On 27 February 2020, Facebook filed a complaint in a San Francisco federal court seeking to halt New Jersey‑based marketing firm oneAudience from continuing what it describes as covert collection of user information. The lawsuit alleges that oneAudience paid mobile‑app developers to embed a custom software development kit (SDK) that surreptitiously captured personal data each time a user logged in through Facebook’s single‑sign‑on (SSO) button.
According to the filing, the SDK was distributed to Android and iOS developers under the guise of a standard analytics tool. Once installed, the code accessed data supplied by Facebook’s OAuth process and also scraped details from Twitter and Google login sessions. The kit allegedly retrieved identifiers such as names, gender, email addresses and even the device’s advertising ID, enabling marketers to track the same individual across multiple apps and websites.
The alleged activity spanned from at least late 2018 until November 2019, when security researchers reported the issue to Facebook via its data‑abuse bounty program. Jessica Romero, Facebook’s director of platform enforcement and litigation, said the company promptly disabled the affected applications and requested an audit.
When oneAudience declined to cooperate, Facebook pursued court action, seeking a permanent injunction and damages under the federal Computer Fraud and Abuse Act and California’s Comprehensive Computer Data Access and Fraud Act. OneAudience, along with affiliates Adience Ltd. and MobiStream Media, is listed as a defendant. The firms, headquartered in Red Bank, New Jersey, have not responded to repeated requests for comment, and calls to their office went unanswered. Facebook estimates that “hundreds of thousands” of accounts may have had basic profile fields copied, though it has not disclosed an exact figure.
The complaint notes that oneAudience marketed the compiled database to advertisers as “verified, opted‑in consumer records,” charging up to $0.12 per profile. A cached pitch deck obtained by InfoPulse Today promised “real‑time mobile app behaviour linked to individual identity.”
Platform Alerts and Industry Reaction
Both Twitter and Facebook issued warnings on 25 November 2019, alerting users that oneAudience had paid app developers to embed the SDK and urging them to review and revoke access tokens for unfamiliar applications. Google confirmed that data from Google‑sign‑in sessions had been exposed but stopped short of a public notice, stating it found “no evidence that the SDK accessed sensitive Google account data.” Security experts say the case highlights the risks posed by third‑party SDKs.
Alex Stamos, director of the Stanford Internet Observatory and former Facebook security chief, explained that developers often integrate external code without scrutinizing its permissions, allowing a seemingly benign analytics library to inherit the host app’s full access. Stamos added that the lawsuit underscores the need for federal privacy legislation, arguing that stronger laws would give individuals clearer recourse against data misuse.
What Users Can Do Now
Facebook has revoked the SSO tokens linked to the implicated apps, meaning users will need to re‑authorize any legitimate connections. The company also mailed notices to individuals it believes were affected.
Users can audit their connections by navigating to Facebook Settings → Apps and Websites and removing any entries they do not recognize. Twitter provides a similar review tool under Settings and privacy → Apps and sessions. Security professionals recommend using password managers instead of SSO wherever possible. Allison Nixon, director of research at Unit 221B, cautioned that each additional “log in with” button creates another potential data exit point, and that most free, ad‑supported apps already collect advertising identifiers at a minimum.
Broader Implications for the Ad‑Tech Landscape
The lawsuit arrives amid heightened scrutiny of real‑time bidding and other programmatic advertising practices that rely on device identifiers. California’s Consumer Privacy Act (CCPA), effective 1 January 2020, gives residents the right to request deletion of personal data, and similar measures are under consideration in New York and other states.
Federal Trade Commissioner Rohit Chopra praised Facebook’s move on Twitter, stating that platforms must crack down on data intermediaries that violate rules, especially when they refuse audits. Industry groups, including the Interactive Advertising Bureau, warned that SDKs collecting data beyond disclosed purposes could trigger state privacy statutes and result in platform suspensions. Both Apple and Google have announced plans to tighten review processes for SDKs in their app stores, though implementation timelines have not been disclosed.
The court has yet to schedule a hearing on Facebook’s injunction request. OneAudience has 21 days to file a response, after which a default judgment could be entered.
Regardless of the case’s outcome, the episode shines a light on hidden data brokers operating within the mobile advertising supply chain and reinforces calls for a unified U.S. privacy framework.
