Facebook kept call and text history on Android phones for years

Facebook has stored the call and text history of older Android phones for years, even if they weren’t authorized to do so. The company can no longer just access that data.

To collect the data, Facebook only needed permission to read the contacts. Phones with an Android version before 4.1 Jelly Bean also gave access to the call and text history.

Google phased out version 4.0 of the Android API in October 2017, which means that from that moment on it is no longer possible to read the extra data. Ars Technica writes that its collection has since stopped. Such data collection has never occurred on iOS.

Facebook’s misuse of this API was first revealed when a New Zealand man downloaded an archive of the data collected about him from Facebook and saw that there were also detailed metadata of his calls had been collected.

An Ars Technica writer downloaded his own Facebook archive and found similar aggregated data. He asked for a statement from Facebook, saying that uploading contacts makes it easier to find friends on Facebook.

The spokesperson also says that the Facebook app asks for permission to use the contacts and users can choose not to do this. This data can also be removed from Facebook. The collection of call and SMS data is not discussed. Nor is it clear whether those will also disappear from the Facebook servers when the contact details are removed.

Update, 26.3: Facebook has responded in its own blog post and says it did ask for permission. Ars Technica writes that this explanation does not agree with its own findings.