Investigation finds that Facebook has been paying people to install a “Facebook Research” VPN to gather data on phone use habits
Desperate for data on its competitors, Facebook has been secretly paying people to install a “Facebook Research” VPN that lets the company suck …
Context & Ripple Effects
The Research VPN program is an escalation of a playbook Facebook has run openly before: it acquired Onavo in 2013 and by early 2018 was promoting that user-tracking VPN inside its main iOS app under a "Protect" tab. What changed with this investigation is the method — instead of routing users through a branded app, Facebook paid panelists directly to install a certificate-bearing VPN that mirrors their phone traffic back for competitive analysis.
The fallout moved fast: within weeks Facebook pulled Onavo from Google Play and said it would stop feeding its market-research pipeline, while the same reporting cycle surfaced that analytics firm Sensor Tower had shipped VPN and ad-blocking apps with 35M+ downloads doing comparable quiet collection.
First-order effects
- Facebook loses its two consumer-side collection funnels at once — the Research VPN is exposed and Onavo is withdrawn from distribution, cutting off the competitor-usage telemetry both fed into.
- Participants who took the payments are left running root-level network access on their devices for a program now publicly documented, with some Reddit users saying they knew what they installed and priced in no privacy anyway.
Second-order effects
- App-store gatekeepers face pressure to treat research-labeled VPNs as data-collection tools rather than utilities — the Sensor Tower findings show the pattern wasn't Facebook-specific, so enforcement can't stop at one company.
- Competitors whose apps were being measured through the tunnel gain a talking point against Facebook's data practices, while legitimate market-research firms inherit the reputational discount the 'paid VPN panel' model now carries.
Third-order effects
- If gatekeepers tighten VPN-category review, paid-usage-research programs migrate toward opt-in panels with explicit disclosure — raising the cost of the competitive-intelligence data that consumer platforms have treated as free infrastructure.
- The episode hardens a consent standard for network-level instrumentation: any app that terminates device traffic becomes presumptively a surveillance surface, shifting burden onto publishers to prove otherwise.
The trend: Consumer VPNs and research-panel apps are being reclassified from utilities into covert data-collection channels, forcing platform gatekeepers and regulators to police them category-wide.