Instead of downloading the app through the App Store or using Apple's TestFlight beta testing program, users got it through three different beta testing services: BetaBound, uTest and Applause. These three services specifically posted ads on Instagram and Snapchat targeted at a demographic group of ages between 13 and 35, saying it was a "paid social media research study." By signing up for the application, minors are requested to request parental permission through a form. One of the forms says: "There are no known risks associated with the project, although you acknowledge that the inherent nature of the project consists in tracking personal information through the use of the applications by your child ".
Below is a text of a disclaimer clause when users download the Facebook Applause App (acquired by TechCrunch):
"When installing the software, you are giving permission to our customer to collect data from the phone that will help them understand how to browse the Internet and how to use the features of the applications that you have installed … This means that" re letting our client gather information such as what applications are on the phone, how and when you use them, information about their activities and content within these applications, as well as about how other people interact with you or with their content within these applications. also allowing our client to collect information about your Internet browsing activity (including the websites you visit and the data are exchanged between your device and these websites) and use of the # 39; other online services. There are some cases in which our client will compile this information even when the application uses encryption or from secure browser sessions. "
According to a Will Strafach, a security expert commissioned by TechCrunch, the access level that the Facebook Research oferia application could lead the company to compile all kinds of data that include private messages, chats Instant messaging that includes photos and videos, emails, web activity, and even location information.
Instead of downloading the Apple app, users would download it from a different Facebook URL, he said that he installed a Business Developer Certificate and allowed the # 39 ; business access to your phone. One of the Applause programs even asked users to provide screenshots of their Amazon order history. If users kept the VPN in operation and sent the data to Facebook, they would pay through electronic gift certificates.
Facebook has recognized the existence of this program at TechCrunch: "As many companies, we invite people to participate in a research that helps us identify what we can do better. Because this research has the purpose Helping Facebook to understand how people use their mobile devices, we have provided ample information about the type of data we collect and how they can participate. We do not share this information with others and people can stop participating at any time " .
According to the Facebook spokesman, the company does not violate Apple's rules, as the application was distributed online with Apple's business certificate program. But since the certificate program is mainly for the internal use of the developer and not as a public beta where users are paid, it is not clear if this is true.