Facebook has been paying teenagers to turn over almost everything about themselves, TechCrunch reported Tuesday.
The “Facebook Research” app uncovered by TechCrunch has been distributed through beta testing services — via ads on Instagram and Snapchat that make no explicit reference to Facebook — since 2016. Downloading the app, which sets up a Virtual Private Network (VPN), gives Facebook total access to almost everything done on the phone. Security expert Will Strafach told TechCrunch that this includes “private messages in social media apps, chats from in instant messaging apps — including photos/videos sent to others — emails, web searches, web browsing activity, and even ongoing location information.”
The program is open to people ages 13 to 35, but ads that ran on Instagram and Snapchat specifically asked for participants to be 13 to 17 years old. The subsequent sign-up page also did not mention Facebook, and the word “Facebook” first appeared in the process on a parental consent form for minors. Kids were given $20 per month for each month that the app was allowed to run consistently, and an additional $20 for each friend referred. (In gift cards, not cash.)
Big tech has your kid’s data — and you probably gave it to them
Facebook, now entering a second year of huge data-collection scandals, can’t really afford this particular news story. However, it’s possible the company just weighed the risks of public outrage against the benefits of the data and made a deliberate choice: Knowing which apps people are using, how they’re using them, and for how long is extremely useful information for Facebook. Similar intel may have informed the $19 billion purchase of Whatsapp in 2014, and factored into the recent decision to merge Whatsapp’s messaging system with Instagram’s and with Messenger.
This program may have informed Facebook’s decision to copy popular Snapchat features
Chasing teenagers has been a focus for Facebook for several years, since they have far less interest in the main app than older demographics and heavily prefer Instagram, as well as competitors like Tik Tok, Musical.ly, and Snapchat.
The information Facebook has collected from them may have influenced its decision to openly copy popular Snapchat features (like Stories) and add them to Instagram, or its more recent decision to create a mortifying new meme hub called “LOL.” It could inform the way it makes future product decisions or approaches new acquisitions of teen-friendly companies. (Although the current anti-trust fervor around Facebook makes the latter unlikely for now.)
This is a company that knows by now exactly how uncool it is, and may now be revealing itself as even more desperate to undo that reputation than we previously realized. To get in kids’ heads and find the next cool thing, the company is sifting through their most intimate information.
While nobody is sure exactly what data Facebook has been pulling from the devices its gotten into, we can say what the company has access to. Which, again, is basically everything.
Strafach emphasized to TechCrunch that Facebook asked people to give them root access to their phones, which gives the company the ability to modify or install software and complete access to device data, including encrypted traffic.
“This hands Facebook continuous access to the most sensitive data about you,” Strafach explained. “And most users are going to be unable to reasonably consent to this regardless of any agreement they sign, because there is no good way to articulate just how much power is handed to Facebook when you do this.”
Facebook asked people to give them root access to their phones, which gives the company complete access to data, even when it was encrypted
To distribute this new app outside of the App Store, Facebook did not use Test Flight — the official beta testing system controlled and monitored by Apple — but, as TechCrunch’s investigation found, three others: BetaBound, uTest, and Applause. They also named the Research app “Project Atlas,” internally, for whatever reason.
Facebook first told TechCrunch that it would voluntarily shut down the iOS version of Research, though Apple had seemingly already told the company that it was banning the app in adherence with the policies of the Enterprise development program. (Enterprise apps are supposed to be tested and used solely by employees of the company that makes them, and never distributed to consumers.) In any case, Research will continue to run on Android, the operating system currently installed on more than 80 percent of the world’s phones.
Apple’s quick move to ban the Research app is not the end of the story. This latest dust-up will likely fuel a grudge war between the company’s CEOs, which has been playing out increasingly publicly in the last year. Apple CEO Tim Cook has criticized Facebook’s data-collection business model on multiple occasions, including in an interview with Recode’s Kara Swisher in March 2018. Asked what he would do if faced with a scandal like Cambridge Analytica, Cook said, “I wouldn’t be in this situation.” Later, Zuckerberg told Vox’s Ezra Klein that the comment was “extremely glib,” then forced all Facebook employees to switch to Android phones.
The two companies have actually sparred over a similar situation before. Facebook Research is extremely similar to the VPN app Onovo, which Facebook acquired for $120 million in 2014. The original app was supposed to help people figure out their personal data usage and cut back on their phone bills, but Facebook started promoting a version of it within the main Facebook app in 2018 that would provide it with much of the information it’s getting now.
Last summer, Apple banned this kind of data collection and forced Facebook to remove its Onovo spin-off from the App Store. (Starfach pointed out on Twitter that the current Research app uses lines of code pulled directly from Onovo.) As of this morning, The Verge reports, Apple has shut down all of Facebook’s internal beta apps — including test versions of Instagram, Messenger, and Facebook.
If the relationship between the two companies were to deteriorate further, there could be serious problems for Facebook, which absolutely needs iOS users more than iOS users need it. Last spring, a Piper Jaffray survey found that 82 percent of American teenagers currently own an iPhone.
Facebook did not immediately respond to a request for comment from Vox, but has released this statement to several news outlets:
As should go without saying: Signing consent forms doesn’t imply complete or even partial understanding of what the app was really doing, and semantic quibbles about what is or isn’t “spying” doesn’t feel especially relevant, but at least there were supposedly more adults than kids in this program.
This news comes just five days after Mark Zuckerberg published a somewhat condescending op-ed in the Wall Street Journal, purporting to explain all the ways Facebook uses personal data. It has been one day since 13 children’s data privacy groups wrote an open letter to Zuckerberg, asking him to shut down Facebook’s Messenger Kids app, saying, “Facebook is unfit to make any platform or product for children, especially one like Messenger Kids, which gives Facebook unfettered access to kids’ relationships, conversations, and private moments with friends and family.”