Date of Last Revision: October 27th, 2009

Developer Principles and Policies


Facebook Platform is an extension of Facebook, whose mission is to give people the power to share and make the world more open and connected.

Platform applications and developers are required to comply with the following three documents:


Here are some Examples and Explanations for specifics.

Principles

  1. Be trustworthy
    • Respect privacy
    • Don't mislead or surprise users
    • Don't spam - encourage authentic communications
  2. Create a great user experience
    • Build social and engaging applications
    • Give users choice and control
    • Help users share expressive and relevant content

Policies

  1. Presenting Your Policies
    1. You must provide a link to your privacy policy and any other applicable policies in the Info section of your application's Profile page and on every page of your application.
  2. Features and Functionality
    1. You must not confuse, mislead, surprise, or defraud anyone.
    2. You must not violate any law or the rights of any individual or entity, and must not expose Facebook or Facebook users to harm or legal liability as determined by us in our sole discretion.
    3. You must not use a user's session key to make an API call on behalf of another user.
    4. You must not include functionality that proxies, requests or collects Facebook usernames or passwords.
    5. You must not circumvent our intended limitations on core Facebook features. For example:
      1. You must not notify a user that someone has removed the user as a friend.
      2. You must not track visits to a user's profile, or estimate the number of such visits, whether aggregated anonymously or identified individually.
    6. You must not significantly alter the purpose of your application such that users would view it as entirely unfamiliar or different.
    7. To change the name of your application, you must use one of the following formats for 30 days before completely switching to your new application name: "New name (formerly 'old name')" or "New name (renamed)." For example, "App 2 (formerly App 1)" or "App 2 (renamed)."
  3. Storing and Using Data You Receive From Us
    1. You must not store or cache any data you receive from us for more than 24 hours unless doing so is permitted by the offline exception, or that data is explicitly designated as Storable Data.
    2. You must not give data you receive from us to any third party, including ad networks.
    3. You must not use user data you receive from us or collect through running an ad, including information you derive from your targeting criteria, for any purpose off of Facebook, without user consent.
    4. Unless authorized by us, your ads must not display user data - such as users' names or profile photos - whether that data was obtained from us or otherwise.
    5. You cannot convert user data you receive from us into Independent Data (e.g., by pre-filling user information with data obtained from the API and then asking the user to save the data).
    6. Before making use of user data that may be protected by intellectual property rights (e.g., photos, videos), you must obtain permission from those who provided that data to us.
    7. You must not give your secret key to another party, unless that party is an agent acting on your behalf as an operator of your application, but you must never give your secret key to an ad network. You are responsible for all activities that occur under your account identifiers.
  4. Application Content
    1. Prohibited Content - You are responsible for all content within your application, including advertisements and user-generated content. You must not promote, or provide content (including any advertising content) referencing, facilitating, containing or using, the following:
      1. Adult content, including nudity, sexual terms and/or images of people in positions or activities that are excessively suggestive or sexual;
      2. Obscene, defamatory, libelous, slanderous and/or unlawful content;
      3. Content that infringes upon the rights of any third party, including copyright, trademark, privacy, publicity or other personal or proprietary right, or that is deceptive or fraudulent;
      4. Liquor, beer, wine or other alcoholic beverages (unless the appropriate Demographic Restrictions are used), or sale of tobacco products, ammunition and/or firearms;
      5. Gambling, including without limitation, any online casino, sports books, bingo or poker;
      6. Inflammatory religious content;
      7. Politically religious agendas and/or any known associations with hate, criminal and/or terrorist activities;
      8. Content that exploits political agendas or uses "hot button" issues for commercial use regardless of whether the developer has a political agenda;
      9. Hate speech, whether directed at an individual or a group, and whether based upon the race, disability, sex, creed, national origin, religious affiliation, marital status, sexual orientation, gender identity, or language of such individual or group;
      10. Illegal activity and/or illegal contests, pyramid schemes, sweepstakes or chain letters; if you run, reference, or facilitate a legally permissible sweepstakes, contest, or other promotion you are subject to Facebook's Promotions Guidelines;
      11. "Spam" or other advertising or marketing content that violates applicable laws, regulations or industry standards.
    2. Content Unsuitable for General Facebook User Base
      1. If your application contains content unsuitable for consumption by the general Facebook user base (e.g., strong language, fantasy violence, simulated gambling; see also MPAA PG-13 and ESRB Teen standards), you must describe the nature of the content in the Info section of your application's Profile page.
      2. You must provide users with a way to report user-generated content and timely address any user reports.
    3. Advertisements and Cross-Promotions
      1. You must not include advertisements or promotions, cross-promote other applications, or provide web search functionality on user profile pages or in content distributed through Facebook communication channels.
      2. Your advertisements must comply with our Advertising Guidelines.
  5. Application Integration Points
    1. You must not incentivize users to grant additional permissions or use Application Integration Points.
    2. You must not provide users with rewards or gate content from users based on their number of friends who use your application.
    3. You must not require users to grant additional permissions or add Application Integration Points, and must only request extended permissions at reasonable times when the user engages with features that would require the use.
    4. You must not prompt users to send invitations, requests, generate notifications, or use other Facebook communication channels immediately after a user allows access or returns to your application.
    5. You must provide users with a "skip" button on any page where users are prompted to use a Facebook communication channel (e.g., invitations, requests, and notifications) that is adjacent to and the same size and design of the send option. If a user chooses to "skip" you must not present the user with a similar prompt during that user's visit to your application.
    6. You must not pre-select more than one person to receive information through a Facebook communication channel.
    7. You must only use one Facebook communication channel in response to a user's single action.
    8. You must not pre-fill the name, title, user_message parameter, or description of Photos, Videos, Notes, Links, Share, or Stream stories, unless the user generated the content earlier in the workflow.
    9. Your Application tab label must not contain a call to action (e.g., "Click Here").
    10. You must not prompt users to bookmark your application (e.g., by using a modal window or pop-up dialog). Instead, users must explicitly invoke any bookmark option you provide.
  6. Developer Responses to User Actions
    1. Notifications
      1. You must not send a user-to-user notification unless the sending user takes a direct action against a friend and would expect the notification to be sent.
      2. You must not send user-to-user notifications to multiple users without requiring the sending user to confirm the action with at least two clicks or steps. For example, if a feature states "Notify friends" or "Ask friends for help," when a user clicks on this option they must be presented with an additional confirmation step before any notifications are generated.
    2. Stream Stories
      1. You must not publish or prompt a user to publish a Stream story immediately after a user allows access or returns to your application.
      2. You must not use Stream stories as a method for users to invite friends to your application.
      3. You must use discretion when publishing Stream stories and must not misuse the Stream by publishing an excessive amount of stories on a user's behalf.
      4. You must not publish more than one story for a user's single action, i.e., do not publish a one-line story and present a user with the Feed form.
      5. You must not pre-fill the user_message parameter or content sent via an extended permission (such as a status update or note), unless the user generated the content earlier in the workflow.
      6. You must not include calls to action in the body of your Stream stories (e.g., "Beat her score!” or "Can you beat her score?"). A call to action must only be presented as an action link (in line with "comment" and "like" and similar to Facebook's stories in design).
      7. A Feed form cannot be used to present information to the user for the first time (such as quiz results).
      8. Stream stories must be consistent with our design and be user-focused based on the user's action that triggered the story. In no case should a Stream story serve primarily as a means to promote or advertise your application.
  7. Facebook's Feature and Functionality Terms and Trademarks
    1. You must not express or imply any affiliation or relationship with or endorsement by us.
    2. You must not use or make derivative use of Facebook icons.
    3. You must not use terms for Facebook features and functionality (e.g., fan, feed, status, tag, like) in the name of your application, any corresponding URL, or your application's features and functionality, if such use could confuse users into thinking that the reference is to Facebook features or functionality of the same name.
    4. You must not make use of Facebook trademarks, including but not limited to FACEBOOK, FACEBOOK LOGO, F LOGO, FB, WALL, POKE and 32665, or any trademarks or terms confusingly similar to Facebook trademarks, in any way that may suggest that we are affiliated with, endorse, or sponsor you or your application.
  8. Enforcement

    We can take enforcement action against you and any or all of your applications if we determine in our sole judgment that you or your application violates Facebook Platform Terms and Policies. Enforcement action can include disabling your application, restricting you and your application's access to Platform functionality, terminating our agreements with you, or any other action as we in our sole discretion deem appropriate.

  9. Changes

    We can change these Developer Principles and Policies at any time without prior notice as we deem necessary. Your continued use of Platform constitutes acceptance of those changes.

  10. Definitions
    1. By "Application" we mean canvas page application, Connect integration, or any other technical integration we have assigned an application identification number.
    2. By "Application Integration Point" we mean Profile Box, Application Info Section, Application tab, notification email, Feed, requests (including invites), Publisher, inbox attachments, Chat, Bookmarks, or any other feature of a user profile or Facebook communication channel in which or through which an application can provide, display, or deliver content directed at, on behalf of, or by permission of a user.
    3. By "User data you receive from Facebook" (also called "user data you receive from us," "user data received from Facebook," or "user data received from us") we mean any data or content (including any images, text, or other information or materials) you receive from us, that was provided by users to us or was associated by us with a particular user.
    4. By "Independent Data" we mean information that users provide directly to you.
    5. By "Facebook Platform Terms and Policies" we mean the Statement of Rights and Responsibilities and the Developer Principles and Policies.
  11. Additional Policies Governing Facebook Connect
    1. Login/Connect
      1. The website must display and use one of the approved Facebook Connect buttons on Facebook Connect Login Buttons to being the "Connect" process.
      2. When Facebook Connect is used to allow a user to "sign in" or authenticate with your website, the Facebook Connect option must be presented at least as prominently as the most prominent of any other sign in or authentication method on your site, and not as a secondary option.
      3. The website must offer an explicit "Log Out" option that also logs the user out of Facebook Connect.
      4. When a user has connected their account and is currently logged in on your site, the application must show the profile picture and name of the user in a visible place on the page. This profile picture should be no smaller than 16x16 pixels and should include the Facebook "f" favicon in the lower right corner. If the profile picture is too small to position the icon over the lower right corner, you can position the favicon to the right of the picture.
      5. When a user connects with your website, the user is granting this authentication/permission only to the specific website. The user's data or access cannot be made available to another website not under your control unless the user specifically connects to that website as well.
      6. If you have an application on Facebook and a website that implements Facebook Connect, the user will need to explicitly connect on your website before your website can use their information. However, once the user has both authorized the application and connected to your website, you can link the information.
      7. Best Practice: When you use a "Facebook Connect" button on your website, you should make sure to have the right descriptive text to describe how the experience will work on your site. For example, we recommend associating Facebook Connect with one of the following words or phrases: "Connect," "Sign In," "Sign Up," "Login," "Log in," "Create account," "Register," "Join," "Find your friends," or "Share with your friends."
    2. Feed
      1. Facebook Connect applications cannot publish one line stories automatically via the Facebook Platform API (i.e., without being presented to the user in a Feed form) unless the story and template have been approved through the Facebook Connect approval process. NOTE: This process is still being finalized. For now, you may not publish one line stories automatically.
      2. Best Practice: When a user completes an action in an application that would prompt a Feed form, the application should add a check box (to the part of the flow associated with completing the action) asking the user if they want to share this information through Facebook (e.g., "Share this run with my Facebook friends?"). The check box may be pre-checked by default, but if the user unchecks this box during the flow, the Feed form should not be shown.
      3. Best Practice: One line stories published from your site will be approved for automatic publishing only if they meet the following criteria: (1) the story contains information that is publicly available to users who can view the story (e.g., a user commented on an article); (2) the information shared in the story is associated with the user on the website (e.g., no anonymous data); (3) the story is a result of an explicit action taken by the user. NOTE: Details for how to get one-line stories approved will be announced soon.
    3. Friends and Friend Linking
      1. When representing a list of friends to a user on the website, which includes a set of friends from the user's full Facebook friend list, the website must indicate that the friend relationship on this website is associated with their friend relationship on Facebook. It is recommended that you use a Facebook favicon or the word "Facebook" to indicate that these friend relationships are associated with Facebook.
      2. Sites that use the Friend Linking feature to help users find their friends can only use this feature if the site also offers a separate way to search for friends by email address or via a contact importer. NOTE: This feature is available for your site on an approval basis only. Details for approval appear on the Connect tab in the application settings editor.
      3. All email addresses submitted for friend linking must be legitimate email addresses for users on your site.
    4. Facebook Connect for iPhone - The following policies apply only if you're developing a Facebook Connect for iPhone application.
      1. Facebook must be referenced in plain text, capital "F", lower case "acebook", no copyright message necessary. Do not use the Facebook logo.
      2. Use full name of the user, including first and last names. You get the user's name by calling fql.query on the name column of the user FQL table.
      3. The Facebook favicon must exist on users' profile pictures, and is recommended for friends' pictures.
      4. Use official iPhone buttons for Connect and logout. You can find the images for these buttons at Facebook Connect for iPhone Buttons.
      5. Overlay the official Facebook favicon over profile pictures, in the bottom right corner of the image. You can find this image at Facebook Connect for iPhone Buttons.
    5. Disconnecting

      6. You must provide a simple online process, placed in a prominent location on your Connect site, for Facebook users to disconnect or otherwise disassociate their Facebook account from your site. If a user disconnects/disassociates (either through your site or via Facebook), you must immediately delete all User Data (including any Storable Data) relating to that user.

  12. Escalation Procedures for Facebook Policy Issues

    The vast majority of the Facebook developer community is well intentioned and unlikely to be impacted by an enforcement action. We strive to work with developers to correct any issues we discover, but when necessary we will act quickly to correct problems and ensure a safe and high-quality Facebook Platform experience for all. Thus, Facebook may respond to non-compliance or other matters of concern with one of the actions listed below. Facebook may or may not notify you of such action in advance.

    Please note that these possible actions are not necessarily an escalating sequence. In particular, while we try to work with developers to resolve issues, and aim to support developers in their efforts to come into compliance with policy and best serve the community of users, in rare cases an immediate enforcement action may be imposed.

    Communication with developers takes place via an email sent from the facebook.com or facebookmail.com domain to the Developer Contact email address registered to the application. To stay in touch, please ensure that you do not filter out any such messages.

    Possible Actions

    1. Notice of Concern: An indication that the Facebook team is concerned that some aspect(s) of your application's functionality or content may be in violation of the letter or spirit of Facebook Policy and our mission to ensure a safe and high-quality user experience. Your application is under review, but if you wish you may voluntarily modify your application and obviate the need for further evaluation.
    2. Request for Action: We request that you make specific changes to facilitate an application's performance, enhance the user experience, or eliminate potential for violations of the letter or spirit of the policy. Compliance is voluntary.
    3. Notice of Violation: We determined that your application is in violation of Facebook policy and a restriction or moratorium on some aspect of your application's functionality may be imposed if the violation persists. The nature of the violation and any suggested corrective action will be described, as well as a time limit for coming into compliance.
    4. Notice of Restriction or Moratorium: Due to violation of policy, some aspect of your application's functionality has been disallowed on a temporary basis. The length of time of the restriction or moratorium, the nature of the violation, and any required corrective action will be described.
    5. Notice of Suspension: As above, with temporary removal of the entire application from Facebook Platform.
    6. Notice of Termination: Application has been permanently disabled.
  13. Contacting Facebook

    If you wish to correspond with Facebook after receiving a policy notice, please follow the instructions provided in the notice.

    To report bugs or technical problems related to Facebook Platform functionality or the Application Directory approval process, or to make a specific Platform feature request, please use the Platform bug tracking system. We aim to triage all new bug reports within two business hours.

    For discussions or inquiries about technical issues, policy matters, or documentation, or to solicit help from Platform Developer Operations and Support, other people at Facebook, or the developer community, please use the Developer Forum. The Forum is monitored by Facebook personnel throughout the day; typically we take action on urgent items within two business hours.

    To contact Facebook about a confidential matter that you do not wish to post for public view, please use the Developer Help Contact Form. Response times are much faster in the Forum and Bug Tracker, so it's best to use them whenever possible.

    Note: Although we endeavor to protect your privacy, Facebook does not guarantee the confidentiality of communications sent by email and webform unless there is a prior written agreement to that effect.

  15. Developer PR Policy

    Thank you for joining the Facebook developer community! We know you are eager to do PR around your new Facebook application, so we've developed this policy to help you draft a press release and speak with press.

    1. Press Release

      2. Facebook Corporate Communications needs to approve any press releases mentioning Facebook that you put on the wire. Please use the Press Release Policy below to draft your press release, and send it to platformPR@facebook.com once completed. A member of the Facebook Corporate Communications team will respond to you with edits or final approval within 5 business days of receipt. You cannot distribute the press release unless you have received written approval to do so from Facebook.

    2. Talking to the Press

      3. We encourage you to blog and talk to the press about your application, provided you accurately represent your application and your relationship with Facebook. We suggest that you look at the Press Release Policy below for context on how we think about Facebook Platform and our partnership with you. For your reference, you can find the latest Facebook stats here. If you have any questions or press requests, please send them to platformPR@facebook.com.

    3. Helping Us Help You

      4. We are always interested in hearing from developers and entrepreneurs who build on Facebook Platform and occasionally will point interested reporters to members of our developer community when it supports a story or trend. Please take a few minutes to tell us about your successes via our submission form and we'll keep you in mind for appropriate press opportunities.

      As we are sure you understand, we expect partners to comply with this process. However, if you do not adhere to this policy we will take action up to and including the termination of your relationship with Facebook, termination of your access to Facebook Platform and/or removal or disabling of your Facebook Platform application or Facebook Connect site.

      Thanks for your participation and we look forward to working with you!

    4. Press Release Policy
      1. Headline/Lead

        2. Any reference to "Facebook" in the headline, subheadline and lead must be followed by the word "Platform" or "Connect," and must clarify that the application is built "on" or "using" Facebook Platform.

        1. Correct: Company Launches New Slideshow Application on Facebook Platform -- OR -- Company Implements Facebook Connect to make (product/serve/site) More Social
        2. Incorrect: Company and Facebook Launch New Slideshow Application

        The lead cannot reference Facebook as announcing this news.

        1. Correct: Company today announced a new budgeting application built on Facebook Platform
        2. Incorrect: Company and Facebookk Platform today announced a new budgeting application for Facebook
      2. Facebook Lanugage

        3. The Facebook boilerplate cannot be used anywhere in the press release. We have provided a series of sentences that can be used as needed in the press release.

        Please see "Facebook Press Release Language."

        We have also provided a "Sample Press Release" format which you may choose to use as a model.

      3. General Language

        4. All references to your product must be called an "application," not a widget or gadget.

        Words NOT to be used regarding Facebook and Company: partnership, strategic, commitment.

        Words NOT to be used regarding Facebook: college site.

      4. Quote

        5. Facebook will not supply a custom quote for the press release.

      5. Competitive

        6. No direct or perceived competitors to Facebook may be listed or referenced anywhere in the press release.

      6. Trademarks

        7. The first reference to Facebook must include a registered trademark.

        1. Correct: Facebook®
        2. Incorrect: FacebookTM

        The following trademark language must be added at the bottom of the release: "Facebook® is a registered trademark of Facebook Inc."

      7. Press Outreach

        8. Developers are responsible for distribution of their own press release. Facebook will not conduct press outreach for applications, but may (at its sole discretion) mention certain applications or Connect sites in press interviews.

        Facebook will respond to press inquiries on a case-by-case basis.

      8. Approved Facebook Press Release Language

        9. Facebook gives everyone the power to share with the people they care about, making the world more open and transparent.

        Facebook users communicate and share information through the social graph, the network of connections and relationships between people.

        Facebook gives companies and the developer community access to the social graph through Facebook Platform.

        Using a rich set of tools and online services, developers can build applications that are deeply integrated into the Facebook website.

        Millions of Facebook users return to the site each day, providing unparalleled distribution potential for applications and the opportunity to build a business that is highly relevant to people's lives.

        Facebook Platform offers deep integration into the Facebook website, distribution through the social graph and an opportunity to build a business.

        Facebook Platform is a development system that enables companies and developers to build applications for the Facebook website, where all of Facebook's [XXX] million* users can interact with them.

        Facebook Platform is a way for companies and developers to integrate with the Facebook website and gain access to its [XXX] million* users.

        Facebook launched Facebook Platform in May 2007 to enable developers and entrepreneurs to integrate with Facebook and gain access to millions of users.

      9. Facebook Connect

        10. Facebook Connect extends the core features of Facebook Platform – social graph, identity and distribution – to technology off of Facebook.

        Facebook Connect allows Facebook's [XX] million* users to login and easily share [your website/app/device] content with their friends using their Facebook username and password.

        With Facebook Connect, Facebook users can quickly and easily authenticate into [your website/app/device] using their already established Facebook account.

        Facebook users use their real names and real identities to represent their actions in the Facebook experience. With Facebook Connect, users will have the same opportunity to leverage their real identity on [your website/app/device].

        Through trusted friend connections on Facebook, users share more information because they know what information is being shared and with whom. With Facebook Connect, users are able to access their Facebook friends on [your website/app/device], enabling a trusted social context.

        Giving users control over their privacy is paramount on Facebook. With Facebook Connect, users can be assured that the same privacy settings they have set up on Facebook will follow them when they log in to [your website/app/device].

        Facebook Connect makes it faster and easier for users to seamlessly share [type of actions/interest shared on your site] with their friends on Facebook, enhancing the social experience across both [your website/app/device] and Facebook.

        When Facebook users log in to [your website/app/device] with Facebook Connect, they can publish their actions back to Facebook, where that content can be shared with friends.

        Users have complete control over their information, who sees it, and what content is published back to their Facebook stream.

        More than [XX]* websites, devices and applications have implemented Facebook Connect since it was released in December 2008.

        * Facebook user numbers increase weekly. We will edit your press release to include the most accurate count on that date.

      10. Sample Press Release

        11. [Company] Launches [Type] Application on Facebook® Platform

        CITY, STATE — Month XX, 2009 — [Company] today announced a(n) [Type/Name] application built on Facebook Platform. [Company's] [Type/Name] application [does what?] for Facebook users worldwide.

        [Quote from company spokesperson]

        [Paragraph to describe application]

        Facebook's mission is to give people the power to share and make the world more open and connected. Facebook users communicate and share information through the social graph, the network of connections and relationships between people. With more than XXX million active users, Facebook is the fourth- most trafficked website in the United States.

        In 2007, Facebook launched Facebook Platform to empower developers and entrepreneurs around the world make the Web more social for users. Millions of Facebook users return to the site each day, providing unparalleled distribution potential for applications and the opportunity to build a business that is highly relevant to people's lives.

        About [Company] [Company Boilerplate]

        # # #

        Facebook® is a registered trademark of Facebook Inc.

  16. Branding and Promotion Policy

    There are currently no additional assets or policies in addition to those set out in the Statement of Rights and Responsibilities.

  17. Advertising Guidelines

Examples and Explanations