Photo by DAMIEN MEYER/AFP via Getty Images
Facebook has launched a legal action against New Jersey-based analytics company OneAudience, claiming it paid app developers to help it gain access to personal data.
According to Facebook, OneAudience persuaded app developers to install a malicious software development kit (SDK) in shopping and games apps, allowing it to collect user data without permission from last September.
It also claims that users' Google and Twitter information was also harvested when they logged into one of the compromised apps using those accounts. Facebook alerted Google and Twitter last year.
The data included names, email addresses, location, time zone, Facebook ID, and in some cases gender, and potentially affected 9.5 million users.
"Security researchers first flagged OneAudience’s behavior to us as part of our data abuse bounty program," says Facebook's director of platform enforcement and litigation Jessica Romero in a statement.
"Facebook, and other affected companies, then took enforcement measures against OneAudience."
However, she says, OneAudience failed to cooperate, despite a cease and desist letter and a request to take part in an audit.
In a November statement on its website, OneAudience claims the data "was never intended to be collected, never added to our database and never used", adding that it updated the SDK and pushed it out to developers, requiring them to update immediately.
Facebook now wants OneAudience to be forced to take part in an audit to make sure the data collection has stopped, and to be banned from accessing any of Facebook's servers and creating new Facebook accounts.
Facebook has a history of suing companies that abuse its platform, most recently in December, when it launched a lawsuit against a Chiese firm for using Facebook ads to trick users into downloading and installing malware.
"This is the latest in our efforts to protect people and increase accountability of those who abuse the technology industry and users," says Romero.
"Through these lawsuits, we will continue sending a message to people trying to abuse our services that Facebook is serious about enforcing our policies, including requiring developers to cooperate with us during an investigation, and advance the state of the law when it comes to data misuse and privacy."
