After a flood of criticism stemming from the Cambridge Analytica scandal, Facebook has this week released its updated privacy tools and settings, which are in compliance with the EU’s General Data Protection Regulation (GDPR) and will apply to all users across the world (with some regional variations).

And they do comply with the new, higher privacy standards - Facebook’s updates are in line with all requirements – they tick all the boxes. But as with all aspects of data usage, on Facebook and beyond, there’s more to it than just straight compliance.

The complications lie in the detail.

That’s not to criticize Facebook – they’ve absolutely done what they need to, and the privacy controls and options on offer are best in class. For example, Facebook will make it easier for users to opt-out of data sharing from partners, which Facebook uses to refine its specific audience focus, and their settings in relation to political, religious, and relationship information will be clearer and easier to remove if users so wish.

Essentially, this is similar to the process as it is right now, but Facebook's overhauled the system to make it clearer, easier to understand, and easier to opt-out of any targeting elements you might feel overstep the bounds.

Facebook will also enable EU nations to utilize its face-recognition technology, which has been banned in Europe since 2012 due to privacy concerns.

As explained by Facebook:

“We’ve offered products using face recognition in most of the world for more than six years. As part of this update, we’re now giving people in the EU and Canada the choice to turn on face recognition. Using face recognition is entirely optional for anyone on Facebook.”

That ‘entirely optional’ focus is emphasized throughout the update – Facebook is very clearly working to make users understand the control is with them, that you can choose which information you do and don’t share on the platform. Which is largely how it is now, and how it has been for some time, but that hasn’t stopped people from scrolling through to get to the ‘I agree’ button without taking in the specific detail.

And that’s the core criticism, and core challenge, here. As noted by TechCrunch (where Josh Constine has provided a solid, in-depth review of each element), while Facebook follows the letter of the law with their update, the whole process seems to put more focus on quick sign-up, as opposed to prompting users to take a moment to best understand what exactly they’re agreeing to. But at the same time, it’s difficult to put the pressure on Facebook for this – they are giving users the options, and they are communicating them. They can’t be expected to hold people’s hands, necessarily, as they go through the system.

This is where the broader debate needs to focus – the problem is less about what data people submit, and more about explaining the full context of what such insights can mean. As we’ve noted previously, people don’t see much value in their personal insights based on Facebook actions – so what if Facebook knows you like 'MMA' and 'corn chips'? But in aggregate, those insights can be hugely indicative – you, as an individual, likely don’t realize it, but every element you share can be powerful when matched against broader trend sets, which is what Cambridge Analytica reportedly used to manipulate voters with political messaging.

But is it on Facebook to explain that better? And can they actually do so in a way which would prompt users to take pause and consider their actions in a deeper way?

Really, it’s likely that people would rush through to sign up anyway, because Facebook, and social media more broadly, has become such an essential element in the modern interactive process. If you want evidence of this, go and tell people that Facebook’s terms of service, which they’ve agreed to, allow the company to listen in to their conversations at any time.

They don’t, but most people would believe you, because they’ve never read the terms and conditions.

Facebook’s updated regulations explain each element in more detail, and provide resources to help users understand. But the question is, will people actually pay more attention?