Facebook has been conducting research that gathers highly personal data from paid volunteers, a report has revealed.
TechCrunch said participants – including those aged 13-17 – had been paid up to $20 (£15.30) a month to open up their phones to deep analysis.
Facebook is said to have created an app that the report said appeared to breach Apple’s privacy protection policies.
TechCrunch reported Facebook used social media ads to target teenagers for the scheme. Facebook denies this.
The app had the potential to provide Facebook with “nearly limitless access” to a user’s device including:
- the contents of private messages in chat apps including photos and videos
- web browsing activity
- logs of what apps are installed, and when they are used
- a location history of where the owner had physically been
- data usage
In addition, TechCrunch reported that users were asked to provide screenshots of their Amazon orders.
When the BBC visited one of the sign-up pages, it stated that Facebook would use the information to improve its services.
It added that “there are some instances when we will collect this information even where the app uses encryption, or from within secure browser sessions”.
It added that participants had to agree not to disclose “any information about this project to third parties”.
The social network said everyone involved in the programme had consented, and that market research was standard practice.
However, in the hours after TechCrunch’s report was published, Facebook said it would end the programme on Apple devices. It is not, however, suspending a parallel effort on Android.
The research focused on users aged 13-35, and those under 18 were asked to get signed parental consent, Facebook said.
However, when the BBC identified itself as a 14-year-old boy during its test, it was able to download the app without any parental consent being sought. A page did state, however, that users should be over the age of 18.
A reporter from Buzzfeed tried signing up via an alternative registration page, where obtaining parental consent involved sharing an email address and clicking a tick box.
In a statement, the firm took issue with TechCrunch’s characterisation of the programme.
“Key facts about this market research program are being ignored,” a spokeswoman said via email.
“Despite early reports, there was nothing ‘secret’ about this; it was literally called the Facebook Research App. It wasn’t ‘spying’ as all of the people who signed up to participate went through a clear on-boarding process asking for their permission and were paid to participate.
“Finally, less than 5% of the people who chose to participate in this market research program were teens. All of them with signed parental consent forms.”
When asked by the BBC how exactly the parental consent was obtained, Facebook said it was handled by a third-party and did not elaborate.
Apple has not yet commented on whether it felt Facebook had broken its rules, and what action it might take as a result.
There is also an app on Google’s mobile operating system, Android. Google is also yet to comment.
TechCrunch’s detailed report explains Facebook had previously conducted market research using an app called Onavo, which it acquired in 2013.
But in August last year, Facebook removed the app from the App Store after Apple complained that violated its data-collection rules.
Facebook, however, had another research app, which has been running since 2016. It circumvents Apple’s App Store by using testing tools typically used to install apps that are still in development.
The app installs a “root certificate”, which enables deeper access to a phone’s software – functions not reachable by typical apps.
Apple allows the installation of root certificates in narrow cases, such as for companies which provide employees with iPhones but want to install added protections, monitoring capabilities and security.
But Apple’s Developer Enterprise Program License Agreement” makes it clear that these certificates must only be used for “specific business purposes” and “only for use by your employees”.
There are scenarios that allow exceptions to the rule, the policy goes on to say, but market research does not appear to be one of them.
Facebook insisted its market research policies were not unusual.
“Like many companies, we invite people to participate in research that helps us identify things we can be doing better,” it said.
“Since this research is aimed at helping Facebook understand how people use their mobile devices, we’ve provided extensive information about the type of data we collect and how they can participate.
“We don’t share this information with others and people can stop participating at any time.”
Additional reporting by Leo Kelion
Follow Dave Lee on Twitter @DaveLeeBBC
Do you have more information about this or any other technology story? You can reach Dave directly and securely through encrypted messaging app Signal on: +1 (628) 400-7370