Facebook secretly paid teenagers to install data harvesting app

Social media platform has been caught paying teenage users to install a VPN app that decrypts and harvests virtually all of their mobile internet activity

Facebook has been paying people to install a VPN called “Facebook Research” that gives it root access to network traffic, allowing it to decrypt and analyse phone activity, TechCrunch reports.

The data-mining project is dubbed “Project Atlas” and has been running since 2016. To disguise its involvement Facebook deployed the program through beta testing services Applause, BetaBound and uTest. While the iOS version has been pulled, the Android app is still available.

Users aged between 13-35 were being paid up to $20 per month plus referral fees to install the VPN. The testing sites did not initially disclose to the users it paid who the data was being harvested for, only mentioning Facebook in the instruction manual.

A notice on the BetaBound sign-up page for Atlas reads: “For $20 per month (via e-gift cards), you will install an app on your phone and let it run in the background.” The Applause version asked users to screenshot their Amazon orders once installed.

According to researchers, if Facebook was making full use of the access it granted them it has been continuously collecting private social media messages, instant messaging chats, emails, web history and location data for two years.

“The fairly technical sounding ‘install our Root Certificate’ step is appalling,” security expert Will Strafach told TechCrunch.

“This hands Facebook continuous access to the most sensitive data about you, and most users are going to be unable to reasonably consent to this regardless of any agreement they sign, because there is no good way to articulate just how much power is handed to Facebook when you do this.”

By decrypting and analysing phone activity on iOS devices Facebook may have violated Apple policy.

Apple CEO Tim Cook has been outspoken in his criticism of aggressive data harvesting and earlier this month called for a data broker registry to shed light on the murky industry of data sales.

Apple is yet to comment on the debacle, but the revelations will surely strain relations between the two tech powerhouses even further.