Senators Richard Blumenthal (D-Conn.), Ed Markey (D-Mass.), and Josh Hawley (R-Mo.) are demanding answers from Facebook on its research project that incentivized teens and others to give up info (Project Atlas) and calling on Apple and Google to "do more to protect their customers from intrusive monitoring practices."
That came against the background of a House Communications Subcommittee hearing where some legislators and ISPs were calling for new net neutrality regulations to be applied to edge providers like Google and Apple given issues like privacy and data sharing.
They were reacting to a TechCrunch report that Facebook had offered teens money for giving up personal information including communications, web histories and photos.
Markey earlier in the week called Facebook to cut it out and called for boosting online protections for teens.
Facebook had had no comment on that Markey statement, but did weigh in on the TechCrunch story that prompted it. “Key facts about this market research program are being ignored," a company spokesperson said. "Despite early reports, there was nothing 'secret' about this; it was literally called the Facebook Research App. It wasn't 'spying' as all of the people who signed up to participate went through a clear on-boarding process asking for their permission and were paid to participate. Finally, less than 5% of the people who chose to participate in this market research program were teens. All of them with signed parental consent forms.”
A Facebook source said it plans to end the market research program on Apple's app store and that it wasn't meant to replace Onavo, which was removed from the app store last year.
Thursday's letter to Facebook CEO Mark Zuckerberg sought the answers to the following questions:
- "When did Project Atlas begin and how many individuals have participated in the program? How many of those participants were under 18?
- Did Facebook or its partners specifically target teenagers with advertisements at any point in the research program? Did it provide referral payments targeted specifically to recruit teenagers?
- Why did Facebook use a less strict mechanism for verifying parental consent than is required for Messenger Kids or Global Data Protection Regulation (GDPR) compliance?
- What specific types of data was collected (e.g. device identifers, usage of specific applications, content of messages, friends lists, location, et al.)?
- Did Facebook use the root certificate installed on a participant device by the Project Atlas app to decrypt and inspect encrypted web traffic? Did this monitoring include analysis or retention of application-layer content?
- For what specific purposes was the app usage or collected internet traffic used, and for how long was this data retained?
- Were app usage data or communications content collected by Project Atlas ever reviewed by or available to Facebook personnel or employees of Facebook partners?
- Given that Project Atlas acknowledged the collection of “data about [users’] activities and content within those apps,” did Facebook ever collect or retain the private messages, photos, or other communications sent or received over non-Facebook products?
- Did Facebook collect or retain communications sent to participants’ devices in the Project Atlas program? If so, did it obtain consent to store personal data from those third parties?
- Has Facebook ever used traffic information collected from Onavo or Project Atlas to monitor the adoption or popularity of non-Facebook products or services? Has the data from either ever informed Facebook’s acquisition decisions regarding such products or services?
- Why did Facebook bypass Apple’s app review? Has Facebook bypassed the App Store approval processing using enterprise certificates for any other app that was used for non-internal purposes? If so, please list and describe those apps.
- In light of recent invasions of children’s and teens’ privacy, including those described above, would Facebook support federal legislation to create new privacy safeguards for children and teens online?"
The letter follows one last week from Markey and Blumenthal to Facebook "demanding" information about what they said was evidence that the company knowingly manipulated children into spending their parent's money on in-app purchases during gaming.
