Apple withdraws certificate for data-gathering Facebook app, among other things – update
Apple has announced that it has withdrawn the business certificate for the so-called Facebook Research App, with which Facebook collects a lot of data from smartphone users. With that, Apple will no longer be distributing these and other apps for iOS.
An Apple spokesperson told Recode that the Enterprise Developer Program is only intended for distribution of apps within an organization. The spokesperson notes that Facebook “used its membership in this program to distribute a data-collecting app to consumers.” The Cupertino company describes this as a “clear violation of the agreement with Apple”. Apple says it has revoked the certificate for the Facebook app in question “to protect our users and their data.” It is unknown if Apple will take further steps. Facebook has since confirmed that it will close the iOS version of the Research app.
This move by Apple is not entirely unexpected, because it was already clear in advance that the terms of the Enterprise Developer Program do not allow such distribution to consumers. The Facebook Research app can, in fact, be regarded as a redesigned version of Onavo Protect, a VPN app that Facebook removed from the App Store last year by order of Apple, because it violated the terms of Apple’s store. Facebook reportedly used this VPN app to map apps on users’ smartphones. Since then, Onavo Project is still available in the Play Store. These types of apps violate Apple’s privacy guidelines, which prevents them from appearing in the App Store. This is probably why Facebook chose the Enterprise Developer Program to be able to distribute the app after all.
On Tuesday, it turned out that Facebook has been providing a so-called Research app to consumers aged 13 to 35 since 2016. If they install the app on their smartphone, Facebook will pay them up to $20 a month. In return, Facebook can collect a variety of data, including private messages, emails, location data and browsing activity. A Facebook spokesperson defended the app’s use, stating that only five percent of users were teenagers, and all of them had received parental consent.
Update, 5:15 PM: The Verge reports, based on a person aware of the situation, that Apple has shut down Facebook’s ability to distribute its internal iOS apps. Reportedly, early versions of apps such as Facebook, Instagram and Messenger no longer work on Facebook employees’ smartphones. So it appears that Apple has revoked all certificates Facebook has under the Enterprise Developer Program. That matches Apple’s official statement that a company that uses its certificates to deliver apps to consumers will lose its certificates. Facebook would consider this a serious problem internally.