Facebook says it continued sharing data of inactive users with around 5,000 developers even after their apps' 90-day cut-off date expired; issue is now fixed
A Facebook privacy mechanism blocks apps from receiving user data if users didn't use an app for 90 days.
Context & Ripple Effects
This lands squarely inside the cleanup Facebook promised after Cambridge Analytica: its 2018 pledge to audit every app with extended data access produced an investigation that has already removed tens of thousands of apps from around 400 developers. The 90-day inactivity cutoff was one of the guardrails from that era.
The recurring shape of these disclosures is the problem: last November Facebook admitted roughly 100 developers kept improper access to Groups member data even after restrictions were announced, and now the same class of failure — announced restrictions not actually enforced — surfaces again at 5,000-developer scale.
First-order effects
- Around 5,000 developers retained access to inactive users' data past the 90-day cutoff until Facebook fixed the mechanism, meaning user data was exposed to apps whose owners had no recent engagement justification for it.
- Facebook's own audit machinery, not a third party, caught and disclosed this — but each self-disclosed enforcement failure extends the remediation workload on the app-investigation program it has been running since 2018.
Second-order effects
- Regulators and privacy watchdogs tracking Facebook's post-Cambridge-Analytica compliance now have another documented instance of announced data restrictions failing in practice, raising the cost of the company's 'issue is now fixed' assurances.
- Developers building on Facebook's platform face a tightening enforcement environment where permissions granted years ago are subject to retroactive revocation, shifting integration risk onto anyone dependent on long-lived data access.
Third-order effects
- If announced restrictions keep leaking — Groups data, inactive-user data, partner friend data — the durable lesson is that permission boundaries enforced only by policy documents rather than technical cutoffs fail systematically, pushing platforms toward hard engineering controls over API governance.
- The pattern points toward platform data access becoming an audited, revocable lease rather than a standing grant — the structural end-state of the investigation cycle Facebook has been in since 2018.
The trend: Platform-API privacy is moving from written policy promises to technically enforced, continuously audited permission cutoffs — because Facebook's own record shows policy-only boundaries keep failing.