Investigation: data collected by Facebook quiz myPersonality was shared with researchers over insecure site, leaving 3M+ users' details vulnerable for 4 years
Data from millions of Facebook users who used a popular personality app, including their answers to intimate questionnaires …
Context & Ripple Effects
The myPersonality finding extends the arc that began when [[a:878234|Cambridge Analytica built psychological profiles of Facebook users from personality quizzes]] and voter-targeting data: the same quiz format that powered political profiling is now shown to have leaked raw questionnaire answers through an unsecured researcher portal for four years.
It is also the second insecure-database disclosure in the coverage in as many years — the teen quiz app Wishbone lost an unprotected database holding emails and phone numbers in 2017, and weeks after this report a researcher showed the quiz maker NameTests had left personal data of ~120M users exposed until the post-Cambridge-Analytica cleanup forced a fix. The pattern pushed Facebook into its own audit, which ended with 400+ apps suspended, myPersonality among them.
First-order effects
- More than 3M quiz-takers' intimate questionnaire answers sat behind no authentication on a site used to share data with researchers, meaning anyone with the URL could pull psychometric profiles for four years.
- The researchers who received the dataset were working from an exposure-prone distribution channel, not a controlled access agreement — their own institutions now carry reputational risk alongside Facebook.
Second-order effects
- Each successive quiz-app failure — Wishbone's open database, NameTests' ~120M-user leak, myPersonality's open portal — gave Facebook's internal investigation more grounds to suspend apps wholesale rather than case-by-case, raising the compliance bar for every developer in its ecosystem.
- Quiz and personality-app makers face a credibility collapse with both users and academic partners, since the research value of their datasets depends on trust that the collection pipeline is secure.
Third-order effects
- If the pattern holds, platform operators rather than individual developers become the accountable party for third-party app security, forcing Facebook-style audits, app suspensions, and tighter data-access permissions as standard governance.
- Psychometric data collection drifts toward a regulated boundary: what began as an academic sharing arrangement is recast as a data-protection failure, narrowing how personality data can be harvested, stored, and redistributed.
The trend: The personality-quiz data economy is being dismantled piece by piece, with each insecure-app disclosure converting loose developer data-sharing into audited, platform-enforced permission boundaries.