Sure, Facebook has let scores of companies have your personal data — but not to worry, it’s perfectly safe, the social-media giant insisted Monday. Facebook, still reeling from the Cambridge Analytica scandal, responded the day after it was revealed that it has struck deals over the past decade with at least 60 smartphone and tablet makers — including Apple, Amazon, Microsoft and Samsung — that granted them “deep” access to personal data. Facebook launched software 10 years ago that gave the companies access even to the data of users’ friends without their consent — and let the arrangements continue after declaring it would no longer share such material with outsiders, The New York Times reported Sunday. The deals granted the companies access to a user’s relationship status, political leaning, education history, religion and upcoming events, according to the report.​ ​S​ome device makers were able to retrieve personal information from users’ friends who believed they had barred any such sharing, the Times reported. The newspaper said the unfettered access continued even after Facebook agreed with the Federal Trade Commission in 2011 to better protect data and only share it after getting users’ express consent. Facebook pushed back Monday. Ime Archibong, vice president of product partnerships, said in a blog post that Facebook has maintained tight control over the technology, known as application programming interfaces, or APIs, and that it is unaware of any abuse by the companies with which it teamed. “These partners signed agreements that prevented people’s Facebook information from being used for any other purpose than to recreate Facebook-like experiences,” he said. “Contrary to claims by The New York Times, friends’ information, like photos, was only accessible on devices when people made a decision to share their information with those friends.” New York Attorney General Barbara Underwood said in a statement Monday that “the news that Facebook struck ‘data-sharing’ partnerships with other corporations is yet another reminder of the many questions that remain unanswered. “Consumers have the right to know how their personal information is being used; and the companies . . . have a critical responsibility to protect it,” she added. Lawmakers also slammed Facebook, saying it misled them about how it collects and shares data. Sen. Richard Blumenthal (D-Conn.) said Facebook “has failed to come clean with the American people about the extent, the scope and the scale, of data sharing.” The social network has already failed to protect the data of about 87 million users that was shared with political data firm Cambridge Analytica, which worked for President Trump’s 2016 campaign. In April, Facebook CEO Mark Zuckerberg appeared before Congress to answer questions about user data the company provided to third parties. With Post wires<doc-sep>This is just getting ridiculous. A day after Facebook admitted to changing 14 million users' post settings to "public," three days after it was revealed that the company had given an accused national security threat access to data on some users' friends, and less than a week after the news dropped that the social media giant had special data sharing deals with 60 device manufacturers, we're hit with yet another scandal from the bottomless pit of shamelessness. And — you'll be forgiven for experiencing a bit of deja vu here — the privacy violation du jour involves Facebook providing certain companies access to data on users' friends. So reports the Wall Street Journal, which notes that the company Mark Zuckerberg started in his dorm room made special deals with a host of companies, including RBC Capital Markets and Nissan Motor Co. Per the Journal: The unreported agreements, known internally as “whitelists,” also allowed certain companies to access additional information about a user’s Facebook friends, the people familiar with the matter said. That included information like phone numbers and a metric called “friend link” that measured the degree of closeness between users and others in their network, the people said. Notably, this reportedly went on after Facebook insisted it ended the ability of third-party developers to gather data on users' friends in 2015. The Journal notes that it's not exactly clear when these deal ended. Did they even end? It's also unknown just how many companies were given this special access. We reached out to Facebook in an effort to determine how many companies were granted this special access, what those companies are, when and if this special access ended, and if Facebook users were notified of this in any way. We have received no response as of press time. So, yeah, another big helping of unaccountability from our friends in Menlo Park. UPDATE: June 8, 2018, 4:28 p.m. PDT: A Facebook spokesperson provided the following statement, attributable to the company's VP of Product Partnerships Ime Archibong:<doc-sep>Photo : Getty Ever since the Cambridge Analytica scandal first broke in March, Facebook has been scrambling to change its policies and reassure the public that it no longer recklessly shares data with third parties. But on Sunday we learned that it has quietly been giving device makers access to users data this whole time. It argues this was different for several reasons and device makers could only use the data to provide “the Facebook experience.” Advertisement The New York Times reports that Facebook has maintained data-sharing agreements with “at least 60 device makers” for the last 10 years. Each partner was given access to a private API that allowed at least some partners to access more than 50 types of information about an individual user. It also extended that information to a users’ friends—and friends of friends—with the kind of wide net that famously resulted in a massive leak of millions of users’ data to Cambridge Analytica, a firm working for the 2016 presidential campaign to elect Donald Trump. Throughout its all-hands-on-deck PR campaign over the last few months, Facebook has shuffled its data policies and reassured lawmakers that handing out user data to anyone who asked is no longer part of its standard operations. It maintained that its policies for sharing data with third-party app developers have changed following a consent decree with the FTC in 2011 over a previous privacy scandal. Since it was revealed that millions of users’ data was gathered by a quiz app and subsequently sold to Cambridge Analytica, it’s been a lingering question if Facebook may have violated its consent decree by not notifying users of the breach. If the FTC determined that the social media network was in violation of the agreement, it could face “trillions of dollars” in fines. But Facebook is claiming that it’s fully in compliance with the consent decree due to its interpretation of one clause in the agreement. The Times found that Facebook has given device makers like Apple, Amazon, BlackBerry, Microsoft, and Samsung extensive access to user data through partnerships that appear uncannily similar to its past third-party policies. These partnerships are reportedly ongoing. Facebook confirmed much of the Times report but took issue with some interpretations and asserted that it has been “winding down” the data-sharing program since *ahem* April. To illustrate how the program works, the Times used a Blackberry device from 2013 to access one of its reporter’s Facebook accounts. From the report: Immediately after the reporter connected the device to his Facebook account, it requested some of his profile data, including user ID, name, picture, “about” information, location, email and cellphone number. The device then retrieved the reporter’s private messages and the responses to them, along with the name and user ID of each person with whom he was communicating. The data flowed to a BlackBerry app known as the Hub, which was designed to let BlackBerry users view all of their messages and social media accounts in one place. The Hub also requested — and received — data that Facebook’s policy appears to prohibit. Since 2015, Facebook has said that apps can request only the names of friends using the same app. But the BlackBerry app had access to all of the reporter’s Facebook friends and, for most of them, returned information such as user ID, birthday, work and education history and whether they were currently online. Advertisement The reporter used in the test only had 550 friends, but when Facebook’s system was done combing through all of the information that its system allowed to be shared, “identifying information for nearly 295,000 Facebook users” was transmitted to the Blackberry Hub, the Times reported. Facebook has clarified that its partners receive user information of the people you choose to share content with. A spokesperson explained to Gizmodo: A great way to think about that is, just like when you see your timeline. If you and I are friends, and I post on my timeline, and one of my friends comments on it, you’re still going to be able to see that friend’s comment, and that’s just the nature of sharing on Facebook. Advertisement Unidentified officials told the Times that agreements with device makers include strict prohibitions on data usage that go beyond the rules applied to app developers. Developers have been given various levels of freedom to use personal data to build new products, but device makers have only been allowed to use data as necessary to provide “the Facebook experience.” In a follow-up post on its newsroom blog, Facebook explained that these agreements first began as a way to more quickly integrate Facebook’s features across the wide range of devices on the market. It claimed,“In the early days of mobile, the demand for Facebook outpaced our ability to build versions of the product that worked on every phone or operating system.” But that’s no longer an issue because, “now that iOS and Android are so popular, fewer people rely on these APIs to create bespoke Facebook experiences.” Advertisement Another way to interpret that is that Facebook didn’t have the resources to handle its rapid and unprecedented expansion. In order to get itself to 2 billion users and ingrain its system into every corner of the internet, it played loose with data so that other people could build out the platform. Today, it argues that handling the abuse of its platform around the world is difficult because so many different factors like language, cultural differences, and insufficiently advanced AI present limitations. CEO Mark Zuckerberg has recently been vocal about the fact that Facebook doesn’t even want to make hard decisions about the governance of its platform and floated the idea of creating some third-party “Supreme Court.” When contacted by Gizmodo, a Facebook spokesperson emphasized that the private API approach has been common in the tech industry, especially in the early days of the mobile era—they cited YouTube as an example of an app that was initially included on iPhones but was originally developed by Apple. They acknowledged that the “winding down” was prompted by the “hard look” Facebook has taken with its data policies and said that technology has changed to the point that this sort of data sharing isn’t necessary. The spokesperson said that it’s ended its partnerships with 22 parties but gave no timeline on the rest. When asked for a list of all the partners, the spokesperson said they haven’t decided to share that information at this time. Advertisement The Times attempted to contact several major device makers about the partnerships. Apple confirmed it was part of the program, but it hasn’t had access to Facebook user data since September, the company said. A Blackberry spokesperson did not say that the company no longer participates in the program but emphasized it “did not collect or mine the Facebook data of our customers.” Microsoft claimed all data is stored locally on the user’s device. Amazon and Samsung declined to comment. With all of those big manufacturers accounted for, there’s still the question of who else is part of this program. Facebook has only said, “around 60 companies” have used the private API and that some of its partners did store user data on their own servers. I certainly can’t think of 60 device manufacturers I’d trust with my data. And considering the fact that Cambridge Analytica and Aleksandr Kogan—the professor who developed the quiz app that sucked up tens of millions of people’s data—allegedly violated Facebook’s terms of service and received no penalty, it’s not exactly reassuring to hear that these agreements had “strict” guidelines. We’ve asked Facebook whether it audits the device makers it partners with for compliance with its guidelines, and a spokesperson said that hasn’t happened because they’ve never had any “issues” with the program. Facebook does claim it’s performed “spot checks” with dummy accounts to ensure that the proper data was being pulled. But the question of whether all user data was treated properly after it was transferred to a partner’s server remains unanswered. Advertisement<doc-sep>
Facebook potentially has another privacy problem. The social networking giant allowed companies such as Apple and Samsung access to Facebook users' friends without explicit consent, according to a report in The New York Times, which cited Facebook documents, interviews and its own tests. If that turns out to be the case, the action could be a violation of a 2011 consent decree Facebook reached with the Federal Trade Commission. Facebook allowed makers of mobile devices — including Apple, Amazon, BlackBerry, Microsoft and Samsung — access to data of Facebook users' friends without explicit consent, according to the report. Some device makers could get information from users’ friends who thought they had prohibited any sharing, The Times found in doing tests of data sharing. Facebook is denying it violated users' privacy. "These partners signed agreements that prevented people’s Facebook information from being used for any other purpose than to recreate Facebook-like experiences," Facebook's vice president of product partnerships Ime Archibong said in a post on the company's blog Monday. Facebook said the device partnerships included strict limits on the use of data, including any stored on partners’ servers. Facebook executives said there were no known cases of data misuse. "Partners could not integrate the user’s Facebook features with their devices without the user’s permission. And our partnership and engineering teams approved the Facebook experiences these companies built," Archibong wrote. "Contrary to claims by the New York Times, friends’ information, like photos, was only accessible on devices when people made a decision to share their information with those friends. We are not aware of any abuse by these companies." The newspaper report said the agreements, numbering as many as 60 and struck as far back as a decade ago, were made before smartphones became powerful enough to run fully-fledged apps such as those running on devices today. Under the agreements, Facebook worked with the companies to create private application programming interfaces (APIs) so that devices could let users access popular Facebook features such as messaging, “like” buttons and address books, The Times says. But some device partners could get Facebook users’ relationship status, religion, political leaning and upcoming events, among other data, The Times says. Facebook announced in April that it was "winding down access" to APIs, Archibong says. More:Will the FTC come down hard on Facebook? It's only happened twice in 20 years These device partnerships were a concern inside of Facebook, according to Sandy Parakilas, who in 2012 oversaw Facebook's third-party advertising and privacy compliance.“This was flagged internally as a privacy issue,” Parakilas told The Times. He left the company that year. “It is shocking that this practice may still continue six years later, and it appears to contradict Facebook’s testimony to Congress that all friend permissions were disabled.” The device partnerships were touched on in documents Facebook submitted to German lawmakers who are looking into the company's privacy measures. “What we have been trying to determine is whether Facebook has knowingly handed over user data elsewhere without explicit consent,” German parliament member Elisabeth Winkelmeier-Becker told The Times. She is among those who questioned Joel Kaplan, Facebook’s vice president for global public policy, during a closed-door hearing in April. “I would never have imagined that this might even be happening secretly via deals with device makers," she said. The FTC is investigating whether Facebook has violated a consent decree that barred it from making misrepresentations about the privacy or security of consumers' personal information and required it to ask users before any changes that overrode privacy preferences. The agreement also prevented Facebook from letting anyone access users' information more than 30 days after a user deleted their account. The agency began the investigation after Facebook disclosed 87 million users had their data improperly obtained by U.K.-based Cambridge Analytica after the political firm got a collection of data from University of Cambridge researcher Aleksandr Kogan, whose personality quiz app had gleaned information on 270,000 Facebook users and tens of millions of their friends. In the wake of the massive data breach, Facebook CEO Mark Zuckerberg has testified before both houses of Congress and two weeks ago appeared before the European Parliament. Bub based on The Times report, "sure looks like Zuckerberg lied to Congress about whether users have 'complete control' over who sees our data on Facebook," Rep. David Cicilline, D-R.I., tweeted Monday. "This needs to be investigated and the people responsible need to be held accountable."