Sometimes we move too fast.

That’s an apology of sorts, I suppose. But it’s not an apology for further loosening Facebook’s privacy safeguards or for the speed with which Facebook loosened them. In other words, it’s a comment on the execution of a policy, not on the policy itself.

By saying “we move too fast,” Zuckerberg isn’t admitting that Facebook was headed in the wrong direction with respect to user privacy; he’s saying Facebook was headed in right direction all along, just a bit too quickly–for those of us with reasonable expectations or privacy, anyway.

Which makes you wonder about Facebook’s claim that its changing privacy policy and tools reflect “shifting social norms around privacy.”

Do they really?

Or is Facebook itself attempting to shift those norms in its quest for revenue? After all, there’s great money to be made in the sort of behavioral advertising that Facebook’s user data makes possible–great money to be made in monetizing our privacy and reputations.

So the unveiling this morning of what Facebook claims are “enhanced, simpler” privacy controls is interesting, to say the least. How does a company so clearly prejudiced against privacy assuage concerns that it might violate privacy?

With a new set of “granular data permissions,” Zuckerberg said this morning (here’s Facebook’s guide explaining them).

“First, we’ve built one simple control to set who can see the content you post,” he explained in a blog post published to coincide with the announcement. “Second we’ve reduced the amount of basic information that must be visible to everyone and we are removing the connections privacy model….Third, we’ve made it simple to control whether applications and Web sites can access any of your information.” (Click image below to enlarge.)

Evidently, there will be a simple control that applies to all content retroactively and to new products going forward. If, for example, you set your preference to friends-of-friends, that will be your historic default as well as your default going forward.

For applications, access to member information has been “dramatically” limited. There will be a single check box to opt out of information-sharing with third-party sites. Said Zuckerberg: “The net effect of this is that all applications are going to have restricted access to your personal information.”

And for Facebook Platform, the company is adding an “easy” opt-out for instant personalization. Finally, Facebook is differentiating between “basic directory” information and the more personal information in its members’ profiles. Directory information must be public so friends can find one another, and “allowing people to find you on Facebook is a very different use case than sharing your information.”

As a privacy tool overhaul, this is fairly substantial. And it does seem to address many complaints about the previous system. But it doesn’t do one thing that many critics have called for: Make the highest privacy settings the default.

Why not? Said Zuckerberg: “We’re trying to make the system simple to use. Facebook has never worked in a way where you sign up and only your friends can see your personal information. The point of the site is to allow you to connect with new friends and friends of friends. And that’s always been a really important part of how Facebook has worked. It’s really important to help people share simply by default.”

With their friends, perhaps. But not with anonymous companies. In that case, you’d think most people would want to limit that “sharing” by default. But that would undermine Facebook’s business model, wouldn’t it?

Evidently, outrage over the company’s privacy missteps hasn’t been sufficient to effect that particular change. “We really think about the trust issues,” Zuckerberg explained. “A lot of people right now are upset with us about these changes, and I take that really seriously…and I don’t mean to diminish privacy concerns….but all these blogs are talking about Delete-Your-Facebook-Pages campaigns and we’ve seen no meaningful change to our usage stats.”

So how does Zuckerberg answer accusations that Facebook doesn’t care about privacy, that his company preys on people who have an expectation of privacy but don’t necessarily understand the implications of putting their personal information on Facebook?

“People perceive that we don’t care about privacy and that’s just not true,” he said. “People want to share information and there’s got to be a balance. They’ve got to have control over how they share their information and that’s where the world is going….We’ve learned time and time again that privacy is a sensitive thing. Now we feel like we have a privacy model that will scale as we add more users….And hopefully, we won’t be messing with it for a long time.”

It is an extraordinary market play. And an unsettling one. For it seeks to place Google (GOOG), which already collects vast amounts of data about our Internet use, at the very center of our information experience.

The privacy implications are, of course, horrendous. And while Google will inevitably dismiss such concerns as paranoid and argue that any data the company might collect at the OS level will be used only to improve its services and benefit users, it should still give us all pause. Because when it is finally launched, Chrome OS will be yet one more deep well of consumer data to which Google will have access.

There are already quite a few such wells, including Google Search and Chrome, that profile user interests and surfing habits: Gmail, which gives the company access to our email conversations, and Google Voice, which gives the company access to our spoken ones. Add to this Google Street View and Latitude, a service that tracks the physical location of its users, and mobile and desktop operating systems and, well…that kind of consolidation of Internet-based services around a single dominant company should give us all pause.

Lest we forget, Google is in the behavioral targeting business. Why would people ever use an OS developed by a company whose business is based on meticulously recording and analyzing their online behavior? Because they enjoy using its other services, I suppose. But there is a privacy-vs-ease-of-use tradeoff here. And with Chrome OS, it is unprecedented. Further, while Google might tout its “don’t be evil” motto as reason enough to trust the company with our data, there are other entities that don’t always share that sensibility. Remember, it wasn’t so long ago that the federal government tried to force Google to turn over user search data to the Justice Department…

“Competition in the OS market should always be welcome, but Google is the special case,” Marc Rotenberg, executive director of the Electronic Privacy Information Center, told Digital Daily. “It has become dominant across many essential Internet services–search, mail, video, online apps, and advertising. Coupled with Google’s growing profiles of American consumers and reluctance to adopt meaningful privacy safeguards, we expect that antitrust authorities in the US and Europe will view Google’s entry into the OS market with enormous skepticism.”

Jeff Chester, executive director of The Center for Digital Democracy, echoed Rotenberg’s concerns. “Google’s new OS has to be placed under the data collection X-Ray by US and EU privacy regulators and advocates,” he said. “Any expansion into the marketplace by either Google or Microsoft should generate intense scrutiny, especially for the privacy implications. These two are engaged in a global data collections digital arms race, which has far-reaching implications for consumers and their information.”