Facebook Admits User Data was Wrongly Shared to 5,000 Developers, Violating Its Own Policy

Facebook has admitted that an “issue” with the system caused it to share user data with 5,000 developers after 90 days of inactivity. In 2018, Facebook announced that it would automatically prevent apps using Facebook Login from getting user data if the user has not used the particular app in the last 90 days. However, as per the post on Facebook's news page, around 5,000 developers continued to receive information even though the users had been inactive for 90 days. The social networking giant states that it discovered this issue recently and had fixed it the next day. Facebook did not say how many users were affected by this lapse.

Like Sign in With Apple, or Google Login, Facebook Login allowed app developers to get users to sign up without having to create a fresh account — and it also gave developers access to some data from Facebook. Since this affects third party apps, it's not clear what data precisely was being accessed, or how many users were affected by this.

In a post on Facebook, Konstantinos Papamiltiadis, VP of Platform Partnerships at Facebook, wrote that “in some instances apps continued to receive the data that people had previously authorised, even if it appeared they hadn't used the app in the last 90 days.” This 90 day lockout rule was introduced in 2018 as a means to protect user privacy and data when users use Facebook to sign in to other apps. Papamiltiadis stated that Facebook estimates approximately 5,000 developers continued to receive user information like language settings or user gender after 90 days of inactivity.

“We haven't seen evidence that this issue resulted in sharing information that was inconsistent with the permissions people gave when they logged in using Facebook,” Papamiltiadis added, and said that the issue was fixed the day after it was found and that the social media giant will continue to investigate and “prioritise transparency around any major updates.”

Facebook did not clarify what all information and user data was accessed by the developers but it did give an example of a case where this issue could have caused unauthorised sharing of data. It stated that “this could happen if someone used a fitness app to invite their friends from their hometown to a workout, but we (Facebook) didn't recognize that some of their friends had been inactive for many months.”

Papamiltiadis said that new Platform Terms and Developer Policies have been introduced that “limit the information developers can share with third parties without explicit consent from people.”

WWDC 2020 had a lot of exciting announcements from Apple, but which are the best iOS 14 features for India? We discussed this on Orbital, our weekly technology podcast, which you can subscribe to via Apple Podcasts, Google Podcasts, or RSS, download the episode, or just hit the play button below.