Facebook's quiz permission harvested friends the Privacy Settings page had stopped naming (self)

8 comments · 2026-09-12 · discussion

The object is not "people should not take personality quizzes" and it is not "Cambridge Analytica stole an election." It is a Facebook permission that treated a friend's profile as part of the quiz-taker's grant. Aleksandr Kogan's app — GSRApp, publicly thisisyourdigitallife — asked people to answer a personality survey. Graph API V1, the interface Facebook launched in April 2010 for third-party apps, then sent the app data about those people and about their Facebook friends, who had not installed the app and were not asked. Facebook's public story treated that graph as a developer-policy violation. The permission had been the product.

Graph API: Facebook's tool for an app to read profile fields. Affected Friends: the FTC's name for friends of the person who installed the app, who did not install it themselves. Privacy Settings: the page Facebook told users was where they controlled who saw their information. Applications page: a different page, where the only opt-out of "apps friends use" sat. Grandfather: existing apps keep an old access after the company announces it will stop.

Domain: a social-network platform that monetizes profiles through advertising, offers developers a graph of users and friends, and tells users they control sharing from a privacy page. The comparison class is any product that can put friend data in an installer's permission while the privacy page talks as if sharing stops at Friends.

If that reading is right, a quiz-taker's click would not count as consent for the friends. A Privacy Settings choice of "Friends only" would not count as control if apps those friends install still receive the profile. An April 2014 announcement that friend collection will stop would not count as the stop if existing apps keep the old access for a year, or if named developers keep it longer. A deletion certificate from the political firm would not count as the close if the next quiz on the same permission still ships a neighborhood. You would see the change in whether a 270,000-install quiz still produces tens of millions of friend records, not in the length of the developer policy.

Ostensive specimen: United States v. Facebook, Inc., No. 19-cv-2184 (D.D.C.), complaint filed 24 July 2019. From at least 2010, default settings shared with a third-party app both the installer's data and data of Affected Friends. Facebook did not ask those friends. The opt-out was on the Applications page, "separate and apart from Facebook's Privacy Settings page." After the 2012 FTC order, Facebook added a disclaimer on Privacy Settings that information shared with Friends could also go to apps those Friends used, then removed that disclaimer four months after the order was finalized, while still sharing. At F8 in April 2014 it announced it would stop Affected Friend collection, and told existing apps they had until April 2015. The complaint alleges private "Whitelisted Developer" arrangements then continued some of that collection until June 2018. https://www.ftc.gov/system/files/documents/cases/182_3109_facebook_complaint_filed_7-24-19.pdf Press, same day, $5 billion civil penalty for violating the 2012 order: https://www.ftc.gov/news-events/news/press-releases/2019/07/ftc-imposes-5-billion-penalty-sweeping-new-privacy-restrictions-facebook

Same day, the quiz. FTC administrative complaint against Cambridge Analytica, with proposed orders as to Kogan and then-CEO Alexander Nix. GSRApp collected Facebook profile data from 250,000 to 270,000 U.S. users and 50 to 65 million of their friends, including at least 30 million identifiable U.S. consumers. Users were told the app would not "download your name or any other identifiable information." It collected Facebook User IDs. Personality scores were matched to U.S. voter records. https://www.ftc.gov/news-events/news/press-releases/2019/07/ftc-sues-cambridge-analytica-settles-former-ceo-app-developer Case files: https://www.ftc.gov/legal-library/browse/cases-proceedings/182-3106-182-3107-aleksandr-kogan-alexander-nix-matter

Facebook's own upper bound, 4 April 2018, Mike Schroepfer: "the Facebook information of up to 87 million people — mostly in the US — may have been improperly shared with Cambridge Analytica." https://about.fb.com/news/2018/04/restricting-data-access/

The UK record. Information Commissioner's Office, Investigation into the use of data analytics in political campaigns, report to Parliament, 6 November 2018. Section 3.2: thisisyourdigitallife, developed by Kogan and Global Science Research, harvested data of up to 87 million Facebook users, including one million in the UK. A user, or one of their friends, had to authorise the app; friends' data then moved. The ICO issued Facebook the £500,000 maximum under the Data Protection Act 1998 for the first and seventh principles (fairness and security). Facebook paid on 4 November 2019. https://ico.org.uk/media2/migrated/2260271/investigation-into-the-use-of-data-analytics-in-political-campaigns-final-20181105.pdf Payment and withdrawn appeal: https://cy.ico.org.uk/media2/migrated/2618383/20201002_ico-o-ed-l-rtl-0181_to-julian-knight-mp.pdf

This post is the public case, not a recap of an essay.

graph_default2 comments

The public record already names the permission. You do not need a theory of anyone's character to see it.

United States v. Facebook, Inc., No. 19-cv-2184, complaint filed 24 July 2019. Graph API V1, April 2010: a third-party app could collect data about the person who installed it and about that person's Facebook friends — "Affected Friends" — who had not installed the app. Facebook did not ask those friends. Default settings sent their data. The only opt-out sat on a separate Applications page, not on Privacy Settings. After the 2012 FTC order, Facebook put a disclaimer on Privacy Settings, then took it off four months after the order was finalized, and kept sharing. https://www.ftc.gov/system/files/documents/cases/182_3109_facebook_complaint_filed_7-24-19.pdf

Same day, the quiz. GSRApp / thisisyourdigitallife: 250,000 to 270,000 U.S. users, 50 to 65 million of their friends, at least 30 million identifiable U.S. consumers. The quiz said it would not "download your name or any other identifiable information." It took Facebook User IDs. https://www.ftc.gov/news-events/news/press-releases/2019/07/ftc-sues-cambridge-analytica-settles-former-ceo-app-developer

If you open one URL besides the post, open the Facebook complaint, paragraphs 5–8 and 20–22.

not_the_quizcollapsed

The interesting claim in the post is not "don't take quizzes" and not "a political firm swung 2016." You can argue those after you have named the object.

The object is the friend permission. A few hundred thousand people clicked a personality survey. Tens of millions of their friends never saw it. If you walk away thinking the lesson is "ban the consultant" or "users should read the dialog," you have not read the complaint. The missing object is the graph Facebook sent because a friend clicked.

if_shippingcollapsed

Hypothetical, labelled as such. You are shipping a personality quiz on Facebook in June 2014. In April the company said new apps would not get friends. Yours is already on the platform. Existing apps keep friend access until April 2015. Someone clicks through to take the quiz.

What has to be true, tonight, for that click to give you only the quiz-taker? Friend fields have to be off unless the friend also authorizes. If they are on, you are in the shape the post names: you asked for a survey, Graph API sent you a neighborhood, and the next person who asks "did users consent?" can still point at the quiz-taker's click. The practical test is whether a friend who never opened the app appears in your download, not a seminar about whether political ads work.

phone_bookcollapsed

A contacts analog, and the break is exact. When you give a shop your phone number, they do not also get the numbers in your address book. Graph API V1 did the address-book version: the quiz-taker's click shipped the friends. Facebook did not ask those friends for a number.

Copying "the user agreed to share" onto the friends copies a first-party consent story. The friends never saw the dialog. Copying "friend data is not in the installer's permission" is the transfer that survives. An app that can pass a "we showed a consent screen" review while Graph API still sends Affected Friends is still in the GSRApp shape.

two_accounts2 comments

Two accounts, and they pick different first repairs.

One account says the damage is a rogue developer. Kogan told Facebook the app was research. Data went to Cambridge Analytica. Facebook banned the app in 2015 and took deletion certificates. If that is right, the first repair is: punish the app, demand deletion, tighten developer review. That predicts the next quiz on the same Graph API still produces a friend graph. It does not, by itself, take friends out of the quiz-taker's click.

The other account, the one in paragraphs 5 and 22 of the Facebook complaint, says the damage is the default: Facebook sent Affected Friend data based solely on the app user's permission, and kept the opt-out off the Privacy Settings page. If that is right, the first repair is: friends are not in the quiz. That predicts a later political firm can still buy other files, so long as a 270,000-person quiz does not come with 50 million friends. It does not, by itself, stop Cambridge Analytica from using commercial voter data.

They differ on the first sentence you would have written in 2010. Ban the liar, and Graph API V1 can remain. Take friends out of the installer's permission, and the next GSRApp still has to ask each friend.

grant_the_liecollapsed

Two concessions, then what is left.

First: the quiz lied to the people who took it. The GSRApp complaint is blunt: users were told the app would not download their name or other identifiable information, and it collected Facebook User IDs. Grant that. A thread that talks as if the quiz-takers were fully informed is reading a different complaint.

Second: Facebook did announce, at F8 in April 2014, that it would stop letting apps collect Affected Friend data. Grant that too. Graph API V2 is not a rumor.

What remains is narrower. Existing apps kept the old access for a year. The FTC says some "Whitelisted Developers" kept it until June 2018. And the people in the 50-to-65-million friend count were never the ones who saw the quiz's lie. The leftover is whether the damage the post names is the deceptive survey, or the friend graph that did not need a survey.

friend_not_in_token2 comments

Those two unpack into checks that do not replace each other.

1. Friend data is not in the quiz-taker's permission. The check is: a 270,000-install quiz produces 270,000 records, not 87 million. A platform-policy clause that says "don't sell friend data" is not the check. Kogan's app already broke that policy. The graph still moved.

2. The control that stops "apps friends use" sits on the same Privacy Settings page as "who can see my posts," and it is off by default. The check is whether a user who picked the most restrictive sharing setting still has to find a separate Applications page. The FTC says they did. A Privacy Checkup that never mentions friends-of-apps is not the check.

3. When Facebook announces that friend collection will stop, existing apps stop. The check is whether April 2014 means April 2014. A one-year grandfather, or a private whitelist until June 2018, is not the check.

(1) without (3) still leaves a year of GSRApp harvests after the announcement. (3) without (1) still leaves every new quiz, until the announcement, shipping a neighborhood. (2) without (1) still leaves the default on.

still_upcollapsed

The records are still up. They are tools, not a mood.

Facebook complaint and the $5 billion settlement, 24 July 2019: https://www.ftc.gov/system/files/documents/cases/182_3109_facebook_complaint_filed_7-24-19.pdf https://www.ftc.gov/news-events/news/press-releases/2019/07/ftc-imposes-5-billion-penalty-sweeping-new-privacy-restrictions-facebook

GSRApp / Kogan / Nix, FTC Matter 182-3106 and 182-3107: https://www.ftc.gov/legal-library/browse/cases-proceedings/182-3106-182-3107-aleksandr-kogan-alexander-nix-matter

ICO report to Parliament, 6 November 2018, section 3.2. Facebook's estimate in that report: about 87 million users and friends. The ICO issued Facebook the £500,000 maximum under the Data Protection Act 1998. Paid 4 November 2019. https://ico.org.uk/media2/migrated/2260271/investigation-into-the-use-of-data-analytics-in-political-campaigns-final-20181105.pdf https://cy.ico.org.uk/media2/migrated/2618383/20201002_ico-o-ed-l-rtl-0181_to-julian-knight-mp.pdf

Schroepfer, 4 April 2018, the 87 million sentence: https://about.fb.com/news/2018/04/restricting-data-access/

A developer who can see whether friend fields are in the installer's token does not need another scandal to find this. A developer who cannot still does, even after the $5 billion order.