Collateral damage of Facebook third-party applications: a comprehensive study

Abstract

Third-party applications on Facebook can collect personal data of the users who install them, but also of their friends. This raises serious privacy issues as these friends are not notified by the applications nor by Facebook and they have not given consent. This paper presents a detailed multi-faceted study on the collateral information collection of the applications on Facebook. To investigate the views of the users, we designed a questionnaire and collected the responses of 114 participants. The results show that participants are concerned about the collateral information collection and in particular about the lack of notification and of mechanisms to control the data collection. Based on real data, we compute the likelihood of collateral information collection affecting users: we show that the probability is significant and greater than 80% for popular applications such as TripAdvisor. We also demonstrate that a substantial amount of profile data can be collected by applications, which enables application providers to profile users. To investigate whether collateral information collection is an issue to users' privacy we analysed the legal framework in light of the new General Data Protection Regulation. We provide a detailed analysis of the entities involved and investigate which entity is accountable for the collateral information collection. To provide countermeasures, we propose a privacy dashboard extension that implements privacy scoring computations to enhance transparency towards collateral information collection. Furthermore, we discuss alternative solutions highlighting other countermeasures such as notification and access control mechanisms, cryptographic solutions and application auditing. To the best of our knowledge this is the first work that provides a detailed multi-faceted study of this problem and that analyses the threat of user profiling by application providers.

Information privacy behavior in the use of Facebook apps: A personality-based vulnerability assessment

“…Research has also suggested that conscientious individuals are reluctant online users and particularly wary about sharing personal information (Ross et al, 2009). Given the responsible nature of conscientious individuals, they are also likely to be concerned about the level of access their friends' Facebook apps have to their personal information and vice versa (Symeonidis et al, 2018). In support of this finding, Codish and Ravid (2014) found that individuals high in conscientiousness dislike mechanisms that raise awareness of performance-related information (e.g., leader boards).…”

“…Members of social groups take it upon themselves to regulate their own behavior in line with the extant social norms of the larger group. There are, however, occurrences in which the use of Facebook apps affects other users, specifically those in a person's list of friends ( Symeonidis et al., 2018 ). These apps harvest personal information from friends and thus also increases an individual's vulnerability to privacy violations.…”

“…Several studies have investigated the influence of IPCs, social norms, and personality traits on intention to use—albeit from different perspectives ( Baek et al., 2014 ; Ahn et al., 2015 ; Mohammed and Tejay, 2017 ). For example, some studies have primarily focused on either the Facebook apps themselves ( Symeonidis et al., 2018 ), transactional privacy when using apps ( Choi and Land, 2016 ), privacy risks ( Farnden et al., 2015 ), privacy concerns when using apps ( Golbeck and Mauriello, 2016 ; Wisniewski et al., 2017 ), or the relationship between users’ age and privacy management ( Pang and Zhang, 2015 ; Kezer et al., 2016 ). The studies that have in fact explored the behavioral influence of information privacy have done so within an organizational context in which social media formed only one component of the larger questionnaire ( Parsons et al., 2017 ).…”

A Survey on Interdependent Privacy

“…In a follow-up work, Symeonidis et al revisit their initial investigation in the light of the Cambridge Analytica scandal and complement it with a legal analysis based on the General Data Protection Regulation of the European Union (EU GDPR) [Symeonidis et al 2018].…”

Computer Estimation of Customer Similarity With Facebook Lookalikes: Advantages and Disadvantages of Hyper-Targeting

“…All these data have enormous potential for data mining methods and subsequent analysis. We already have sufficient capabilities (hardware and software) to process, store, organize, and evaluate them, but unfortunately, this is not accessible to third parties [32,33,34].…”