Skip to navigationSkip to content
File - In this April 4, 2013 file photo, Facebook CEO Mark Zuckerberg walks at the company's headquarters in Menlo Park, Calif. Facebook is having one of its worst weeks as a publicly traded company with a share sell-off continuing for a second day. Britain's Commissioner Elizabeth Denham told the BBC that she was investigating Facebook and has asked the company not to pursue its own audit of Cambridge Analytica's data use. Denham is also pursuing a warrant to search Cambridge Analytica's servers. (AP Photo/Marcio Jose Sanchez, File)
(AP Photo/Marcio Jose Sanchez
It’s even more serious.
FACEBOOK WOULD LIKE ACCESS

Android phone users, Facebook was tracking your calls and texts

By Marc Bain

Facebook’s reach into its users’ data just seems to keep growing.

While the company deals with the fallout of the Cambridge Analytica scandal—and the many privacy concerns it has raised—people have been digging into their downloadable data archives on the network to get a sense of exactly how much it knows about them. Several have taken to Twitter with the finding that Facebook has records of their calls and messages.

Following up on those tweets, tech news site Ars Technica found that Facebook has been quietly tracking calls and texts on Android phones for years.

When you download Facebook’s app, it asks for access to your phone contacts, which it uses for its friend-recommendation algorithm. It now makes clear that it wants access to call logs and SMS logs as well, but in the past, Android users may have given Facebook access to this data unknowingly, as a result of the way Android dealt with asking permission for call logs.

Before Android 4.1 (a.k.a. Jelly Bean), which was released in 2012, when an Android user gave Facebook access to phone contacts, Facebook also got access to actual call and text data by default.

The permissions in the Android API were subsequently changed, but according to Ars Technica, developers could get around the change if they wrote apps to previous versions of the API. In October 2017, Google finally deprecated version 4.0 of the Android API.

(iPhone users, rest easy. Apple has never allowed silent access to call data.)

Facebook has now published a post that says the feature was available for Android phone users who downloaded its Facebook Lite and Messenger apps.

“When this feature is enabled, uploading your contacts also allows us to use information like when a call or text was made or received,” it said. “This feature does not collect the content of your calls or text messages. Your information is securely stored and we do not sell this information to third parties.” It also gave instructions on how to control or delete the information.

The answers may not comfort those who already feel the network isn’t handling their private information as carefully as it should.

It may not much matter. Facebook has so many users and is so deeply ingrained in people’s lives that it could simply be too big to fail at this stage, not to mention that many haven’t trusted Facebook for years, but still continue to use it.

Update (4 pm): This post was updated with Facebook’s blog post.