After CNBC inquiry, Facebook suspends CubeYou, a firm that made popular quiz apps for Cambridge University and bragged it had personal info of tens of millions
that Facebook can't police Apps that use fraudulent means to get Facebook users to divulge personal information — it's going to be a very long couple of days. http://twitter.com/... @d1gi : Meaning that CubeYou used Facebook's account recovery “side door” aka did bulk FB user-matching by phone number and email address to build its enriched PII database Nick Short / @politicalshort : Facebook is suspending another data analytics firm called CubeYou after CNBC notified FB that CubeYou was collecting info about users through quizzes misleadingly labeled “for non-profit academic research,” then shared user info w/marketers. http://www.cnbc.com/... James Grimmelmann / @grimmelm : Note that Facebook failed to discover this on its own. I.e, it wasn't willing to devote resources equivalent to one investigative reporting team to the problem. http://twitter.com/... Fatemeh Khatibloo / @fatemehx2 : Much like when the news about PRISM originally broke, implicating only Verizon, it's fairly ridiculous to assume that there aren't dozens more “insights and analytics” firms using #facebook data in unsanctioned ways. http://twitter.com/... Zeynep Tufekci / @zeynep : I'd be surprised if every person who was on Facebook by 2015 didn't have their data siphoned this way, and still floating out there in many databases. There may have been thousands, hundreds of thousands—maybe millions—of apps with this kind of access. http://twitter.com/... @dellcam : This is Facebook's SOP. I reported on several companies providing FB/Instagram data to law enforcement in 2016. (See: Snaptrends) FB would only take action after I provided them proof & told them I was going to print. http://twitter.com/... Christina Wilkie / @christinawilkie : Facebook told CNBC that it can't control whether or not companies lie to their users about what they do with personal information. Both Cambridge companies told users their quiz data would be used only for academic research. Instead, iit was sold to campaigns and marketers. http://twitter.com/... @d1gi : pic.twitter.com/Alj7wskwLi @d1gi : CubeYou, a reseller of academic FB user data (Apply Magic Sauce) was suspended from Facebook *after CNBC showed them the quizzes* https://www.cnbc.com/... Privacy Matters / @privacymatters : A thread from two weeks ago on Apply Magic Sauce - Cambridge Uni and now this: Facebook suspends another data analytics firm after CNBC discovers it was using tactics like Cambridge Analytica http://www.cnbc.com/... http://twitter.com/... Brian McClendon / @bmcclendon : The headline “CNBC discovers” is a serious problem for Facebook. There's _no_reason FB couldn't have audited all of the usage of its “platform API” to and review the apps. http://www.cnbc.com/...
Context & Ripple Effects
Three weeks into the Cambridge Analytica reckoning, where Facebook's own estimate of exposed users grew to as many as 87 million, the CubeYou suspension shows the scandal was not a single bad actor but a pattern Facebook was only finding when journalists did the digging. CNBC's inquiry — not any internal audit — is what triggered this ban, echoing how the forensics audit of Cambridge Analytica had to be stepped down at the UK ICO's request rather than completed on Facebook's terms.
First-order effects
- CubeYou loses platform access immediately, and its method is now public: quizzes mislabeled 'for non-profit academic research' feeding an enriched PII database built by bulk-matching accounts through Facebook's phone-number and email recovery side door.
- Facebook's admission that it cannot control whether developers lie to users undercuts Mark Zuckerberg's earlier claim that it was unaware of widespread developer misuse — a claim already drawing fire from commentators.
Second-order effects
- Every analytics and insights firm that touched Facebook data now faces the same suspension risk, pushing marketers and campaigns toward first-party data collection they control directly.
- The FTC angle sharpens: with former officials arguing Facebook may have breached its 2011 privacy consent decree, each journalist-surfaced abuser becomes fresh evidence for regulators rather than a one-off violation.
Third-order effects
- If enforcement depends on press inquiries rather than platform monitoring, the durable fix is structural — API access treated as a security boundary with audit rights, not a trust-based developer agreement.
- Academic labeling itself becomes suspect: 'research' framing as a data-harvesting cover forces universities like Cambridge into reputational defense and pushes platforms toward verified institutional pipelines for scholarly data access.
The trend: Platform data abuse is being surfaced journalist-by-journalist rather than caught by the platforms themselves, converting each revelation into regulatory leverage against Facebook's consent-decade promises.