Facebook went to federal court in California on 27 February 2020 to sue OneAudience, a New Jersey data analytics firm. Its claim: OneAudience paid app developers to install its software development kit, then used its control over that code to harvest Facebook users’ data.
The technical reality is mundane, which is the problem. An SDK is a bundle of third-party code that an app developer drops in to get a feature without writing it. Once it is in, it runs with the app’s permissions. According to court documents obtained by ZDNet, this one sat inside shopping, gaming and utility apps, some of them distributed through the official Google Play Store.
“After a user installed one of these apps on their device, the malicious SDK enabled OneAudience to collect information about the user from their device and their Facebook, Google, or Twitter accounts, in instances where the user logged into the app using those accounts,” the complaint reads.
From Facebook accounts, the filing says, OneAudience took a user’s name, email address, locale (the country the user logged in from), time zone and Facebook ID. In limited instances it also took gender. Facebook says none of that was authorized.
How it came out
Twitter was first to expose the practice, on 26 November 2019, and Facebook confirmed the same day. Twitter’s blog post said the harvesting also reached users of other companies, Apple and Google among them.
OneAudience answered on its own website. “This data was never intended to be collected, never added to our database and never used,” it said, adding that it had updated its SDK to stop any further collection.
Facebook says it learned of the SDK’s behavior from a bug report filed through its Data Abuse Bounty program, which it launched in April 2018 after the Cambridge Analytica scandal. It disabled the apps that used the SDK, sent OneAudience a cease and desist letter and asked the company to take part in an audit. Facebook says OneAudience refused.
What Facebook wants
The suit asks a judge to order OneAudience to comply with the audit, so Facebook’s engineers can check whether the firm still holds data on Facebook users. Facebook also wants an injunction barring OneAudience from reaching its servers or creating new Facebook accounts.
Jessica Romero, Facebook’s director of platform enforcement and litigation, called it “the latest in our efforts to protect people and increase accountability of those who abuse the technology industry and users.”
It is the fifth suit Facebook has filed in the past year against outside parties that abused its platform. In March 2019 it sued two Ukrainian browser extension makers, Gleb Sluchevsky and Andrey Gorbachov, for allegedly scraping user data. In October 2019 it went after Israeli surveillance vendor NSO Group over a WhatsApp zero-day used in May 2019 against attorneys, journalists, human rights activists, dissidents, diplomats and government officials. In December 2019 it sued ILikeAd and two Chinese nationals for using Facebook ads to trick people into downloading malware.
A Facebook spokesperson told ZDNet the company is still investigating MobiBurn, a data monetization platform caught doing something similar at the same time. Whether that leads to another lawsuit is unclear. OneAudience could not be reached for comment.
