LOS ANGELES — If you had 800 million friends, you’d think you’d be worry-free. But Facebook isn’t.
As part of its plans to go public, the popular social network has spelled out its worst nightmares — a litany of scenarios in which its unmatched success in social networking is gnawed at by federal regulators, adverse media coverage, widespread privacy concerns, rampant hacker attacks, unseen flaws in its technology and worst of all, unhappy users.
“It just struck me about how aware they are of their vulnerabilities,” Ryan Calo, director of privacy at Stanford Law School’s Center for Internet & Society, said after reading the 150-page document Facebook Inc. filed with federal regulators Wednesday to start its path toward an initial public offering of stock.
Many of Facebook’s most serious concerns arise from a tension at the core of its business: ensuring the privacy of its customers while also using what it knows about them to court advertisers.
“They have a narrow path to walk, and their risk factors really dramatize that in a way we hadn’t seen before,” Calo said.
By storing, transmitting and analyzing the huge amount of user data it collects each day, Facebook said, it sends its customers “billions” of ads a day, all keyed to “the information they have chosen to share.”
One of the company’s triumphs as both a business and a popular digital gathering place is that it has coaxed users into sharing ever larger amounts of information about themselves and their daily doings — information it readily turns into advertising gold.
“The ad economy is really monetized by the sharing of personal information,” said Ashkan Soltani, an independent privacy and security researcher.
“The more information that’s flowing, the better the odds of targeting you are,” Soltani said.
But the company has repeatedly run afoul of both its users and federal authorities who saw it as less than upfront about the kinds of information it collects and where it all ends up.
In November, the Federal Trade Commission accused the company of deception and violations of federal law by telling users it would keep their information private “and then repeatedly allowing it to be shared and made public.”
As part of a far-reaching settlement, Facebook agreed to allow independent privacy audits every other year for 20 years and to obtain users’ permission before changing privacy settings.
Noting the FTC probe and a similar bout recently with privacy regulators in Ireland, Facebook said in its filing with the Securities and Exchange Commission that it might well be subject to future investigations by government authorities.
That “could cause us to incur substantial costs or require us to change our business practices in a manner materially adverse to our business,” the filing says.
Moreover, the company said that even though it takes substantial precautions to protect its rich cache of user data, hacking has become an increasing problem for Internet companies, and Facebook believes it may be in attackers’ cross-hairs.
“Because of our prominence, we believe that we are a particularly attractive target for such attacks,” it said. Any failure to protect its user data from malicious intrusions, the company acknowledged, “may harm our reputation and our ability to retain existing users and attract new users.”
Though the FTC settlement led Chief Executive Mark Zuckerberg to declare he was “the first to admit that we’ve made a bunch of mistakes,” he said he was “committed to making Facebook the leader in transparency and control around privacy.”
Still, the company has already raised eyebrows among privacy critics with a data-sharing feature it unveiled last month.
The feature allowed popular Internet companies to launch several dozen new Facebook applications that — after they are first installed — automatically record and publicize a user’s online activities, including the songs they listen to, the news stories they read and the videos they watch.
Facebook calls this “frictionless sharing” because users can be broadcasting their online doings without taking any action — or, as critics said, without even being aware they’re doing it.