A settings change at Facebook has once again put the social site in a negative light concerning users’ privacy. Someday, users just might decide that they have had enough.

The change happened in October but was only recently noticed, according to The Guardian: “Facebook rolled out an update to its internal search engine, letting users search the entire network for the first time. All public posts became searchable for everyone, but private posts weren’t affected. When it made the change, though, the social network also removed a privacy setting entirely: it’s now not possible to choose to hide your profile from strangers. Every profile on Facebook now shows up when users search for it by name, even those, like mine, with the tightest possible settings, no friends in common, no profile picture, and no content posted. Worse, if you then click on the profile, a large amount of information is still public: any page I’ve liked, any group I’ve joined, and, if I had any, every friend I have on the site. And although I can’t be added as a friend by strangers — thanks to the requirement that they be a friend of a friend — I can be followed by them, letting them be notified of any future posts. That’s because, helpfully, the ability to turn off that feature isn’t under privacy but under a different tab, Followers.”

Social sites can go astray in two ways: selling users’ information to advertisers, and sharing it with others as research data, regardless of whether those “others” are actual researchers or instead thieves or potential assailants.

The business appeal of making your users’ information available as research data is that it will increase traffic and activity while encouraging people to see the site as an indispensable information source.

But treating users’ information as a commodity for your profit almost certainly goes against users’ desires. That’s always dangerous. Had Facebook asked users for permission to make their profiles public and offered something of value in exchange, it might have worked out fine. But making the change in secret is a problem.

One has to wonder why Facebook didn’t expect massive backlash. One reason is that no social media engine is in a position to replace it, and there’s a chicken-and-egg challenge that keeps Facebook fairly safe: People won’t switch until many of their friends and colleagues have switched.

Facebook also counts on people’s reluctance to toy with their settings, or even look at them. Doing that is almost as rare as carefully reviewing privacy policy changes. Combine those two and you get users who will go with the default settings and won’t know when the company changes them.

Eventually, though, Facebook will go too far. Something about privacy offenses is cumulative, as trust erodes and is just too difficult to restore. It could be that word of this particular change will finally spread — probably through Facebook posts, ironically enough. Someday, the chicken-and-egg challenge will no longer be insuperable, and Facebook’s privacy betrayals will be the edge that a new competitor needs.