Facebook bans app that misused data of 4 mn users

Facebook has banned a third-party application called "myPersonality" after finding that the personal information of nearly four million users may have been improperly shared with researchers and companies, the social media giant said on Thursday.

Ime Archibong, Facebook's Vice President of Product Partnerships, said the company took action after the app's developers failed to cooperate with a request to conduct an audit of how Facebook users' information had been handled.

"We banned 'myPersonality' for failing to agree to our request to audit and because it's clear that they shared information with researchers as well as companies with only limited protections in place," Archibong said in a blog post.

Facebook said it would inform users whose information was affected. However, the company said it had found no evidence that the app had accessed information belonging to users' Facebook friends and therefore would not notify those friends unless new evidence emerged.

The disclosure came at a time when Facebook was under intense scrutiny over the handling of user data. The company had launched a broad investigation into thousands of third-party applications following the Cambridge Analytica scandal, in which data linked to nearly 87 million Facebook users was reported to have been improperly obtained.

As part of that review, Facebook had suspended more than 400 apps over concerns about their developers or the way user information had potentially been used.

The "myPersonality" case highlighted a key vulnerability in the third-party app ecosystem: users could voluntarily grant an application access to certain Facebook information, but the subsequent handling and sharing of that data could depend heavily on the safeguards maintained by the developer.

Facebook had also begun tightening its platform policies in response to the wider data-privacy concerns. Among the changes was an expansion of its app-review process, along with a policy under which apps would no longer receive information if a user had not interacted with them for 90 days.

The latest action added to Facebook's growing effort to audit older third-party applications and limit the ways developers could access and use personal information shared through the platform.