Sometimes we move too fast.

That’s an apology of sorts, I suppose. But it’s not an apology for further loosening Facebook’s privacy safeguards or for the speed with which Facebook loosened them. In other words, it’s a comment on the execution of a policy, not on the policy itself.

By saying “we move too fast,” Zuckerberg isn’t admitting that Facebook was headed in the wrong direction with respect to user privacy; he’s saying Facebook was headed in right direction all along, just a bit too quickly–for those of us with reasonable expectations or privacy, anyway.

Which makes you wonder about Facebook’s claim that its changing privacy policy and tools reflect “shifting social norms around privacy.”

Do they really?

Or is Facebook itself attempting to shift those norms in its quest for revenue? After all, there’s great money to be made in the sort of behavioral advertising that Facebook’s user data makes possible–great money to be made in monetizing our privacy and reputations.

So the unveiling this morning of what Facebook claims are “enhanced, simpler” privacy controls is interesting, to say the least. How does a company so clearly prejudiced against privacy assuage concerns that it might violate privacy?

With a new set of “granular data permissions,” Zuckerberg said this morning (here’s Facebook’s guide explaining them).

“First, we’ve built one simple control to set who can see the content you post,” he explained in a blog post published to coincide with the announcement. “Second we’ve reduced the amount of basic information that must be visible to everyone and we are removing the connections privacy model….Third, we’ve made it simple to control whether applications and Web sites can access any of your information.” (Click image below to enlarge.)

Evidently, there will be a simple control that applies to all content retroactively and to new products going forward. If, for example, you set your preference to friends-of-friends, that will be your historic default as well as your default going forward.

For applications, access to member information has been “dramatically” limited. There will be a single check box to opt out of information-sharing with third-party sites. Said Zuckerberg: “The net effect of this is that all applications are going to have restricted access to your personal information.”

And for Facebook Platform, the company is adding an “easy” opt-out for instant personalization. Finally, Facebook is differentiating between “basic directory” information and the more personal information in its members’ profiles. Directory information must be public so friends can find one another, and “allowing people to find you on Facebook is a very different use case than sharing your information.”

As a privacy tool overhaul, this is fairly substantial. And it does seem to address many complaints about the previous system. But it doesn’t do one thing that many critics have called for: Make the highest privacy settings the default.

Why not? Said Zuckerberg: “We’re trying to make the system simple to use. Facebook has never worked in a way where you sign up and only your friends can see your personal information. The point of the site is to allow you to connect with new friends and friends of friends. And that’s always been a really important part of how Facebook has worked. It’s really important to help people share simply by default.”

With their friends, perhaps. But not with anonymous companies. In that case, you’d think most people would want to limit that “sharing” by default. But that would undermine Facebook’s business model, wouldn’t it?

Evidently, outrage over the company’s privacy missteps hasn’t been sufficient to effect that particular change. “We really think about the trust issues,” Zuckerberg explained. “A lot of people right now are upset with us about these changes, and I take that really seriously…and I don’t mean to diminish privacy concerns….but all these blogs are talking about Delete-Your-Facebook-Pages campaigns and we’ve seen no meaningful change to our usage stats.”

So how does Zuckerberg answer accusations that Facebook doesn’t care about privacy, that his company preys on people who have an expectation of privacy but don’t necessarily understand the implications of putting their personal information on Facebook?

“People perceive that we don’t care about privacy and that’s just not true,” he said. “People want to share information and there’s got to be a balance. They’ve got to have control over how they share their information and that’s where the world is going….We’ve learned time and time again that privacy is a sensitive thing. Now we feel like we have a privacy model that will scale as we add more users….And hopefully, we won’t be messing with it for a long time.”

Using SelfServe, American Express, for example, might aim ads at users that MySpace has identified as having a pulse and mercilessly beat them into submission with credit card offers. The site has created more than 100 user-interest categories already and hopes to have 300 by the end of the year. “We’re looking at everything people put into their profiles and what their friends are into,” Arnie Gullov-Singh, a Fox Interactive vice president, told the Los Angeles Times.

And so the evolution of behavioral targeting begins. “It changes everything,” said Michael Barrett, chief revenue officer at Fox Interactive Media, the News Corp. unit that includes MySpace. “Every form of targeting has been trying to get to what that individual is thinking about, passionate about and interested in. It defines the next generation of targeting.”