Facebook has agreements with four Chinese smartphone makers — including Huawei, a company with questionable ties to the Chinese government — that allow them special access to user data, a Facebook executive confirmed on Tuesday.
Francisco Varela, vice president of mobile partnerships at Facebook, said in a statement that the relationship with Huawei, the third-largest mobile manufacturer in the world, was "controlled from the get-go" by Facebook. Concerns about Huawei's relationship with the Chinese government were first raised in 2012 in a report by the House Permanent Select Committee on Intelligence.
"We approved the Facebook experiences these companies built," he said. "Given the interest from Congress, we wanted to make clear that all the information from these integrations with Huawei was stored on the device, not on Huawei's servers.”
The social media company is under renewed scrutiny this week after The New York Times reported on Sunday that Huawei and other smartphone manufacturers had been given access to the private information of Facebook users, some without their permission.
Last month, the Pentagon ordered military bases to remove devices made by Huawei and another Chinese smartphone maker, ZTE, after it was found that they posed an "unacceptable risk," according to The Wall Street Journal.
At an event hosted by Axios on Tuesday in Washington, Sen. Mark Warner, D-Va., said he wanted Facebook to “come clean with the whole story in the first 24 hours."
Warner said in a statement Tuesday evening that Facebook's confirmation that it shared user data with Huawei and others "raises legitimate concerns, and I look forward to learning more about how Facebook ensured that information about their users was not sent to Chinese servers.”
Under a program that began in 2007, as many as 60 smartphone makers, including Apple, Microsoft and BlackBerry, had agreements with Facebook that allowed them access to user data to create a bespoke Facebook mobile experience for their devices. Some of the deals date back to the years before cellphones could host apps, creating the need for Facebook to work with phone manufacturers to create mobile-friendly experiences for its social network.
Facebook said in April that it would begin winding down the program and had closed its agreements with at least 30 smartphone manufacturers as of Tuesday evening. Huawei's relationship is expected to be terminated by the end of the week.
In a blog post on Sunday, Facebook took issue with the Times article.
“These partners signed agreements that prevented people’s Facebook information from being used for any other purpose than to recreate Facebook-like experiences,” Ime Archibong, vice president for product partnerships, said in the blog post. Many of these experiences are no longer needed, since the use of apps on iOS and Android is now widespread, he added.
Facebook faces consequences from the Federal Trade Commission for these revelations. It agreed to a consent decree in 2011 meant to prevent users’ data from being shared with third parties without the user's consent, said Lindsey Barrett, staff attorney at the Institute for Public Representation at Georgetown Law.
“The consent decree required Facebook to obtain consumers’ affirmative express consent before enacting changes that override their privacy preferences,” Barrett said. “Some of the deals with the device companies did exactly that — the companies could access detailed information on users and their friends even if the user hadn’t given Facebook permission to share their information with third parties.”
The FTC is already investigating whether Facebook violated the consent decree. The issue came to light after it was revealed that Cambridge Analytica, a data analysis firm that worked with President Donald Trump’s campaign, used apps as a way to harvest data on Americans before the U.S. presidential election.
If the FTC finds that Facebook violated that agreement, it could face a record fine.
While Facebook has already admitted fault with how it handled data collection by connected apps, the situation with phone manufacturers is different.
At issue is the question of whether the smartphone makers should be viewed as third parties or as service providers.
“Facebook’s response is that they consider device companies service providers as opposed to full third parties, and that the consent decree gives them more leniency in their dealings with service providers,” Barrett said. “I’m not sure that argument holds water, and it doesn’t help that Facebook has yet to release the full list of companies that were engaged in these partnerships.”
Facebook said that its agreements with smartphone manufacturers held them to strict rules and that the company is not aware of any abuses.
On Monday, Apple CEO Tim Cook said the iPhone maker requested “zero” personal data in its deal with Facebook.
“We weren't in the data business. We've never been in the data business,” Cook told NPR on Monday afternoon after he delivered the keynote speech at Apple’s annual developer conference in San Jose, California.
Also Monday, New York Attorney General Barbara Underwood said her office would expand its investigation into Cambridge Analytica’s reported misuse of Facebook user data to include Facebook’s data sharing with hardware manufacturers.
Barrett said she expects that Facebook will face “renewed scrutiny and public pressure, as they well should.”
“This highlights the limits of relying on individual user controls to protect privacy writ large. It’s like clean air and clean water,” she said. “If your data is only as safe as the most unreliable actor in your ecosystem — say, your most share-happy Facebook friend — there is no functional means for any individual to protect herself beyond throwing her phone into the ocean.”