Facebook announced Friday on its developer blog, that a data broker has been buying identifying Facebook user information and app developers have been willingly selling the information.
Facebook’s most popular apps, including Zynga Game Network Inc.’s FarmVille (59 million users) have been leaking user IDs to advertising networks.
Top Facebook applications also transmit personal information about a users friends to other companies.
On the company’s developer blog Facebook’s Mike Vernal said that many publishers have, in fact, violated its privacy policy by sharing UIDs with ad networks, but added most companies “did not intend to pass this information, but did so because of the technical details of how browsers work.”
While investigating the bug Facebook discovered that ceartin application developers have been selling user details to data brokers to target adverts more precisely.
Application developers who have been found selling and leaking user data have been placed on a six month suspension, during that time they are banned from connecting to Facebook. The developers will need to be audited to check they comply with Facebook’s policies.
According to Facebook’s developer blog:
As we examined the circumstances of inadvertent UID transfers, we discovered some instances where a data broker was paying developers for UIDs. While we determined that no private user data was sold and confirmed that transfer of these UIDs did not give access to any private data, this violation of our policy is something we take seriously. As such, we are taking action against these developers by instituting a 6-month full moratorium on their access to Facebook communication channels, and we will require these developers to submit their data practices to an audit in the future to confirm that they are in compliance with our policies. This impacts fewer than a dozen, mostly small developers, none of which are in the top 10 applications on Facebook Platform.
Facebook did not identify which developers were being punished and only said there were fewer than a dozen of them, none had top 10 applications.
It named ad-targeting firm Rapleaf as one of the data brokers which had been buying UIDs. It said it had reached an agreement with the firm which would end Rapleaf’s involvement with any application on Facebook now and in the future.
Facebook said it had reached an agreement with Rapleaf, a San Francisco-based data aggregation company, Rapleaf will delete all user ID information in its possession and will not to interact with the social network in future.
