13 ms·

Seriously. Once a mobile app is granted access to contacts, it has your entire social graph. Every app since 2012 has been building these shadow social graphs.

spullara 5y ago
Well before 2012. Started as soon as you could access the address book through an API - not just on the phone. First one that got a lot of bad press was Plaxo which launched in 2002.
- scoot 5y ago
  Not forgetting sixdegrees.com (1997-2000). Sure, it didn't access your address book directly, but it did abuse your social graph. In my memory Plaxo was connected somehow (same founder?), but it's a long time ago, so I might be mistaken.
  - chaostheory 5y ago
    Amazon bought six degrees
hutzlibu 5y ago
"Every app since 2012 has been building these shadow social graphs." No, not every app. There are still open source apps who usually do not do this and there are probably also some proprietary ones with ethics who have not given into it. But that this is the default and there is no big outcry is probably because allmost no one outside tech circles understands anything of it, or just throw their hands in the air.
kingcharles 5y ago
And these get immediately sold on. I often buy contacts from online resellers who have obtained them through your number being in someone else's contacts who allowed an app to upload their whole address book.
lmkg 5y ago
Fun fact: Whatsapp (Facebook) was recently fined 75 million Euros for this practice under GDPR. To be pedantic, that was one part of a 225-million-Euro fine. But that practice was specifically broken out as one of the line items, with a dollar amount attached. And to be more pedantic, the fine wasn't for the practice itself. It was for failing to provide notice to the users whose contact info was harvested. In theory, this practice is acceptable under GDPR if the app immediately informs the user whose contact issue was harvested, and gives them an opportunity to reject. The 225-million-euro fine is still the second-largest fine issued under GDPR, after Amazon's. The 75-million-euro line item were an individual fine, it would be the fourth-largest after (one of) Google's.
- CursedUrn 5y ago
  Does that mean Facebook will stop doing it? I find that hard to believe. I doubt the EU understands Facebook's code or servers enough to judge if they're complying.
  - digisign 5y ago
    With 200+ million it sounds like they'll be able to hire a developer.
    - hutzlibu 5y ago
      There definitely is technical competence within the EU and also within the burocratic institutions. The thing is just, that the people in charge only listen to them, when it is convenient.
      - pc86 5y ago
        As an American I have to wonder what it's like to have technical competence within your bureaucratic institutions. We can't even get bureaucratic competence, technical competence is completely out of the question.
        5y ago

spullara 5y ago

Well before 2012. Started as soon as you could access the address book through an API - not just on the phone. First one that got a lot of bad press was Plaxo which launched in 2002.

scoot 5y ago
Not forgetting sixdegrees.com (1997-2000). Sure, it didn't access your address book directly, but it did abuse your social graph. In my memory Plaxo was connected somehow (same founder?), but it's a long time ago, so I might be mistaken.
- chaostheory 5y ago
  Amazon bought six degrees

hutzlibu 5y ago

"Every app since 2012 has been building these shadow social graphs." No, not every app. There are still open source apps who usually do not do this and there are probably also some proprietary ones with ethics who have not given into it. But that this is the default and there is no big outcry is probably because allmost no one outside tech circles understands anything of it, or just throw their hands in the air.

kingcharles 5y ago

And these get immediately sold on. I often buy contacts from online resellers who have obtained them through your number being in someone else's contacts who allowed an app to upload their whole address book.

lmkg 5y ago

Fun fact: Whatsapp (Facebook) was recently fined 75 million Euros for this practice under GDPR. To be pedantic, that was one part of a 225-million-Euro fine. But that practice was specifically broken out as one of the line items, with a dollar amount attached. And to be more pedantic, the fine wasn't for the practice itself. It was for failing to provide notice to the users whose contact info was harvested. In theory, this practice is acceptable under GDPR if the app immediately informs the user whose contact issue was harvested, and gives them an opportunity to reject. The 225-million-euro fine is still the second-largest fine issued under GDPR, after Amazon's. The 75-million-euro line item were an individual fine, it would be the fourth-largest after (one of) Google's.

CursedUrn 5y ago
Does that mean Facebook will stop doing it? I find that hard to believe. I doubt the EU understands Facebook's code or servers enough to judge if they're complying.
- digisign 5y ago
  With 200+ million it sounds like they'll be able to hire a developer.
  - hutzlibu 5y ago
    There definitely is technical competence within the EU and also within the burocratic institutions. The thing is just, that the people in charge only listen to them, when it is convenient.
    - pc86 5y ago
      As an American I have to wonder what it's like to have technical competence within your bureaucratic institutions. We can't even get bureaucratic competence, technical competence is completely out of the question.
      - 5y ago