Facebook got it wrong on number of teenagers using tracking app

Facebook admits it gave misleading information about how many teenagers were using its banned tracking app.

Facebook CEO Mark Zuckerberg. Pic: AFP

Facebook gave misleading information about how many teenagers were using its banned tracking app, the company has admitted in a previously unpublished letter to a US senator.

In January it was revealed Facebook commissioned a controversial program to pay users as young as 13 $20 per month for access to their personal data.

The social media giant paid people about $US20 a month to use the “Facebook Research” app, which gave the company access to the users’ phone and web activity, including private messages, internet searches, emails and shopping.

At the time, Facebook said less than 5 per cent of those users were teenagers.

“Less than 5 per cent of the people who chose to participate in this market research program were teen,” the company told The Australian and other outlets.

Now, in responses to questions from US senator Mark Warner first published by the tech blog TechCrunch, the company has changed its story and admitted the numbers were much higher.

Virginian senator Mark Warner wrote to Facebook CEO Mark Zuckerberg that “Facebook’s apparent lack of full transparency with users – particularly in the context of ‘research’ efforts – has been a source of frustration for me.”

The company responded with an 11-page letter, admitting that 18 per cent of the research testers were teenagers.

“At the time we ended the Facebook Research App on Apple’s iOS platform, less than 5 per cent of the people sharing data with us through this program were teens,” Facebook said in its letter in response.

“Analysis shows that number is about 18 per cent when you look at the complete lifetime of the program, and also add people who had become inactive and uninstalled the app.”

Facebook’s admission means that less than 5 per cent of the research testers were teenagers at the time of the revelations, but over the course of the program a much higher percentage were involved.

Another admission from Facebook was that while it told reporters that of the teens’ participation program, “all of them signed parental consent forms,” it said in its letter that: “Potential participants were required to confirm that they were over 18 or provide other evidence of parental consent, though the vendors did not require a signed parental consent form for teen users.”

This means that instead of an actual form filled out by parents, a ticked box from the teen would have been sufficient for Facebook’s vendors.

It comes amid another privacy scandal for Facebook, which has been caught using users’ smartphone numbers for targeted advertising and search, when they had only been provided for security reasons.

The security problem was discovered by Emojipedia founder, Australian Jeremy Burge, who noticed that a mobile number provided by users for “two-factor authentication” use is also searchable by all Facebook users by default.

Two-factor authentication is an extra layer of security for websites like Facebook, so that instead of just needing a password, Facebook also sends a text message PIN number to your phone, to make your account harder to hack.

“For years Facebook claimed that adding a phone number for 2FA was only for security,” Mr Burge said on Twitter. “Now it can be searched and there’s no way to disable that.”

This means if one of your friends uploads their contacts to Facebook, you will appear as a suggested friend if you use your phone number for two-factor authentication.

“Today, the ‘Who can look me up?’ settings control how your phone number or email address can be used to look you up in other ways, such as when someone uploads your contact info to Facebook from their mobile phone,” a Facebook spokesperson told The Register.

The move has drawn criticism from Facebook’s former chief information security officer Alex Stamos.

Facebook “can’t credibly require 2FA for high-risk accounts without segmenting that from search & ads,” Mr Stamos said in a tweet.

Facebook’s Australian arm has been contacted for comment.