Facebook to review all apps that had extended data access in 2014 and prior, audit suspicious ones, inform users about misuse, revoke permissions of unused apps
Context & Ripple Effects
This announcement is Facebook's opening move after the Cambridge Analytica scandal: rather than patching forward-facing rules only, it committed to a backward-looking sweep of every app that held extended data access before its 2014 platform tightening — auditing flagged apps, notifying affected users, and cutting off permissions for apps gone dormant.
The follow-on coverage shows the promise became a multi-year program: by May 2018 Facebook had suspended roughly 200 suspicious apps out of thousands reviewed, high-profile developers like Mail.Ru were pulled into the probe, and by September 2019 the tally had grown to tens of thousands of apps removed from about 400 developers — with a later disclosure showing even inactive-user data kept flowing past cut-off dates for thousands of developers.
First-order effects
- Every developer whose app held extended permissions from 2014 or earlier now faces review, with suspicious cases audited and unused apps losing their permissions outright.
- Users whose data was misused are promised direct notification, shifting some of Facebook's disclosure burden onto individual account holders.
Second-order effects
- Developers built on Facebook Login and the data APIs face tightening supply: weeks later Facebook moved to require approval for every app touching the Pages, Events, Groups, and Login APIs (limiting those endpoints), raising the compliance bar across the ecosystem.
- Large third-party developers become audit targets regardless of size — Mail.Ru's apps entered the probe even as two of them received extensions to keep collecting data under the old policy.
Third-order effects
- If the pattern holds, app-platform governance shifts from one-time permission grants to continuous audits and revocation, making long-lived data access something platforms actively police rather than passively extend.
- The program's own disclosures — removals measured in tens of thousands of apps, and a later fix covering around 5,000 developers still receiving inactive-user data — suggest retroactive cleanup becomes a recurring cost of operating an open data platform.
The trend: Social platforms are moving from permissive app ecosystems toward permanent audit-and-revocation regimes over historical data access, with each scandal expanding the scope of retroactive review.