Analysis In just the latest in a seemingly endless stream of half-truths, Facebook has admitted it misled the public when it claimed that only 5 per cent of the users of its banned tracking app were teenagers.
The real figure, the Silicon Valley wunderkind has since confirmed to US Senator Mark Warner (D-VA), was nearly four times higher: 18 per cent.
That wasn't the only knowingly false response that Facebook made when it emerged that the antisocial network had secretly bypassed the Apple App Store's privacy rules, and used its enterprise developer certificate to create a VPN-based data-slurping iOS application that paid adults and teenagers to monitor their online activities. The enterprise cert should only be used to sign and release internal apps, not ones for the general public, which should go through Apple's App Store checks and approval process.
The other half-truths were immediately exposed at the time, whereas this misleading figure was only corrected this week, a month later, and only in response to a demand from Senator Warner asking for more details.
"At the time we ended the Facebook Research App on Apple’s iOS platform, less than 5 percent of the people sharing data with us through this program were teens," Facebook explained in its letter in response [PDF], provided to us by Senator Warner's office and reported on first by TechCrunch. "Analysis shows that number is about 18 percent when you look at the complete lifetime of the program, and also add people who had become inactive and uninstalled the app."
That is a very different response to the one that Facebook provided when it responded to the initial probe by TechCrunch. In that response, it strongly intimated that the reporter in question had actively ignored critical details. Facebook said at the time:
Key facts about this market research program are being ignored. Despite early reports, there was nothing 'secret' about this; it was literally called the Facebook Research App. It wasn’t 'spying' as all of the people who signed up to participate went through a clear on-boarding process asking for their permission and were paid to participate. Finally, less than 5 percent of the people who chose to participate in this market research program were teens. All of them with signed parental consent forms.
Every part of that statement is false.
Here we go
First, while Facebook claims that it was open about its "research app," the truth – as it admits to Warner – was that it used third parties to approach people, and ask if they would be interested in participating in a paid study. Those third parties referred only to "our client" in their approach and, critically, required anyone interested in learning more to agree to a series of disclosures before being informed the project was being run by Facebook.
They included the agreement: "By installing the research application, you’re also agreeing to keep this research, and your participation in it, strictly confidential, and to not disclose any information about this project to third parties."
In other words, yes, it was a secret project and participants were required to agree that they will not inform anyone about any detail of it.
Facebook said that "less than 5 percent of the people who chose to participate in this market research program were teens."
By any reasonable reading of that sentence, it is also a lie. In fact, 18 per cent of the people who "chose to participate" were teens. And the figure was likely much higher: Facebook asked users to self-confirm that they were under 18. The company provided Senator Warner with a series of screengrabs of its app installation, but what are missing are images or details about how the age verification was carried out.
Given Facebook willingness to lie about anything that makes it look bad, it is all too likely that the biz simply asked children and adults to tap a button to confirm they were over 18. Even though doing so would require an additional step – seeking non-signed flimsy parental permission – 18 per cent of them still said they were under 18.
It appears that they could have simply tapped that they were over 18 straight away, and the entire process would have continued with no other checks. It's also possible that users could simply have clicked Back and then said that there were in fact over 18 after all – we don't know, and Facebook won't tell us.
Facebook gives no details over what instructions it gave to the third parties who it paid to approach possible candidates for its surveillance market research. It is inconceivable that the company did not tell those third parties who its target markets were. So the question is: did Facebook actively target under 18 year olds?
And the answer is yes, because research firms are very careful about ensuring that they know whether the individuals in their lists are minors or not. Not everyone is willing to play so loose and fast as Facebook.
Trust Facebook? Of course, why wouldn't you?
Lastly, Facebook claimed that: "It wasn’t 'spying' as all of the people who signed up to participate went through a clear on-boarding process asking for their permission and were paid to participate."
And in this respect, the screengrabs that Facebook shared with Senator Warner appear to back up their assertion: users were, according to Facebook, required to agree to multiple steps in which it was mostly clear about what installing its "research app" would enable the company to do.
Here's one example: "By tapping OK, you will install a research VPN and will give Facebook permission to collect data from your phone. This data will help us understand how you browse the internet, how you use the features in the apps you've installed, and how people interact with the content you send and receive."
While this is carefully written language designed to make what is effectively complete access to your phone usage palatable, it does demonstrate that Facebook was at least open about what its app would do.
Or was it? Because in its response to the senator, Facebook includes yet another careful caveat. Prior to the screengrabs, it notes that "while the language used in the flows varied over time, the following paragraphs walk through an example of this process, providing sample screenshots of the iOS experiences as examples of the disclosures, and consent a user saw."
- Language that varied over time
- Example of the process
- Sample screenshots
- Examples of the disclosures
Here's what Facebook did not say: "Here is the sign-up process." Here's what it did say: "Here are some examples and samples of what people saw and by the way the language was different." For a company that actively pushed a 5 per cent figure when it knew its own flawed figure was actually 18 per cent, it fair to assume that Facebook is willing to go to some lengths to distort what actually happened.
Regardless, Senator Warner seems content with the response telling The Register: "I was pleased to learn that Facebook made its role in the research study relatively prominent. I still have grave concerns with the way that Facebook has used both the research app and its VPN Onavo to keep track of emerging competitors, in ways that users do not reasonably expect."
But before we file this away in the ever-expanding "Facebook Lies" folder, what about the claim that all the under 18s that did sign up got their parents' permission? Yep, that's also BS.
"Less than 5 percent of the people who chose to participate in this market research program were teens. All of them with signed parental consent forms," the tech giant claimed a month ago.
In reality, in its response to Warner, Facebook revealed that parental consent comprised of users giving an email address connected to a Paypal account so they could be paid $20 a month "in exchange for their participation in the research panels." In other words, the kids were supposed to hand over their parents' email address so they could be paid, and that's it, it is claimed.
Incidentally, they weren't included in any "research panels" – Facebook simply sucked their data out of their phones. And Facebook also didn't pay participants directly but through the third-party "vendors" it hired to find them.
'We don't want a camera in everyone's living room' says bloke selling cameras in living rooms. Zuckerberg, you moronREAD MORE
But how does providing an email address connected to a Paypal account possibly equate to a "parental consent form"? According to Facebook: "PayPal requires users to be 18 or the age of majority in their respective jurisdictions."
It is of course trivial to create a functioning PayPal account if you are under 18: all you need are bank account details or the details of a credit or debit card. You can then receive money into the account and spend it on any website that accepts PayPal without ever needing to go through the traditional banking system.
To imagine that providing a single email address comprises written parental consent is so laughable it is incredible that Facebook ever dared to suggest otherwise. And, of course, there's the inconvenient fact that those that said they were over 18 would also have been asked for a PayPal email address so Facebook could pay them.
Which makes it entirely possible that there was in fact no real difference between someone under 18 and someone over 18 when they signed up and Facebook is creating an entire fiction around its now-banned program. Who'd have thought that a company run by a liar and filled with lying liars would stoop so low?
A spokesperson for Facebook did not respond with comment in time for publication. ®
Sponsored: Webcast: Simplify data protection on AWS