external system configured to provide an online service to the subject user, and the external system further configured to personalize the online service with information associated with the subject user obtained from the social networking system; and responding to the external system, the response comprising information associated with the subject user responsive to the request and information describing the maintained privacy settings governing access to the information associated with the subject user responsive to the request. ### Claim 23 (depends on 22) The computer implemented method of claim 22, further comprising: updating the maintained privacy settings changing one or more of the rules for access to the social network information associated with the subject user responsive to the request for information; and communicating the updated privacy settings to the external system instructing the external system to enforce the updated privacy settings. ### Claim 24 (depends on 23) The computer implemented method of claim 23, wherein information describing the updated privacy settings is communicated responsive to receiving a request to update privacy settings associated with the user. ### Claim 25 (depends on 23) The computer implemented method of claim 23, wherein information describing the updated privacy settings is communicated responsive to receiving a request to update privacy settings associated with a connection of the user. ### Claim 26 (depends on 22) The computer implemented method of claim 22, wherein the response to the external system comprises information associated with the subject user, wherein the social networking system requires the external system to use the information associated with the subject user based on the maintained privacy settings. ### Claim 27 (depends on 22) The computer implemented method of claim 22, wherein the information associated with the subject user responsive to the request comprises information identifying a subset of the information associated with the subject user based on the maintained privacy settings. ### Claim 28 (depends on 22) The computer implemented method of claim 22, wherein the information associated with the subject user responsive to the request is required by the social networking system to be used by the external system in accordance with the maintained privacy settings. ### Claim 29 (depends on 22) The computer implemented method of claim 22, further comprising: updating the maintained privacy settings; and sending a request to the external system to cease using the information associated with the subject user in a previously transmitted response. ### Claim 30 (depends on 22) The computer implemented method of claim 22, further comprising: updating the maintained privacy settings; and receiving a subsequent request from the external system for information associated with the subject user, wherein the social networking system requires the external system to use the social network information associated with the subject user for no more than a predetermined time period after receiving the social network information associated with the subject user. ### Claim 31 (depends on 22) The computer implemented method of claim 22, further comprising: requiring the external system to use the social network information associated with the subject user for no more than a predetermined time period after receiving the social network information associated with the subject user.