http://online.wsj.com/article/SB10001424052748704477904575586690450505642.html

OCTOBER 31, 2010

Facebook Says User Data Sold To Broker

By GEOFFREY A. FOWLER And EMILY STEEL

Facebook Inc. said that a data broker has been paying application developers for identifying user information, and that it had placed some developers on a six-month suspension from its site because of the practice.

The announcement, which Facebook made on its developers' blog Friday, follows an investigation by Facebook into a privacy breach that The Wall Street Journal reported in October. [1]

Some "apps," the small programs that let users play games or share information with each other on the social-networking site, were sending users' Facebook ID numbers to third-party marketing or data firms, in violation of Facebook's privacy policies. An ID can be used to look up a user's name and other publicly available information on the social network and link it to their use of the app. Such information can be used by companies that build profiles of Internet users by tracking their online activities.

Facebook didn't identify the data broker that was buying user IDs. But it said it had reached an agreement with RapLeaf Inc., which it described as "the data broker who came forward to work with us on this situation." It's unclear whether Facebook is implicating RapLeaf and neither company responded to questions.

Under the agreement, Rap Leaf agreed to delete all Facebook user IDs in its possession, and also agreed "not to conduct any activities on the Facebook Platform" in the future, according to Facebook.

In its post, Facebook said it has a "zero tolerance" policy for data brokers "because they undermine the value that users have come to expect from Facebook." While the apps weren't selling or granting data brokers access to data that users had set to be private, "this violation of our policy is something we take seriously," Facebook said.

Facebook didn't specify which app developers it had suspended, but said it affects fewer than a dozen, mostly small ones. Facebook also said it was adding a mechanism so app developers that need to share a unique identifier with outside parties, such as content partners, can do so in an anonymous fashion. This new function will be released next week, and will be required of all apps by Jan. 1, 2011.

The Journal investigation also found that MySpace and some of its popular apps were transmitting identifying information to outside advertising companies. Asked whether MySpace had found any app developers were selling user IDs, a MySpace spokesman said the company was "taking appropriate action" against developers that break its privacy rules.

MySpace is owned by News Corp., which also owns The Wall Street Journal.

Write to Geoffrey A. Fowler at geoffrey.fowler@wsj.com and Emily Steel at emily.steel@wsj.com

[1] http://online.wsj.com/article/SB10001424052702304772804575558484075236968.html