NY Governor Andrew Cuomo orders two state agencies to investigate a report that Facebook may be collecting users' health data and other sensitive info
NEW YORK (Reuters) - New York Governor Andrew Cuomo on Friday ordered two state agencies to investigate a report that Facebook Inc …
Context & Ripple Effects
This order lands mid-surge: weeks earlier, [[a:938221|attorneys general in six states including New York were already probing how Facebook handles user data]] in the wake of Cambridge Analytica, and Cuomo is now adding executive-branch muscle on top of that legal scrutiny. The trigger is a report that Facebook may be pulling health and other sensitive information from its software kits embedded in third-party apps.
The arc that follows shows why it mattered: within two months New York's attorney general opened a separate probe into Facebook's unauthorized harvesting of over 1.5 million users' email contact books, and by 2021 the state concluded Facebook had taken steps to stop collecting sensitive data through those embedded SDKs but had done little to track which apps were sending it, per the state's own follow-up review.
First-order effects
- Facebook now faces overlapping New York investigations — the six-state attorney general effort plus whatever the two ordered agencies produce — with health-app data as the newest front.
- Developers of health and fitness apps that embed Facebook's SDKs come under implicit scrutiny, since their data flows are the mechanism being investigated.
Second-order effects
- Other state attorneys general, already coordinating on Facebook data practices, have a template for widening their own probes toward sensitive-category data like health information.
- The findings feed the broader enforcement stack around Facebook — alongside the reported federal criminal inquiry into its data-sharing deals, where an NY grand jury subpoenaed device-maker partners — raising the cost of every future SDK partnership.
Third-order effects
- If the pattern holds, states become the de facto regulators of platform data collection in sensitive categories, with governors and attorneys general setting the pace federal privacy legislation has not.
- Third-party SDKs — the plumbing connecting apps to platforms — shift from invisible infrastructure to a named regulatory target, forcing platforms to audit and document what partner apps send them.
The trend: State officials are filling the federal privacy-law vacuum by treating platform data collection — especially health data flowing through embedded SDKs — as a prosecutable offense.