User joins a site in the past, present or future.
User does not read any of the privacy or Terms of Use data on the screen
User does not understand all the various privacy controls
Site updates Terms of Service and notifies user
User ignores updates
Site adds, enhances, changes or modifies privacy controls and notifies users
User ignores updates
User figures out that they have had all their personal data wide open to the universe
User sues site

Now then, we have the circle revolving around the user once again.  I am unclear in what way the site is responsible for the user not knowing how to control the sharing of their own information they willingly provided.  This is not a credit reporting service where you have your data sent to suppliers that sell it without you knowing what data is really there.  You have to manually go and check to verify the integrity of the data.

Utilizing Facebook is the total opposite.  You willingly sign up, willingly place data and willingly have total control over what is shared and to whom.  The privacy controls are quite extensive, as we have even shown in videos.  It is all up the the user to follow along the changes and options for a site they participate in.

The only variance to this is if Facebook started using your pictures in advertising and had never sent you notifications that it was taking place.  Thereby giving you the chance to hide or pull photos from your collections.

Privacy on the sites is more than a right they give you in the Terms of Service.  It is a responsibility of the user to understand, set and update on their own as long as the controls are available.