Facebook paid users as young as 13 to install an app that gave the company access to everything their phone sent or received over the internet. In response, Apple has revoked Facebook’s ability to publish certain apps, in a move that could have far-reaching implications for both companies.
Facebook has been accused of exploiting a loophole in Apple’s privacy regulations to publish the iPhone app, which provided it with data it used to keep ahead of youth trends.
As well as sparking renewed privacy concerns, the discovery revived the cold war between the two businesses, which have previously attacked each other in the press over issues of privacy and security.
Facebook was found to be using a voluntarily installed virtual private network (VPN) to route all data from participants’ devices through its own servers – despite the fact that Apple had removed a previous Facebook app that did the same thing, Onavo, from the iOS App Store over privacy violations.
Facebook now says it will shut down the app, called Facebook Research, on iOS and maintains it did nothing wrong, and that the service was not a replacement for the Onavo VPN.
According to TechCrunch, which first reported the existence of Facebook Research, the company paid users aged 13 to 35 a monthly fee, of up to $20, to install the app on iOS and Android. When they did, all of their internet data, however they connected and whatever apps they were using, was funnelled through the company’s servers, allowing it to keep track of their activities on other services.
Onavo Protect was used by the company for the same purpose but was removed from the iOS App Store in June 2018 when Apple implemented new rules that banned the collection of “information about which other apps are installed on a user’s device for the purposes of analytics or advertising/marketing”.
Facebook Research avoided Apple’s enforcement of those privacy rules by asking users to install it using a feature called an “enterprise developer certificate”, which is intended to allow companies to build applications for internal use without needing to publish them to the App Store.
“We designed our Enterprise Developer Program solely for the internal distribution of apps within an organization,” an Apple spokesperson said in a statement. “Facebook has been using their membership to distribute a data-collecting app to consumers, which is a clear breach of their agreement with Apple. Any developer using their enterprise certificates to distribute apps to consumers will have their certificates revoked, which is what we did in this case to protect our users and their data.”
In a statement, Facebook criticized the initial reporting. “Key facts about this market research program are being ignored. Despite early reports, there was nothing ‘secret’ about this; it was literally called the Facebook Research App.
“It wasn’t ‘spying’ as all of the people who signed up to participate went through a clear on-boarding process asking for their permission and were paid to participate. Finally, less than 5% of the people who chose to participate in this market research program were teens. All of them with signed parental consent forms.”
But Will Strafach, the developer of Guardian Protect, an iOS firewall (unrelated to the Guardian newspaper), described the move on Twitter as “the most defiant behaviour I have ever seen by an App Store developer … I still don’t know how to best articulate how absolutely floored I am by Facebook thinking they can get away with this.”
Addressing the issue of consent, Strafach acknowledged that Facebook said users were provided with “extensive information about the type of data we collect and how they can participate”, but argued that “they do not inform users of the massive amount of access you hand them when hitting ‘Trust’ on their root certificate. I do not think users can reasonably consent without this knowledge.”
Facebook also said that the program was not built to replace Onavo, arguing that it started in 2016, while Onavo was only removed from Apple’s App Store in 2018. But the market research program appears to have been only active on Android from 2016 to 2018, with the iOS version launching after Onavo was pulled. Indeed, according to Strafach, the app reportedly contains numerous references to Onavo in its code.
Already, some are speculating that the decision to bypass Apple’s approval process could lead to an escalation in the conflict between the two companies. John Gruber, an Apple blogger with an inside line to the iPhone maker, speculated that it could even result in the Facebook app being pulled off the store in retaliation.
“To my eyes, this action constitutes Facebook declaring war on Apple’s iOS privacy protections,” Gruber wrote. “I don’t think it would be out of line for Apple to revoke Facebook’s developer certificate, maybe even pull their apps from the App Store. No regular developer would get away with this. Facebook is betting that their apps are too popular, that they can do what they want and Apple has to sit back and take it.”
Facebook declined to comment further to the Guardian.
