Facebook to Teens: We'll Give You $20 If You Let Us Spy on You

Facebook has reportedly been paying children as young as 13 to install a VPN and give the social network full access to their phone data.

As TechCrunch reports, in 2016 Facebook started offering to pay users aged between 13 and 35 as much as $20 per month plus referral fees to install an app. That app is referred to internally as Project Atlas, but offered to iOS and Android users as "Facebook Research." Under the hood, the app is actually a VPN that gains root access to a device and then is able to decrypt and analyze all traffic.

An analysis of the app by Will Strafach of Guardian Mobile Firewall concluded that it allows Facebook to, "continuously collect the following types of data: private messages in social media apps, chats from in instant messaging apps – including photos/videos sent to others, emails, web searches, web browsing activity, and even ongoing location information by tapping into the feeds of any location tracking apps you may have installed." Apparently the app also asked users to "screenshot their Amazon order history page."

It's important to point out that even though Facebook created the app and benefited from the data being collected, the social network masked its involvement. The app was offered to users through beta testing services Applause, BetaBound, and uTest, instead of directly by the social network.

If the app sounds familiar it's because Facebook has tried this before, only using a more legitimate route. In February 2018, Facebook launched a VPN app called Onavo Protect, which was promoted as helping to keep your mobile data safe. But while it was "protecting" your data, it was also collecting your mobile data traffic and sending it back to Facebook. By August, Apple decided Onavo Protect violated App Store rules and Facebook removed the app.

The Facebook Research app looks to be Onavo Protect in a new form, with the data-protection feature replaced by a monthly payment. To allow full access to a device, Facebook asks users to download the Research app from r.facebook-program.com, install an Enterprise Developer Certificate, and agree to trust the app with root access. After that, the VPN just needs to be kept running all the time so it can collect data. As long as the data keeps flowing back to Facebook's servers, the users gets their $20 each month.

Since news of this app went public, Facebook has decided to shut down the program on iOS (but not Android). According to Recode, Apple revoked Facebook's certificates "to protect our users and their data."

Recommended by Our Editors

How Should You Evaluate VPNs? Consider These Questions

Facebook Wants to Integrate Messenger, WhatsApp, Instagram

When TechCrunch asked Facebook to comment, a spokesperson responded by saying, "Like many companies, we invite people to participate in research that helps us identify things we can be doing better. Since this research is aimed at helping Facebook understand how people use their mobile devices, we've provided extensive information about the type of data we collect and how they can participate. We don't share this information with others and people can stop participating at any time."

Another Facebook spokesperson took a harder line, arguing that "there was nothing 'secret' about this; it was literally called the Facebook Research App," while "less than 5 percent of the people who chose to participate in this market research program were teens. All of them with signed parental consent forms."