Facebook in Privacy Breach
Top-Ranked Applications Transmit Personal IDs, a Journal Investigation Finds — Facebook founder and CEO Mark Zuckerberg addressed the F8 developer conference this spring. — Many of the most popular applications, or “apps,” on the social-networking site Facebook Inc …
Context & Ripple Effects
The Journal investigation lands in the middle of a bruising October for Facebook: three days earlier it rolled out one-time passwords for safer logins on shared computers, and the day before that came reports that photos marked for deletion remained accessible more than a year later. Mark Zuckerberg spent the spring pitching this same developer community at F8 — the community the investigation now implicates.
Enforcement followed fast. Trade outlets All Facebook and Inside Social Games report that Facebook shut down all of LOLapps' games and applications immediately around publication, making clear that leaking user IDs is now a fireable offense even for popular developers — just as Facebook is courting mainstream users with revamped Groups and a planned joint Bing social-search announcement.
First-order effects
- Facebook has started banning offenders: the shutdown of LOLapps' entire games-and-apps portfolio shows the company will enforce against top-ranked titles, not just obscure ones.
- Developers named in the investigation face immediate revenue risk — their distribution depends entirely on Facebook's platform, which just demonstrated it will pull the plug.
Second-order effects
- App makers across the ecosystem will have to strip personal IDs from their data flows, forcing ad networks that monetize Facebook games to reprice around anonymous or platform-brokered identities.
- Brands and advertisers buying Facebook app inventory inherit a due-diligence problem: a continuing investigative series shifts scrutiny up the chain to whoever funds and profits from the traffic.
Third-order effects
- The structural question this raises is whether a platform is accountable for what third-party apps do with the identity data it hands them — a framing almost certain to draw regulator interest toward Facebook's developer program.
- If enforcement holds, the platform-developer contract gets rewritten: user identity stops being a default field every app receives and becomes a controlled resource Facebook meters out and audits.
The trend: Social platforms are moving from open developer access toward metered, audited control of user identity as the recurring cost of app-ecosystem privacy scandals.