Facebook paid teenagers to mine device data

Facebook is halting a scheme that gathered highly personal data from paid volunteers, after it was exposed.

TechCrunch said participants - including those aged 13-17 - had been paid up to $20 (£15.30) a month to open up their phones to deep analysis.

Apple has said Facebook misused its privileges to distribute the app involved.

The iPhone-maker has now restricted Facebook's ability to issue iOS apps that are not listed on its App Store.

This will disrupt the social network's ability to distribute test versions of its software among staff and for the employees to run apps designed for their exclusive use, which are used to do things such as book transportation.

This could add to tensions between the two companies.

A spokeswoman for the social network was unable to say whether it ran the programme in the UK or other countries outside the US.

TechCrunch reported that Facebook used social media ads to target teenagers for the scheme. Facebook denies this.

On Wednesday, it was also revealed that Google maintained an app that paid some users to monitor their usage habits. Google says it has now disabled the app.

The app had the potential to provide Facebook with "nearly limitless access" to a user's device including:

In addition, TechCrunch reported that users were asked to provide screenshots of their Amazon orders.

When the BBC visited one of the sign-up pages, it stated that Facebook would use the information to improve its services.

It added that "there are some instances when we will collect this information even where the app uses encryption, or from within secure browser sessions".

It added that participants had to agree not to disclose "any information about this project to third parties".

The social network said everyone involved in the programme had consented, and that market research was standard practice.

However, in the hours after TechCrunch's report was published, Facebook said it would end the programme on Apple devices.

It has not, however, suspended a parallel effort on Android.

The research focused on users aged 13-35, and those under 18 were asked to get signed parental consent, Facebook said.

However, when the BBC identified itself as a 14-year-old boy during its test, it was able to download the app without any parental consent being sought. A page did state, however, that users should be over the age of 18.

A reporter from BuzzFeed News tried signing up via an alternative registration page, where obtaining parental consent involved sharing an email address and clicking a tick box. He said this form did not mention Facebook by name.

In a statement, Facebook took issue with TechCrunch's characterisation of the programme.

"Key facts about this market research programme are being ignored," a spokeswoman said via email.

"Despite early reports, there was nothing 'secret' about this; it was literally called the Facebook Research App. It wasn't 'spying' as all of the people who signed up to participate went through a clear on-boarding process asking for their permission and were paid to participate.

"Finally, less than 5% of the people who chose to participate in this market research program were teens. All of them with signed parental consent forms."

When asked by the BBC how exactly the parental consent was obtained, Facebook said it was handled by a third party and did not elaborate.

Apple has accused Facebook of abusing a system designed to distribute software to staff to carry out the scheme.

"We designed our Enterprise Developer Programme solely for the internal distribution of apps within an organisation," it said in a statement.

"Facebook has been using their membership to distribute a data-collecting app to consumers, which is a clear breach of their agreement with Apple.

"Any developer using their enterprise certificates to distribute apps to consumers will have their certificates revoked, which is what we did in this case to protect our users and their data."

Facebook has yet to respond to the punishment.

There is also an app for devices running on Android distributed outside of Google's Play Store.

TechCrunch’s detailed report explained Facebook had previously conducted market research using a virtual private network (VPN) app called Onavo, which it acquired in 2013.

Internal documents, published online in December, revealed Facebook had used the data gathered to decide to takeover WhatsApp and track usage of rivals including Snapchat and Twitter's former video service Vine.

But in August last year, Facebook removed the app from the App Store after Apple complained that violated its data-collection rules.

However, Facebook had another research app that it had been running since 2016. It circumvented Apple’s App Store by using testing tools typically used to install software that is still in development.

The app installed a “root certificate”, which enabled deeper access to a phone’s software including functions not reachable by typical apps.

Apple allows the installation of root certificates in narrow cases, such as for companies that provide employees with iPhones but want to install internal apps, monitoring capabilities and extra security.

But Apple’s Developer Enterprise Program License Agreement makes it clear that these certificates must only be used for “specific business purposes” and “only for use by your employees”.

There are scenarios that allow exceptions to the rule, the policy goes on to say. But market research is not one of them.

Facebook had earlier insisted its market research policies were not unusual.

"Like many companies, we invite people to participate in research that helps us identify things we can be doing better,” it said.

"Since this research is aimed at helping Facebook understand how people use their mobile devices, we've provided extensive information about the type of data we collect and how they can participate.

"We don't share this information with others and people can stop participating at any time."

________

Additional reporting by Leo Kelion

Follow Dave Lee on Twitter @DaveLeeBBC

Do you have more information about this or any other technology story? You can reach Dave directly and securely through encrypted messaging app Signal on: +1 (628) 400-7370