(2010-10-19) Facebook App Privacy Breach

Emily Steel and Geoffrey Fowler report that many of the most popular applications, or "apps," on the social-networking site FaceBook Inc. have been transmitting identifying information—in effect, providing access to people's names and, in some cases, their friends' names—to dozens of advertising and Internet tracking companies, a Wall Street Journal investigation has found. The issue affects tens of millions of Facebook app users, including people who set their profiles to Facebook's strictest Privacy settings. The practice breaks Facebook's rules, and renews questions about its ability to keep identifiable information about its users' activities secure... Since a Facebook user ID is a public part of any Facebook profile, anyone can use an ID number to look up a person's name, using a standard Web browser, even if that person has set all of his or her Facebook information to be private... The apps reviewed by the Journal were sending Facebook ID numbers to at least 25 advertising and data firms, several of which build profiles of Internet users by tracking their online activities.

The Journal found that some LOLapps applications, as well as the Family Tree application, were transmitting users' Facebook ID numbers to Rap Leaf. Rap Leaf then linked those ID numbers to dossiers it had previously assembled on those individuals, according to Rap Leaf. Rap Leaf then embedded that information in an Internet-tracking file known as a "cookie." Rap Leaf says it strips out the user's name when it embeds the information in the cookie and shares that information for ad targeting. However, The Wall Street Journal found that Rap Leaf transmitted Facebook user IDs to a dozen other advertising and data firms, including Google Inc.'s Invite Media.