Facebook flaw gave 5,000 developers access to users' data

Information from users' profiles was accessible after the 90-day time limit had expired

Facebook has admitted that it accidentally shared user data with developers for longer than it should have.

Facebook apps are supposed to prevent access to personal data if users have not used the app for more than 90 days. However, the social network has said that a flaw in how inactivity was recorded allowed approximately 5,000 developers to collect data from users’ profiles after the 90-day time limit on their rights had expired. 

“Recently, we discovered that in some instances apps continued to receive the data that people had previously authorized, even if it appeared they hadn’t used the app in the last 90 days,” Facebook admitted in a statement.

“For example, this could happen if someone used a fitness app to invite their friends from their hometown to a workout, but we didn’t recognize that some of their friends had been inactive for many months. 

“From the last several months of data we have available, we currently estimate this issue enabled approximately 5,000 developers to continue receiving information - for example, language or gender - beyond 90 days of inactivity as recognized by our systems.”

Facebook says it fixed the issue the day after discovering it, adding that it plans to investigate the slip-up and that it will continue to prioritize transparency with respect to any major updates. It has not stated how many users had their personal data scraped.

In 2018, the Cambridge Analytica privacy scandal exposed how third-party apps were harvesting Facebook users’ personal information. Cambridge Analytica’s app harvested the data of users who interacted with the app, as well as their friends who had not consented to the use of their data. 

Following the US Congress’ questioning of Mark Zuckerberg in 2018 on how Facebook dealt with users’ personal data, the company established the 90-day lock-out policy for apps that year. However, the lock-out did not work as intended.

A company rep stated: “We haven’t seen evidence that this issue resulted in sharing information that was inconsistent with the permissions people gave when they logged in using Facebook.”

Facebook has also simplified its platform terms and developer policies to provide clearer guidance on data usage and sharing, as well as respecting users’ privacy when using its platform.

Facebook stated: “These new terms limit the information developers can share with third parties without explicit consent from people. They also strengthen data security requirements and clarify when developers must delete data.”

Featured Resources

Humility in AI: Building trustworthy and ethical AI systems

How humble AI can help safeguard your business

Download now

Future of video conferencing

Optimising video conferencing features to achieve business goals

Download now

Leadership compass: Privileged Access Management

Securing privileged accounts in a high-risk environment

Download now

Why you need to include the cloud in your disaster recovery plan

Preserving data for business success

Download now

Recommended

People can’t resist opening LinkedIn phishing emails
Security

People can’t resist opening LinkedIn phishing emails

16 Nov 2020
Snapchat now allows you to display subscriber numbers
social media

Snapchat now allows you to display subscriber numbers

4 Nov 2020
Instagram to extend livestreaming time limit to 4 hours
social media

Instagram to extend livestreaming time limit to 4 hours

28 Oct 2020
CEOs of Facebook, Twitter and Google face Senate hearing
Policy & legislation

CEOs of Facebook, Twitter and Google face Senate hearing

28 Oct 2020

Most Popular

350,000 Spotify users hacked in credential stuffing attack
Security

350,000 Spotify users hacked in credential stuffing attack

24 Nov 2020
46 million Animal Jam accounts leaked after comms software breach
Security

46 million Animal Jam accounts leaked after comms software breach

13 Nov 2020
Samsung Galaxy Note might be discontinued in 2021
Mobile Phones

Samsung Galaxy Note might be discontinued in 2021

1 Dec 2020