Some popular apps send sensitive info to Facebook via the company's analytics SDK, such as a user's heart rate, intent to get pregnant, and home listings viewed
Rise of ‘Surveillance Capitalism,’ China and Iran Go Hacking, Facebook as ‘Digital Gangster’ NBC News : Use an app to track your period? That data and more could end up with Facebook, WSJ reports John Bowden / The Hill : Cuomo directs NY agencies to investigate Facebook over report of secret acquisition of private data Lauren Feiner / CNBC : Facebook reportedly gets deeply personal info, such as ovulation times and heart rate, from some apps Firstpost : Several phone apps feed sensitive data to Facebook without user consent: Report Abdullah / Gizchina : Some apps share sensitive personal information with Facebook without users knowledge Catalin Cimpanu / ZDNet : Another Facebook privacy scandal, this time involving its mobile analytics SDK Nick Statt / The Verge : Apps makers are sharing sensitive personal information with Facebook but not telling users Sergiu Gatlan / BleepingComputer : NY Governor Cuomo Calls For Investigation on Facebook Health Data Collection Maggie Tillman / Pocket-lint : Latest Facebook scandal involves apps sharing users' sensitive health data Karissa Bell / Mashable : Period tracking app says it will stop sharing health data with Facebook Rhett Jones / Gizmodo : These Apps Reportedly Shared Sensitive Personal Information With Facebook Andrew Orr / The Mac Observer : What Will it Take for Apple to Break Up With Facebook? Troy Wolverton / Business Insider : Apps are reportedly telling Facebook how much users weigh and when they're menstruating Buster Hein / Cult of Mac : Some of your favorite iOS apps are feeding your data to Facebook Queenie Wong / CNET : Facebook receives personal info like your heart rate from popular apps C. Scott Brown / Android Authority : At least 11 popular apps are secretly giving your private data to Facebook Juli Clover / MacRumors : Some iOS Apps Sending an Alarming Amount of Data to Facebook and Most Users Are Unaware Evan Selleck / iPhone Hacks : Some Popular Apps Send Personal Info, Like Intent to Get Pregnant, to Facebook in Secret Kris Holt / Engadget : Multiple iOS apps are reportedly sharing sensitive data with Facebook Usman Qureshi / iPhone in Canada Blog : Popular iOS Apps are Stealing Your Private Data via Facebook SDK: WSJ Michael Potuck / 9to5Mac : Popular apps caught secretly sending health data and more to Facebook, should Apple intervene? MacDailyNews : You give apps your sensitive personal information, then they tell Facebook, even if you have no connection to Facebook Tweets: Sam Schechner / @samschech : A few seconds after the app finished measuring my pulse, I saw it pop up in the network traffic headed to Facebook: \"heartrate\":56,\" Here is the resulting story about how many popular apps are sending your intimate data to Facebook : http://www.wsj.com/... Mark Schoofs / @schoofsfeed : Wow. @facebook sweeps up sensitive data — including heart rate and when a woman is having her period — from top phone apps. And users have no way to opt out. @WSJ @samschech http://www.wsj.com/... Antonio Garca Martnez / @antoniogm : Episode #457 in ‘AGM Re-Interprets Tech Journalism’ (soon to be available on @SubstackInc!)Today's big news is a WSJ report that FB apparently knows when you're menstruating. Yes, really.http://www.wsj.com/... Antonio García Martínez / @antoniogm : Key point: FB was in no way involved with the data collection, nor do they store the data in usable form (they're stored as bucketed ‘events’, so the developer can sort user actions, per whatever internal analytics philosophy they have). FB is basically a bean counter here. Will Strafach / @chronic : no clue if this is just extreme carelessness on the developer's side or what. either way, pretty weird to have that sort of data stored with a third party, in my opinion. WSJ highlighted Facebook's role, but tracking is really a wider issue, Facebook just plays a part in it. Will Strafach / @chronic : My Calendar - Period Tracker (#174 in Health & Fitness, https://itunes.apple.com/... / com.lbrc.PeriodCalendar) sends more granular information to Google Analytics, such as mood and intercourse entries (as specific as whether protected / unprotected) Will Strafach / @chronic : Dot Fertility Tracker ( https://itunes.apple.com/... ) sends Flurry Analytics information about what contraceptive methods are used, if recently pregnant, and other bits of info. this occurs even if the age is set to be under 18. Will Strafach / @chronic : Period Calendar (#32 in Health & Fitness, 35,000 ratings, https://itunes.apple.com/... ) communicates often with Google Analytics. what data it sends is a bit harder to judge precisely, because some of the content they send to appears to be obfuscated or in an odd format. Will Strafach / @chronic : best I can say about that one without speculating much: that app allows you to enter some extremely personal information, and right after doing so there is a flurry of connectivity to Google Analytics. watching that is quite unsettling, even if it's not clear what data is sent. Will Strafach / @chronic : also surprised they didn't dig deeper on period trackers. there is some odd stuff. example: Period Tracker Lite (#30 in Health/Fitness, 20k+ reviews, https://itunes.apple.com/... ) sends ‘fact of’ sensitive actions, like start of a period, or marking the user was intimate, to Apsalar. Hamza Shaban / @hshaban : New Facebook report from the WSJ: FB takes potentially sensitive info from apps about how people behave or data they enter - Often without prominent/specific disclosure - FB is sent your body weight, blood pressure, menstrual cycles, pregnancy status http://www.wsj.com/... http://twitter.com/... Oliver Darcy / @oliverdarcy : Wow. Apps are sending Facebook very intimate personal information, without prominently disclosing it to users, WSJ reports: http://www.wsj.com/... http://twitter.com/... Tim O'Brien / @timobrien : 2/2: Millions of smartphone users share personal data with apps, including exercise habits, the price of a house they checked out, blood pressure, menstrual cycles or pregnancy status. Unbeknownst to many of them, that data is being shared with Facebook http://www.wsj.com/... Antonio García Martínez / @antoniogm : Is it weird that an app developer is segmenting you by heartrate, and maybe using that to vary your experience, or even target you with ads (say, heart meds if you seem ill). Yeah, it is. Some users might well find that objectionable, and should get angry...at the app developer. Molly Wood / @mollywood : Muse on how this is the power that FB somehow wields in the digital ecosystem, that apps just REFLEXIVELY funnel your information straight from their servers to Facebook's. How exactly did this become a norm? https://twitter.com/... Zeynep Tufekci / @zeynep : Read this. An app learns you want to get pregnant or your weight or which house you liked or your weight, and immediately passes it off to Facebook with no way to opt out. http://twitter.com/... Bjrn Jeffery / @bjornjeffery : In the category: “you probably approved it with a click, but was this what you intended?” Trust and privacy from a legal perspective are two very different things. http://twitter.com/... Michael Veale / @mikarv : Of course many of my followers will know the data sharing practices of health and period tracking apps has been academically studied since at least 2015 http://techscience.org/... http://twitter.com/... Steve Streeting / @stevestreeting : Product managers who are telling devs to slap in analytics and telemetry willy-nilly without a proper privacy audit: the time to wake up about this was *several* years ago, but ffs get your act together and stop assuming it's OK because “everybody does it” http://twitter.com/... Antonio García Martínez / @antoniogm : Facebook is no more responsible for what data gets piped to it via the SDK than Google is the browsing data it receives via Google Analytics (whose pixels, or ones like it, absolutely paper every news outlet you visit). This is blaming the ruler for what gets measured. Dare Obasanjo / @carnage4life : It's opaque data, Facebook doesn't know what it is. The apps are the ones violating user privacy by giving it to Facebook without disclosure in violation of GDPR (and soon CCPA). OTOH FB, provides this disclosure of who gave them your data https://techcrunch.com/... @dhh : Collecting and sharing medical data is serious. You can't just wing it. HIPAA spells out restrictions, consent requirements, and more plainly. All parties involved here are violating that a minimum. https://www.hhs.gov/... Dare Obasanjo / @carnage4life : The article mentioned custom events which implies it's opaque data (to FB) which apps attach to users for later targeting. A feature supported by all major ad platforms including Google (who is never mentioned in these stories). This isn't some deliberate medical data harvesting Ed Markey / @senmarkey : A new low in privacy malpractice. @facebook has been collecting app users' blood pressure, body weight, and even pregnancy status without users' knowledge. This is a stunning, unacceptable invasion of privacy. http://www.wsj.com/... Emma Graham-Harrison / @_emmagh : Facebook doesn't just secretly track when you have your period, it secretly tracks when you ovulate. Most women don't even know this about themselves... terrifying, vital reporting from @samschech about the deeply personal data the tech giant is secretly scooping up from apps http://twitter.com/... Damian Collins / @damiancollins : This important @wsj report on apps sharing data with Facebook shows how totally out of control the system is. I'm sure most users had no idea personal information about their heart rate, pregnancy planning & even period dates was shared with Facebook. http://twitter.com/... @dhh : We must have read different stories. Facebook's data is used specifically for ad targeting, it's not like Facebook has some generic data store that's not integrated into the app. Facebook is holding this liability, and have the power to tie data to accounts for targeting. Dare Obasanjo / @carnage4life : Quite a bit of hyperbole. From the description in the article this is either app analytics or conversion events. Either way, FB isn't anymore aware of the data than Google knows what's in Firebase or Amazon does about app uploads to S3. If even techies spread FUD we're all lost. Jamie / @j_winterton : “In the case of apps...Facebook software collects data from many apps even if no Facebook account is used to log in and if the end user isn't a Facebook member... None of those apps provided users any apparent way to stop that information from being sent to Facebook.” UGH. http://twitter.com/... Jay Pinho / @jaypinho : Yes, I agree the implied blame is somewhat misplaced in the article too. But it's also somewhat of a semantic point, because in another sense all of these apps are bit players in a data ecosystem largely controlled by FB and Google. Antonio García Martínez / @antoniogm : But the journalists charged with informing the public could maybe read five year old docs rather than breathlessly declaring a scoop....for example. Antonio García Martínez / @antoniogm : Turns out that certain app developers (there are lots of apps that measure personal data like heart rate and, yes, ovulation) were using the SDK to create trackable segments on the FB side. This is both to just gauge user engagement, and *maybe* target ads later. Jay Pinho / @jaypinho : You're missing the point. The public doesn't know about the docs. How late the journalists discovered them is immaterial. The issue is the asymmetry of knowledge between the users and the companies throwing around their personal data. Antonio García Martínez / @antoniogm : The (valid) counter-argument is: who cares that it's well-known to those working in mobile? The average user doesn't know, and the goal is to reduce the delta between the common user and tech insiders, to improve the discourse. True, and fair enough. https://twitter.com/... Antonio García Martínez / @antoniogm : As a meta-comment on tech journalism (you knew it was coming), this is a pretty normal piece of market color, known to anyone who works in the field, being spun as a scoop, and rewritten so the current bogeyman (FB) plays a leading role (rather than the real villain). Antonio García Martínez / @antoniogm : Facebook dominates mobile ads spending like Google used to dominate desktop ads spending, so this is their long-term bid to provide one analytics platform for the mobile ecosystem. It's plumbing, but important plumbing. But what about this business of menstruation and heartbeat? Nick Confessore / @nickconfessore : When a major newspaper has a sidebar called “How an App Told Facebook You're Ovulating,” safe to say we have a problem. http://www.wsj.com/... Philip Gourevitch / @pgourevitch : How is this plunder not criminal? http://twitter.com/... Antonio García Martínez / @antoniogm : In a bit of impressive smartphone sleuthery, @samschech uncovers that mobile apps are sending highly personal data to FB's mobile analytics product. Of course, one time-saver would have been to just read the public FB developer docs on the functionality: https://developers.facebook.com/ ... John S. Wilson / @johnwilson : Facebook may not even be using the data for any purpose. If so, classic case of asking for or receiving info you don't need. Not smart. http://twitter.com/... John Paczkowski / @johnpaczkowski : “Instant Heart Rate: HR Monitor, the most popular heart-rate app on Apple's iOS, made by California-based Azumio Inc., sent a user's heart rate to Facebook immediately after it was recorded.” http://twitter.com/... Chip Stewart / @medialawprof : I'm trying to write a chapter on futuristic sci-fi invasions of privacy and I would appreciate it if Facebook would stop being worse than Orwellian and making my stuff look tame by comparison http://twitter.com/... @wsj : Millions of smartphone users confess intimate secrets to apps. In many cases, that information is shared with Facebook, WSJ testing reveals. http://www.wsj.com/... Oliver Darcy / @oliverdarcy : Another day, another instance where it took a journalist or user to discover Facebook's rules were being broken for the social network to act. It's a broken record. http://www.wsj.com/... http://twitter.com/... Harmeet K. Dhillon / @pnjaban : Does Facebook know when you're ovulating? “This is a big mess.” Numerous popular apps send sensitive information about their users directly to Facebook, @WSJ testing reveals. http://www.wsj.com/... Thanks: @cremnob