Facebook says it continued sharing data of inactive users with around 5,000 developers even after their apps' 90-day cut-off date expired; issue is now fixed
yes, again David Challis / Android Headlines : Facebook Shares Users Data With Developers... Again Tweets: Jason Kint / @jason_kint : A subtle but important observation from me on this report. Bloomberg has clearly paid attention to the details (and not allowed Facebook to rewrite history) as they correctly describe Facebook data being *purchased by* Cambridge Analytica. Many newsrooms miss this. Hat tip. https://twitter.com/... https://twitter.com/...
Context & Ripple Effects
Two years into Facebook's post-Cambridge Analytica cleanup, the promised audit keeps surfacing exceptions. The company committed in 2018 to reviewing apps with extended data access and revoking permissions from unused ones (review all apps that had extended data access), then removed tens of thousands of apps from about 400 developers by late 2019 (removed tens of thousands of apps from about 400 developers). Today's admission is the third leak category: after the ~100 developers with improper Groups member data access last November, Facebook now says around 5,000 developers kept receiving inactive users' data past their apps' 90-day cutoff.
The pattern echoes an earlier failure mode: in 2018 reporting showed some partners retained friend-data access after the 2015 developer lockdown (partners including Nissan and Royal Bank of Canada kept access). Each disclosure arrives with the same framing — a cutoff rule existed, enforcement lagged, and Facebook declares the issue fixed only after it is reported.
First-order effects
- Around 5,000 developers held active data-sharing pipelines for users who had stopped using their apps, meaning people who never revoked permissions were still exposed until Facebook cut off the flow.
Second-order effects
- Every new exception weakens the credibility of Facebook's self-audit as the regulatory answer: the same investigation framework that produced the 400-developer app removals also missed this cohort, giving regulators and privacy litigants a recurring template of 'announced fix, later found leaking.'
Third-order effects
- If each audit wave keeps finding post-cutoff leakage, platform API governance drifts toward continuous external verification rather than company-attested compliance — with the 90-day permission expiry becoming a legally scrutinized boundary rather than an engineering default.
The trend: Facebook's post-Cambridge Analytica data-access cleanup keeps producing retroactive disclosures of enforcement gaps, shifting trust in its developer platform from policy promises to independently verified compliance.