British company Privacy International revealed on Sunday at the 35th Chaos Communication Congress that app developers are handing over data to Facebook, even from users who are not Facebook users.
The company conducted a study on the subject, testing 34 Android apps that have between 10 and 500 million users, and says it is “particularly concerned” about how user data is “exploited” in Facebook and Google’s back-end systems.
Privacy International found that 23 of the apps tested sent data to Facebook (data that tells the social network that a user opened or closed a particular app along with device information, language settings, and time zone). The apps also sent the user’s Google advertising identifier, which allows tracking companies to easily match users to their profiles.
By performing a special processing on the Kayak travel app, the researchers discovered that it was delivering data to Facebook with every search within the app: search time, departure and arrival city, airport and date, number and class of tickets.
Privacy International pointed out that this behavior was repeated regardless of whether the user had logged out of Facebook or did not have an account on the social network at all.
“Facebook offers analytics and advertising services to app developers, which help them get aggregated information about how people engage with their apps, which is a common practice for many companies,” Facebook told Privacy International.
Facebook also pointed to its Clear History feature, first announced in May during the Cambridge Analytica, as a means of addressing Privacy International's complaints.
Privacy International also looked at how Facebook's policies compare to Europe's GDPR requirements and its design for data minimization.
But with apps transferring data to Facebook before the user has a chance to use the app, Privacy International said there are many questions about whether there is any legal basis for the data transfer.
“The fact that the SDK’s default implementation automatically transmits data when an app is opened, and that a feature to delay this transmission was released in July 2018 (meaning Clear History), raises questions about Facebook’s liability to developers as well as the company’s compliance with data protection,” Privacy International said.
It is difficult to protect yourself from the kind of data sharing we described in this research.
Recall that last month, Facebook was once again found to be exposing its users' data, when it revealed a bug in one of its APIs, exposing private photos of approximately 6.8 million users.
Last October, the social network announced that unknown individuals had combined three bugs to gain access to ID tokens of 30 million accounts.
______________________
- Facebook: we have the social network we deserve
- See how much time you spend on Facebook
- Facebook download the video you are interested in
