Facebook responds to UK Parliament document dump, giving an explanation for API whitelisting, scraping Android call and SMS records, how it uses Onavo, and more
As we've said many times, Six4Three — creators of the Pikinis app — cherrypicked these documents from years ago as part …
Context & Ripple Effects
The UK Parliament followed through on its promise to publish the internal Facebook documents it seized from Six4Three's founder, releasing 250+ redacted pages covering data-sharing agreements, the shutdown of Vine's access, and the growth team's push to collect Android call and SMS records despite internal PR concerns. Earlier leaks from the same case had already shown staff weighing whether to charge developers and advertisers for user data.
Facebook's response is a defensive counter-narrative: it frames the documents as cherrypicked from years ago by a company suing it, while offering its own explanations for API whitelisting, the Android call/SMS scraping, and how Onavo fits into its business. The stakes are that Parliament has turned litigation discovery into a public accountability mechanism.
First-order effects
- Facebook is now fighting the story on two fronts at once — the Six4Three lawsuit and parliamentary scrutiny — with each explanation (whitelisting, Onavo, call/SMS collection) inviting follow-up questions from the committee that published the documents.
- The partner companies named in the leaked data-sharing agreements face renewed scrutiny of why their API access was preserved while rivals like Vine were cut off by Zuckerberg personally.
Second-order effects
- Other regulators examining Facebook's data practices gain a ready-made evidentiary base: the emails showing the growth team added Android call/SMS collection amid PR fears give oversight bodies documented intent, not just outcomes.
- Onavo's dual role as a consumer VPN and a source of competitive intelligence comes under pressure, threatening an acquisition playbook other platforms have copied.
Third-order effects
- If parliaments can seize and publish a foreign company's internal documents via a domestic lawsuit, platform data governance shifts from self-policing toward external audit — with API access decisions treated as matters of public record rather than private contract.
- The pattern points toward developers and advertisers demanding contractual clarity on data access tiers, since the documents show access was negotiated case-by-case at the executive level.
The trend: Platform data practices are being dragged from self-policing into external audit, as legislators use litigation discovery to force disclosure that voluntary testimony never produced.