Facebook Privacy and Security: Choosing a North-Star Goal, Metrics and Guardrails
Company: Meta
Role: Product Manager
Category: Analytics & Experimentation
Difficulty: medium
Interview Round: Other
You are the product manager who owns privacy and security for Facebook. What goal would you set for this area, and how would you measure whether the team is achieving it?
```hint Success is mostly what does not happen
Much of the value here shows up as harm avoided, such as an account that was never taken over, rather than as visible usage. Decide what you would count, and how you would tell a real change apart from a change in detection or reporting.
```
### Clarifying Questions
- Should privacy and security be treated as one product area spanning every Facebook surface, from sign-up and login to posting, messaging and Marketplace purchases, or should I focus on one surface?
- Is the focus everyday people using Facebook, or also businesses, advertisers and Marketplace sellers?
- Is this an annual goal for the team, and is there a baseline for incidents and user trust to set targets against?
### What a Strong Answer Covers
- A clear statement of what privacy and security mean for Facebook users, tied to the company mission, and of the threats in scope.
- A goal and a north-star metric that capture harm prevented or trust earned, with a reason they beat raw engagement or feature-adoption counts.
- Supporting metrics for the main pillars, such as account protection, privacy control, scams and fraud, and user perception.
- Guardrails against friction and over-enforcement, such as login success and legitimate users locked out.
- How targets are set and how measurement traps are handled: underreporting, better detection inflating counts, rare events and attackers who adapt.
### Follow-up Questions
- Right after you launch an easier way to report a hacked account, reported takeovers rise sharply. Is that a success or a failure, and how would you tell?
- A new login challenge cuts account takeovers but lowers sign-in success. How would you decide whether to keep it?
- The ideal number of breaches is zero. How would you set a realistic quarterly target instead?
Overview: A metrics and goal-setting case for the product manager who owns privacy and security at Facebook. It tests how a candidate defines success for a product whose value is harm prevented, picks a north-star metric with supporting metrics and guardrails, and handles reporting bias and rare events.