Facebook let some companies read private messages, access friend lists, report finds

Facebook gave some companies more extensive access to users' personal data than it has previously revealed, letting them read private messages or see the names of friends without consent, according to a New York Times report.

On Wednesday the newspaper detailed special arrangements between Facebook and companies such as Microsoft, Netflix, Spotify and Royal Bank of Canada, in the latest revelations on how the social network shares user data.

Here are highlights from the report.

The deals

Facebook shared data with more than 150 companies — not only tech businesses but automakers and media organizations — through apps on its platform, even if users disabled sharing. Apps from many of these "integration partners" never even showed up in user application settings, with the company considering them an extension of its own network.

The deals dated back as far as 2010 and were all active in 2017, with some still in effect this year.

Private messages

Spotify, Netflix and the Royal Bank of Canada were able to read, write and delete Facebook users' private messages, and to see everyone on a message thread. Spotify could look at messages of more than 70 million users a month and still lets users share music through Facebook Messenger while Netflix and Royal Bank have turned off features that incorporated message access.

Friends lists

Facebook let Microsoft's Bing search engine see the names of "virtually all Facebook users' friends without consent," the paper said. Microsoft officials said Bing was using the data to build Facebook user profiles on Microsoft servers but the company has since deleted the data.

Yahoo had the ability to show Facebook users' news feeds, including posts by their friends, on its home page. The search company eliminated the feature in 2012 but still had access last year to data for nearly 100,000 people a month.

Russia

Facebook designated a Russian search site, Yandex, as a partner, giving it access to unique user IDs as recently as 2017 after it stopped sharing them with other applications because of privacy risks.

Sources

The New York Times says it obtained more than 270 pages of Facebook documents and interviewed more than 60 people, including many former Facebook employees.

Facebook's response

Facebook responded to the report in a blog post, which said the partnerships did allow features like "messaging integrations," but nearly all have been shut down over the past few months, except for deals with Apple and Amazon.

None of the deals gave outside companies access to data without user consent, it said. The company also said a separate product called "instant personalization" — which powered Bing's features — was shut down in 2014, though it acknowledged it should not have left the data exchange interface up.