Facebook let Netflix and Spotify read private messages 🔓

A new scandal is engulfing Facebook: this week, the multinational confirmed that it had allowed other companies, notably Spotify and Netflix, to access millions of users' private messages.

Responding to a New York Times report published on Tuesday about how the social network had shared user data with partners over the years, Mark Zuckerberg's company said it had indeed given them extensive access to messages.

The tech giant claims this only happened to let people log in to apps such as Spotify with their Facebook account and send messages through those services.

In a blog post, Zuckerberg's company says: "Did our partners get access to messages? Yes. But people had to explicitly sign in to Facebook first to use these partners' messaging features. Take Spotify as an example. After logging in to Facebook through Spotify's desktop app, you could send and receive messages without leaving the app. Our API allowed access to personal messages to provide this kind of feature."

Citing internal Facebook documents, The Times says the music streaming service could view messages from more than 70 million users in a single month. The newspaper also reports that Spotify, Netflix and the Royal Bank of Canada could read, write and even delete this highly private data.

Both Spotify and Netflix, however, told the newspaper they were unaware of this kind of permission. Facebook, for its part, says it has found no evidence of improper access.

Speaking to Business Insider, Netflix said it had not accessed any messages. "Over the years, we have tried various ways to make Netflix more social," a spokesperson said. "One example is a feature we launched in 2014 that allowed members to recommend TV programmes and films to their Facebook friends through Messenger or the platform. As the feature was not particularly popular, we discontinued it in 2015. At no point did we access people's private Facebook messages or ask for permission to do so."

That the world's largest social network has deep integrations with third parties is not necessarily surprising, as former privacy chief Alex Stamos has pointed out. It is a sign of a healthy system of interoperability.

"Sorry, but allowing outside companies to do this is the kind of competitive strategy we want to see from dominant platforms," Stamos said in a tweet on Wednesday. "For example, make Gmail accessible only on Android and the app would be terrible. It is wrong of the New York Times to turn this kind of integration into a scandal," he continued.

What is harder for the public to accept, however, is the sense that Facebook gave such broad access to user data without properly informing people and, consequently, without their express permission. Many people tend to assume that their private messages on social media will always remain private.

Former officials at the US consumer protection commission have already said that the recently revealed data-sharing agreements probably violate regulations.

For the company that also owns Instagram, this is the latest privacy scandal at a time when it is still recovering from the fallout of Cambridge Analytica in March and fighting heavy fines. In September, a large-scale attack affected the security and privacy of at least 50 million users.