Facebook accused of collecting sensitive data of app users

Millions of smartphone users confess their most intimate secrets to apps, which then send that information to Facebook.

Facebook CEO Mark Zuckerberg delivers the keynote address at a developer’s conference in San Jose, California, last year. Picture: AP

Millions of smartphone users confess their most intimate secrets to apps, including when they want to work on their belly fat or the price of the house they checked out last weekend. Other apps know users’ body weight, blood pressure, menstrual cycles or pregnancy status.

Unbeknown to most people, in many cases that data is shared with someone else: Facebook.

The social-media giant collects intensely personal information from many popular smartphone apps just seconds after users enter it, even if the user has no connection to Facebook, according to testing by The Wall Street Journal. The apps often send the data without any prominent or specific disclosure, the testing showed.

It is already known that many smartphone apps send information to Facebook about when users open them, and sometimes what they do inside. Previously unreported is how at least 11 popular apps, tens of millions of downloads, have also been sharing sensitive data entered by users. The findings alarmed some privacy experts who reviewed the Journal’s testing.

Facebook is under scrutiny from Washington and European regulators for how it treats the information of users and non-users alike. It has been fined for allowing now defunct political-data firm Cambridge Analytica illicit access to users’ data and has drawn criticism for giving companies special access to user records well after it said it had walled off that information.

In the case of apps, the Journal’s testing showed Facebook software collects data from many apps even if no Facebook account is used to log in and if the end user isn’t a Facebook member.

Apple and Google, which operate the two dominant app stores, don’t require apps to disclose all the partners with whom data is shared. Users can decide not to grant permission for an app to access certain types of information, such as their contacts or locations. But these permissions generally don’t apply to information users supply directly to apps, which is sometimes the most personal.

In the Journal’s testing, Instant Heart Rate: HR Monitor, the most popular heart-rate app on Apple’s iOS, made by California-based Azumio, sent a user’s heart rate to Facebook immediately after it was recorded.

Flo Health’s Flo Period & Ovulation Tracker, which claims 25 million active users, told Facebook when a user was having her period or informed the app of an intention to get pregnant.

Real-estate app Realtor.com, owned by Move, a subsidiary of Wall Street Journal parent News Corp, sent the social network the location and price of listings that a user viewed, noting which ones were marked as favourites, the tests showed.

None of those apps provided users any apparent way to stop that information from being sent to Facebook.

Facebook said some of the data sharing uncovered by the Journal’s testing appeared to violate its business terms, which instruct app developers not to send it “health, financial information or other categories of sensitive information”. Facebook said it will tell apps flagged by the Journal to stop sending information its users might regard as sensitive. The company said it may take additional action if the apps don’t comply. “We require app developers to be clear with their users about the information they are sharing with us,” a Facebook spokeswoman said.

At the heart of the issue is an analytics tool Facebook offers developers, which allows them to see statistics about their users’ activities — and to target those users with Facebook ads. Although Facebook’s terms give it latitude to use the data uncovered by the Journal for other purposes, the spokeswoman said it doesn’t do so.

Facebook tells its business partners it uses customer data collected from apps to personalise ads and content on Facebook and to conduct market research, among other things. A patent the company applied for in 2015, approved last year, describes how data from apps would be stored on Facebook servers where it could be used to help the company’s algorithms target ads and select content to show users.

Apple said its guidelines require apps to seek “prior user consent” for collecting user data and take steps to prevent unauthorised access by third parties. “When we hear of any developer violating these strict privacy terms and guidelines, we quickly investigate and, if necessary, take immediate action,” Apple said.

A Google spokesman declined to comment beyond pointing to the company’s policy requiring apps that handle sensitive data to “disclose the type of parties to which any personal or sensitive user data is shared,” and in some cases to do so prominently.

Before Alice Berg began using Flo to track her periods last June, she checked the app’s terms of service. The 25-year-old Oslo student says she had grown more cautious about sharing data with apps and wanted to ensure only a limited amount of her data would be shared with third-parties like Facebook. Now Ms Berg said she may delete the app. “I think it’s incredibly dishonest of them that they’re just lying to their users especially when it comes to something so sensitive,” she said.

Flo Health’s privacy policy says it won’t send “information regarding your marked cycles, pregnancy, symptoms, notes and other information that is entered by you and that you do not elect to share” to third-party vendors.

Flo initially said in a written statement it doesn’t send “critical user data” and that the data it does send Facebook is “depersonalised” to keep it private and secure.

The Journal’s testing, however, showed sensitive information was sent with a unique advertising identifier that can be matched to a device or profile. A Flo spokeswoman later said the company will “substantially limit” its use of external analytics systems while it conducts a privacy audit. Move, the owner of real-estate app Realtor.com — which sent information to Facebook about properties that users liked, according to the Journal’s tests — said “we strictly adhere to all local, state and federal requirements,” and that its privacy policy “clearly states how user information is collected and shared.” The policy says the app collects a variety of information, including content in which users are interested, and may share it with third parties. It doesn’t mention Facebook.

The Journal tested more than 70 apps that are among the most popular in Apple’s iOS store in categories that handle sensitive user information. The Journal used software to monitor the internet communications triggered by using an app, including information sent to Facebook and other third parties. The tests found at least 11 apps sent Facebook potentially sensitive information about how users behaved or actual data they entered.

Apps often integrate code known as software-development kits, or SDKs, that help developers integrate certain features or functions. Information shared with an app may also be shared with the maker of the embedded SDK. There are SDKs, including Facebook’s, that allow apps to better understand user behaviour or to collect data to sell targeted advertising. Such data-sharing among apps through the use of SDKs is “industry standard practice,” a Facebook spokeswoman said.

Facebook’s SDK, in thousands of apps, includes an analytics service called “App Events” allowing developers to look at user trends. Apps can tell the SDK to record a set of standardised actions taken by users, such as when a purchase is completed. App developers also can define “custom app events” for Facebook to capture — and that is how the sensitive information the Journal detected was sent.

Facebook said it was looking into how to search for apps that violate its terms, and to build safeguards to prevent Facebook from storing sensitive data that apps may send. Data drawn from mobile apps can be valuable. Advertising buyers say that because of Facebook’s insights into users’ behaviour, it can offer marketers better return on their investment than most other companies when they seek users who are, say, exercise enthusiasts, or in the market for a new sports car.

Additional reporting: Mark Secada, Yoree Koh and Kirsten Grind