META Meta Platforms Inc

By Jeff Horwitz 

Facebook Inc. has taken steps to prevent it from collecting unauthorized data about people's medical conditions, religious practices and finances but should do more to limit the sharing of such sensitive information, the New York Department of Financial Services said Thursday in an investigative report that was sharply critical of the social-media giant.

The regulator concluded that Facebook has failed to appropriately investigate its past collection of sensitive data and called for further federal action.

The state's investigation began after The Wall Street Journal reported in 2019 that personal health apps, including a popular period and pregnancy tracker called Flo, were quietly passing data to Facebook.

The transfer occurred through a snippet of code known as a software development kit without providing users' notice or obtaining consent. Facebook would then match the app users' sensitive data to their social media accounts, allowing the developers to target ads at them.

Officially, Facebook's terms of service prohibited app developers from providing the platform with data from children or about health, finance or other sensitive topics. But the company told the New York regulator that it had "routinely obtained" such data from developers, contrary to its own policies.

In response to the DFS's findings, Facebook called the issue of health data sharing an industrywide problem and said that it welcomed New York's review.

"Our policies prohibit sharing sensitive health information and it's not something we want," a spokeswoman wrote.

Flo Health Inc., which developed the Flo app, separately reached a settlement in January with the Federal Trade Commission in which the company pledged to obtain an independent review of its privacy practices and get users' consent before sharing their health information. The company said it was committed to ensuring the privacy of its users.

Following its admission that it had received sensitive data without permission, Facebook took steps to block app developers from providing data that included 70,000 terms related to topics such as sexual health and medical conditions.The company also created a machine learning system to improve its detection of such data, the New York report said.

How well that effort will work isn't clear, the DFS said, citing Facebook's struggle to reliably block off-limits data from a system that collects more than 25 million "custom" data points a week.

"Facebook does little to track whether app developers are violating this rule and takes no real action against developers that do," the agency said.

While Facebook cooperated with the agency's requests to explain how the lapses had occurred, the DFS said, the company balked at undertaking a review of which developers had provided such data and how it was used within Facebook's targeting systems.

"It is unclear whether Facebook was unwilling to expend the time and resources to undertake this review or simply did not want a regulator to gain access to such information," the DFS said, calling on "federal regulators with nationwide jurisdiction over Facebook to compel Facebook to provide full transparency on this issue."

The FTC in December ordered nine social media and video-streaming companies to provide the agency with data on how they collect and use personal consumer information. The New York regulator called for the agency to follow up on its report with more action.

"The way Facebook receives and uses data from third parties isn't unique to Facebook, and the issues identified in the WSJ Article are present to some extent throughout the data analytics industry," the agency wrote. "It is painfully obvious that laws and regulations in this area have plainly not kept up with technological advancement."

Write to Jeff Horwitz at Jeff.Horwitz@wsj.com

(END) Dow Jones Newswires

February 18, 2021 18:54 ET (23:54 GMT)

Copyright (c) 2021 Dow Jones & Company, Inc.